# The Verification Field ## The corpus’s most cited work, Sastry et al. (February 2024), appears in the references of at least 32 of the 100 works published after it. The corpus is 158 works on verifying AI compute and governing it through hardware, dated 2016 to October 2026. The 100 works published after Sastry et al., by topic - Cites it · 32 - Reference list not read · 7 - Does not cite it · 61 Foundations: 7 of 10 cite it; 3 do not. Hardware-enabled mechanisms: 8 of 16 cite it; 7 do not; 1 reference list was not read. Location verification: 0 of 4 cite it; 4 do not. Workload and training verification: 6 of 31 cite it; 22 do not; 3 reference lists were not read. International agreements and inspection: 10 of 16 cite it; 6 do not. Confidential computing: 0 of 17 cite it; 15 do not; 2 reference lists were not read. Security analyses: 1 of 6 cites it; 4 do not; 1 reference list was not read. WorkHwang 2018 · Computational Power and the Social Impact of Artificial IntelligenceDafoe 2018 · AI Governance: A Research AgendaBrundage et al. 2020 · Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable ClaimsKhan and Mann 2020 · AI Chips: What They Are and Why They MatterTrask et al. 2020 · Beyond Privacy Trade-offs with Structured TransparencyWhittlestone and Clark 2021 · Why and How Governments Should Monitor AI DevelopmentAvin et al. 2021 · Filling gaps in trustworthy development of AISevilla et al. 2022 · Compute Trends Across Three Eras of Machine LearningShavit 2023 · What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute MonitoringAnderljung et al. 2023 · Frontier AI Regulation: Managing Emerging Risks to Public SafetyEgan and Heim 2023 · Oversight for Frontier AI through a Know-Your-Customer Scheme for Compute ProvidersPilz and Heim 2023 · Compute at Scale: A Broad Investigation into the Data Center IndustryPilz et al. 2023 · Increased Compute Efficiency and the Diffusion of AI CapabilitiesSastry et al. 2024 · Computing Power and the Governance of Artificial IntelligenceHeim et al. 2024 · Governing Through the Cloud: The Intermediary Role of Compute Providers in AI RegulationHeim and Koessler 2024 · Training Compute Thresholds: Features and Functions in AI RegulationHooker 2024 · On the Limitations of Compute Thresholds as a Governance StrategyReuel et al. 2024 · Open Problems in Technical AI GovernanceErdil and Besiroglu 2024 · Introducing the LLM distributed training simulatorPistillo and Villalobos 2025 · Defending Compute Thresholds Against Legal LoopholesCasper et al. 2025 · Practical Principles for AI Cost and Compute AccountingPilz et al. 2025 · Trends in AI SupercomputersBarnett 2025 · Compute Requirements for Algorithmic Innovation in Frontier AI ModelsBrundage et al. 2026 · Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI CompaniesAllen et al. 2022 · Improved Export Controls Enforcement Technology Needed for U.S. National SecurityGrunewald and Aird 2023 · AI Chip Smuggling into China: Potential Paths, Quantities, and CountermeasuresFist and Grunewald 2023 · Preventing AI Chip Smuggling to ChinaAarne et al. 2024 · Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced ComputingKulp et al. 2024 · Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090Petrie 2024 · Near-Term Enforcement of AI Chip Export Controls Using A Firmware-Based Design for Offline LicensingClifford et al. 2024 · Locking Machine Learning Models into HardwarePetrie et al. 2024 · Interim Report: Mechanisms for Flexible Hardware-Enabled GuaranteesGupta et al. 2024 · Whack-a-Chip: The Futility of Hardware-Centric Export ControlsFist et al. 2024 · Technology to Secure the AI Chip Supply Chain: A Working PaperO’Gara et al. 2025 · Hardware-Enabled Mechanisms for Verifying