Compartmentalization ↗
Dividing a facility's accelerators into groups with restricted communication between them, so that combining groups for large training runs becomes slow or impractical.
A common vocabulary
Terms of assurance.
The words in a verification proposal should be doing technical work. Start here for definitions, then follow the source and the claim boundary.
Cryptographic commitment ↗
A way to fix a value now without revealing it, so that it can later be opened and shown not to have changed.
Evidence binding ↗
Tying verification evidence to the specific device, workload, data and time it describes, so it cannot be substituted, replayed or misattributed.
FLOP accounting ↗
Estimating or verifying how many floating-point operations a training run or other workload used, often to compare against a threshold in a rule.
Hardware-enabled mechanism (HEM) ↗
A governance or verification function built into AI chips or closely attached hardware, such as usage reporting, location attestation or enforced limits.
Inference and training workloads ↗
Training updates a model's weights from data. Inference uses fixed weights to produce outputs. Their different resource use underpins several verification methods.
Interconnect bandwidth ↗
The data rate of links between accelerators or groups of them; large-scale training needs far more of it than inference, so limiting it constrains workloads.
Network tap ↗
A device that copies the traffic on a network link for inspection without disrupting it; proposed for checking what AI data centres compute.
Numerical nondeterminism ↗
Differences between runs, or between machines, in the results of the same AI computation, because floating-point rounding depends on the order of operations.
Positive and negative claims ↗
A positive claim asserts that something is present or happened; a negative claim, that an activity or resource is absent; a mixed claim, both.
Proof of (useful) work ↗
Evidence that a party spent a given amount of computation; in useful variants, the same work can also solve a problem someone wants solved.
Proof of space ↗
A protocol in which a prover shows that it is dedicating a given amount of storage or memory, rather than computation, to a task.
Prover ↗
The party that makes a claim about its own AI hardware, models or workloads and supplies the evidence a verifier checks.
Recomputation ↗
Checking a claimed computation by re-running all of it, or a random sample, on hardware the verifier trusts and comparing the results.
Remote attestation ↗
A process in which a device sends signed evidence about its state, such as software measurements, so a remote party can judge its trustworthiness.
Root of trust ↗
A component that anchors security functions such as measurement, storage and reporting, and must be trusted because its misbehaviour cannot be detected.
Sampling and assurance ↗
Checking a random sample of accelerators, workload segments or outputs rather than all of them, so that violations are caught with a calculable probability.
Side channel ↗
An unintended path by which information leaks from a system through effects of its operation, such as timing, power draw or electromagnetic emissions.
Tamper evidence and tamper resistance ↗
Tamper evidence makes interference detectable; tamper resistance makes it difficult or costly; tamper response reacts to it, often by erasing secrets.
Threat model ↗
An explicit statement of who might attack a system, what they can do, and which threats the design covers or leaves out of scope.
Trusted execution environment (TEE) ↗
An execution area protected by the processor that keeps the data inside confidential and unaltered, and the code unaltered, even from the host's own software.
Undeclared compute ↗
AI-relevant hardware, or uses of declared hardware, that a prover has not reported, and that verification must therefore detect or rule out.
Verifier ↗
The party that examines evidence supplied by, or collected about, a prover and decides whether the prover's claim holds.
Weight exfiltration ↗
Unauthorized copying of a model's trained parameters out of the environment meant to contain them, by theft or through covert channels.
Zero-knowledge proof ↗
A cryptographic protocol by which a prover convinces a verifier that a statement is true while revealing nothing beyond the fact that it is true.