{"id":"dc092563-ebf2-4365-a22c-cd32343d88c7","arxiv_id":"2608.02774","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"MID selects verifier-facing evidence, such as telemetry or power traces, by minimizing conditional mutual information about a protected property given the authorized verification result, and demonstrates perfect held-out verification with zero measured leakage on three of six tasks.","lead":"This paper introduces a framework, called minimal information disclosure (MID), that chooses what evidence an AI verifier receives so that the evidence proves the authorized claim while revealing as little as possible about a protected property. It tests the idea on physical measurements from GPUs and data centers, showing three cases where the chosen reports leak nothing measurable.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Zero-leakage headline rests on releases that encode the authorized label; test whether nontrivial mechanisms and bootstrap CIs support the practicality claim.","rationale":"Reading in good faith, the framework is internally consistent. Eq. (1) is the privacy funnel specialized to verification; the data-processing and Fano bounds are standard; Algorithm 1's nested grouping is a real strength; and the paper explicitly disclaims population guarantees (\"zero measured,\" Sec. 2.2) and distribution-shift scope (Sec. 5). The Auditor-in-a-Box analysis supports the motivation. My concern is not that the math is wrong but that the strongest empirical evidence for practicality, three exact-zero leakage results, is less discriminating than it appears: in each case the release is constant within authorized classes, so plug-in MI is zero by construction. The paper flags this for the working mechanism but does not quantify margins or uncertainty. This is exactly the finite-sample issue the reader identified, though I would put more weight on the by-construction nature of the zeros. A candidate-set ablation plus bootstrap CIs would settle whether MID can find nontrivial zero-leakage releases and whether the zeros are stable. Without that, the verdict should stay CONDITIONAL: accept the framework as a proposal, but do not treat the held-out zeros as a robustness guarantee. The absence of released code or processed data makes these checks impossible for third parties today, which further supports a conditional rather than full acceptance.","tokens_in":22660,"tokens_out":17487,"duration_ms":171516,"concrete_test":"Re-run Algorithm 1 on each of the three zero-leakage tasks after removing from M every mechanism whose release is a deterministic function of Y alone in the development folds (e.g., memory capacity, duration, and the RL score threshold that maps every held-out session to the true label), and simultaneously compute 95% bootstrap CIs (resampling whole physical runs) for the original plug-in I(S;E|Y). If a zero-leakage mechanism still exists and the CI upper bound is below 0.01 bits, the practicality claim is supported; otherwise the headline is an artifact of trivial Y-encoding candidates and small matched samples.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that MID is practical, evidenced by three releases with perfect held-out verification and zero measured collateral leakage. The load-bearing condition is that I(S;E|Y)=0 is not an artifact of the estimator or of the observed sample. In all three headline cases (the RL one-bit report in Sec. 4.2, the H100 memory-capacity report in Sec. 4.3, and the NLR node-count report in Sec. 4.4), the selected release is constant across the sensitive classes within each authorized class on the held-out data, and in fact is effectively the authorized label itself. The paper acknowledges this (e.g., Sec. 4.4: \"the zero-leakage result follows directly from the released code\"). That is a valid design outcome, but it means the zero values follow from the release rule, not from a sensitive measurement of conditional MI. No confidence intervals, margins to decision/quantization boundaries, or drift tests are reported for these releases, and for continuous releases the reported \"bits\" are lower bounds from held-out predictors (Sec. 2.2). The finite-sample nature is stated, but the \"practicality\" claim depends on these zeros surviving outside the matched development set, which has not been established.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces minimal information disclosure (MID), an information-theoretic framework for designing verifier-facing evidence in AI verification. A policy declares an authorized target Y and a protected property S, and each candidate evidence mechanism m=(c,α,θ) is evaluated by mutual information I(Y;E_m) for verification utility and conditional mutual information I(S;E_m|Y) for collateral leakage. The proposed optimization (Eq. 1) selects the deployable mechanism that minimizes leakage subject to a utility threshold. The authors prove an upper bound on any later inference procedure via the conditional data-processing inequality and connect the objective to adversary error via Fano's inequality. They describe two deployment