Verifying AI Compute by Bounding Unexplained Information Exfiltration

We propose an architecture for verifying AI compute agreements by bounding the amount of unexplained information in network outputs, without requiring either party to trust the other's hardware. Prover compute nodes are isolated so that all traffic passes through a verifier interlock, which records cryptographic commitments of the encrypted traffic. The verifier periodically challenges the prover to demonstrate that a randomly selected output is well-predicted by a policy-compliant computation on the measured inputs. The better a compliant computation can predict each output token, the less bandwidth remains for exfiltrating results from undeclared workloads. We present three confidentiality-preserving approaches to perform the recomputation: prover recomputation inside a verifier-controlled enclosure, verifier recomputation inside a prover-controlled enclosure, and zero-knowledge proofs. We describe the architecture, protocol, potential attacks, and sketch a plan to prototype this system.