Mechanisms · category

Isolation & system architectures

Ways of arranging or constraining a facility so that other checks become possible: bandwidth limits, compartmentalization, memory wiping, secure facilities, whole verification stacks.

Name	Type	Readiness	Verifies	Threat model
Bandwidth limits and compartmentalization Capping or removing network links between groups of accelerators, so that serving within each group still works but large training across groups becomes far slower.	Mechanism	R2Demonstrated	Communication between compute groups is bounded This compute runs inference, not training A training run stayed within declared limits Model weights have not left the facility	Adversarial prover
Bounding unexplained information in outputs Limits the hidden information a facility's outputs can carry by measuring how much of those outputs the declared computation fails to predict.	Mechanism	R2Demonstrated	Model weights have not left the facility This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
Tamper evidence for verifier devices Enclosures, seals and sensors that make physical interference with verification hardware either visible or self-defeating.	Mechanism	R2Demonstrated	This compute runs inference, not training Communication between compute groups is bounded	Adversarial prover
AI 2040 inference-only verification stack A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs. Provider-reported	Implementation	R1Proposed	This compute runs inference, not training The declared model is the one being served Communication between compute groups is bounded	Adversarial prover
Hardware-enabled guarantees (flexHEG) and guarantee processors Proposed chip add-ons, a guarantee processor inside a tamper-protected enclosure, that would check and enforce agreed rules on how AI accelerators are used.	Mechanism	R1Proposed	A training run stayed within declared limits The declared model is the one being served Chips are where they are declared to be Communication between compute groups is bounded Declared safeguards were applied during inference	Adversarial prover
Low-trust AI compute verification system overview A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records. Provider-reported	Implementation	R1Proposed	This compute runs inference, not training The declared model is the one being served Declared safeguards were applied during inference There is no undeclared relevant compute	Adversarial prover
Memory wiping and proofs of secure erasure Overwriting a device's memory in a way a verifier can check, so that data from earlier, undeclared work cannot persist in memory the wipe reaches.	Mechanism	R1Proposed	This compute runs inference, not training	Adversarial prover
RAND secure inference data center (SIDC) design A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers. Provider-reported	Implementation	R1Proposed	Model weights have not left the facility The declared model is the one being served This compute runs inference, not training	Semi-trusted prover
Side-channel suppression for isolated facilities Shielding, filtering, jamming and inspecting an AI facility to limit hidden physical communication around monitored network links.	Mechanism	R1Proposed	Communication between compute groups is bounded Model weights have not left the facility This compute runs inference, not training	Adversarial prover
Whole-workload recomputation (reproducible packets) Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.	Mechanism	R1Proposed	This compute runs inference, not training A training run stayed within declared limits	Adversarial prover

Includes records that list this as a secondary category. Claims in grey italics are supported rather than aimed at.