Pith. sign in

REVIEW 5 major objections 5 minor 63 references

Privacy-Preserving AI Verification via Minimal Information Disclosure

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that privacy-preserving AI verification can be posed as choosing the verifier-facing evidence that keeps enough authorized information while minimizing additional disclosure about a declared protected property.

desk verdict A well-executed, honestly-hedged framework for choosing verifier-facing evidence in AI verification; the zero-leakage headline is real but partly follows from the release rule by construction. read the letter →

arxiv 2608.02774 v1 pith:VTN6QBCE submitted 2026-08-03 cs.CR cs.AI

Sleem Abdelghafar , Gabriel Kulp This is my paper · ORCID
classification cs.CRcs.AI
keywords minimalinformationdisclosureAIverificationconditionalmutualprivacy-utilityfrontierside-channelevidencezero-knowledgeproofcomputegovernanceinformation-theoreticprivacy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces minimal information disclosure (MID), a design principle for AI verification: instead of asking what evidence exists, ask what evidence should cross the trust boundary. It formalizes the choice as constrained optimization: among deployable evidence mechanisms $m=(c,\alpha,\theta)$, minimize the conditional mutual information $I(S;E_m|Y)$—what the verifier-facing evidence reveals about a declared protected property $S$ after the authorized result $Y$ is known—subject to keeping enough authorized information $I(Y;E_m)$ for verification. Across six physical-measurement tasks this approach produces three releases with perfect held-out verification and zero measured collateral leakage, while the remaining tasks yield explicit privacy–utility frontiers. This matters because compliance reporting for AI compute and model claims currently limits output size, which the paper shows is not enough: a one-bit verdict can still carry measurable information about a private request group.

What carries the argument

The central object is the conditional mutual information $I(S;E_m|Y)$, called collateral leakage, paired with the authorized-information term $I(Y;E_m)$ in the constrained minimization of Eq. (1). A mechanism $m=(c,\alpha,\theta)$ specifies the evidence channel, collection policy, and release transformation; the paper develops collection-time mechanisms, hard-decision and quantized reports, and privacy-aware linear projections, and it uses regularized Gaussian separation scores and plug-in mutual-information estimators to compare candidates on finite development data. This objective upper-bounds the information available to any later inference procedure through the conditional data-processing inequality, and a Groth16 zk-SNARK certifies that a released scalar is the correct projection of a private measurement.

What would settle it

Take a MID-selected release that measured zero collateral leakage on its development groups and apply it to a new deployment where the protected workload, hardware, or input distribution differs; if an analyst can distinguish the protected classes from the released values at accuracy substantially above chance after conditioning on the authorized result, the claimed privacy guarantee fails for that deployment.

Watch

Extended reading notes

Core claim

The central claim is that the privacy of AI verification is a property of the verifier-facing evidence itself, and that it can be engineered by solving the Privacy-Preserving AI Verification Problem: choose $m\in M$ to minimize $I(S;E_m|Y)$ subject to $I(Y;E_m)\ge\tau_Y$. The paper asserts this is practical, because mechanism choices such as which physical channel to measure, at what rate, and what release transformation to apply can suppress collateral leakage below detectable levels on held-out data, and because a selected linear projection can be released through a Groth16 zero-knowledge proof without exposing the private measurement. It also claims that limiting the size of the report is not sufficient: on an existing one-bit verdict interface, the released decision supports inference about a protected request group with 72.4% balanced accuracy, compared with 50% without the decision.

Load-bearing premise

The load-bearing premise is that the finite, labeled, grouped development data used to calibrate MID represent the distribution the verifier will actually see, and that undeclared sensitive properties or later distribution shifts cannot create leakage the calibration did not measure.

Editorial extensions

If this is right

  • If the central claim is right, a verifier can declare an authorized result, a protected property, and a verification threshold, and then treat the evidence interface itself as the object to optimize rather than accepting fixed telemetry or logs.
  • Three of the six evaluated tasks reach the empirical ideal of perfect held-out verification with zero measured collateral leakage, showing that some policy-relevant claims can be verified without a measurable privacy penalty.
  • Because the objective is attack-agnostic, a release selected under MID should transfer to new inference attacks rather than requiring a separate defense for each attack.
  • Post-collection releases can be made certifiable: a zero-knowledge proof can convince a verifier that a released value was computed correctly from a private measurement without revealing the measurement itself.
  • Small output alphabets are insufficient protection: an existing one-bit audit interface is shown to leak 0.176 bits beyond the authorized answer, enough to drive a decision-only inference from 50% to 72.4% balanced accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: the same selection logic should transfer to non-physical evidence such as software telemetry, network metadata, and trusted-execution attestation transcripts, making MID a general governance tool rather than a physical-side-channel method only.
  • Beyond the paper: because zero measured leakage is a finite-sample estimate, a deployed MID monitor would need to track distribution shift and re-run selection over time; otherwise an undeclared sensitive property could become inferable from a release that calibration found harmless.
  • Beyond the paper: the framing suggests a testable design rule for compute-governance agreements—publish the optimization objective and the candidate mechanism catalog, and let the privacy–utility frontier be evaluated independently, rather than fixing a one-bit report by fiat.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper introduces minimal information disclosure (MID), an information-theoretic framework for designing verifier-facing evidence in AI verification. A policy declares an authorized target Y and a protected property S, and each candidate evidence mechanism m=(c,α,θ) is evaluated by mutual information I(Y;E_m) for verification utility and conditional mutual information I(S;E_m|Y) for collateral leakage. The proposed optimization (Eq. 1) selects the deployable mechanism that minimizes leakage subject to a utility threshold. The authors prove an upper bound on any later inference procedure via the conditional data-processing inequality and connect the objective to adversary error via Fano's inequality. They describe two deployment paths: authenticated direct collection and a ZKP-certified post-collection release. The evaluation covers six tasks on four public physical-measurement datasets, reporting three selected releases with perfect held-out verification and zero measured collateral leakage (RL vs non-RL, H100 vs B200, NLR node allocation), explicit privacy–utility frontiers for the other tasks, and a Groth16 zk-SNARK implementation of a linear projection. An appendix re-analyzes Auditor-in-a-Box, showing that a one-bit valid/invalid verdict carries 0.176 bits about the request set and supports a 72.4% balanced-accuracy inference attack, motivating the framework.

