01 / The mechanism and its boundary
What the technique establishes
Memory wiping verifiably overwrites a device's memory, so that data from earlier work cannot persist where the wipe reaches. In AI verification, periodic wipes would help show that only verified outputs carry forward. The technique builds on proofs of secure erasure: the device fills its memory with data derived from a verifier's seed, then answers timed questions about it. The theory is peer-reviewed. Scaling from fill benchmarks on CPUs, GPUs and disks, Amodo estimates about 43 minutes to wipe the memory of one GB200 tray and about 2.5 hours for an NVL72 rack's storage. As of September 2026 no end-to-end wipe with timed challenges has been published for data-centre hardware. The main obstacles are wipe time and memory the wipe cannot reach, such as drive-controller DRAM. The largest known weakness is that the guarantee depends on ruling out outside help during challenges, which fast data-centre networks make harder.
- Threat model
- Adversarial prover
- Adversarial evaluation
- Published analysis
- Hardware needed
- None
- Prover cooperation
- Required
- Confidentiality
- Preserving
- Category
- Isolation & architecture
Technical detail and cited results
- Origin. Perito and Tsudik introduced proofs of secure erasure (PoSE) for embedded devices with bounded memory and a small ROM S-1304.
- Bursuc et al.'s model. The adversary is a distant, memory-unbounded helper A0 and a local device A1 bounded to memory M. The protocol has an initialization phase (fill memory), r timed challenge-response rounds, and a verification phase that accepts only if the answers are correct and each round-trip time is at most Δ S-0032.
- Variants. An unconditional variant fills memory with random bits sent by the verifier. A graph-based variant sends only a seed: the prover computes labels of a depth-robust graph with a hash function and stores the output labels, and a construction with in-place labelling needs only about the output size plus O(w) memory. A lightweight variant relaxes depth-robustness to a small constant for speed S-0032.
- Prototype. Bursuc et al. ran their prototype on a standard desktop computer and simulated the erasure of 32 KB, which took 0.25 s; compiled for a 32-bit architecture, the program is 3.4 KB S-0032.
- Amodo's implementation. It follows Bursuc et al.: node labels are L(n) = H(n ∥ L(p1) ∥ … ∥ L(pk)), only "robust" labels are stored and challengeable, and the scheme is secure if q < γ, where q is the number of hashes a cheater can compute within the round-trip time and γ is the minimum number of hashes needed to recompute a robust label S-1302.
- Amodo's parameters and throughput. An assumed RTT of 1 ms; γ = 65,536 for host RAM and 32,768 for GPU HBM; Dual-AES-PRF on CPU and BLAKE3 on GPU. The measured throughputs, 126.3 MiB/s for 120 GB of RAM and 244.5 MiB/s for 140 GB of HBM, scale to 2,565 s for the memory sizes in a GB200 tray S-1302.
- Disk path. A later optimization parallelized label generation across GPUs and reached 6 min 41 s per TB with 6 GPUs on one fast drive; it needs 25 GiB of working memory, which is left unattested if used on HBM S-1303. The NVL72 storage estimate assumes 30.72 TB of drives per tray and an estimated 840 MiB/s per B200 GPU, four GPUs per tray S-1303. Code for this path (CUDA graph labeller, multi-GPU disk-wipe benchmark with sample verification, wipe-time calculator) is public under the MIT licence S-1321.
Claims and scope
A direct link identifies the intended claim. A supporting link supplies part of the evidence. Neither establishes that a complete verification system has been demonstrated.
This compute runs inference, not training
Periodic wipes are proposed so that only verified inference outputs persist (S-0067); Amodo frames wipes as verifying completeness of declared workloads (S-1302).
Readiness for a stated use
Assessed use: showing that no data from earlier work persists in memory the wipe reaches
medium confidence · current · assessed 2026-09-25 · rubric 1.1
This is the source map’s editorial assessment. Production use is not evidence of resistance to every adversary.
The protocols are peer-reviewed and the AI use is proposed, but no public run covers the timed challenge phase on data-centre hardware.
- R1 met: the AI 2040 plan proposes periodic memory wipes on inference units so that only verified outputs persist S-0067. Peer-reviewed protocols define proofs of secure erasure and their assumptions S-1304 S-0032. The MIRI overview specifies filling memory with incompressible data and challenging random samples S-0018.
- R2 not met: complete protocols, with a separate verifier, have been reported end to end only on microcontrollers erasing 2–8 KB S-3240, and Bursuc et al. simulated a 32 KB erasure on a desktop computer S-0032. Amodo has run a Bursuc-style erasure on a Raspberry Pi 5 and benchmarked label generation on H200 and H100 GPUs, CPUs and NVMe drives S-1302 S-1303. Its public code for the GPU-accelerated disk-wiping path runs on realistic hardware S-1321. But the repository excludes "the verifier, the RAM and GPU-HBM session code" S-1321, the notes report fill throughput rather than timed challenge rounds S-1302 S-1303, and the GB200 figures are estimates scaled from component measurements S-1302 S-1303. The fill alone does not make an erasure verifiable, so this code does not meet R2. The mechanism's implementations, AI 2040 inference-only verification stack and Low-trust AI compute verification system overview, are proposed architectures at R1.
