{
  "schema_version": "1.2.0",
  "rubric_version": "1.1",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "C-0005",
    "slug": "declared-model-is-served",
    "title": "The declared model is the one being served",
    "aliases": [
      "model identity",
      "model substitution"
    ],
    "status": "published",
    "last_reviewed": "2026-09-25",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": [
        "codex-review"
      ]
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Outputs delivered to users or auditors come from the specific model, weights and configuration the provider declared, not from a substitute.",
    "summary": "The claim is that outputs delivered to users or auditors come from the specific model, weights and configuration the provider declared. Evaluations, audits and agreements often apply to one specific model. If a provider could evaluate one model and serve another, such as a cheaper, quantized or modified version, those checks would say little about what users receive. It is a positive claim that can be tested directly, but three problems make it hard. Numerical nondeterminism means honest recomputation does not match exactly. The verifier usually cannot see the weights, which are commercially or strategically sensitive. And the evidence must come from the actual serving system rather than a separate test instance. Approaches include statistical or exact recomputation of sampled outputs, hardware attestation of the loaded weights, and zero-knowledge proofs. They trade off cost, trust in hardware vendors and confidentiality.",
    "claim_class": "positive",
    "editors_synthesis": {
      "assessment": true,
      "markdown": "The served model can be checked directly on its outputs, and several mechanisms for it are demonstrated (R2) or in production (R3). None is deployment-ready (R4): independent security evaluations are either missing or, for trusted execution environments, found a critical flaw.\n\nFor example, users of a hosted model may want to know that the model answering them is the one an auditor evaluated.\n\n- [[M-0012|Model identity attestation]] (R3) extends [[M-0008|TEE remote attestation]] (R3) from the software an enclave booted to the weights it loads. [[M-0025|Confidential multi-party verification]] (R2) runs the audit in an enclave and binds its result to the model's hash [[S-0009]].\n- [[I-0007|Attestable Audits]] (R2) joins the two steps. At inference, the enclave checks the served model's hash against the audited one and returns each response with an attestation that links model, prompt, output and audit result [[S-0009]]. Its reported evaluation covers only the audit step, on CPU-only enclaves with a 4-bit, 8-billion-parameter model [[S-0009]]. [[I-0006|Tinfoil's Modelwrap]] (R3) covers serving alone, in what Tinfoil reports is a production service [[S-1208]].\n- The evidence is narrower than what users want. Attested enclaves report that the weights that answered have the same hash as the weights that were audited. For a public model, Modelwrap lets anyone rebuild the hash from the published weights. For a private model, users see only the hash [[S-0013]].\n- The chain trusts the TEE vendors' attestation keys. With physical access, researchers forged Intel TDX attestations and paired them with relayed H100 attestations, so that a system outside TEE protection passed both checks [[S-1202]]. [[M-0001|Sampled recomputation]] (R3), as in [[I-0002|DiFR]], avoids hardware trust but needs a trusted copy of the weights and evidence tied to the production serving path [[S-0018]]. [[M-0004|Zero-knowledge proofs of inference]] (R2) keep the weights private without trusting hardware, but proving remains expensive [[S-0018]].",
      "text": "The served model can be checked directly on its outputs, and several mechanisms for it are demonstrated (R2) or in production (R3). None is deployment-ready (R4): independent security evaluations are either missing or, for trusted execution environments, found a critical flaw. For example, users of a hosted model may want to know that the model answering them is the one an auditor evaluated. - Model identity attestation (R3) extends TEE remote attestation (R3) from the software an enclave booted to the weights it loads. Confidential multi-party verification (R2) runs the audit in an enclave and binds its result to the model's hash [S-0009]. - Attestable Audits (R2) joins the two steps. At inference, the enclave checks the served model's hash against the audited one and returns each response with an attestation that links model, prompt, output and audit result [S-0009]. Its reported evaluation covers only the audit step, on CPU-only enclaves with a 4-bit, 8-billion-parameter model [S-0009]. Tinfoil's Modelwrap (R3) covers serving alone, in what Tinfoil reports is a production service [S-1208]. - The evidence is narrower than what users want. Attested enclaves report that the weights that answered have the same hash as the weights that were audited. For a public model, Modelwrap lets anyone rebuild the hash from the published weights. For a private model, users see only the hash [S-0013]. - The chain trusts the TEE vendors' attestation keys. With physical access, researchers forged Intel TDX attestations and paired them with relayed H100 attestations, so that a system outside TEE protection passed both checks [S-1202]. Sampled recomputation (R3), as in DiFR, avoids hardware trust but needs a trusted copy of the weights and evidence tied to the production serving path [S-0018]. Zero-knowledge proofs of inference (R2) keep the weights private without trusting hardware, but proving remains expensive [S-0018]."