Significance. If the claims hold, the paper makes a useful and timely contribution. The formulation in Eq. (1) gives AI verification a principled, attack-agnostic objective, and the conditional data-processing inequality and Fano bound correctly justify the use of conditional mutual information as a leakage measure. The evaluation is stronger than typical in this literature: nested mechanism selection with grouped outer held-out runs, fixed attack schedules for ModelSpy and DeepTheft, and a working Groth16 circuit for a selected release transformation are concrete strengths. The Auditor-in-a-Box re-analysis is a clean empirical illustration that output cardinality alone does not control disclosure. The main gap is that the three zero-leakage headline results are essentially by construction and are not accompanied by uncertainty quantification, margin analysis, or an explicit statement that the zeros are design outcomes rather than empirical discoveries. With additional finite-sample guarantees or reframing, the practicality claim could be made solid.

major comments (5)
  1. [§4.2–4.4, Tables 3, 4, 8] The three headline zero-leakage results are properties of the release rule rather than empirical discoveries. In the RL one-bit report (Eq. 23), the H100 memory-capacity report (Eq. 24), and the NLR node-count report (Eq. 25), the release is constant across sensitive classes at fixed Y on the held-out runs, so the plug-in conditional MI described in §2.2 is zero by construction. The paper acknowledges this for NLR ('the zero-leakage result follows directly from the released code'), but the abstract and introduction present 'perfect held-out verification and zero measured collateral leakage' as the main evidence of practicality. The text should state clearly that these zeros are design outcomes, and should provide a finite-sample or margin analysis—for example, bootstrap confidence intervals, worst-case near-threshold values, or an explicit description of what distribution shift would break the conditional independence. Without this, the reader cannot distinguish a robustly private mechanism from a finite-sample artifact.
  2. [§2.2, Eqs. (10)–(13); §4.5, Table 9] There is no uncertainty quantification on the estimated leakage and utility values that drive mechanism selection. In Table 9, the algorithm compares D_cond_S values 8.0075 (α=160) and 7.2474 (α=192) with authorized balanced accuracies 0.8922 and 0.9046, respectively, while the stated constraint is 0.90; a small sampling fluctuation would move these candidates across the constraint and change the selected mechanism. Similarly, the exact zero plug-in estimates in Tables 3, 4, and 8 are computed on small held-out groups (e.g., 41 runs for NLR), and no confidence interval or resampling estimate is reported. Because the central claim of the framework is that it can rank mechanisms by leakage, the evaluation should report at least bootstrap intervals for the selected mechanisms and for near-boundary candidates.
  3. [§4.4, Table 5, DeepTheft coarse-tier task] The coarse-execution-tier task defines Y from trace duration, and then evaluates a 'duration only' collection-time mechanism that is the same quantity used to construct Y. This makes perfect authorized verification and low sensitive leakage for that mechanism partly tautological. The paper's disclaimer that the target is a laboratory construct is appropriate, but the paragraph's conclusion that 'the post-collection path adds value' relies on comparing scalar releases against this self-referential baseline. The task should be framed only as a stress test of the selection machinery, not as independent evidence for compute-scale verification at deployment.
  4. [§2.2, Eq. (9); Fig. 2; §4.2] Some reported leakage values in bits are lower bounds from held-out prediction models rather than estimates of I(S;E|Y). The training-versus-inference experiment labels the raw baseline 0.6375 bits as a decoded-information lower bound, and the selected report's 0.000239 bits appears in the same table; the paper does not make explicit whether the latter is a plug-in MI over discrete bins, a decoded lower bound, or another quantity. Lower bounds cannot certify the absence of leakage, so the manuscript should distinguish between certified or measured values and decodable-information lower bounds wherever a headline number is close to zero.
  5. [§4.5, Table 9; Fig. 18] The selection of α=192 is a point on a noisy frontier, and the two metrics used for selection do not move monotonically: α=160 has lower authorized separation D_Y but higher conditional disclosure than α=192, while authorized balanced accuracy changes non-monotonically across the sweep. The paper should report the variance of D_cond_S and held-out balanced accuracy across the outer folds, or otherwise show that the selection is stable under plausible resampling. As written, the specific claim that MID selects α=192 is not established beyond a single point estimate.
minor comments (5)
  1. [§4.4, Eq. (25)] The candidate set includes q=0 as 'no quantization', but the release formulas in §3.1 (Eq. 15) and §4.4 (Eq. 25) are undefined for q=0; please specify the release rule for this candidate explicitly.
  2. [§4.2, Table 2] The selected report has I(Y;Z)=0.9723 bits while achieving Y balanced accuracy 0.9966; a sentence explaining the relationship between the mutual-information value and the near-perfect balanced accuracy would help readers interpret the frontier.
  3. [§4.4, Table 5] The minimum-D_cond_S model-family candidate reports S|Y balanced accuracy 0.1419, below the six-class chance level 0.167; since values below chance can indicate model misspecification or small-sample noise, a brief comment would avoid overinterpreting the value.
  4. [§4.4, Figure 11] The text explains that the horizontal repetition in the figure is a visualization of a scalar release, but the caption could state explicitly that the waveform-like graphic is not the actual released time series.
  5. [§3.2, Table 7] The Groth16 demonstration uses a 258-constraint linear circuit, which is much simpler than the quantized, randomized, or classifier-based release rules used elsewhere in the paper; the text should state that the ZKP path is demonstrated for the linear projection only and that nonlinear mechanisms require future circuit work.

