In this section, trust means the parts of a verification system whose honest operation the verifier has to assume rather than check. There are many possibilities for where that trust can sit: on-chip, off-chip digital, off-chip analog, and hybrid. This section compares them against one verification target and weighs what each design reveals and who each design empowers.
Hardware verification can place trust inside the accelerator, in a separate digital monitor, in physical sensors, or across a hybrid design. Moving trust does not remove it.
Use one verification target for the comparison:
Verification target
Determine whether permitted workloads account for all covered compute in a declared data center.
Architecture A: On-Chip Monitoring
Possible components include device identity, secure or measured boot, signed counters, protected telemetry, workload certificates, trusted execution environments, and hardware-backed authorization.
| Strengths | Concerns |
|---|---|
| Fine-grained access to device state and activity | Trust in design, manufacturing, firmware, and key provisioning |
| Low marginal cost across a fleet after deployment | Vendor control of reference values, updates, revocation, and appraisal services |
| Evidence can travel with the device | Physical control by the prover |
| Fast or real-time response | Common-mode failure when identity, metering, classification, and licensing share one root |
| Compact, privacy-preserving outputs rather than raw workloads | Legacy and nonparticipating hardware |
| Hardware redesign and fleet-turnover time | |
| Political resistance to foreign- or vendor-controlled keys |
Current confidential-computing support on accelerators is a deployed security primitive, not proof of treaty compliance. For example, NVIDIA describes Hopper confidential computing as protecting code and data in use from the host and basic physical attacks under its stated threat model. A treaty adversary may be stronger than that threat model, and a confidential workload may still violate the treaty.
NVIDIA, NVIDIA H100 Tensor Core GPU Security — the confidential-computing whitepaper and current product documentation.
Architecture B: Off-Chip Digital Monitoring
Possible components include network taps, server or rack gateways, input/output loggers, tamper-evident enclosures, and separate secured verification computers.
| Strengths | Concerns |
|---|---|
| Clearer separation between prover hardware and verifier hardware | Visibility falls as the monitor moves farther from the computation |
| Devices can be jointly designed, inspected, or supplied | Encrypted links and large data volumes |
| Possible retrofit of existing accelerator fleets | Covert, timing, analog, and steganographic channels |
| Reduced dependence on proprietary accelerator internals | Difficulty reconstructing high-level workloads from low-level traffic |
| Installation, calibration, chain of custody, and maintenance | |
| Risk that verifier-supplied hardware enables espionage or sabotage |
Recent work has proposed fingerprinting or committing cluster input and output through external taps and secure gateways. These designs are research proposals. Their value is to make the trust-placement problem concrete, not to show that the engineering and political problems are solved.
A. Cankaya et al., Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors — arXiv:2606.10724, June 2026. Treat the architecture and implementation schedule as a research proposal.
Architecture C: Off-Chip Analog Monitoring
Possible components include independently installed power meters, thermal sensors, electromagnetic measurements, independent clocks, tamper-evident packaging, and physical inspection of the sensor boundary.
| Strengths | Concerns |
|---|---|
| A physically independent account of activity | Approximate conversion from physical signals to compute |
| Possible retrofit | Architecture- and workload-dependent signatures |
| Less dependence on proprietary firmware | Calibration, placement, uncertainty, and sensor drift |
| Evasion may require changing several physical signatures or sacrificing performance | Deliberate mimicry or masking |
| Coverage only inside instrumented facilities | |
| Dependence on inspections to preserve the measurement boundary |
A rack meter installed under treaty access belongs in this hardware section. A foreign intelligence service estimating the same site’s power use from outside the facility belongs in the intelligence section. The physical phenomenon may be similar, but the access, chain of custody, confidence, and institutional role differ.
Architecture D: Hybrid Assurance
A hybrid system might combine:
- On-chip identity and secure boot
- Hardware-rooted telemetry
- Independently installed rack-level power measurement
- Provider allocation and billing records
- Periodic physical inspection
- Intelligence comparison against declared facility capacity
- Protected human reporting channels
Count independent failure modes, not mechanism names. A signed meter, a signed classifier, and a licensing system that all depend on one vendor key provide less redundancy than their number suggests.
The Confidentiality Trade
Hardware evidence can reduce disclosure by returning a bounded claim rather than raw code, data, weights, or traces. It can also concentrate power in manufacturers, key authorities, and verifiers. A proposal should specify exactly what leaves the facility, who can link evidence across devices, sites, and time, whether the result reveals commercially sensitive utilization or topology, whether raw evidence is retained, who can query the system, how abuse is audited, and what happens when parties disagree about the verifier or reference values.
Activity: Bilateral Pilot Review
Compare a concrete on-chip design with a concrete off-chip design for the working pause rule: for on-chip, take Architecture A as built on NVIDIA's Hopper confidential computing; for off-chip, take Architecture B as proposed in Cankaya et al.'s cluster I/O fingerprinting. Answer each question for both designs, then choose one for a pilot, not immediate universal deployment.