{"id":"11b6dd66-5b5e-4f1d-b71e-05e5351e41a1","arxiv_id":"2608.00801","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Software action records for AI agents are bound to RATS hardware attestation via a TPM quote, with a six-term verdict vocabulary demonstrated on an emulated TPM.","lead":"An AI-governance note argues that signed software records of agent actions cannot prove which model actually ran on which hardware, and proposes binding those records to hardware attestation from the IETF RATS architecture. A small experiment on an emulated TPM shows the binding works end to end, distinguishing an attested platform, a swapped model, and a stale quote.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Feasibility demo sidesteps the actual model-artefact measurement, so the central swapped-model scenario remains unvalidated.","rationale":"The reader's weakest assumption correctly identifies that the model artefact measurement is an unfulfilled engineering commitment. My stress-test confirms this is the most load-bearing point: the paper's motivating scenario (detecting a swapped model) is not demonstrated by the executed experiment, which uses a stand-in digest in PCR 3. The paper is honest about this limitation, so the central claim is scoped rather than false. However, the feasibility demonstration's value for the headline 'model version' question is conditional on the measurement being performed in real deployments. I considered whether the composite's inability to prove the model actually computed the output is more fundamental, but the paper's own explicit scope (composite attestation proves platform properties, not computation) and its reference to verifiable inference as a complementary line make that a known limitation rather than a hidden flaw. Thus I agree with the reader's assessment and see no reason to change the verdict.","tokens_in":7689,"tokens_out":11603,"duration_ms":116108,"concrete_test":"Re-run the §6 pipeline with a real model artefact (e.g., a small model file with a known hash) extended into a PCR that the actual platform measures during deployment, and verify that (a) an unmodified model yields Attested, (b) swapping to a different model binary yields Contested due to PCR mismatch, and (c) the reference value in the verifier is sourced from an independent registry of model hashes, not from a value recorded by the operator. If any of these fail, the composite does not yet deliver the paper's headline scenario.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's motivating scenario is detecting when a claimed model version did not actually run on unmodified hardware. The composite can only do this if the model artefact is measured into the attested platform state (a PCR). Section 7 explicitly concedes this is an engineering commitment not all deployments make. The §6 experiment does not exercise this commitment: it extends a stand-in tagged digest into PCR 3 rather than hashing a real model binary, and the appraiser compares against a manually recorded 'good state'. Thus the demonstrated Attested/Contested distinction is for a synthetic register value, not for a model artefact. If a deployment leaves the model unmeasured, the quote attests only the boot configuration, and a swapped or altered model will not change any PCR, so the (Authorised, Contested) failure case is invisible. This is the load-bearing assumption for the paper's core claim that the composite answers 'did this specific model version produce this output on unmodified hardware?'","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper argues that a signed, append-only action evidence package (AEP), being a software-layer self-report, cannot by itself establish that a specific model version actually ran on unmodified hardware. It proposes composing a RATS-style hardware attestation with the AEP: the AEP outcome digest and a fresh appraiser nonce are folded into the qualifying data of a TPM-signed quote, so that a later reviewer can traverse from an output to an attested, authorised origin. The paper defines a six-term verdict vocabulary (Authorised/Unauthorised/Indeterminate on the AEP axis; Attested/Contested/Expired on the platform axis), maps it provisionally to AR4SI/EAR, and reports a small executed experiment on swtpm with four cases: a good quote (Attested), a perturbed PCR 3 (Contested), a replayed quote (Expired), and a forged AEP outcome under a valid quote (rejected). The paper is explicitly a feasibility demonstration on emulated hardware and states several limitations, including the use of a stand-in digest in PCR 3 rather than a genuinely measured model binary.","tokens_in":7829,"tokens_out":8200,"duration_ms":89025,"significance":"If taken as a design-level composition note, the paper is useful and timely: it connects an active standards effort (IETF RATS, Veraison) to AI-agent governance evidence, and it is unusually honest about the boundary between architecture and implementation. The main strengths are the clean two-axis verdict space, the explicit output-binding mechanism, and the willingness to