Circularity Check

4 steps flagged · score 6.0 of 10

Headline zero-leakage results reduce to reports that equal the authorized label; DeepTheft compute-tier utility is definitional.

  1. self definitional [Sec. 4.4, 'Coarse execution tier using DeepTheft traces', Table 5]
    "We define Y from trace duration: the bottom 30% is low tier, the top 30% high tier, and the middle 40% is excluded. ... Duration can be collected directly and verifies the duration-defined compute tier perfectly."

    Y is defined as a quantile of the same trace length T_i that the 'duration only' release reports as normalized log duration, a monotone function of T_i. On the labeled data, Z and Y determine each other, so the reported YBA = 1.0000 and I(Y;Z) = 1 bit for the duration-only mechanism are identities restating the labeling rule rather than empirical verification results. The authorized-utility half of this row is therefore forced by construction; only the sensitive-leakage half is an independent empirical measurement.

  2. self definitional [Sec. 4.2, 'Reinforcement learning versus non-RL training', Eq. (23), Table 3]
    "The one-bit release is correct for every held-out session and constant across non-RL workloads: I(Y ;Z) = 1 bit, sensitive balanced accuracy is 0.25, and the held-out plug-in estimate is I(S;Z|Y = non-RL) = 0."

    The release is Z_i = 1{hat p_i >= 1/2} and is correct for every held-out session, so on the evaluation data Z = Y. For any binary report with Z = Y, the conditional distribution P(Z|S,Y) is a point mass independent of S, hence I(S;Z|Y) = 0 identically, without any estimation or privacy measurement. The zero-leakage headline for this task is therefore a mathematical consequence of perfect one-bit classification, not an independent finding about the selected channel's privacy; the only empirical content is that the selected telemetry supports perfect classification.

2 more flagged steps
  1. self definitional [Sec. 4.3, Eq. (24), Table 4]
    "The one-bit report preserves perfect chip verification and is constant across workloads within each chip."

    The report is Z_i = 0 if V_i <= b_f (H100) and Z_i = 1 if V_i > b_f (B200), and it is correct for every matched group. Since the authorized target is Y in {H100, B200}, a perfect binary report satisfies Z = Y on the evaluation data. Then S is conditionally independent of Z given Y automatically, so the reported I(S;Z|Y) = 0 and BA = 0.5000 are forced by the release rule being equal to the label. The same zero would hold for any measurement that classifies the chip perfectly, regardless of whether it encodes workload information; the empirical discovery is only that reported memory capacity separates chips.

  2. self definitional [Sec. 4.4, 'Declared node allocation on NLR', Eq. (25), Figure 16]
    "Figure 16 shows that the zero-leakage result follows directly from the released code. Each node allocation maps to a distinct value, so the verifier recovers the complete authorized allocation. Within each fixed node count, however, Llama-2 LoRA and Stable Diffusion map to exactly the same value."