Responsible AI DevelopmentPetrie et al. 2025 · Flexible Hardware-Enabled Guarantees for AI ComputePetrie and Aarne 2025 · Part II: Technical Options for Flexible Hardware-Enabled GuaranteesAarne and Petrie 2025 · Part III: International Security Applications of Flexible Hardware-Enabled GuaranteesGrunewald and Fist 2025 · Countering AI Chip Smuggling Has Become a National Security Priority: An Updated Playbook for Preventing AI Chip Smuggling to the PRCKulp et al. 2025 · Insights from a Workshop on Hardware-Enabled Governance MechanismsReber 2025 · No Backdoors. No Kill Switches. No Spyware.Ammann and Dalrymple 2025 · Faster AI Diffusion Through Hardware-Based VerificationAarne and Grunewald 2026 · Export Auditors as Market-Powered Export EnforcementAnsari 2026 · Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty VerificationAvellar and Grunewald 2026 · Near-Term Verification Methods for AI Chip ExportsBrass and Aarne 2024 · Location Verification for AI ChipsBrass 2025 · Location Verification for AI Chips (issue brief)Tee and Happel 2026 · GPU Fingerprinting for Location VerificationFeldgoise et al. 2026 · Tracking AI Chips: Assessing Location Verification as an Export Control Enforcement ToolGhodsi et al. 2017 · SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted CloudJia et al. 2021 · Proof-of-Learning: Definitions and PracticeWeng et al. 2021 · Mystique: Efficient Conversions for Zero-Knowledge Proofs with Applications to Machine LearningZhang et al. 2021 · “Adversarial Examples” for Proof-of-LearningLiu et al. 2021 · zkCNN: Zero Knowledge Proofs for Convolutional Neural Network Predictions and AccuracyTang et al. 2022 · The MIT Supercloud Workload Classification ChallengeFang et al. 2022 · Proof-of-Learning is Currently More Broken Than You ThinkKang et al. 2022 · Scaling up Trustless DNN Inference with Zero-Knowledge ProofsChoi et al. 2023 · Tools for Verifying Neural Models’ Training DataSun et al. 2023 · zkDL: Efficient Zero-Knowledge Proofs of Deep Learning TrainingGarg et al. 2023 · Experimenting with Zero-Knowledge Proofs of TrainingSouth et al. 2024 · Verifiable evaluations of machine learning models using zkSNARKsSrivastava et al. 2024 · Optimistic Verifiable Training by Controlling Hardware NondeterminismWaiwitlikhit et al. 2024 · Trustless Audits without Revealing Data or ModelsChen et al. 2024 · ZKML: An Optimizing System for ML Inference in Zero-Knowledge ProofsSun et al. 2024 · zkLLM: Zero Knowledge Proofs for Large Language ModelsSun et al. 2024 · SVIP: Towards Verifiable Inference of Open-source Large Language ModelsZhang et al. 2024 · Hardware and Software Platform InferenceAbbaszadeh et al. 2024 · Zero-Knowledge Proofs of Training for Deep Neural NetworksTan et al. 2025 · Founding Zero-Knowledge Proofs of Training on Optimum VicinityOng et al. 2025 · TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable InferencePeng et al. 2025 · A Survey of Zero-Knowledge Proof Based Verifiable Machine LearningArun et al. 2025 · Verde: Verification via Refereed Delegation for Machine Learning ProgramsAlmusaddar et al. 2025 · ShadowScope: GPU Monitoring and Validation via Composable Side Channel SignalsRinberg et al. 2025 · Verifying LLM Inference to Detect Model Weight ExfiltrationKarvonen et al. 2025 · DiFR: Inference Verification Despite NondeterminismNVIDIA Newsroom 2025 · Opt-In NVIDIA Software Enables Data Center Fleet ManagementMonfared et al. 2026 · Timing and Memory Telemetry on GPUs for AI GovernancePal et al. 2026 · Privacy-Preserving Mechanisms Enable Cheap Verifiable Inference of LLMsCankaya 2026 · Bit-Exact AI Inference Verification Without Performance TradeoffsPeigné et al. 2026 · Zero knowledge verification for frontier AI