Implementations

An implementation is a specific system that realises one or more mechanisms: a research prototype, a product, an open-source project or a proposed architecture. The Verifies column lists the claims each is aimed at, then, in grey italics, those it supports.

Name	Category	Readiness	Verifies	Threat model
Apple Private Cloud Compute Apple's cloud AI inference service, in which user devices send requests only to servers that attest to running software published in a public transparency log. Provider-reported	On-chip	R3In production	The declared model is the one being served	Semi-trusted prover
Pearl proof-of-useful-work blockchain A blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code. Provider-reported	Crypto / compute	R3In production	This compute runs inference, not training Declared hardware is idle or shut down There is no undeclared relevant compute	Adversarial prover
Tinfoil model identity (Modelwrap) Tinfoil's method for proving which model weights its enclave-hosted inference service runs, by binding a dm-verity hash of the weights into remote attestation. ⚠ Open critical flaw Provider-reported	Crypto / compute	R3In production	The declared model is the one being served	Semi-trusted prover
TOPLOC TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims. Provider-reported	Crypto / compute	R3In production	The declared model is the one being served	Adversarial prover
Verde and RepOps (Gensyn) Gensyn's system for checking delegated machine-learning jobs, which settles disagreements between providers by re-running a single operation with bitwise-reproducible operators. Provider-reported	Crypto / compute	R3In production	The declared model is the one being served A training run stayed within declared limits	Adversarial prover
Attestable Audits A research prototype that runs AI safety benchmarks inside a trusted execution environment and publishes attestations binding the model, the audit and the results. Provider-reported	On-chip	R2Demonstrated	The declared model is the one being served Declared safeguards were applied during inference	Semi-trusted prover
Batch-invariant inference kernels (Thinking Machines) Open-source kernels from Thinking Machines Lab that make LLM outputs independent of batch size, adopted in vLLM and SGLang to give reproducible inference. Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served	Cooperative prover
DiFR (Divergence From Reference) DiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed. Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served Model weights have not left the facility	Adversarial prover
EZKL EZKL is a library from Zkonduit that turns neural networks into zero-knowledge circuits, so a prover can show an output came from a committed model.	Crypto / compute	R2Demonstrated	The declared model is the one being served	Adversarial prover
PySyft double-blind evaluations PySyft coordinates an attested enclave where a model owner and evaluator run tests without sharing weights or private prompts. Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served	Semi-trusted prover
zkLLM zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights. Provider-reported	Crypto / compute	R2Demonstrated	The declared model is the one being served	Adversarial prover
AI 2040 inference-only verification stack A proposed retrofit that isolates data-centre inference units, taps their front-end traffic and recomputes random samples to check that only declared inference runs. Provider-reported	Isolation & architecture	R1Proposed	This compute runs inference, not training The declared model is the one being served Communication between compute groups is bounded	Adversarial prover
Attestable zero-knowledge inference prover Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second. Provider-reported	Crypto / compute	R1Proposed	The declared model is the one being served This compute runs inference, not training Declared safeguards were applied during inference	Adversarial prover
Low-trust AI compute verification system overview A retrofittable reference design in which network taps commit to all facility traffic, and air-gapped, independently sourced checkers later re-run randomly challenged records. Provider-reported	Isolation & architecture	R1Proposed	This compute runs inference, not training The declared model is the one being served Declared safeguards were applied during inference There is no undeclared relevant compute	Adversarial prover
Lucid sovereignty (location) certificates A draft specification, hosted by Lucid Computing, for short-lived certificates that bound where a workload runs by timing signed exchanges with fixed anchors. Provider-reported	Accounting	R1Proposed	Chips are where they are declared to be	Semi-trusted prover
RAND secure inference data center (SIDC) design A RAND design for a purpose-built facility that serves already-trained AI models while protecting weights and inference data against state-level attackers. Provider-reported	Isolation & architecture	R1Proposed	Model weights have not left the facility The declared model is the one being served This compute runs inference, not training	Semi-trusted prover
SASH confidential network logger An open-source prototype that routes a facility's inference traffic through a logger and re-runs requests on a separate cluster to check it serves inference. Provider-reported	Off-chip devices	R1Proposed	This compute runs inference, not training The declared model is the one being served	Semi-trusted prover