A System Overview for Near-Term, Low-Trust AI Compute Verification

Cited by

• Deploy only evaluated modelsGoal
• Prevent catastrophic misuseGoal
• Bandwidth limits and compartmentalizationMechanism
• Bounding unexplained information in outputsMechanism
• Deterministic and bit-exact inferenceMechanism
• Memory wiping and proofs of secure erasureMechanism
• Network taps and certifiersMechanism
• Proofs of useful work for capacity accountingMechanism
• Safeguard attestationMechanism
• Sampled inference recomputationMechanism
• Side-channel suppression for isolated facilitiesMechanism
• Tamper evidence for verifier devicesMechanism
• Timed challenge-response and memory-occupation challengesMechanism
• Zero-knowledge proofs of inferenceMechanism
• Data-centre memory challengingImplementation
• Low-trust AI compute verification system overviewImplementation
• SAGEImplementation
• VRAM-residency challengeImplementation
• zkLLMImplementation
• Communication between compute groups is boundedClaim
• The declared model is the one being servedClaim
• This compute runs inference, not trainingClaim
• Declared safeguards were applied during inferenceClaim
• A training run stayed within declared limitsClaim
• Model weights have not left the facilityClaim
• CompartmentalizationConcept
• Cryptographic commitmentConcept
• Evidence bindingConcept
• FLOP accountingConcept
• Inference and training workloadsConcept
• Interconnect bandwidthConcept
• Network tapConcept
• Numerical nondeterminismConcept
• Positive and negative claimsConcept
• Proof of spaceConcept
• RecomputationConcept
• Sampling and assuranceConcept
• Side channelConcept
• Threat modelConcept
• Undeclared computeConcept
• VerifierConcept
• Weight exfiltrationConcept
• Machine Intelligence Research InstituteOrganization