Cove: Compositional Multi-Party Confidential Workflows for Verifiable AI Governance

Audits are a key mechanism for measuring the safety and compliance of frontier AI systems, and are increasingly mandated by emerging regulation. Conducting audits in a verifiable and privacy-preserving way, however, remains an open problem: realistic audits involve multiple mutually distrusting parties (e.g., model developers, auditors), each holding private artifacts (e.g., weights, code, and evaluation data) that they cannot reveal to one another, yet must jointly certify properties over. Trusted execution environments (TEEs) offer a promising foundation for such audits, but existing work builds a custom protocol for each audit scheme, re-establishing the chain-of-trust for every new configuration of parties, artifacts, and trust assumptions. We present Cove, a framework that instead composes attested computations into reusable multi-stage, multi-party audit workflows. We show how Cove's primitives express audit applications of increasing complexity (capability-attested inference, attested confidential benchmarks, and bilateral capability verification) and provide an open-source reference implementation on Intel TDX via Phala Cloud's dstack, demonstrating end-to-end feasibility on an attested confidential benchmark workflow. All code is open-source at https://github.com/covehub/cove.