state what is not demonstrated (endorsement chains, AR4SI/EAR serialization, a real hardware root, a measured model artefact). The executed experiment is small but reproducible in principle, with pinned tool versions. However, the experiment is a specification-compliance check against the author's own stand-in verifier, and it does not exercise the motivating swapped-model scenario with an actual model artefact. These gaps do not invalidate the architecture, but they do mean the paper's central claim is supported only conditionally.","major_comments":[{"comment":"The experiment's Case B perturbs a stand-in tagged digest in PCR 3, not a hash of a real model binary. The paper's motivating question is whether a claimed model version actually produced an output; the demonstrated Contested verdict only shows that a PCR mismatch against a manually recorded good state is detected. The flagship (Authorised, Contested) failure for a swapped model is therefore not actually exercised. This is load-bearing because the abstract's central claim is about 'the specific model version'. Either extend the experiment to measure a real model artefact (e.g., extend a SHA-256 of the model file into a PCR at load time, or use an IMA-style measurement), or explicitly reframe the claim as platform-state attestation with model measurement as a stated precondition for the model-version question.","section":"§6, Table 1 (Case B); §7, second honest limitation; abstract"},{"comment":"The 'verifier' is an author-written stand-in that performs signature, freshness, and PCR-reference checks but not endorsement appraisal, CoRIM ingestion, or AR4SI/EAR serialization. The reported Attested/Contested/Expired outcomes are thus conformance of the implementation to the author's own design, not independent validation against a real RATS verifier or against the §5 mapping. The paper already flags this, but the wording in the abstract ('Veraison ... supply exactly this') and in §6 ('the checks a Verifier performs') overstates the evidential weight. At minimum, the abstract and results should state explicitly that the experiment validates only the binding mechanics and the stand-in verdict logic, not a RATS-compliant appraisal.","section":"§6 'Results' and second caveat; §5 mapping"}],"minor_comments":[{"comment":"Several missing spaces: 'acomposite', 'anoutput-bindingprotocol', 'atrust' (Abstract), and similar in §4. These are typographical but should be fixed.","section":"Abstract, §4"},{"comment":"The caption says all nine pairs are reachable, but the text does not give a concrete scenario for each pair (e.g., how Unauthorised+Attested arises). A short list of example scenarios would make the matrix more convincing.","section":"Figure 1 and §6"},{"comment":"The Expired case (Case C) tests only nonce freshness, not the lapsed-endorsement or EAT 'exp' paths. This is stated, but the term 'Expired' is used in the abstract and table as if the full semantics were exercised. A sentence in the results section noting this would avoid overreading.","section":"§6, fifth caveat"},{"comment":"The run package is 'available on request' rather than publicly deposited. Given the emphasis on verifiable provenance, a public repository with the deterministic run script and results.json would strengthen reproducibility.","section":"Data and code availability"}],"recommendation":"major_revision","confidential_remarks":"The paper is a scoped design/feasibility note rather than a full systems paper. The main blocker for acceptance is the gap between the motivating swapped-model scenario and the stand-in PCR measurement in the experiment; this is fixable with a real model measurement or a clear reframing. The self-consistency nature of the stand-in verifier is a secondary but real weakness. No concerns about citation or authorship integrity."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick read: this is a modest note that does exactly what it says. It composes RATS hardware attestation with the author's Action Evidence Package and shows on a software TPM that an output-bound quote can distinguish Attested, Contested, and Expired. The contribution is the composition and the six-term verdict vocabulary, not the mechanism—the paper says that itself. I like the flight-recorder analogy and the clean separation of the authorisation axis (AEP) from the platform axis (RATS). The feasibility run is executed, four cases behave as designed, and the limitations section is unusually candid.\n\nThe main gap, which the stress-test flags correctly, is that the model-artefact measurement is not actually demonstrated. PCR 3 gets a stand-in tagged digest, not a hashed model binary. The paper acknowledges this in Section 6 and again in Section 7, calling it an engineering commitment. So the central swapped-model scenario is unvalidated in the form that matters for real deployments. But the paper explicitly frames the whole thing as a feasibility demonstration on emulated hardware, not a hardware-rooted guarantee. You can't fairly fault it for not solving an open engineering problem it names. What you can say is that the claimed composition is contingent on deployments measuring model artefacts, and that is the real-world binding constraint.