This unit is for choosing a technical direction. Choose one primary track below and work through its readings. That is the required part of the unit.
The six tracks are starting points and do not cover the whole field. Verification is technically and politically messy, and the summaries that exist leave gaps. Use the readings to get your bearings, then work out for yourself what the field needs and what a six-day project could test.
Read one track closely. If your project crosses boundaries, add a supporting reading from another track.
Allocate 100 imaginary hires across the verification field. Submitting your answers at the end is optional. Use it to think through the kinds of talent verification will need and where you would put it. If you think something important is missing from the six areas below, that can be your project.
Open the exerciseMechanisms that try to make the chip, package or attached hardware produce evidence about where it is, what it is allowed to run, or what work it performed.
Track total: about 2.5-3 hours.
Defines a flexHEG as hardware governance the owner can trust not to enable covert surveillance and a governance authority can trust to enforce disclosed policies, working air-gapped, with rules updated by cryptographic quorum. Ends with the six-component design and the case that each part is feasible.
Watch on YouTube
A RAND working paper proposing two classes of hardware-enabled governance mechanisms, offline licensing and fixed set, with a threat analysis of how each could be circumvented.
Executive summary, then skim the offline licensing and fixed set chapters.
A short proposal for a chiplet that lets high-bandwidth memory participate in workload verification, moving the root of trust closer to where the model and activations pass.
The full paper.
A systems-security paper on runtime protection and isolation for generative workloads on heterogeneous accelerators.
Abstract, introduction and sections 6 and 8. Skim section 2.
Argues that trusted execution environments can give a regulator verification of AI deployments without mass surveillance, then works through side-channel attacks, physical key extraction, measurement completeness and reliance on vendor-controlled hardware identities. Goes into more depth on confidential computing than the CNAS report in Unit 2.
The whole post.
Checking whether an output plausibly came from the claimed model, even when exact deterministic replay is unavailable.
Track total: about 2.5-3 hours.
Shows that non-determinism in inference verification is tractable. Fewer than a thousand tokens separate a model from its quantised version, and running the verifier inside a TEE removes the need to trust the verifier. Closes by presenting bug catching, hacker detection and treaty verification as the same problem at different levels of trust and adversary power.
Watch on YouTube
A security-game version of inference verification, asking whether a service can secretly use exfiltrated weights while still producing outputs that pass a verifier's statistical checks.
Abstract, introduction and the empirical results.
Explains why exact replay is brittle, then uses distributional fingerprints to verify nondeterministic inference without requiring every floating-point operation to reproduce bit-for-bit.
Abstract, introduction and the methods.
Shows that modern LLM inference can be recomputed bit-for-bit without performance-reducing determinism flags when relevant execution details are available.
Abstract, introduction and sections 3 and 4.
Applies the recomputation idea from the papers above to a concrete treaty setting, spelling out how a training pause between distrustful states would be verified. Network taps redirect datacentre traffic to a recomputation server that re-runs a random sample of the work, with enforcement layers around it.
The whole supplement.
Proving a claim about a model or training run without revealing the weights or data.
Track total: about 3.5-4.5 hours.
Explains how proving one GPT-2 token went from an hour to about 1.5 seconds in three years, by collapsing linear operations into single constraints and exploiting the structure of exponentiation tables. It also compares what a cryptographic proof guarantees with what TEE attestation guarantees.
Watch on YouTube
A model-attestation construction in which the evaluator gets cryptographic evidence that a model with private weights achieves stated performance on public benchmark inputs.
Abstract, introduction and the system design.
A systems paper on reducing the cost of ZK proofs for LLM inference. Read it for the engineering bottlenecks.
The full paper.
Compiler and systems work for ZKML inference. Shows where proof cost comes from and which optimisations matter.
The full paper.
Sidesteps floating-point non-determinism by proving a bound on how much hidden information an output could carry, instead of reproducing exact tokens. This addresses the floating-point problem faced by the ZK inference papers above.
The README.
Most zkML hides the weights but leaks the model architecture. This scheme hides the architecture too, for CNNs, at 30 to 40 percent more prover time than the architecture-public state of the art.
Abstract, introduction, and the technical overview in section 3.
Proves LLM inference layer by layer with constant-size 5.5KB proofs, roughly 70 times smaller and 5.7 times faster to prove than EZKL. A 2026 reference point for how far ZK inference proofs have moved since the 2024 papers above.
Abstract and introduction.
An attack on ZK verification of LLM inference. A prover can satisfy the proof with hollowed-out, computationally trivial weights, so a valid proof does not on its own show that the claimed model did the work.
Paywalled. You will need to purchase it or use institutional access.
Reading network, timing, memory and other side-channel signals to infer what a cluster is doing.
Track total: about 2-3 hours.
Covers what a nation-state attacker can do to a chip, including laser probing that reads individual transistors and 200-dollar spy implants, and the anti-tamper enclosures built in response. The constructive half presents impedance sensing to detect tampering, and compute and memory puzzles that catch a datacentre lying about its utilisation.
Watch on YouTube
Uses challenge-response timing and GPU memory residency signals to infer whether a declared workload is running on the claimed hardware.
The full paper.
A lab notebook on hashing every packet crossing a 400GbE link, to establish the hardware cost of the tap side of evidence capture. SipHash and AES-GMAC sustain line rate on a 32-core CPU for realistic frame sizes, DPUs fall short, and minimum-size frames need an FPGA.
The full post.
Reads GPU power draw and temperature to infer a transformer’s architecture, classifying model families at 95 and 91 percent for language and vision models and key hyperparameters at close to 100 percent. Framed as an attack, but the same power side-channel is a governance signal for telling what a datacentre is running.
Abstract, introduction and sections IV and V.
Surveys physical side channels in monitored AI datacentres and proposes layered retrofitted defences to bound covert communication bandwidth.
The whole post.
Evidence from the physical layer, covering proofs of memory erasure, tamper detection around chips and enclosures, and verification from outside the chip.
Track total: about 2-2.5 hours.
A proof-of-secure-erasure construction. Deletion of data or weights is a claim a verification regime may need to prove.
Abstract, introduction, lightweight protocol and conclusion.
A design note on verifying compute from outside the chip, as a counterpoint to on-chip governance. Sets out what off-chip evidence can establish and its limits.
The full document.
Detects physical manipulation by monitoring radio-wave propagation inside a protected enclosure.
Abstract, introduction and the system outline and adversary model.
A survey of physical security enclosures and PUF-based tamper evidence.
Paywalled. You will need to purchase it or use institutional access.
Trusted environments, audit protocols and certification regimes that produce evidence someone else can check.
Track total: about 2.5-3.5 hours.
A governance architecture in which domestic jurisdictions certify actors and international rules rely on those certificates, without direct inspection of every provider.
The full paper.
A compact survey that separates national technical means, access-dependent methods and hardware-dependent methods, with comparisons to arms-control verification practice.
The full paper.
Surveys tests for training-data verification based on memorisation, committed random seeds and re-training segments of the run, and shows why “what data was used?” is a hard claim to verify.
The introduction, the verification strategies and the discussion and limitations.
Demonstrates reproducible low-cost attacks on proof-of-learning schemes and argues robust verification depends on unresolved questions about deep-learning optimisation.
Abstract, introduction and sections 5 and 7.
Finished this unit? Please give us your feedback on how it went!