    The paper itself states that the zero value follows from the release rule. Once the deterministic quantized report Z = round(log2 mean power - b) maps each node count Y to a distinct code and maps both workloads to the same code within each Y, Z is, on the evaluation data, a function of Y alone. I(S;Z|Y) = 0 is then an identity for conditional mutual information rather than an estimated quantity, and I(Y;Z) = 1.9952 bits is a restatement that the codes are distinct for each authorized class. This is a transparent acknowledgment, but it means the headline zero is not an independent empirical finding about workload privacy.

full rationale

The general MID objective in Eq. (1) is a stated policy choice -- minimize conditional mutual information about S beyond Y subject to verification utility -- and it is not derived from the paper's own results. The nonzero frontiers (training-versus-inference, the ModelSpy downsampling sweep, and the DeepTheft scalar projections) are genuine empirical measurements, and the ModelSpy/DeepTheft attack evaluations are meaningful because they keep the attack fixed and replace only the evidence. The paper is also honest about finite-sample estimation and explicitly says in Sec. 4.4 that one zero-leakage result follows directly from the released code. However, the three headline claims of 'perfect held-out verification and zero measured collateral leakage' all use discrete releases that are, on the evaluation data, perfect predictors of the authorized label. For a discrete release with Z = Y, conditional mutual information I(S;Z|Y) is zero by definition, so these zeros do not establish a privacy property beyond accuracy. In addition, the DeepTheft compute-tier task defines Y from trace duration and then reports the duration-only release as achieving perfect utility, which restates the labeling rule. These constructions make the headline practicality claim partially circular, even though the framework itself retains independent content. Score 6 reflects that one or more headline predictions reduce by construction while the central formulation and the nonzero frontier experiments remain independent.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim depends on standard information-theoretic inequalities, a Gaussian modeling assumption for the finite-sample scores, the authenticity of the evidence source, and the representativeness of the calibration data. The mechanism parameters (quantization widths, noise scales, thresholds, downsampling rates) are selected on development data; they are reported rather than hidden, but they are fitted values rather than derived predictions.

free parameters (6)
  • Training/inference quantizer width and noise (q, sigma) = q=0.05, sigma=0.15 (Table 2)
    Selected by grid search on the development set to minimize estimated leakage; reported as mechanism parameters rather than derived from the objective.
  • H100/B200 memory-capacity threshold b_f = Per-fold midpoint between max H100 and min B200 training capacities
    Fitted on the training fold and applied to the held-out fold; the evidence is a static hardware attribute.
  • NLR quantizer offset b and width q = b=0.134, q=1, sigma=0 (Eq. 25); per-fold offsets 0.1329 to 0.1778
    Selected to minimize conditional workload leakage subject to node-count accuracy; the offset is fitted on training data.
  • DeepTheft projection regularization beta and noise sigma = beta from 3 to 1000, sigma from 0.0 to 1.0 depending on task (Table 5)
    Grid-selected per sensitive target in the linear-projection mechanism of Eqs. (16)-(19).
  • ModelSpy downsampling factor alpha = alpha=192
    Selected as the candidate with lowest D_cond_S among those with Y balanced accuracy at least 0.90 (Table 9).
  • Regularization gamma and lambda for separability scores = gamma >= 0 in Eq. (10); lambda in Eq. (18)
    Stabilize covariance inversion and the projection; values are not reported but affect mechanism ranking.
assumptions (5)
  • standard math Data-processing inequality and Fano's inequality bound downstream inference.
    Used in Eq. (7) and the Fano bound in Sec. 2.2 to claim the leakage objective upper-bounds any adversary.
  • domain assumption Shared-covariance Gaussian model for separation scores.
    Eqs. (10)-(13) translate Bayes accuracy into Mahalanobis distance under a balanced binary shared-covariance model; used for candidate comparison.
  • domain assumption Authenticated evidence source binds evidence to the execution.
    Sec. 2.1 threat model states that MID assumes the integrity layer operates according to its stated security assumptions; required for any verification claim.
  • domain assumption Development distribution represents deployment and policy declares all sensitive targets.
    Secs. 2.1-2.2: MID is calibrated on grouped, labeled executions and the policy setter specifies S before selection.
  • domain assumption Groth16 zk-SNARK soundness and zero-knowledge under cryptographic assumptions.
    Sec. 3.2: computational guarantee for a computationally bounded verifier, with circuit-specific setup requirements.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Privacy-Preserving AI Verification via Minimal Information Disclosure." pith.science (2026). https://pith.science/paper/VTN6QBCE

@misc{pith2026260802774,
  author       = {Pith},
  title        = {Pith review of: Privacy-Preserving AI Verification via Minimal Information Disclosure},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VTN6QBCE}},
  note         = {Machine review of arXiv:2608.02774}
}
read the original abstract

AI verification crosses a trust boundary: a verifier must learn enough to establish an authorized claim, yet the same evidence can reveal sensitive details about the model, workload, or hardware. We introduce minimal information disclosure (MID), which designs and quantifies the information content of verifier-facing evidence itself. MID measures collateral leakage with conditional mutual information: what the release reveals about the protected property after the authorized result is known. MID is general by design: it can accommodate different verification goals, protected properties, evidence sources, and deployment constraints. To demonstrate MID's practicality, we evaluate it on four physical measurements and six verification tasks spanning execution type, hardware identity, compute scale, and model identity. These experiments use three mechanism-design variables--the evidence channel, collection policy, and release transformation--but MID is not limited to these choices and can accommodate other deployable mechanisms. Across these tasks, MID produces three releases with perfect held-out verification and zero measured collateral leakage, while the remaining tasks yield explicit privacy--utility frontiers. MID also supports ZKP-certified releases: we demonstrate our proposed linear-projection mechanism using a Groth16 zk-SNARK.

Figures

Figures reproduced from arXiv: 2608.02774 by the authors.

