This unit covers concrete ways a third party might check claims about AI development. It is deliberately broad, so you can choose a track to focus on in Unit 3.
As you read, keep the claim being verified separate from how the evidence for it is gathered. Usually the claim itself is a single thing, say that a given workload is not being run, or that a chip is where it claims to be. What changes from one paper to the next is the evidence channel, such as an on-chip attestation, an off-chip measurement, a cryptographic proof, physical access for a human inspector, or a certification regime.
Read the system overview first, then move through the tracks in any order.
A working draft of a complete verification system, covering sensing, proofs, what information can safely cross the boundary, and the assumed adversary.
Sections 1 to 3.
Introduces hardware-based, privacy-preserving verification as a way to support wider AI diffusion while limiting misuse, protecting intellectual property and reducing compliance burdens.
The full article.
Mechanisms that try to make the chip, package or attached hardware produce evidence about where it is, what it is allowed to run, or what work it performed.
Makes the policy case for on-chip governance. Secure hardware could support export-control enforcement, operating licences and future agreement verification without creating a general surveillance back door.
Executive summary, technical underpinnings, implementation challenges and recommendations.
A concrete architecture for adding a guarantee processor around AI accelerators, so a regulator can get workload guarantees while the operator keeps models and data private.
Abstract, introduction and the section ‘Conceptual Overview of the FlexHEG Design Stack’.
Checking whether an output plausibly came from the claimed model, even when exact deterministic replay is unavailable.
A plain-language introduction that frames inference verification as selective recomputation. The verifier checks randomly chosen steps, so the prover cannot know in advance which work must be reproducible.
The full post.
Proposes hardware-independent verification using prover isolation, cryptographic commitments and challenge-based recomputation to bound unexplained information in network outputs.
Full.
Proving a claim about a model or training run without revealing the weights or data.
Explains what a zero-knowledge proof is using the graph three-colouring protocol, covering completeness, soundness and zero-knowledgeness, and how digital commitments replace the physical hiding step.
The full post.
A proposal for proving properties of a frontier training run without revealing the model or dataset, using a proving architecture designed around the training trace.
Abstract and introduction.
The shortest introduction to ZK audit logic. Shows how to prove that training or evaluation was computed correctly while keeping the model, data and audit details hidden.
The full paper.
Reading network, timing, memory and other side-channel signals to infer what a cluster is doing.
Network taps are much more plausible for low-bandwidth north-south traffic than for high-bandwidth east-west accelerator fabric, where link budgets and covert channels dominate.
The three-minute summary only.
The compute-monitoring proposal that later work builds on, based on inspecting chips and datacentres well enough to detect large training-rule violations. Its most distinctive idea is proof of learning from training checkpoints, which is closer to proving a training run than to telemetry.
The full paper.
Evidence from the physical layer, covering proofs of memory erasure, tamper detection around chips and enclosures, and verification from outside the chip.
First numbers for proof of secure erasure on real hardware. RAM and GPU memory on a GB200 tray wipe in about 43 minutes, but the SSDs drag a full wipe towards 24 hours, which makes disk the binding constraint. The graph-labelling scheme shows how a verifier checks the wipe without trusting the prover's hardware.
The full post.
Trusted environments, audit protocols and certification regimes that produce evidence someone else can check.
Explains why cloud providers are attractive intermediaries for AI regulation. They already sit between users and compute, and can record, verify or enforce some rules at lower cost than direct state inspection.
Introduction, the governance-capacities section, and the conclusion.
A TEE-based audit protocol for proving that a benchmark ran on a specific model and dataset while keeping sensitive model and benchmark details protected.
The full paper.
Finished this unit? Please give us your feedback on how it went!