paths: authenticated direct collection and a ZKP-certified post-collection release. The evaluation covers six tasks on four public physical-measurement datasets, reporting three selected releases with perfect held-out verification and zero measured collateral leakage (RL vs non-RL, H100 vs B200, NLR node allocation), explicit privacy–utility frontiers for the other tasks, and a Groth16 zk-SNARK implementation of a linear projection. An appendix re-analyzes Auditor-in-a-Box, showing that a one-bit valid/invalid verdict carries 0.176 bits about the request set and supports a 72.4% balanced-accuracy inference attack, motivating the framework.","tokens_in":22869,"tokens_out":8762,"duration_ms":81990,"significance":"If the claims hold, the paper makes a useful and timely contribution. The formulation in Eq. (1) gives AI verification a principled, attack-agnostic objective, and the conditional data-processing inequality and Fano bound correctly justify the use of conditional mutual information as a leakage measure. The evaluation is stronger than typical in this literature: nested mechanism selection with grouped outer held-out runs, fixed attack schedules for ModelSpy and DeepTheft, and a working Groth16 circuit for a selected release transformation are concrete strengths. The Auditor-in-a-Box re-analysis is a clean empirical illustration that output cardinality alone does not control disclosure. The main gap is that the three zero-leakage headline results are essentially by construction and are not accompanied by uncertainty quantification, margin analysis, or an explicit statement that the zeros are design outcomes rather than empirical discoveries. With additional finite-sample guarantees or reframing, the practicality claim could be made solid.","major_comments":[{"comment":"The three headline zero-leakage results are properties of the release rule rather than empirical discoveries. In the RL one-bit report (Eq. 23), the H100 memory-capacity report (Eq. 24), and the NLR node-count report (Eq. 25), the release is constant across sensitive classes at fixed Y on the held-out runs, so the plug-in conditional MI described in §2.2 is zero by construction. The paper acknowledges this for NLR ('the zero-leakage result follows directly from the released code'), but the abstract and introduction present 'perfect held-out verification and zero measured collateral leakage' as the main evidence of practicality. The text should state clearly that these zeros are design outcomes, and should provide a finite-sample or margin analysis—for example, bootstrap confidence intervals, worst-case near-threshold values, or an explicit description of what distribution shift would break the conditional independence. Without this, the reader cannot distinguish a robustly private mechanism from a finite-sample artifact.","section":"§4.2–4.4, Tables 3, 4, 8"},{"comment":"There is no uncertainty quantification on the estimated leakage and utility values that drive mechanism selection. In Table 9, the algorithm compares D_cond_S values 8.0075 (α=160) and 7.2474 (α=192) with authorized balanced accuracies 0.8922 and 0.9046, respectively, while the stated constraint is 0.90; a small sampling fluctuation would move these candidates across the constraint and change the selected mechanism. Similarly, the exact zero plug-in estimates in Tables 3, 4, and 8 are computed on small held-out groups (e.g., 41 runs for NLR), and no confidence interval or resampling estimate is reported. Because the central claim of the framework is that it can rank mechanisms by leakage, the evaluation should report at least bootstrap intervals for the selected mechanisms and for near-boundary candidates.","section":"§2.2, Eqs. (10)–(13); §4.5, Table 9"},{"comment":"The coarse-execution-tier task defines Y from trace duration, and then evaluates a 'duration only' collection-time mechanism that is the same quantity used to construct Y. This makes perfect authorized verification and low sensitive leakage for that mechanism partly tautological. The paper's disclaimer that the target is a laboratory construct is appropriate, but the paragraph's conclusion that 'the post-collection path adds value' relies on comparing scalar releases against this self-referential baseline. The task should be framed only as a stress test of the selection machinery, not as independent evidence for compute-scale verification at deployment.","section":"§4.4, Table 5, DeepTheft coarse-tier task"},{"comment":"Some reported leakage values in bits are lower bounds from held-out prediction models rather than estimates of I(S;E|Y). The training-versus-inference experiment labels the raw baseline 0.6375 bits as a decoded-information lower bound, and the selected report's 0.000239 bits appears in the same table; the paper does not make explicit whether the latter is a plug-in MI over discrete bins, a decoded lower bound, or another quantity. Lower bounds cannot certify the absence of leakage, so the manuscript should distinguish between certified or measured values and decodable-information lower bounds wherever a headline number is