Attestation
Cryptographic verification that an AI system or model has not been tampered with.
Attestation is the process of cryptographically verifying that a system, model, or dataset is in a known, trusted state and has not been maliciously or inadvertently altered. In practice, a trusted entity — often backed by secure hardware such as a Trusted Platform Module (TPM) or a confidential computing enclave — generates a signed report describing the current state of the system. Any party receiving that report can verify the signature and confirm that the software stack, model weights, or data pipeline match an expected, approved configuration. Attestation can occur locally (self-attestation) or across a network (remote attestation), and typically relies on public-key cryptography, hash chains, and hardware root-of-trust mechanisms.
In machine learning, attestation has grown in importance as models are deployed in sensitive or regulated environments — healthcare inference APIs, financial decision systems, federated learning networks, and edge AI devices. Without attestation, a downstream consumer of a model's predictions has no reliable way to confirm that the model running in a cloud enclave or on a remote device is the exact version that was audited and approved. Confidential computing frameworks such as Intel TDX, AMD SEV, and NVIDIA's Hopper confidential GPU extensions now expose attestation APIs specifically designed to cover GPU workloads and model execution, making it feasible to attest not just the host OS but the ML runtime itself.
Attestation is a foundational building block for broader trustworthy AI goals, including model provenance, supply-chain security, and regulatory compliance. It complements techniques like differential privacy and watermarking by providing infrastructure-level assurance rather than algorithmic guarantees. As AI governance frameworks increasingly demand auditability and tamper-evidence — from the EU AI Act to NIST's AI Risk Management Framework — attestation is becoming a practical engineering requirement rather than a niche security concern, particularly in multi-party or federated settings where no single organization controls the full compute stack.