training is possibleCankaya et al. 2026 · Fingerprinting All AI Cluster I/O Without Mutually Trusted ProcessorsRahman and Tajdari 2026 · Detecting Hidden ML Training With Zero-Overhead TelemetrySu et al. 2026 · OVIG: Optimistic Verification of AI Training Integrity via Gradient SignalsAlpay and Alpay 2026 · Unprivileged Topology Certificates for Cloud GPU AttestationCankaya 2026 · A System Overview for Near-Term, Low-Trust AI Compute VerificationScher et al. 2026 · De-risking Interconnect Limits for AI VerificationAbdelghafar and Kulp 2026 · Privacy-Preserving AI Verification via Minimal Information DisclosureWilding et al. 2026 · Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM VerificationGargiulo and Kulp 2026 · Workload Identification with Physical Side Channels for AI GovernanceAnsari 2026 · Beyond Training: A Feasibility Taxonomy for Inference-Time AI GovernanceDonaghy et al. 2026 · OPEN-1B: A Fully Auditable Training RunKimpson et al. 2026 · Can Power Draw Constrain Covert Compute? Limits of Analogue Verification for AI GovernanceMittelsteadt 2021 · AI Verification: Mechanisms to Ensure AI Arms Control ComplianceScharre and Lamberth 2022 · Artificial Intelligence and Arms ControlBaker 2023 · Nuclear Arms Control Verification and Lessons for AI TreatiesHo et al. 2023 · International Institutions for Advanced AIShoker et al. 2023 · Confidence-Building Measures for Artificial Intelligence: Workshop ProceedingsTrager et al. 2023 · International Governance of Civilian AI: A Jurisdictional Certification ApproachHausenloy et al. 2023 · Multinational AGI Consortium (MAGIC): A Proposal for International Coordination on AIMiotti 2023 · An international treaty to implement a global compute cap for advanced artificial intelligenceWasil et al. 2024 · Verification methods for international AI agreementsWasil et al. 2024 · Governing dual-use technologies: Case studies of international security agreements and lessons for AI governanceScher and Thiergart 2024 · Mechanisms to Verify International Agreements About AI DevelopmentHendrycks et al. 2025 · Superintelligence Strategy: Expert VersionScholefield et al. 2025 · International Agreements on AI Safety: Review and Recommendations for a Conditional AI Safety TreatyBucknall et al. 2025 · In Which Areas of Technical AI Safety Could Geopolitical Rivals Cooperate?Barnett and Scher 2025 · AI Governance to Avoid Extinction: The Strategic Landscape and Actionable Research QuestionsAl Ramiah et al. 2025 · Toward a Global Regime for Compute Governance: Building the Pause ButtonHarack et al. 2025 · Verification for International AI GovernanceBelfield 2025 · Domestic frontier AI regulation, an IAEA for AI, an NPT for AI, and a US-led Allied Public-Private Partnership for AI: Four institutions for governing and developing frontier AIBarnett et al. 2025 · Technical Requirements for Halting Dangerous AI ActivitiesBaker et al. 2025 · Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and DeploymentScher et al. 2025 · An International Agreement to Prevent the Premature Creation of Artificial SuperintelligenceKoopmanschap and Barten 2026 · How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI AgreementsScher 2026 · Verifying Restrictions on Frontier AI ResearchTeague et al. 2026 · Could Underwater Data Centers Pose a Risk to AI Treaty Verification?Costan and Devadas 2016 · Intel SGX ExplainedTramèr and Boneh 2018 · Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted HardwareVolos et al. 2018 · Graviton: Trusted Execution Environments on GPUsJang et al. 2019 · Heterogeneous Isolated Execution for Commodity GPUsZhu et al. 2019 · Enabling Rack-scale Confidential Computing using Heterogeneous Trusted Execution EnvironmentHunt