close to zero.","section":"§2.2, Eq. (9); Fig. 2; §4.2"},{"comment":"The selection of α=192 is a point on a noisy frontier, and the two metrics used for selection do not move monotonically: α=160 has lower authorized separation D_Y but higher conditional disclosure than α=192, while authorized balanced accuracy changes non-monotonically across the sweep. The paper should report the variance of D_cond_S and held-out balanced accuracy across the outer folds, or otherwise show that the selection is stable under plausible resampling. As written, the specific claim that MID selects α=192 is not established beyond a single point estimate.","section":"§4.5, Table 9; Fig. 18"}],"minor_comments":[{"comment":"The candidate set includes q=0 as 'no quantization', but the release formulas in §3.1 (Eq. 15) and §4.4 (Eq. 25) are undefined for q=0; please specify the release rule for this candidate explicitly.","section":"§4.4, Eq. (25)"},{"comment":"The selected report has I(Y;Z)=0.9723 bits while achieving Y balanced accuracy 0.9966; a sentence explaining the relationship between the mutual-information value and the near-perfect balanced accuracy would help readers interpret the frontier.","section":"§4.2, Table 2"},{"comment":"The minimum-D_cond_S model-family candidate reports S|Y balanced accuracy 0.1419, below the six-class chance level 0.167; since values below chance can indicate model misspecification or small-sample noise, a brief comment would avoid overinterpreting the value.","section":"§4.4, Table 5"},{"comment":"The text explains that the horizontal repetition in the figure is a visualization of a scalar release, but the caption could state explicitly that the waveform-like graphic is not the actual released time series.","section":"§4.4, Figure 11"},{"comment":"The Groth16 demonstration uses a 258-constraint linear circuit, which is much simpler than the quantized, randomized, or classifier-based release rules used elsewhere in the paper; the text should state that the ZKP path is demonstrated for the linear projection only and that nonlinear mechanisms require future circuit work.","section":"§3.2, Table 7"}],"recommendation":"major_revision","confidential_remarks":"The manuscript fits the scope of a security or AI-governance venue, and I did not identify citation or novelty concerns. The main risk is the gap between the 'zero measured leakage' phrasing and the by-construction nature of those zeros; the authors can address this with reframing and additional finite-sample analysis within the scope of the current manuscript."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know. The paper gives AI verification a usable way to treat verifier-facing evidence as a design object, and it is admirably honest about the finite-sample nature of its leakage numbers. But the headline zero-leakage results are partly built into the chosen releases, not found in the data; the paper acknowledges this, and it means the \"practicality\" claim is narrower than the abstract suggests.\n\nWhat is actually new: the formulation of Eq. (1) as a mechanism-selection problem over channels, collection policies, and transformations, and the demonstration that this works on four public physical-measurement corpora. The math is standard privacy funnel plus Fano and data-processing inequalities, but the application to AI verification and the deployment story (authenticated direct release or ZKP-certified linear projection) is new. The evaluation is genuinely careful: nested held-out splits grouped by physical run, attack evaluations with the original attack code unchanged, a clear statement that zero is a measured quantity, and a nice independent Auditor-in-a-Box result showing a one-bit verdict can leak request-group information.\n\nSoft spots. The three zero-leakage cases (RL one-bit, H100 memory capacity, NLR node count) are releases that are constant within each authorized class, effectively encoding the authorized label. That is a legitimate mechanism design outcome, but it means I(S;E|Y)=0 is a property of the release rule, not an empirical discovery about the channel. The paper says as much in Sec. 4.4, and the sensitivity analysis around calibration is a good start, but there are no error bars or margins to decision boundaries for the continuous releases, and no code or processed data is released. Some of the tasks are laboratory constructs — compute tier from trace duration, static memory capacity as evidence — so the deployment claims should be read as proof-of-concept. None of this breaks the central argument, but it does mean a serious referee should ask for artifacts and explicit distinction between \"zero by construction\" and \"zero by measurement\".