Figure 1
Figure 1. MID mechanism design and deployment. For an AI execution, a policy specifies an authorized target Y , a sensitive target S, and candidate evidence mechanisms m = (c, α, θ). Information-theoretic optimization selects m⋆ to retain authorized information while minimizing additional information about S. Deployment then either releases the selected collection-time measurement directly or keeps the measurement private and… view at source ↗
Figure 2
Figure 2. Training-versus-inference information frontier. The selected report retains 0.9723 bits of authorized information while reducing measured conditional leakage from a raw-evidence lower bound of 0.6375 bits to 0.000239 bits. Its position near the upper-left ideal shows that MID removes workload information without making the evidence uninformative for verification. Released MID value Randomized quantized MID report Tr… view at source ↗
Figure 3
Figure 3. Training-versus-inference evidence before and after MID. The selected randomized report retains separated, multi-bin distributions for the authorized classes. 12 [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (16 more)
Figure 4
Figure 4. Figure 4: Conditional workload evidence. The top row fixes training and compares Llama-2 LoRA with Stable Diffusion; the bottom row fixes inference and compares InstructCoder with MLPerf. Raw trace features distinguish each sensitive pair, whereas the selected report makes the c…
Figure 5
Figure 5. Figure 5: RL-versus-non-RL information frontier across telemetry-channel mechanisms. Every colored candidate is a one-bit RL-status report, yet several have nonzero exact-workload leakage. On the held-out sessions, the selected GPU-utilization report retains one bit of authorize…
Figure 6
Figure 6. Figure 6: RL-versus-non-RL held-out verification evidence and the selected one-bit report. The left panel shows a classifier score (log-odds) computed from rich telemetry; the right panel shows the released RL/non-RL bit. 14 [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 7
Figure 7. Figure 7: Exact-workload evidence at fixed non-RL. Raw telemetry identifies forecasting, image captioning, image classification, and text generation; MID releases the same non-RL result for all four workloads. 4.3 Hardware Identity We next apply MID to hardware identity: whether…
Figure 8
Figure 8. Figure 8: H100-versus-B200 information frontier. Each candidate uses a different telemetry channel or channel family. The experiment shows that MID can choose what to measure, not only how to alter a fixed measurement. chip-identity information, but only the dynamic telemetry ex…
Figure 9
Figure 9. Figure 9: H100-versus-B200 verification before and after MID. The left panel visualizes the multivariate raw telemetry with a held-out log-odds score; the right panel shows the actual one-bit hardware report. Both rich telemetry and the selected one-bit capacity report identify …
Figure 10
Figure 10. Figure 10: Conditional diffusion-versus-LLM evidence within each authorized chip. Rich telemetry distinguishes the workloads, while both workloads induce the same MID released chip result, hence zero leakage. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: One execution from the DeepTheft dataset before and after release design. We treat model family and architecture as separate sensitive targets and design a release for each. The first sensitive target contains six model families, Sfamily ∈ {custom net, custom net bn, …
Figure 12
Figure 12. Figure 12: DeepTheft evidence grouped by authorized compute tier. The duration and scalar releases preserve the low-versus-high distinction after removing the detailed waveform [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: DeepTheft model-family evidence within fixed compute tier. Raw trace features contain strong family-separating directions. Duration reduces but does not eliminate that structure; the family-targeted scalar moves conditional inference close to six-class chance. In the …
Figure 14
Figure 14. Figure 14: NLR node-allocation information frontier. On the held-out runs, the selected quantized report retains all available node-count information and has numerically zero measured conditional workload information. −20 −10 0 10 20 Global multiplicative power-calibration error…
Figure 15
Figure 15. Figure 15: Robustness of the selected node-count report to global power-calibration error. Verification remains perfect from −15.5% to +18.5% error, showing that the low-information discrete release does not depend on exact power calibration within this interval. 23 [PITH_FULL_…
Figure 16
Figure 16. Figure 16: NLR node-allocation evidence. The MID-selected report retains four non-overlapping node codes. At each fixed node count, Llama-2 LoRA and Stable Diffusion induce the same released value, hence zero leakage. We simulate lower-rate collection by retaining every α-th rec…
Figure 17
Figure 17. Figure 17: Representative ModelSpy EM evidence at the raw rate and selected lower-rate factor α = 192. The selected collection policy retains the coarse activity pattern used for model-type verification while avoiding most of the fine temporal detail exploited for architecture i…
Figure 18
Figure 18. Figure 18: Authorized CNN-versus-Transformer evidence before and after lower-rate collection. The selected α = 192 mechanism retains sufficient class separation to meet the verification requirement, so its privacy improvement is not obtained by making the evidence useless for mo…
Figure 19
Figure 19. Figure 19: Protected layer-signature evidence for the five most frequent layer signatures at fixed Y = CNN. Lower-rate acquisition makes the signature distributions substantially more overlapping, consistent with the reduction in ModelSpy’s layer and hyperparameter attack scores…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

63 extracted references · 38 canonical work pages

  1. [1]

    Pacing the frontier

    Pacing the Frontier. Pacing the frontier. July 2026.https://www.pacingthefrontier.com

    work page 2026

  2. [2]

