Case file HG-08ControlMaturity: Research agendaReviewed 2026-08-22

Mechanism under review

Policy, but make it a peripheral

FlexHEG places an auditable guarantee processor beside AI accelerators inside a tamper-responsive enclosure. It observes device traffic and selected state, produces authenticated receipts and aggregate claims, and can optionally enforce updateable rules over visible operations.

Read primary source ↗

Adversary realism4/5

High but unvalidated

The source targets state physical adversaries and discusses supply chain, authority, ecosystem, and semantic limits, but offers no fabricated device or attack results.

Trusted dependencies5/5

Very high

The enclosure, processor, observation coverage, receipt composition, rule semantics, authorities, supply chain, ecosystem, and institutional interpretation must compose correctly.

Policy reach5/5

Systemic

The proposal extends from receipts to location, evaluation, model custody, compute caps, licences, deployment controls, safety protocols, and multistate rules.

01Mechanism under review

Provide a programmable hardware trust boundary for privacy-preserving verification and optional enforcement of commitments about frontier AI compute.

01
Place accelerators, memory, and an auxiliary guarantee processor inside a protected enclosure.
02
Position the processor between the accelerators and external interfaces to observe I/O and selected internal state.
03
Sign low-level receipts describing data, operations, results, compute use, evaluations, configuration, or sharing.
04
Authenticate and aggregate receipts across devices into privacy-preserving higher-level claims.
05
Optionally enforce updateable rules or licences; detected tampering wipes keys and may blow accelerator fuses.

Technical output

A signed receipt, an aggregate claim about observed activity, or a local allow/block decision under a configured ruleset.

02Claim boundary

What the primitive says—and what it does not.

Can establish

Conditional on the enclosure and processor, a signed receipt records what the mechanism observed and computed.
Receipts can be authenticated and aggregated across participating devices without disclosing every workload detail.
A rule can block an operation visible to and technically classifiable by the processor.
Detected intrusion can invalidate the device's claim-signing identity.

Remains external

Whether every relevant path, component, auxiliary device, and off-enclosure computation is observed.
Whether a technical predicate captures safety, intent, ownership, military purpose, or another policy concept.
Whether the enclosure resists a state laboratory and the manufactured supply chain matches the auditable design.
Whether relevant capability remains inside the flexHEG ecosystem after outputs or modules leave.
Whether update authorities act legitimately and signed claims are sufficient evidence of treaty or legal compliance.

03Threat model in scope

Protected asset

Confidentiality and integrity of workloads, keys, receipts, rules, and enforcement decisions inside the enclosure.

Adversary

A chip owner, well-resourced non-state actor, or state adversary with administrative and possibly physical possession of the device.

Enforcement boundary

Only operations that cross observable flexHEG interfaces and satisfy technically expressible predicates can be constrained; users, external outputs, and uninstrumented compute remain outside.

Capabilities considered

Control workloads, host systems, data, and external interfaces around the enclosure.
Attempt intrusion, probing, fault injection, component replacement, or key extraction.
Use uninstrumented accelerators or route modular and distributed work outside the ecosystem.
Exploit the processor, ruleset, firmware, update path, authority keys, or supply chain.

Limits and exclusions

Part I gives conceptual sketches and defers detailed implementation and feasibility work to Part II.
The source limits plausible coverage to compute-intensive frontier AI, not all compute.
Malicious intent and many safety properties are acknowledged as not observable on-chip.
Early systems are not claimed to eliminate inspection, registries, intelligence, or financial controls.
No fabricated device or quantitative adversarial test result is presented.

04Trust register

The assurance dependency chain.

DomainRequirementFailure consequenceSource treatment

Enclosure and tamper response

Intrusion is detected before secrets or bypasses escape, with reliable key wiping and safe failure.

An attacker preserves device identity after compromise, or false triggers destroy legitimate availability.

central

Processor and observation coverage

The auditable processor is correct and sees every governance-relevant operation and data path.

Every signature is valid while the mechanism observes only a convenient subset of the system.

central

Receipt composition and rule semantics

Receipts aggregate without omission or double counting and coded rules match the intended policy.

Valid artifacts produce a wrong aggregate or flawlessly enforce the wrong proxy.

discussed

Updates, authorities, and supply chain

Manufacture, provisioning, quorum keys, licences, and updates remain secure, available, and legitimate.

A replicated backdoor, captured authority, outage, or unsafe update changes behavior across the estate.

central

Ecosystem and institutional boundary

Relevant capability stays inside participating hardware and verifiers interpret receipts narrowly.

Capability escapes through legacy hardware or outputs while a technical receipt is overread as policy compliance.

discussed

05Caveats on the record

Limitations the source already recognizes.

Early versions may compromise on security and supported-rule sophistication; strong physical security may take years.
FlexHEGs are expected to govern only the compute-intensive frontier.
Devices cannot infer malicious intent and can distinguish uses only when the computation differs technically.
Inspections, intelligence, registries, and other external controls remain complementary.
Perfect privacy, flawless updates, fully automatic compliance, and several Appendix B sketches are described as infeasible, uncertain, or not necessarily desirable.

06Consortium assessment

Where the assurance moves

The processor can carry assurance from protected observations to signed claims and local decisions. It cannot carry that assurance past its visibility, the correctness of its rules, the security of its enclosure and supply chain, or the difference between a predicate and a policy conclusion.

Load-bearing sequence

Manufactured hardware matches the audited design and detects physical attacks.
The processor sees every relevant operation and data path.
Receipts remain attributable and complete across distributed work.
Rules are precise, robust, and updated by secure and legitimate authorities.
Capability stays inside the ecosystem and verifiers do not overread the resulting claim.

Institutional translationThe peripheral can sign the rule, enforce the rule, and report that the rule was enforced. Deciding what the rule means remains with civilization.

07Tests that would change our mind

A finding should be falsifiable.

Test 01

Penetrate production-equivalent enclosures with probing, glitching, substitution, and side channels; Part I reports no prototype test.

Test 02

Move state or compute through paths not mediated by the processor and measure coverage; implementation testing is deferred.

Test 03

Replay, reorder, omit, or duplicate receipts across a multi-accelerator job; no empirical composition result is reported.

Test 04

Optimize workloads to satisfy a coded rule while violating its intended meaning; no adversarial rule suite is reported.

Test 05

Exercise malicious updates, quorum capture, licence expiry, authority outage, and supply-chain substitution; no end-to-end result is reported.

08Record provenance

Primary sourceFlexible Hardware-Enabled Guarantees for AI Compute ↗

Reviewed2026-08-22

Methodologyv1.0

Correction statusnone

Evidence register (4)

Petrie et al., Flexible Hardware-Enabled Guarantees for AI Compute, arXiv:2506.15093, pp. 3, 6–8

The enclosure, processor, receipts, aggregate claims, rules, update expiry, tamper response, and supply-chain requirement.

Petrie et al., arXiv:2506.15093, 'Limitations of FlexHEG Mechanisms,' pp. 16–17

Implementation difficulty, frontier-only coverage, inability to determine intent, and complementary governance.

Petrie et al., arXiv:2506.15093, Appendix A, pp. 24–25

Limits of automatic compliance, privacy, updates, tamper protection, inspection, and sovereignty.

Petrie et al., arXiv:2506.15093, Appendix B, pp. 26–37

Receipt aggregation, compute accounting, evaluations, rules, licences, and off-ecosystem and modular-composition limits.