    },
    "sources": [
      {
        "source": "S-0002",
        "supports": "Subgoal 1.A (declared uses declared accurately, including inference) and 1.B (required properties; deployed models evaluated at intervals)",
        "locator": "§3.2"
      },
      {
        "source": "S-0016",
        "supports": "need to verify inference; nondeterminism; Token-DiFR detects 4-bit quantization with AUC > 0.999 within 300 tokens",
        "locator": "abstract"
      },
      {
        "source": "S-1009",
        "supports": "batch-size dependence as a cause of inference nondeterminism",
        "locator": "batch invariance section"
      },
      {
        "source": "S-0020",
        "supports": "bit-exact reproduction across GPU variants given recomputation data",
        "locator": "abstract"
      },
      {
        "source": "S-0004",
        "supports": "model fingerprint attestation; device-model mating with an encrypted model",
        "locator": "Appendix K (p. 157); Appendix L.4 (p. 159)"
      },
      {
        "source": "S-0018",
        "supports": "whitelisted models for blacklisted uses; attributing forward passes to hardware and time; committed weights in auditing environments; ZKP cost",
        "locator": "verification goals; architecture; open problems"
      },
      {
        "source": "S-0023",
        "supports": "zkLLM proves one 2,048-token forward pass of a 13B-parameter model in under 15 minutes with proofs under 200 kB, keeping parameters private",
        "locator": "abstract; §8 Table 1"
      },
      {
        "source": "S-0012",
        "supports": "property attestation on Intel TDX + NVIDIA H100 with under 11% overhead for common operations",
        "locator": "abstract"
      },
      {
        "source": "S-0014",
        "supports": "attestation-key holder can produce valid reports; side-channel and physical attacks; measurement coverage",
        "locator": "Limitations"
      },
      {
        "source": "S-0009",
        "supports": "attestation linking model, audit result, prompt and response in a TEE; reported evaluation covers the audit step on CPU-only enclaves with a 4-bit 8B model",
        "locator": "abstract; inference protocol; §5"
      },
      {
        "source": "S-0013",
        "supports": "public models' hashes can be rebuilt; private models expose only the hash (provider-reported)"
      },
      {
        "source": "S-1208",
        "supports": "Modelwrap chain in Tinfoil's production service (provider-reported)",
        "locator": "In-band vs. out-of-band verification"
      },
      {
        "source": "S-1202",
        "supports": "physical memory-bus interposition extracts a per-CPU Intel attestation key and forges TDX attestations",
        "locator": "abstract; §1.1"
      },
      {
        "source": "S-1210",
        "supports": "Battering RAM forges SEV-SNP attestation with a DDR4 interposer"
      },
      {
        "source": "S-1212",
        "supports": "RMPocalypse forges SEV-SNP attestation from a malicious hypervisor"
      },
      {
        "source": "S-3540",
        "supports": "model equality testing: median 77.4% power with about 10 samples per prompt; 11 of 31 Llama API endpoints in summer 2024 served distributions different from the reference weights",
        "locator": "abstract"
      },
      {
        "source": "S-3541",
        "supports": "output tests query-intensive and fail against subtle substitutions; log-probability tests defeated by inference nondeterminism",
        "locator": "abstract"
      }
    ],
    "concepts": [
      "K-0009",
      "K-0008",
      "K-0004",
      "K-0006",
      "K-0010",
      "K-0019"
    ],
    "order": 5,
    "type": "claim",
    "url": "https://trustbutveri.fyi/claims/declared-model-is-served/",
    "source_file": "content/claims/declared-model-is-served.md",
    "flags_all": [],
    "body_markdown": "## Why it matters\nChecks on a model's capabilities or safety apply to the model that was checked. Several parties depend on that link:\n\n- RAND's framework asks verifiers to confirm that declared inference is declared accurately, so that the prover actually did the claimed deployment [[S-0002]]. It then asks them to confirm that deployed models have the required properties, for example through evaluations at regular intervals [[S-0002]]. Both steps assume the evaluated model is the served model. A low-trust system overview identifies running approved models for prohibited uses as the most difficult violation to defend against, and aims to deploy only approved models [[S-0018]]. The Oxford Martin report includes appendices on model fingerprint attestation and on \"device-model mating\" with an encrypted model [[S-0004]].\n- The DiFR authors note that providers and their customers increasingly need to verify that inference is performed correctly, without errors or tampering [[S-0016]]. Their Token-DiFR method detected 4-bit quantization of a model with AUC above 0.999 within 300 output tokens [[S-0016]]. In an audit of commercial inference APIs for four Llama models in summer 2024, Gao, Liang and Guestrin found that 11 of 31 endpoints served a different output distribution from the published reference weights [[S-3540]].