    O’Gara, G

    A. O’Gara, G. Kulp, W. Hodgkins, J. Petrie, V. Immler, A. Aysu, K. Basu, S. Bhasin, S. Picek, and A. Srivastava. Hardware-enabled mechanisms for verifying responsible AI development. arXiv:2505.03742, 2025

    arXiv 2025

  3. [3]

    Baker, G

    M. Baker, G. Kulp, O. Marks, M. Brundage, and L. Heim. Verifying international agreements on AI: Six layers of verification for rules on large-scale AI development and deployment. arXiv:2507.15916, 2025

    arXiv 2025

  4. [4]

    Petrie, O

    J. Petrie, O. Aarne, N. Ammann, and D. Dalrymple. Flexible hardware-enabled guarantees for AI compute. arXiv:2506.15093, 2025

    arXiv 2025

  5. [5]

    Reuel, B

    A. Reuel, B. Bucknall, et al. Open problems in technical AI governance.Transactions on Machine Learning Research, 2025

    work page 2025

  6. [6]

    Sastry, L

    G. Sastry, L. Heim, H. Belfield, et al. Computing power and the governance of artificial intelligence. arXiv:2402.08797, 2024

    arXiv 2024

  7. [7]

    Y. Shavit. What does it take to catch a Chinchilla? Verifying rules on large-scale neural network training via compute monitoring. arXiv:2303.11341, 2023

    arXiv 2023

  8. [8]

    N. Cankaya. A system overview for near-term, low-trust AI compute verification. MIRI Technical Governance Team Working Paper, 2026. https://techgov.intelligence.org/research/a-system-overview-for-n ear-term-low-trust-ai-compute-verification

    work page 2026

Show all 63 references
  1. [9]

    Harack, R

    B. Harack, R. F. Trager, A. Reuel, et al. Verification for international AI governance. Oxford Martin AI Governance Initiative, 2025. https://www.oxfordmartin.ox.ac.uk/publications/verification-for-i nternational-ai-governance

    2025

  2. [10]

    Rowstron

    A. Rowstron. Agentic Witnessing: Pragmatic and scalable TEE-enabled privacy-preserving auditing. arXiv:2604.24203, 2026

    2026 arXiv

  3. [11]

    Penchas, G

    B. Penchas, G. Zhao, and R. Rinberg. Enabling verifiably-scoped monitoring through large language models and trusted compute. InICML Workshop on Technical AI Governance Research, 2026. https: //openreview.net/forum?id=AWZJq6O7Cj

    2026

  4. [12]

    Rinberg and B

    R. Rinberg and B. Penchas. Auditor-in-a-Box: Tools for third-party auditing. LessWrong, July 2026. https://www.lesswrong.com/posts/uWYk7MM9hAf9GEbGe/auditor-in-a-box-tools-for-third-party -auditing

    2026

  5. [13]

    Scher and L

    A. Scher and L. Thiergart. Mechanisms to verify international agreements about AI development. arXiv:2506.15867, 2025

    2025 arXiv

  6. [14]

    Aarne, T

    O. Aarne, T. Fist, and C. Withers. Secure, governable chips: Using on-chip mechanisms to manage national security risks from AI and advanced computing. Center for a New American Security, 2024

    2024

  7. [15]

    S. Ansari. Hardware-level governance of AI compute: A feasibility taxonomy for regulatory compliance and treaty verification. arXiv:2604.04712, 2026

    2026 arXiv

  8. [16]

    J. Petrie. Guaranteeable Memory: An HBM-based chiplet for verifiable AI workloads. ICML Workshop on Technical AI Governance, 2025.https://openreview.net/forum?id=uc79kOv0MV

    2025

  9. [17]

    N. Cankaya. Bit-exact AI inference verification without performance tradeoffs. arXiv:2606.00279, 2026

    2026 arXiv

  10. [18]

    Karvonen, D

    A. Karvonen, D. Reuter, R. Rinberg, L. Marks, A. Garriga-Alonso, and K. Warr. DiFR: Inference verification despite nondeterminism. arXiv:2511.20621, 2025

    2025

  11. [19]

    Rinberg, A

    R. Rinberg, A. Karvonen, A. Hoover, D. Reuter, and K. Warr. Verifying LLM inference to detect model weight exfiltration. arXiv:2511.02620, 2025. 30

    2025

  12. [20]

    Petrie and Y

    J. Petrie and Y. M¨ uhlh¨ auser. Verifying AI compute by bounding unexplained information exfiltration. ICML Workshop on Technical AI Governance Research, 2026.https://openreview.net/forum?id=qtgG5HZSsk

    2026

  13. [21]

    Trask, E

    A. Trask, E. Bluemke, B. Garfinkel, C. G. Cuervas-Mons, and A. Dafoe. Beyond privacy trade-offs with structured transparency. arXiv:2012.08347, 2020

    2012 arXiv

  14. [22]

    South, A

    T. South, A. Camuto, S. Jain, S. Nguyen, R. Mahari, C. Paquin, J. Morton, and A. Pentland. Verifiable evaluations of machine learning models using zkSNARKs. arXiv:2402.02675, 2024