\n\nWho it is for: people working on compute governance, hardware attestation, and verification of AI training claims. It deserves peer review; I would recommend acceptance with major revisions requiring released artifacts and a clearer statement of what the zero-leakage results do and don't establish.","headline":"A well-executed, honestly-hedged framework for choosing verifier-facing evidence in AI verification; the zero-leakage headline is real but partly follows from the release rule by construction.","tokens_in":23445,"tokens_out":2629,"would_cite":true,"duration_ms":24540,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that privacy-preserving AI verification can be posed as choosing the verifier-facing evidence that keeps enough authorized information while minimizing additional disclosure about a declared protected property.","keywords":["minimal information disclosure","AI verification","conditional mutual information","privacy-utility frontier","side-channel evidence","zero-knowledge proof","compute governance","information-theoretic privacy"],"falsifier":"Take a MID-selected release that measured zero collateral leakage on its development groups and apply it to a new deployment where the protected workload, hardware, or input distribution differs; if an analyst can distinguish the protected classes from the released values at accuracy substantially above chance after conditioning on the authorized result, the claimed privacy guarantee fails for that deployment.","tokens_in":1759,"feed_emoji":"🔐","tokens_out":4549,"duration_ms":107937,"temperature":0.7,"pith_summary":"The paper introduces minimal information disclosure (MID), a design principle for AI verification: instead of asking what evidence exists, ask what evidence should cross the trust boundary. It formalizes the choice as constrained optimization: among deployable evidence mechanisms $m=(c,\\alpha,\\theta)$, minimize the conditional mutual information $I(S;E_m|Y)$—what the verifier-facing evidence reveals about a declared protected property $S$ after the authorized result $Y$ is known—subject to keeping enough authorized information $I(Y;E_m)$ for verification. Across six physical-measurement tasks this approach produces three releases with perfect held-out verification and zero measured collateral leakage, while the remaining tasks yield explicit privacy–utility frontiers. This matters because compliance reporting for AI compute and model claims currently limits output size, which the paper shows is not enough: a one-bit verdict can still carry measurable information about a private request group.","feed_headline":"AI verification can reveal only the verdict, not the sensitive details","feed_subtitle":"A new optimization selects evidence that proves the authorized claim while suppressing collateral leakage","key_machinery":"The central object is the conditional mutual information $I(S;E_m|Y)$, called collateral leakage, paired with the authorized-information term $I(Y;E_m)$ in the constrained minimization of Eq. (1). A mechanism $m=(c,\\alpha,\\theta)$ specifies the evidence channel, collection policy, and release transformation; the paper develops collection-time mechanisms, hard-decision and quantized reports, and privacy-aware linear projections, and it uses regularized Gaussian separation scores and plug-in mutual-information estimators to compare candidates on finite development data. This objective upper-bounds the information available to any later inference procedure through the conditional data-processing inequality, and a Groth16 zk-SNARK certifies that a released scalar is the correct projection of a private measurement.","core_discovery":"The central claim is that the privacy of AI verification is a property of the verifier-facing evidence itself, and that it can be engineered by solving the Privacy-Preserving AI Verification Problem: choose $m\\in M$ to minimize $I(S;E_m|Y)$ subject to $I(Y;E_m)\\ge\\tau_Y$. The paper asserts this is practical, because mechanism choices such as which physical channel to measure, at what rate, and what release transformation to apply can suppress collateral leakage below detectable levels on held-out data, and because a selected linear projection can be released through a Groth16 zero-knowledge proof without exposing the private measurement. It also claims that limiting the size of the report is not sufficient: on an existing one-bit verdict interface, the released decision supports inference about a protected request group with 72.4% balanced accuracy, compared with 50% without the decision.","pith_inferences":["Beyond the paper: the same selection logic should transfer to non-physical evidence such as software telemetry, network metadata, and trusted-execution attestation transcripts, making MID a general governance tool rather than a physical-side-channel method only.","Beyond the paper: because zero measured leakage is a finite-sample estimate, a deployed MID monitor would need to track distribution shift and re-run selection over time; otherwise an undeclared sensitive property could become inferable from a release that calibration found harmless.","Beyond the paper: the framing suggests a testable design rule for compute-governance agreements—publish the optimization objective and the candidate mechanism catalog, and let the privacy–utility frontier be evaluated independently, rather than fixing a one-bit report by fiat."],"forward_implications":["If the central claim is right, a verifier can declare an authorized