A six-day programme for people developing hardware-enabled verification of what chips are computing, where they are operating and at what scale.
AI governance increasingly depends on knowing where training runs happen, what hardware is involved, and whether deployed systems match evaluated versions. Voluntary safety commitments and agreements between major powers depend on those questions. The infrastructure needed to check these claims independently does not yet exist.
Hardware-enabled verification uses tamper-evident enclosures, telemetry, network monitoring, attestation and cryptographic methods to establish what AI hardware is doing, where it is and at what scale, whilst preserving confidentiality. The field needs more engineers and researchers to build and test these systems.
Hardware assurance draws on several technical disciplines. The cohort includes practising engineers, researchers, PhD students, and technically strong undergraduates or master’s students with depth in one of these areas. Applicants may demonstrate that depth through technical projects, research, coursework or industry experience.
Tamper-evident hardware, silicon-level attestation, and firmware that participates in verification protocols.
Backgrounds in RTL, ASIC, SoC, FPGA, or embedded systems.
Mechanisms that hold up under physical attack and adversarial probing.
Backgrounds in secure hardware, side-channel countermeasures, or tamper protection.
Making proof-of-inference practical, formally verifying attestation protocols, building zero-knowledge tooling.
Backgrounds in applied cryptography, zero-knowledge proof systems, or formal methods.
Designing how labs and chips can prove what they’re running to a third party.
Backgrounds in TEEs, attestation, secure boot, or root-of-trust systems.
Figuring out what’s verifiable in real ML workloads, and how.
Backgrounds in distributed training (NCCL, Megatron, DeepSpeed) or large-scale inference.
Network-level instrumentation that detects training-scale workloads from outside the rack.
Backgrounds in high-performance networking, line-rate packet processing, or deep packet inspection.
The week is built around one project. Technical sessions and office hours give you the context and feedback needed to develop it, then Day 6 is for final presentations and what comes next.
Preparation
Structured preparation so the cohort starts Day 1 with shared context. Four weeks out, an opening call and core reading list.
Two weeks out, small-group discussions to work through the readings and surface project interests.
Meet the cohort and begin
Welcome, introductions and an orientation to hardware-enabled verification. Meet the cohort and residents, choose where to focus, and begin project work.
Threat models and proposals
Build threat models for verification, explore how operators might defeat proposed systems, and compare approaches ranging from accounting for dark compute to current work on inference verification.
Develop the project
The project moves into full swing. Focus on the deliverable, use resident sessions and office hours to unblock the work, and discuss career plans and possible next steps.
Test the work
Share an early version with the cohort and residents. Get feedback on the technical approach, the deliverable and the presentation, then decide what needs to change before the final day.
Finish the deliverable
Resolve the remaining technical questions, bring the project to a clear deliverable, and prepare and rehearse the final presentation with feedback from the cohort and residents.
Present and close the week
Present your final work at a Cambridge college, spend time thinking through your next steps, then finish with a final dinner and goodbye.
Some examples of open problems. Participants spend the week tackling one of these, or an idea of their own, and present their work on Day 6.
AI accelerators dissipate 1,200W and need liquid cooling. How do you seal them in a tamper-evident enclosure while keeping them cool? Insights from nuclear monitoring and banking HSMs may transfer, but this hasn’t been done for GPUs. Without it, no third party can verify what is running on a chip cluster, regardless of what the operator claims.
For international agreements, both parties need to trust the attestation hardware. The prover needs confidence it won’t exfiltrate data. The verifier needs confidence the attestations are genuine. How do you build hardware that highly sceptical actors on both sides can trust?
Can you verify that a deployed AI model matches the one that was safety-tested, without disrupting the workload? Approaches include network taps with randomised recomputation and input-output fingerprinting. Prototyping and red-teaming are needed.
Can you determine what a chip is doing from external signals like power draw, memory access patterns, and network traffic, without seeing the workload itself?
Edition one · Cambridge · August 2026
“This programme is the best way to meet all the important people trying to make hardware assurance possible, and to work with professionals and experts on hardware security.”
Thomas Pierson · Carnegie Mellon University
“A flagship programme in verification. Well organised, with high-level participants and residents, and very impactful for my research and strategy.”
Anna Katariina Wisakanto · Senior Researcher at CARMA
“A great opportunity to test your appetite for this field at small scale, as part of a cohort of diverse and talented individuals.”
Liam Hamill · Former software engineer at Arm
“The people joining the programme had great energy and the organisation of the full week was amazing.”
Robert Neijenhuis · ASML
Residents are domain experts in hardware-enabled verification who join the programme to give talks, run technical sessions, and give feedback on participant projects.
Hardware Engineer at the Future of Life Institute. Eight years as an ASIC verification engineer at Arm.
Policy Researcher at the Future of Life Institute and the Oxford AI Governance Initiative.
Technical AI Governance Researcher at the Machine Intelligence Research Institute.
MATS Scholar (Machine Alignment, Transparency and Security).
Founder and CEO at Earendil.
Staff Director – Intelligence Security Labs.
Associate Professor in Computer Science at the University of Birmingham.
Senior Researcher at the Institute for AI Policy and Strategy.
Applications open ahead of each edition. Register your interest and we will email you when the next round opens. Travel, accommodation and food are covered, plus a stipend.
Hear when the next round opens
Questions? hello@caish.org