    2024 arXiv

  15. [23]

    J. Groth. On the size of pairing-based non-interactive arguments. InAdvances in Cryptology—EUROCRYPT 2016, volume 9666 ofLecture Notes in Computer Science, pages 305–326. Springer, 2016. DOI: 10.1007/978- 3-662-49896-5 11

    2016 doi

  16. [24]

    Circom: A circuit compiler for zero-knowledge proving systems

    iden3. Circom: A circuit compiler for zero-knowledge proving systems. https://github.com/iden3/circom

  17. [25]

    snarkjs: A zk-SNARK implementation in JavaScript and WebAssembly

    iden3. snarkjs: A zk-SNARK implementation in JavaScript and WebAssembly. https://github.com/iden3 /snarkjs

  18. [26]

    Chantasantitam, A

    P. Chantasantitam, A. I. Caulfield, V. Duddu, L. J. Gunn, and N. Asokan. PAL*M: Property attestation for large generative models. arXiv:2601.16199, 2026

    2026 arXiv

  19. [27]

    Rahman and S

    R. Rahman and S. Tajdari. Detecting hidden ML training with zero-overhead telemetry. arXiv:2606.19262, 2026

    2026 arXiv

  20. [28]

    S. K. Monfared, F. Ganji, D. E. Holcomb, and S. Tajik. Timing and memory telemetry on GPUs for AI governance. arXiv:2602.09369, 2026

    2026

  21. [29]

    H. Xu, C. Gong, B. Liu, H. Zheng, B. Chen, and M. Li. WAVE: Leveraging architecture observation for privacy-preserving model oversight. InProceedings of the 31st ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pag...

    2026

  22. [30]

    Almusaddar, Y

    G. Almusaddar, Y. Zhang, S. Ganjisaffar, B. Williams, Y. D. Liu, D. Ponomarev, and N. Abu-Ghazaleh. ShadowScope: GPU monitoring and validation via composable side channel signals. arXiv:2509.00300, 2025

    2025 arXiv

  23. [31]

    Gregersen, P

    T. Gregersen, P. Patel, and E. Choukse. Input-dependent power usage in GPUs. arXiv:2409.18324, 2024

    2024 arXiv

  24. [32]

    C. Fang, H. Jia, A. Thudi, M. Yaghini, C. A. Choquette-Choo, N. Dullerud, V. Chandrasekaran, and N. Papernot. Proof-of-learning is currently more broken than you think. InIEEE European Symposium on Security and Privacy, pages 797–816, 2023

    2023

  25. [33]

    Peign´ e, K

    P. Peign´ e, K. Nguyen, and P. Wang. Zero knowledge verification for frontier AI training is possible. arXiv:2606.05433, 2026

    2026 arXiv

  26. [34]

    T. M. Cover and J. A. Thomas.Elements of Information Theory. Wiley, 2nd edition, 2006

    2006

  27. [35]

    Tishby, F

    N. Tishby, F. C. Pereira, and W. Bialek. The information bottleneck method. InProceedings of the 37th Annual Allerton Conference on Communication, Control, and Computing, 1999

    1999

  28. [36]

    Makhdoumi, S

    A. Makhdoumi, S. Salamatian, N. Fawaz, and M. M´ edard. From the information bottleneck to the privacy funnel. InIEEE Information Theory Workshop, 2014

    2014

  29. [37]

    Sankar, S

    L. Sankar, S. R. Rajagopalan, and H. V. Poor. Utility–privacy tradeoffs in databases: An information-theoretic approach.IEEE Transactions on Information Forensics and Security, 8(6):838–852, 2013

    2013

  30. [38]

    Y. Wang, Y. O. Basciftci, and P. Ishwar. Privacy–utility tradeoffs under constrained data release mechanisms. arXiv:1710.09295, 2017

    2017 arXiv

  31. [39]

    J. Liao, O. Kosut, L. Sankar, and F. P. Calmon. Tunable measures for information leakage and applications to privacy–utility tradeoffs.IEEE Transactions on Information Theory, 65(12):8043–8066, 2019

    2019

  32. [40]

    W. Li, A. Halimi, J. Vaidya, X. Jiang, and E. Ayday. Privacy-preserving verification of ML preprocessing via model behavior indicators.IEEE Transactions on Privacy, 2:144–158, 2025. https://doi.org/10.1109/TP .2025.3628998

    2025

  33. [41]

    Waiwitlikhit, I

    S. Waiwitlikhit, I. Stoica, Y. Sun, T. Hashimoto, and D. Kang. Trustless audits without revealing data or models. InProceedings of the 41st International Conference on Machine Learning, pages 49808–49821, 2024. 31

    2024

  34. [42]

    H. Jia, M. Yaghini, C. A. Choquette-Choo, N. Dullerud, A. Thudi, V. Chandrasekaran, and N. Papernot. Proof-of-learning: Definitions and practice. InIEEE Symposium on Security and Privacy, pages 1039–1056,

  35. [43]

    D. Choi, Y. Shavit, and D. K. Duvenaud. Tools for verifying neural models’ training data. InAdvances in Neural Information Processing Systems 36, 2023

    2023

  36. [44]