result, a protected property, and a verification threshold, and then treat the evidence interface itself as the object to optimize rather than accepting fixed telemetry or logs.","Three of the six evaluated tasks reach the empirical ideal of perfect held-out verification with zero measured collateral leakage, showing that some policy-relevant claims can be verified without a measurable privacy penalty.","Because the objective is attack-agnostic, a release selected under MID should transfer to new inference attacks rather than requiring a separate defense for each attack.","Post-collection releases can be made certifiable: a zero-knowledge proof can convince a verifier that a released value was computed correctly from a private measurement without revealing the measurement itself.","Small output alphabets are insufficient protection: an existing one-bit audit interface is shown to leak 0.176 bits beyond the authorized answer, enough to drive a decision-only inference from 50% to 72.4% balanced accuracy."],"supporting_citations":[{"why":"Supplies the electromagnetic side-channel traces and architecture-inference attack scores used to test whether selected lower-rate releases weaken concrete attacks.","marker":"[48]"},{"why":"Supplies the power traces and attack procedure for the compute-scale tasks; replacing the input with a selected release collapses the layer-sequence and hyperparameter recovery scores.","marker":"[49]"},{"why":"Provides the facility-power workload corpus used for training-versus-inference and node-count verification tasks.","marker":"[61]"},{"why":"Provides multi-GPU telemetry for the RL-versus-non-RL and hardware-identity tasks.","marker":"[62]"},{"why":"Supplies the Groth16 zk-SNARK used to certify a post-collection linear-projection release.","marker":"[23]"},{"why":"Defines mutual information and conditional mutual information used to formulate the optimization objective and leakage measure.","marker":"[34]"},{"why":"Proposes minimal compliance reporting, motivating the need to choose what a verifier receives.","marker":"[6]"},{"why":"Describes six layers of verification for AI rules, including minimal evidence outputs that MID selects among.","marker":"[3]"},{"why":"Proposes one-bit human-assessment outputs, an example of restricted reports that MID generalizes.","marker":"[9]"},{"why":"Provides the published one-bit verdict evaluation used to show that output-size limits alone do not control disclosure.","marker":"[12]"}],"fun_headline_variants":["Minimal Info Disclosure: Prove AI verdicts without leaking secrets","Zero leakage AI verification: selective evidence with ZKP option","AI verification that shows only the verdict, hides the rest","Engineering privacy into AI verification evidence itself","New method: prove AI claims with minimal data leakage"],"cache_read_input_tokens":25472,"weakest_assumption_plain":"The load-bearing premise is that the finite, labeled, grouped development data used to calibrate MID represent the distribution the verifier will actually see, and that undeclared sensitive properties or later distribution shifts cannot create leakage the calibration did not measure.","fun_headline_variants_meta":{"raw":{"variants":["Minimal Info Disclosure: Prove AI verdicts without leaking secrets","Zero leakage AI verification: selective evidence with ZKP option","AI verification that shows only the verdict, hides the rest","Engineering privacy into AI verification evidence itself","New method: prove AI claims with minimal data leakage"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000151,"raw_usage":{"total_tokens":1185,"prompt_tokens":913,"completion_tokens":272,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":529,"completion_tokens_details":{"reasoning_tokens":195}},"tokens_in":529,"tokens_out":272,"duration_ms":2937,"temperature":1.0,"reasoning_tokens":195,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:01:04.471345+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a MID-selected release that measured zero collateral leakage on its development groups and apply it to a new deployment where the protected workload, hardware, or input distribution differs; if an analyst can distinguish the protected classes from the released values at accuracy substantially above chance after conditioning on the authorized result, the claimed privacy guarantee fails for that deployment.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the electromagnetic side-channel traces and architecture-inference attack scores used to test whether selected lower-rate releases weaken concrete attacks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides multi-GPU telemetry for the RL-versus-non-RL and hardware-identity tasks."},{"cited_title":"Harack, R","cited_arxiv_id":null,"evidence_quote":"Proposes one-bit human-assessment outputs, an example of restricted reports that MID generalizes."},{"cited_title":"Rinberg and B","cited_arxiv_id":null,"evidence_quote":"Provides the published one-bit verdict evaluation used to show that output-size limits alone do not control disclosure."}],"review_version":1}