Confidence is medium: the rating turns on the judgment that fill-path code without the challenge phase is not a working implementation of the mechanism.
Evidence needed for the next level
A public end-to-end wipe of an accelerator server, covering fill and timed challenges by a separate verifier, for host memory, HBM and storage.
Coverage of memory the wipe cannot reach: drive-controller DRAM, firmware stores, NICs, DPUs and switches, and the algorithm's own working memory.
Adversarial evaluation in a data-centre setting, including remote-memory (RDMA) help during challenges.
Limitations, flaws, and blockers
These are attributed assessments from the source map. Absence of a listed flaw is not a security guarantee.
significant / open / open question
Memory the wipe cannot reach
Amodo's inventory of a GB200 system lists many memory stores beyond GPU HBM and host DRAM. It notes that SSD controller DRAM sits on a private bus that host commands cannot read or write, and that its optimized algorithm leaves 25 GiB of HBM unattested. It also asks how switch memory could be wiped.
significant / open / theoretical argument
Outside help during challenges
Classic proofs of secure erasure assume the device is isolated during the protocol. Bursuc et al. relax this to a bound on how close a helper can be, enforced by round-trip times. In data centres, remote memory access has round trips of about 1–2 µs, against about 70–200 ns for local DRAM. The MIRI overview therefore says verification depends on ruling out RDMA by latency or physical disconnection.
minor / open / theoretical argument
Gap between erased and total memory
Bursuc et al. note that memory left between the erased region and the device's full memory could hold data, and that their bounds are tighter only against a restricted adversary.
What still blocks use or stronger assurance
- S-0018S-1302S-1303
Wipes take time: tens of minutes for a pod's volatile memory and hours for SSDs, displacing work.
Timed challenges must exclude remote memory and other helpers.
Dependency: Timed challenge-response and memory-occupation challenges
S-0018S-0032- S-1302
All memory stores in a system must be inventoried and wiped at the same time.
Connections in the research map
Depends on
- Timed challenge-response and memory-occupation challenges
The fill is checked by timed challenges, which must exclude outside help.
Complementary techniques
Organizations and developers
Implementations
Sources and provenance
- S-0067 / Tier C
Verification Plan ↗
R. Dean · 2026 · AI 2040
Supports: periodic memory wipes on inference units via forced memorization; purpose
Locator: inference-only retrofitting proposal; verification overview
Version and catalogue details - S-1304 / Tier A
Secure Code Update for Embedded Devices via Proofs of Secure Erasure ↗
D. Perito, G. Tsudik · 2010 · Computer Security – ESORICS 2010, LNCS 6345, pp. 643–662
Supports: origin of proofs of secure erasure; bounded-memory model; applications
Locator: abstract
Version and catalogue details - S-0032 / Tier A
Software-Based Memory Erasure with Relaxed Isolation Requirements ↗
S. Bursuc, R. Gil-Pons, S. Mauw, R. Trujillo-Rasua · 2024 · 2024 IEEE 37th Computer Security Foundations Symposium (CSF 2024)
Supports: PoSE with relaxed isolation; adversary model; graph constructions; prototype; stated gap
Locator: §1–§8; implementation section; conclusion
Version and catalogue details - S-0018 / Tier B
A System Overview for Near-Term, Low-Trust AI Compute Verification ↗
N. Cankaya · 2026 · Machine Intelligence Research Institute
Supports: memory-occupation fill and challenge; fill times; RDMA caveat and latencies
Locator: §5.1.2
Version and catalogue details - S-1302 / Tier C
Memory Wipes - Performance Analysis ↗
Amodo Design · 2026 · Amodo Design
Supports: PoSE implementation, security condition, parameters, measured throughputs, GB200 estimates, memory inventory, open questions
Locator: whole note (corrected version)
Version and catalogue details - S-1303 / Tier C
Improving Disk Wiping Speed for Memory Wipes ↗
Amodo Design · 2026 · Amodo Design
Supports: multi-GPU label generation, per-TB wipe rate, NVL72 storage estimate and its assumptions, SSD DRAM and scratch limits, unprototyped multi-pass fix, remaining integration
Locator: whole note
Version and catalogue details - S-1321 / Tier B
Amodo-Design/PoSE-Memory-Wiping (GitHub repository) ↗
Amodo Design · 2026 · GitHub
Supports: public disk-wiping code; scope and exclusions; LBA overwrite limits
Locator: README
Version and catalogue details - S-3240 / Tier A
Empirical Evaluation of Memory-Erasure Protocols ↗
R. Gil-Pons, S. Mauw, R. Trujillo-Rasua · 2025 · Proceedings of the 22nd International Conference on Security and Cryptography (SECRYPT 2025), pp. 209–220
Supports: end-to-end comparison of seven erasure protocols on IoT microcontrollers; public code; findings
Locator: abstract; experimental setup; conclusion
Version and catalogue details
- Source review date
- 2026-09-25
- Drafted by (source map)
- ai
- Review handles (source map)
- codex-review