\n\n## Why it is hard\n- Statistical tests on an API's outputs need no cooperation from the provider, but they have limits [[S-3540]]. Gao, Liang and Guestrin's test reached a median statistical power of 77.4% against a range of distortions, using an average of 10 samples per prompt [[S-3540]]. Cai and colleagues find that tests on text outputs are query-intensive and fail against subtle substitutions, and that tests on log probabilities are defeated by inference nondeterminism in production [[S-3541]].\n- Re-running the same inference often gives slightly different results because of benign numerical variation, which makes it hard to tell legitimate variation from substitution [[S-0016]]. In LLM serving a major cause is that kernels are not invariant to batch size, which varies with server load [[S-1009]]. Statistical tests tolerate this noise [[S-0016]]. Alternatively, Cankaya reports that inference can be reproduced bit-exactly across several NVIDIA GPU variants in software, given enough recorded information about the original run [[S-0020]].\n- Recomputation requires the weights, which a provider or state may not reveal [[S-0018]]. One system design keeps weights cryptographically committed and uses them only inside air-gapped auditing environments [[S-0018]]. Zero-knowledge proofs avoid revealing weights at all. zkLLM reports proving one 2,048-token forward pass of a 13-billion-parameter model in under 15 minutes, with proofs under 200 kB [[S-0023]], but the low-trust overview describes zero-knowledge proof computation as still expensive [[S-0018]]. Trusted execution environments can attest which software and data were loaded [[S-0014]]. PAL\\*M reports property attestation on confidential computing hardware (Intel TDX with NVIDIA H100) at under 11% overhead for common operations [[S-0012]].\n- Evidence about a test instance says nothing about production unless it is tied to the serving hardware and time. The low-trust design aims to identify each forward pass uniquely and attribute it to the hardware and time it was processed [[S-0018]]. TEE-based binding relies on the vendor's keys: whoever holds the hardware's attestation key can produce valid reports, and every component that influences inference must be covered by launch measurement [[S-0014]]. A published memory-bus interposition attack, which needs physical access, extracted a per-CPU Intel attestation key and forged Intel TDX attestations [[S-1202]]. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone on platforms without AMD's fix [[S-1210]] [[S-1212]].",
    "body_text": "Why it matters Checks on a model's capabilities or safety apply to the model that was checked. Several parties depend on that link: - RAND's framework asks verifiers to confirm that declared inference is declared accurately, so that the prover actually did the claimed deployment [S-0002]. It then asks them to confirm that deployed models have the required properties, for example through evaluations at regular intervals [S-0002]. Both steps assume the evaluated model is the served model. A low-trust system overview identifies running approved models for prohibited uses as the most difficult violation to defend against, and aims to deploy only approved models [S-0018]. The Oxford Martin report includes appendices on model fingerprint attestation and on \"device-model mating\" with an encrypted model [S-0004]. - The DiFR authors note that providers and their customers increasingly need to verify that inference is performed correctly, without errors or tampering [S-0016]. Their Token-DiFR method detected 4-bit quantization of a model with AUC above 0.999 within 300 output tokens [S-0016]. In an audit of commercial inference APIs for four Llama models in summer 2024, Gao, Liang and Guestrin found that 11 of 31 endpoints served a different output distribution from the published reference weights [S-3540]. Why it is hard - Statistical tests on an API's outputs need no cooperation from the provider, but they have limits [S-3540]. Gao, Liang and Guestrin's test reached a median statistical power of 77.4% against a range of distortions, using an average of 10 samples per prompt [S-3540]. Cai and colleagues find that tests on text outputs are query-intensive and fail against subtle substitutions, and that tests on log probabilities are defeated by inference nondeterminism in production [S-3541]. - Re-running the same inference often gives slightly different results because of benign numerical variation, which makes it hard to tell legitimate variation from substitution [S-0016]. In LLM serving a major cause is that kernels are not invariant to batch size, which varies with server load [S-1009]. Statistical tests tolerate this noise [S-0016]. Alternatively, Cankaya reports that inference can be reproduced bit-exactly across several NVIDIA GPU variants in software, given enough recorded information about the original run [S-0020]. - Recomputation requires the weights, which a provider or state may not