\n\nOther soft spots: the appraiser is a self-written stand-in; no Veraison, no endorsement chains, no EAR/AR4SI serialization. Case C only exercises nonce freshness, not the EAT exp or lapsed-endorsement paths. The AEP is synthetic. And the run package isn't public yet—'available on request' is weaker than a DOI. None of these are fatal, because the claims are scoped to emulated feasibility, but they narrow the contribution.\n\nOverall, this is a useful architecture note for the AI-governance evidence crowd. I'd take the conditional verdict seriously. The idea is coherent, the writing is clear, and the limitations are stated up front. A venue like an AI security workshop or a trust/attestation track would be right. I'd want the author to make the artifacts public and ideally pair the stand-in verifier with Veraison before publication, but that's a revision request, not a desk reject.\n\nRecommendation: send it to peer review. Even with the caveats, it's the kind of narrow, honest result that helps a community converge.","headline":"A small, honest architecture note that composes RATS attestation with action evidence packages; feasible on an emulated TPM, but the model-artefact measurement it depends on remains unvalidated.","tokens_in":8351,"tokens_out":2720,"would_cite":true,"duration_ms":28466,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A signed action record cannot prove which model or hardware actually produced it; binding it to a hardware quote can.","keywords":["action evidence package","remote attestation","RATS","TPM quote","output-binding","AI governance","model integrity","attestation verdict vocabulary"],"falsifier":"On a real TPM, measure a real model binary into a PCR, produce an output-binding quote, then silently swap the model binary without updating the measurement; if the verifier returns Attested rather than Contested, the composite fails to catch the swapped-model case it exists for. A second refutation: alter the AEP outcome after a quote is produced and show the pair still verifies.","tokens_in":7531,"feed_emoji":"🔐","tokens_out":12465,"duration_ms":118836,"temperature":0.7,"pith_summary":"An action evidence package (AEP) is a signed, append-only record of what an AI agent did, who authorised it, and what happened. This paper argues that such software-layer evidence is necessary but not sufficient: it tells a verifier what the agent's own runtime claims, but not whether the specific model version the operator says it deployed actually ran, on unmodified hardware. The proposed fix is a composite attestation—hardware evidence appraised under the RATS (Remote Attestation Procedures) architecture, bound to the AEP at record time through an output-binding protocol—resolved into a six-term vocabulary (Authorised/Unauthorised/Indeterminate on the authorisation axis, Attested/Contested/Expired on the platform axis). An executed experiment on a software TPM (Trusted Platform Module) shows the three platform verdicts are reachable and a forged AEP outcome bound to a valid quote is rejected. The paper is explicit that this is a feasibility demonstration on emulated hardware, not a hardware-rooted guarantee.","feed_headline":"Binding AI action logs to hardware attestation catches swapped models","feed_subtitle":"A six-term verdict makes the clean-logbook, wrong-hardware case visible to auditors.","key_machinery":"The load-bearing mechanism is the output-binding protocol within a composite attestation. An AEP is the signed, append-only action record; hardware Evidence is a TPM (Trusted Platform Module) quote signing platform configuration registers (PCRs), with a model-artefact measurement carried in a PCR. At record time, the SHA-256 digest of the AEP outcome plus a fresh appraiser nonce is folded into the quote's qualifying data, so the quote is cryptographically bound to exactly that record and that moment. A six-term vocabulary then maps the AEP's authorisation check and the RATS appraisal into one composite verdict. Without the binding, a valid quote and a valid AEP can be replayed or recombined","core_discovery":"The paper's central claim is that the AEP alone cannot close the gap between 'what does the agent claim it did?' and 'did the specific model version the operator claims to have deployed actually produce this output, on unmodified hardware?' The answer it proposes is to compose two artefacts that live in separate worlds: RATS (Remote Attestation Procedures) hardware Evidence—a TPM (Trusted Platform Module) quote over platform measurement registers, appraised by an independent verifier against reference values—and the software AEP, bound together at record time by folding the SHA-256 digest of the AEP outcome and a fresh appraiser nonce into the quote's qualifying data. A six-term vocabulary (","pith_inferences":["The same binding logic would extend naturally to any high-stakes software record beyond AI—financial trades, medical