This unit is for choosing a technical direction. Choose one primary track below and work through its readings. That is the required part of the unit.
The five tracks are starting points and do not cover the whole field. Verification is technically and politically messy, and the summaries that exist leave gaps. Use the readings to get your bearings, then work out for yourself what the field needs and what a six-day project could test.
Read one track closely. If your project crosses boundaries, add a supporting reading from another track. You do not need to work through all of them.
Allocate 100 imaginary hires across the verification field. You can submit your answers at the end, but mostly use it to think through the kinds of talent verification will need and where you would put it. If you think something important is missing from the five areas below, that can be your project.
Open the exerciseMechanisms that try to make the chip, package or attached hardware produce evidence about where it is, what it is allowed to run, or what work it performed.
Defines what counts as a flexHEG: hardware governance the owner can trust not to enable covert surveillance, and a governance authority can trust to enforce disclosed policies, working even air-gapped, with rules updatable every ten minutes by cryptographic quorum. It ends with the six-component design and why each part looks feasible.
Watch on YouTube
A RAND catalogue of hardware governance mechanisms, more a reference than a read-through. Offline licensing, location verification, performance counters and tamper evidence each rest on different assumptions and fail in different ways.
Executive summary, then skim the mechanism catalogue for mechanism names and tradeoffs.
A short proposal for a chiplet that lets high-bandwidth memory participate in workload verification, moving the root of trust closer to where the model and activations pass.
The full paper.
A systems-security paper rather than a governance proposal, included as an example of runtime protection and isolation for generative workloads on heterogeneous accelerators.
Abstract, introduction, architecture and evaluation; skim the hardware details.
Argues that trusted execution environments can give a regulator verification of AI deployments without mass surveillance, then works through the hard part: side-channel attacks, physical key extraction, measurement completeness, and reliance on vendor-controlled hardware identities. More depth on confidential computing than the CNAS piece above.
The whole post.
Checking whether an output plausibly came from the claimed model, even when exact deterministic replay is unavailable.
Non-determinism in inference verification turns out to be tractable: fewer than a thousand tokens separate a model from its quantised version, and running the verifier inside a TEE answers who verifies the verifier. The talk closes with a framing worth keeping, that bug catching, hacker detection and treaty verification are the same problem at different levels of trust and adversary power.
Watch on YouTube
A security-game version of inference verification, asking whether a service can secretly use exfiltrated weights while still producing outputs that pass a verifier's statistical checks.
Abstract, introduction and the results.
Explains why exact replay is brittle, then uses distributional fingerprints to verify nondeterministic inference without requiring every floating-point operation to reproduce bit-for-bit.
Abstract, introduction and the method.
The applied companion to the inference-verification papers above. It spells out how a training pause between distrustful states would actually be verified: network taps redirect datacentre traffic to a recomputation server that re-runs a random sample of the work, with the enforcement layers around it. Reads the recomputation idea back into a concrete treaty setting.
The whole supplement.
Proving a claim about a model or training run without revealing the weights or data.
Proving one GPT-2 token has gone from an hour to about 1.5 seconds in three years, and this talk explains where the speedups come from, collapsing linear operations into single constraints and exploiting the structure of exponentiation tables. It also compares what a cryptographic proof guarantees with what TEE attestation guarantees.
Watch on YouTube
A model-attestation construction in which the evaluator gets cryptographic evidence about model performance without learning the private model or benchmark data.
Abstract, introduction and the construction.
A systems paper on making ZK proofs for LLM inference less impractical. Read it for the engineering bottlenecks, not for treaty design.
The full paper.
Compiler and systems work for ZKML inference, included to show where proof cost comes from and which optimisations matter.
The full paper.
Sidesteps floating-point non-determinism by proving a bound on how much hidden information an output could carry, rather than exact token reproduction. A concrete answer to the floating-point problem that dogs the ZK inference papers above.
The README.
Most zkML hides the weights but leaks the model architecture. This scheme hides the architecture too, for CNNs, at only 30 to 40 percent more prover time than the architecture-public state of the art. Relevant if you care how much a proof reveals about the model.
Abstract, introduction, and the technical overview in section 3.
A 2026 reference point for how far ZK inference proofs have come. It proves LLM inference layer by layer with constant-size 5.5KB layer proofs, roughly 70 times smaller and 5.7 times faster to prove than EZKL. Read it to correct the impression, left by the 2024 papers above, that ZKPs are hopelessly slow.
Abstract and introduction.
An attack on ZK verification of LLM inference: a prover can satisfy the proof with hollowed-out, computationally trivial weights, so a valid proof does not on its own guarantee the claimed model did the work. A reminder that these schemes have adversarial failure modes.
Paywalled. You will need to purchase it or use institutional access.
Reading network, timing, memory and other side-channel signals to infer what a cluster is doing.
Shows what a nation-state attacker can do to a chip: laser probing that reads individual transistors, spy implants that cost 200 dollars, and why anti-tamper enclosures exist. The constructive half covers impedance sensing to detect tampering, and compute and memory puzzles that catch a datacentre lying about its utilisation.
Watch on YouTube
Uses challenge-response timing and GPU memory residency signals to infer whether a declared workload is really running on the claimed hardware.
The full paper.
A lab notebook on hashing every packet crossing a 400GbE link. SipHash and AES-GMAC sustain line rate on a 32-core CPU for realistic frame sizes, DPUs fall short, and minimum-size frames need an FPGA. This is what the tap side of evidence capture costs.
The full post.
A proof-of-secure-erasure construction. It matters for verification because “the data or weights are gone” is a claim a system may need to prove, not just assert.
Abstract, introduction, lightweight protocol and conclusion.
First numbers for proof of secure erasure on real hardware. RAM and GPU memory on a GB200 tray wipe in about 43 minutes, but the SSDs drag a full wipe towards 24 hours, which makes disk the binding constraint. The graph-labelling scheme shows how a verifier checks the wipe without trusting the prover's hardware.
The full post.
A design note on verifying compute from outside the chip, useful as a counterpoint to on-chip governance. Read it for what off-chip evidence can and cannot buy you.
The full document.
Reads GPU power draw and temperature to infer a transformer’s architecture, over 89 percent accuracy for model family and 100 percent for hyperparameters. Framed as an attack, but the same power side-channel is a governance signal for telling what a datacentre is actually running.
Abstract, introduction and results.
Trusted environments, audit protocols and certification regimes that produce evidence someone else can check.
A governance architecture rather than a mechanism paper. Domestic jurisdictions certify actors, and international rules rely on those certificates rather than direct inspection of every provider.
The full paper.
A compact survey that separates national technical means, access-dependent methods and hardware-dependent methods, with comparisons to arms-control verification practice.
The full paper.
Surveys tests for training-data verification based on memorisation, canaries and dataset fingerprints, and shows why “what data was used?” is a hard claim to verify.
The introduction, the verification techniques and the conclusion.
Finished this unit? Please give us your feedback on how it went!