reveal [S-0018]. One system design keeps weights cryptographically committed and uses them only inside air-gapped auditing environments [S-0018]. Zero-knowledge proofs avoid revealing weights at all. zkLLM reports proving one 2,048-token forward pass of a 13-billion-parameter model in under 15 minutes, with proofs under 200 kB [S-0023], but the low-trust overview describes zero-knowledge proof computation as still expensive [S-0018]. Trusted execution environments can attest which software and data were loaded [S-0014]. PAL*M reports property attestation on confidential computing hardware (Intel TDX with NVIDIA H100) at under 11% overhead for common operations [S-0012]. - Evidence about a test instance says nothing about production unless it is tied to the serving hardware and time. The low-trust design aims to identify each forward pass uniquely and attribute it to the hardware and time it was processed [S-0018]. TEE-based binding relies on the vendor's keys: whoever holds the hardware's attestation key can produce valid reports, and every component that influences inference must be covered by launch measurement [S-0014]. A published memory-bus interposition attack, which needs physical access, extracted a per-CPU Intel attestation key and forged Intel TDX attestations [S-1202]. Other attacks forged AMD SEV-SNP attestations, one through a DDR4 interposer and one from software alone on platforms without AMD's fix [S-1210] [S-1212].",
    "addressed_by": [
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/",
        "role": "primary",
        "note": "Binds audit or capability-evaluation results to the model that is served, without revealing weights (S-0009, S-0011)."
      },
      {
        "id": "M-0002",
        "title": "Deterministic and bit-exact inference",
        "url": "https://trustbutveri.fyi/mechanisms/deterministic-inference/",
        "role": "primary",
        "note": "Enables exact-match recomputation checks that the declared model, weights and software setup produced the outputs."
      },
      {
        "id": "M-0009",
        "title": "Hardware-enabled guarantees (flexHEG) and guarantee processors",
        "url": "https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/",
        "role": "supporting",
        "note": "Deployment only to approved flexHEG devices, and verification of evaluation scores (S-0035)."
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/",
        "role": "primary",
        "note": "Core purpose: responses come from the declared weights."
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/",
        "role": "supporting",
        "note": "Replaying challenged records with the declared model checks which model produced outputs (S-1300, S-0067)."
      },
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/",
        "role": "supporting",
        "note": "Property and audit attestations bind responses to a measured model (S-0012, S-0009)."
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/",
        "role": "primary",
        "note": "Checks that sampled recorded outputs are consistent with the declared model, precision and sampling settings."
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/",
        "role": "primary",
        "note": "Attests the software stack that produced responses, and the model too when paired with a weight commitment (see M-0012)."
      },
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/",
        "role": "primary",
        "note": "Binds each proven output to committed weights and a public architecture."
      },
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/",
        "role": "supporting",
        "note": "Recomputation checks sampled packets against the declared model."
      },
      {
        "id": "I-0013",
        "title": "Apple Private Cloud Compute",
        "url": "https://trustbutveri.fyi/implementations/apple-private-cloud-compute/",
        "role": "supporting",
        "note": "Attests the software release that served a request. Apple reports that model assets share the code's integrity protection (S-1800)."
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/",
        "role": "primary",
        "note": "Users can check that the model answering them is the audited one."
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/",
        "role": "primary",
        "note": "Attestable reports proving y = F(W, x, r) for committed weights W."
      },
      {
        "id": "I-0016",
        "title": "Batch-invariant inference kernels (Thinking Machines)",
        "url": "https://trustbutveri.fyi/implementations/batch-invariant-inference-kernels/",
        "role": "supporting",
        "note": "Makes exact-match recomputation of served outputs possible when the verifier runs the same model, engine and hardware (S-0016)."
      },
      {
        "id": "I-0002",
        "title": "DiFR (Divergence From Reference)",
        "url": "https://trustbutveri.fyi/implementations/difr/",
        "role": "primary",
        "note": "Checks that outputs are consistent with the declared model, precision and sampling configuration."