decisions, industrial control—wherever a signed log needs hardware grounding.","The six-term matrix could be extended with a third axis for trust in the verifier and hardware-vendor endorsements; the paper notes that attestation moves trust to those parties but does not formalise such an axis.","A testable extension is to measure decode parameters and sampler PRNG state into the attested state at generation start; the paper observes this would recover independent re-derivation for deterministic pipelines, but leaves it as future work.","Because the experiment substitutes a stand-in digest for a real model binary, the immediate practical check is whether real model artefacts hash stably into PCRs across boot sequences and updates; if they do not, Contested verdicts could become noisy."],"forward_implications":["Auditors can treat a clean AEP and a contested PCR measurement as a single high-signal failure: the record says the action happened, the hardware says the platform was not in the claimed state.","Deployments that measure the model artefact into the attested state can detect a silently swapped model as a Contested verdict rather than a silent pass.","The composite works for stochastic inference too: it proves this outcome was bound to this attested platform state, not that the output is uniquely reproducible.","Because the output-binding pattern is standard, the composite can be built from existing TPM and RATS components without new cryptographic primitives.","If the model artefact is not measured into the attested state, the composite still attests the boot configuration, but the model-version question remains open—the paper states this as an engineering commitment."],"supporting_citations":[{"why":"Defines the RATS architecture—Attester, Verifier, Relying Party roles, evidence appraisal, and freshness mechanisms (nonce, timestamp, epoch) that the composite uses.","marker":"[1]"},{"why":"Open-source RATS verifier implementation the paper names as the independent Verifier role.","marker":"[2]"},{"why":"Defines PCR semantics and the quote command that signs platform-register values with an attestation key—the hardware mechanism the binding builds on.","marker":"[TCG-TPM2]"},{"why":"Closest existing system: continuous appraisal of key-signed TPM quotes against reference values, extended here from node integrity to a single governance record.","marker":"[Keylime]"},{"why":"Established the output-binding pattern of folding application data into attestation-signed evidence, reused for the AEP digest and nonce.","marker":"[SGX]"},{"why":"Supplies the software TPM emulator used to execute the feasibility experiment.","marker":"[swtpm]"},{"why":"Provides the trustworthiness tiers (None/Affirming/Warning/Contraindicated) that the paper maps onto Attested and Contested.","marker":"[AR4SI]"},{"why":"Defines the result serialisation and the exp claim used to surface the Expired condition and carry attestation results.","marker":"[EAR]"}],"fun_headline_variants":["TPM-tied AI evidence reveals model swaps","AI logs bound to TPM expose model swaps","Hardware-bound AI logs flag model swaps","TPM-bound AI logs prove model identity"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The approach only attests the specific model version if the deployment actually measures the model artefact into the attested platform state—an engineering commitment the paper says not all deployments make today, and one its own experiment sidesteps with a stand-in digest rather than a real model binary.","fun_headline_variants_meta":{"raw":{"variants":["TPM-tied AI evidence reveals model swaps","AI logs bound to TPM expose model swaps","Hardware-bound AI logs flag model swaps","TPM-bound AI logs prove model identity"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001441,"raw_usage":{"total_tokens":5722,"prompt_tokens":898,"completion_tokens":4824,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":642,"completion_tokens_details":{"reasoning_tokens":4767}},"tokens_in":642,"tokens_out":4824,"duration_ms":39133,"temperature":1.0,"reasoning_tokens":4767,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T00:10:47.603641+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"On a real TPM, measure a real model binary into a PCR, produce an output-binding quote, then silently swap the model binary without updating the measurement; if the verifier returns Attested rather than Contested, the composite fails to catch the swapped-model case it exists for. A second refutation: alter the AEP outcome after a quote is produced and show the pair still verifies.","supporting_citations":[{"cited_title":"Remote ATtestation procedureS (RATS) Architecture,","cited_arxiv_id":null,"evidence_quote":"Defines the RATS architecture—Attester, Verifier, Relying Party roles, evidence appraisal, and freshness mechanisms (nonce, timestamp, epoch) that the composite uses."},{"cited_title":"https://github.com/veraison","cited_arxiv_id":null,"evidence_quote":"Open-source RATS verifier implementation the paper names as the independent Verifier role."}],"review_version":1}