> Some proposals to regulate and pace AI development rely on monitoring hardware and how it is used. For example, a provider might be required to devote its hardware to inference rather than to training a powerful new model. The provider might try to cheat by serving cheaper models or using compute in an unexpected way, freeing up resources for training. How can a regulator reliably ensure that the hardware is used for inference?

Is this even a real problem? Forcing a company to only do inference?

Sounds like Anthropic's dream scenario

Very cool. Now prove you are unable to read chat transcripts with provable end to end encryption down to the CPU registers and TPM endorsement chain of the software involved.

Provable privacy via remote attestation effectively gives you provable inference for free.

What are the tradeoffs of an approach like this vs confidential computing primitives and attesting everything from untampered hardware all the way up to the served request? It seems more performant. Is it simply that they would have to reveal too much?

> A user querying a model today cannot check that the responses came from the specific model that a developer claims is responding

Indeed, I wonder what kind of developer would make users worry about that...? Funny PR stunt coming from a company that was in the news for silently routing ML-related requests to an inferior model.

https://fortune.com/2026/06/10/anthropic-accu-claude-fable-5...

> Unlike Fable’s other restrictions, such as around cybersecurity and biology, which openly redirect users to a less powerful model with a visible notification, the system card emphasized that this is “not visible to the user.” The model still responds, but uses “interventions to limit Claude’s effectiveness” without telling the user it’s doing so.

"The commitment to the model, and subsequent inference proofs, hide the weights of the model; hiding the architecture of the model is not a goal of this system."

Your Claude is showing.

isn't model substitution a vendor accountability thing? and token tampering, is that not infra security?

do either of these need 70-95x the GPU time in "zksnark" proofs?

already solved provable inference with encrypted chats on trustedrouter (using TEEs which most people don’t know about)

What a great way to enforce a (still hypothetical) open models ban

[flagged]