Consortium forVerified Computing

K-0002

Verifier

The party that examines evidence supplied by, or collected about, a prover and decides whether the prover's claim holds.

Source reviewed 2026-09-25

01 / The mechanism and its boundary

What is being described

A verifier is the party that examines evidence from or about a prover and decides whether the prover's claim holds S-0004 S-1603.

Under an international agreement the verifier may be another state, an international institution, a government body or a third party S-0004 S-0002. In proof systems, soundness protects the verifier: if a statement is false, a verifier that follows the protocol will not be convinced S-1606. The IETF remote-attestation architecture splits the role in two: a verifier appraises evidence and produces attestation results, and a separate relying party acts on them S-1603. In Shavit's framework the verifier randomly samples and physically inspects accelerators, and re-runs selected training segments as in proof-of-learning S-0029. In low-trust settings the verifier is itself a potential adversary: one system design assumes it may try to exfiltrate the prover's secrets, so the prover distrusts the devices the verifier relies on S-0018.

Connections in the research map

Related research

mechanism / R2

Confidential multi-party verification

Lets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.

mechanism / R1

Network taps and certifiers

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.

mechanism / R2

Safeguard attestation

Hardware-signed evidence that an AI service ran its declared safeguards, such as a guardrail classifier or monitor, when producing a given response.

mechanism / R3

Sampled inference recomputation

A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.

mechanism / R3

TEE remote attestation for AI workloads

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.

mechanism / R2

Zero-knowledge proofs of inference

A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.

implementation / R2

EZKL

EZKL is a library from Zkonduit that turns neural networks into zero-knowledge circuits, so a prover can show an output came from a committed model.

implementation / R2

zkLLM

zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights.

Sources and provenance

  1. S-0004 / Tier B

    Verification for International AI Governance ↗

    B. Harack, R. F. Trager, A. Reuel, D. Manheim, M. Brundage, O. Aarne, A. Scher, Y. Pan, J. Xiao, K. Loke, S. N. Adan, G. Bas, N. A. Caputo, J. C. Morse, J. Ahuja, I. Duan, J. Egan, B. Bucknall, B. Rosen, R. Araujo, V. Boulanin, R. Lall, F. Barez, S. Alvira, C. Katzke, A. Atamli, A. Awad · 2025 · Oxford Martin AI Governance Initiative

    Supports: Verifier defined as an institution, such as another state or an international institution, that assesses the Prover's compliance

    Locator: fn. 20

    Version and catalogue details
  2. S-1603 / Tier B

    Remote ATtestation procedureS (RATS) Architecture (RFC 9334) ↗

    H. Birkholz, D. Thaler, M. Richardson, N. Smith, W. Pan · 2023 · Internet Engineering Task Force (RATS Working Group)

    Supports: Verifier appraises evidence and produces attestation results; Relying Party acts on them

    Locator: §4 Terminology

    Version and catalogue details
  3. S-0002 / Tier B

    Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment ↗

    M. Baker, G. Kulp, O. Marks, M. Brundage, L. Heim · 2025 · RAND Corporation

    Supports: Verifier may be a government body or a third party

    Locator: §3.1

    Version and catalogue details
  4. S-1606 / Tier B

    ZKProof Community Reference ↗

    D. Benarroch, L. Brandão, M. Maller, E. Tromer · 2022 · ZKProof

    Supports: soundness: if the statement is false, a verifier following the protocol will not be convinced

    Locator: p. 1

    Version and catalogue details
  5. S-0029 / Tier B

    What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring ↗

    Y. Shavit · 2023 · arXiv

    Supports: Verifier randomly samples and inspects chips and re-runs selected training segments

    Locator: §3.1–3.2; §5.1

    Version and catalogue details
  6. S-0018 / Tier B

    A System Overview for Near-Term, Low-Trust AI Compute Verification ↗

    N. Cankaya · 2026 · Machine Intelligence Research Institute

    Supports: a malicious verifier may try to exfiltrate confidential information; its devices are verifier-trusted and prover-distrusted

    Locator: threat model section

    Version and catalogue details
Source review date
2026-09-25
Drafted by (source map)
ai
Review handles (source map)
codex-review