- Conditional on faithful capture, sampled checkpoints and data indices are consistent with replayed portions of the declared process.
- The transcript was committed as recorded if the logger, hash function, storage path, and keys operate as assumed.
- Some fabricated or inconsistent histories may be detected without reproducing the whole run.
Mechanism under review
Proof that training happened properly
Proof-of-training records checkpoints and data references during stochastic training so a verifier can replay selected segments and test whether the declared history is internally consistent. The cited source classifies the approach as requiring R&D.
Read primary source ↗Adversary realism3/5
Partially specified
The paper discusses circumvention and structural loopholes, but V2 has no complete threat model or reported adversarial evaluation.Trusted dependencies5/5
Very high
Useful assurance depends on capture, protocol soundness, sampling, shared verification infrastructure, scale, model binding, external coverage, and policy interpretation.Policy reach4/5
High
The source places the mechanism in domestic, bilateral, and treaty verification while the primitive checks only a declared training history.01Mechanism under review
Give a verifier evidence that a particular model arose through a declared training process without rerunning the entire job.
- 01
The prover periodically records weight snapshots and data indices during training.
- 02
In the regulatory variant, on-chip firmware hashes snapshots and sends the transcript to verifier-trusted storage.
- 03
Inspectors select chips or transcript segments for review.
- 04
A neutral cluster trusted by prover and verifier replays selected segments and compares reconstructed states with recorded checkpoints.
- 05
Replay consistency is treated as evidence for the declared training history.
Technical output
A replay-checked transcript supporting the claim that logged checkpoints are consistent with specified training operations.
02Claim boundary
What the primitive says—and what it does not.
- Whether every relevant operation was logged or parallel, undeclared, and off-platform training occurred.
- Whether sampling is sound against an adaptive prover and replay remains practical at frontier scale.
- Whether identified data were lawful, safe, correctly labelled, or semantically permitted.
- Whether the model was later fine-tuned, distilled, combined, or replaced.
- Whether a consistent training history demonstrates safety, intent, provenance, or policy compliance.
03Threat model in scope
Protected asset
Integrity and completeness of the transcript and its binding to the model presented for verification.
Adversary
A training operator seeking to pass verification while performing different, additional, or incompletely logged computation.
Enforcement boundary
The mechanism supplies evidence about captured training. Licensing, sanctions, KYC, inspections, and prevention of unlogged computation remain external.
Capabilities considered
- Control the workload, host software, checkpoint timing, and data ordering around the logger.
- Fabricate a plausible transcript or move deviations into rarely sampled segments.
- Distribute work across chips, providers, or jurisdictions outside the monitored transcript.
- Modify or replace the model after the verified transcript ends.
Limits and exclusions
- The source gives no complete formal security model for this V2 mechanism.
- A production-grade, provably secure and efficient protocol is not provided.
- General-purpose zero-knowledge verification is treated as inefficient at this scale.
- Inference-time governance, policy semantics, and physical resistance of the logger are not established.
04Trust register
The assurance dependency chain.
DomainRequirementFailure consequenceSource treatment
Capture and hardware root
The on-chip logger records all relevant events in order and cannot be bypassed.
An incomplete but coherent transcript describes a permitted run while omitting the activity of interest.
mentionedProtocol and sampling
A malicious prover cannot forge an accepted transcript or hide deviations outside sampled segments.
Heuristic or weakly sampled checks accept selectively valid histories.
centralStorage and neutral cluster
Verifier storage preserves custody and the jointly trusted cluster replays faithfully and confidentially.
Evidence or verification results are manipulated at the new shared trust points.
centralScale and model binding
Replay is affordable and reproducible, and the reviewed model remains bound to the terminal checkpoint.
Verification is impractical or a valid transcript is paired with a later or different model.
discussedCoverage and policy semantics
External controls detect unlogged compute and the evidenced property matches the regulator's concern.
A valid diary of one run is promoted into proof of complete compliance.
discussed05Caveats on the record
Limitations the source already recognizes.
- The mechanism is rated 'requires R&D'; current schemes are described as heuristic and not provably secure.
- Provably secure and efficient Proof-of-Training-Transcript protocols remain future work.
- Zero-knowledge proofs are described as inefficient at this scale, motivating a jointly trusted cluster.
- No production-grade system is said to operate at frontier scale without prohibitive overhead.
- Training-only governance is described as increasingly insufficient as inference and post-training techniques expand.
06Consortium assessment
Where the assurance moves
Replay consistency can support the integrity of a declared transcript. It does not establish completeness of all training, post-training custody, model safety, developer intent, or policy compliance.
Load-bearing sequence
- A trusted logger observes every relevant event.
- The transcript is complete, ordered, and tamper-resistant.
- The protocol and sampling rule are sound against a malicious prover.
- Replay is faithful, confidential, reproducible, and affordable.
- The final model remains bound to the record and the record maps to the policy claim.
Institutional translationThe certificate can establish that the diary is internally consistent. It is less forthcoming on whether this was the only diary.
07Tests that would change our mind
A finding should be falsifiable.
Forge transcripts for training paths that were not executed and measure verifier acceptance; no result is reported.
Run additional training on uninstrumented hardware and test omission detection; no result is reported.
Place deviations in rarely sampled checkpoints and quantify detection probability; no sampling bound is located.
Measure logging, storage, and replay overhead on a frontier-scale distributed run; the source says no production-grade result exists.
Fine-tune or replace the proved model and test whether the certificate remains usable; no end-to-end custody test is located.
08Record provenance
Primary sourceHardware-Level Governance of AI Compute ↗
Reviewed2026-08-22
Methodologyv1.0
Correction statusnone
Evidence register (4)
Ansari, Hardware-Level Governance of AI Compute, arXiv:2604.04712, §3.2 V2, p. 6
Checkpoint logging, replay, on-chip hashing, trusted storage, the neutral cluster, and the R&D rating.
Ansari, arXiv:2604.04712, §4.1–§4.6, pp. 9–14
Algorithmic efficiency, distributed training, physical attack, political feasibility, and the training-inference boundary.
Ansari, arXiv:2604.04712, §5.2, pp. 15–16
The proposed use of V2 in domestic, bilateral, and especially multilateral treaty verification.
Ansari, arXiv:2604.04712, §6.2–§6.4, pp. 18–20
Lack of provable security and production-scale implementations, inference gaps, and caution against premature legislation.