      },
      {
        "id": "I-0014",
        "title": "EZKL",
        "url": "https://trustbutveri.fyi/implementations/ezkl/",
        "role": "primary",
        "note": "Proves an output follows from a committed model. South et al.'s results reach about a million parameters (S-0024)."
      },
      {
        "id": "I-0015",
        "title": "Verde and RepOps (Gensyn)",
        "url": "https://trustbutveri.fyi/implementations/gensyn-verde-repops/",
        "role": "primary",
        "note": "A client learns that a delegated inference output came from the declared model and input, if at least one provider is honest (S-1809, S-1810)."
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/",
        "role": "supporting",
        "note": "Screening checks that the model is on an agreed whitelist."
      },
      {
        "id": "I-0017",
        "title": "PySyft double-blind evaluations",
        "url": "https://trustbutveri.fyi/implementations/pysyft-double-blind-evaluations/",
        "role": "primary",
        "note": "Both parties approve the attested workload that runs a private evaluation against the model and prompts they submit (S-3320)."
      },
      {
        "id": "I-0010",
        "title": "RAND secure inference data center (SIDC) design",
        "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/",
        "role": "supporting",
        "note": "The compute sanctum checks resident weights against reference measurements before serving."
      },
      {
        "id": "I-0008",
        "title": "SASH confidential network logger",
        "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/",
        "role": "supporting",
        "note": "Recomputation uses another copy of the declared model (S-1320, S-1319)."
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/",
        "role": "primary",
        "note": "Clients check that the served weights match a committed root hash."
      },
      {
        "id": "I-0001",
        "title": "TOPLOC",
        "url": "https://trustbutveri.fyi/implementations/toploc/",
        "role": "primary",
        "note": "Checks that the provider produced outputs with the claimed model weights, prompt and precision."
      },
      {
        "id": "I-0003",
        "title": "zkLLM",
        "url": "https://trustbutveri.fyi/implementations/zkllm/",
        "role": "primary",
        "note": "Proves an output follows from committed weights and a public architecture."
      }
    ],
    "referenced_by": [
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/"
      },
      {
        "id": "M-0002",
        "title": "Deterministic and bit-exact inference",
        "url": "https://trustbutveri.fyi/mechanisms/deterministic-inference/"
      },
      {
        "id": "M-0009",
        "title": "Hardware-enabled guarantees (flexHEG) and guarantee processors",
        "url": "https://trustbutveri.fyi/mechanisms/flexheg-guarantee-processors/"
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/"
      },
      {
        "id": "I-0013",
        "title": "Apple Private Cloud Compute",
        "url": "https://trustbutveri.fyi/implementations/apple-private-cloud-compute/"
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/"
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0016",
        "title": "Batch-invariant inference kernels (Thinking Machines)",
        "url": "https://trustbutveri.fyi/implementations/batch-invariant-inference-kernels/"
      },
      {
        "id": "I-0002",
        "title": "DiFR (Divergence From Reference)",
        "url": "https://trustbutveri.fyi/implementations/difr/"
      },
      {
        "id": "I-0014",
        "title": "EZKL",
        "url": "https://trustbutveri.fyi/implementations/ezkl/"
      },
      {
        "id": "I-0015",
        "title": "Verde and RepOps (Gensyn)",
        "url": "https://trustbutveri.fyi/implementations/gensyn-verde-repops/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "I-0017",
        "title": "PySyft double-blind evaluations",
        "url": "https://trustbutveri.fyi/implementations/pysyft-double-blind-evaluations/"
      },
      {
        "id": "I-0010",
        "title": "RAND secure inference data center (SIDC) design",
        "url": "https://trustbutveri.fyi/implementations/rand-secure-inference-data-centers/"
      },
      {
        "id": "I-0008",
        "title": "SASH confidential network logger",
        "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/"
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/"
      },
      {
        "id": "I-0001",
        "title": "TOPLOC",
        "url": "https://trustbutveri.fyi/implementations/toploc/"
      },
      {
        "id": "I-0003",
        "title": "zkLLM",
        "url": "https://trustbutveri.fyi/implementations/zkllm/"
      },
      {
        "id": "C-0006",
        "title": "Declared safeguards were applied during inference",
        "url": "https://trustbutveri.fyi/claims/safeguards-were-applied/"
      },
      {
        "id": "K-0003",
        "title": "Positive and negative claims",
        "url": "https://trustbutveri.fyi/concepts/positive-and-negative-claims/"
      }
    ]
  }
}