    Schnabl, D

    C. Schnabl, D. Hugenroth, B. Marino, and A. R. Beresford. Attestable audits: Verifiable AI safety benchmarks using trusted execution environments. arXiv:2506.23706, 2025

    2025 arXiv

  37. [45]

    J. M. Ong, M. Di Ferrante, A. Pazdera, R. Garner, S. Jaghouar, M. Basra, M. Ryabinin, and J. Hagemann. TOPLOC: A locality-sensitive hashing scheme for trustless verifiable inference. InProceedings of the 42nd International Conference on Machine Learning, pages 47196–47211, 2025

    2025

  38. [46]

    Horv´ ath, D

    P. Horv´ ath, D. Lauret, Z. Liu, and L. Batina. SoK: Neural network extraction through physical side channels. In33rd USENIX Security Symposium, 2024

    2024

  39. [47]

    Debenedetti, G

    E. Debenedetti, G. Severi, N. Carlini, C. A. Choquette-Choo, M. Jagielski, M. Nasr, E. Wallace, and F. Tram` er. Privacy side channels in machine learning systems. In33rd USENIX Security Symposium, 2024

    2024

  40. [48]

    R. Xiao, S. Feng, S. Ramesh, Jun Han, and Jinsong Han. Peering inside the black-box: Long-range and scalable model architecture snooping via GPU electromagnetic side-channel. InNDSS Symposium, 2026. DOI: 10.14722/ndss.2026.230141

    2026

  41. [49]

    Y. Gao, H. Qiu, Z. Zhang, B. Wang, H. Ma, A. Abuadbba, M. Xue, A. Fu, and S. Nepal. DeepTheft: Stealing DNN model architectures through power side channel. InIEEE Symposium on Security and Privacy, pages 3311–3326, 2024. DOI: 10.1109/SP54263.2024.00250

    2024

  42. [50]

    H. T. Maia, C. Xiao, D. Li, E. Grinspun, and C. Zheng. Can one hear the shape of a neural network? Snooping the GPU via magnetic side channel. In31st USENIX Security Symposium, pages 4383–4400, 2022

    2022

  43. [51]

    Shokri, M

    R. Shokri, M. Stronati, C. Song, and V. Shmatikov. Membership inference attacks against machine learning models. InIEEE Symposium on Security and Privacy, pages 3–18, 2017

    2017

  44. [52]

    S. Yeom, I. Giacomelli, M. Fredrikson, and S. Jha. Privacy risk in machine learning: Analyzing the connection to overfitting. InIEEE Computer Security Foundations Symposium, pages 268–282, 2018

    2018

  45. [53]

    M. Nasr, R. Shokri, and A. Houmansadr. Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning. InIEEE Symposium on Security and Privacy, pages 739–753, 2019

    2019

  46. [54]

    Song and P

    L. Song and P. Mittal. Systematic evaluation of privacy risks of machine learning models. In30th USENIX Security Symposium, pages 2615–2632, 2021

    2021

  47. [55]

    Carlini, S

    N. Carlini, S. Chien, M. Nasr, S. Song, A. Terzis, and F. Tram` er. Membership inference attacks from first principles. InIEEE Symposium on Security and Privacy, 2022

    2022

  48. [56]

    Get involved in verification

    AI Futures Project. Get involved in verification. July 9, 2026. https://ai-2040.com/supplements/verifi cation-plan/get-involved

    2026

  49. [57]

    General-purpose AI models in the AI Act: Questions and answers

    European Commission. General-purpose AI models in the AI Act: Questions and answers. Updated September 9, 2025. https://digital-strategy.ec.europa.eu/en/faqs/general-purpose-ai-models-ai-act-que stions-answers

    2025

  50. [58]

    Bengio et al

    Y. Bengio et al. International AI Safety Report 2026. UK Department for Science, Innovation and Technology, Research Series DSIT 2026/001, February 3, 2026. arXiv:2602.21012

    2026

  51. [59]

    DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning.Nature, 645:633–638, 2025

    DeepSeek-AI et al. DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning.Nature, 645:633–638, 2025. DOI: 10.1038/s41586-025-09422-z

    2025 doi

  52. [60]

    Department of Commerce, Bureau of Industry and Security

    U.S. Department of Commerce, Bureau of Industry and Security. Policy statement on controls that may apply to advanced computing integrated circuits and other commodities used to train AI models. 2025. https://www.bis.gov/media/1577. 32

    2025

  53. [61]

    Vercellino, J

    R. Vercellino, J. Willard, G. Campos, W. da Silva Pereira, O. Hull, M. Selensky, and J. Mueller. Dataset of generative AI workload power profiles. National Laboratory of the Rockies Data Catalog, 2026. DOI: 10.7799/3025227

    2026 doi

  54. [62]

    A. A. E. Elsayed, A. A. Al-Obaidi, and H. E. Z. Farag. Characterization of high-resolution AI data center training workloads on single and multiple GPU nodes.Scientific Data, published online June 3, 2026. DOI: 10.1038/s41597-026-07496-6. 33

    2026 doi

  55. [2021]

    DOI: 10.1109/SP40001.2021.00106

    2021

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.