et al. 2020 · Telekine: Secure Computing with Cloud GPUsVaswani et al. 2022 · Confidential Machine Learning within Graphcore IPUsMo et al. 2022 · Machine Learning with Confidential Computing: A Systematization of KnowledgeIvanov et al. 2022 · SAGE: Software-based Attestation for GPU ExecutionJiang et al. 2022 · CRONUS: Fault-isolated, Secure and High-performance Heterogeneous Computing for Trusted Execution EnvironmentDeng et al. 2022 · StrongBox: A GPU TEE on Arm EndpointsBluemke et al. 2023 · Exploring the Relevance of Data Privacy-Enhancing Technologies for AI Governance Use CasesSridhara et al. 2023 · ACAI: Protecting Accelerator Execution with Arm Confidential Computing ArchitectureMai et al. 2023 · Honeycomb: Secure and Efficient GPU Executions via Static ValidationNertney 2023 · Confidential Compute on NVIDIA Hopper H100 (WP-11459-001 v1.0)Apsey et al. 2023 · Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AIDhanuskodi et al. 2023 · Creating the First Confidential GPUsFuture of Life Institute 2023 · Exploration of secure hardware solutions for safe AI deploymentDuddu et al. 2024 · Laminator: Verifiable ML Property Cards using Hardware-assisted AttestationsWang et al. 2024 · CAGE: Complementing Arm CCA with GPU ExtensionsDhar et al. 2024 · Ascend-CC: Confidential Computing on Heterogeneous NPU for Emerging Generative AI WorkloadsWang and Oswald 2024 · Confidential Computing on Heterogeneous CPU-GPU Systems: Survey and Future DirectionsZhu et al. 2024 · Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark StudyWang et al. 2024 · Fastrack: Fast IO for Secure ML using GPU TEEsTan et al. 2024 · PipeLLM: Fast and Confidential Large Language Model Services with Speculative Pipelined EncryptionLee et al. 2025 · Characterization of GPU TEE Overheads in Distributed Data Parallel ML TrainingFan et al. 2025 · XpuTEE: A High-Performance and Practical Heterogeneous Trusted Execution Environment for GPUsPattern Labs and Anthropic 2025 · Confidential Inference Systems: Design principles and security risks (Version 1.0)Schnabl et al. 2025 · Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution EnvironmentsGu et al. 2025 · Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential ComputingWang et al. 2025 · ccAI: A Compatible and Confidential System for AI ComputingChantasantitam et al. 2026 · PAL\*M: Property Attestation for Large Generative ModelsPark et al. 2026 · SCALE: Tackling Communication Bottlenecks in Confidential Distributed Machine LearningThijsman et al. 2026 · Two-Way Confidential VMs (2cVM): Collaborative Confidential Computing for Mutually Distrustful PartiesLindenmeier et al. 2026 · WarpGuard: Towards Control-Flow Attestation for Heterogeneous CPU-GPU ExecutionAsad and Grunseid 2026 · Benchmarking Confidential Computing Performance on NVIDIA Blackwell GPUsNevo et al. 2024 · Securing AI Model Weights: Preventing Theft and Misuse of Frontier ModelsLong 2024 · Protocol Learning, Decentralized Frontier Risk and the No-Off ProblemKryś et al. 2025 · Distributed and Decentralised Training: Technical Governance Challenges in a Shifting AI LandscapeGrunewald and Asher Brass Gershovich 2025 · Accelerating AI Data Center SecurityChuang et al. 2025 · TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus InterpositionRahman 2026 · Does Distributed Training Undermine Compute Governance? - Sastry et al. 2024, selected - Works it cites · 20 - Works citing it · 35 - Cites it and is cited by it · 2 (counted in each) - Not linked to it · 104 - Cited by 0, 10 or 35 works in the corpus - 2016 to 2021, each year at a quarter of the width Chains of citations Foundations #### [Computing Power and the Governance of Artificial Intelligence](https://arxiv.org/abs/2402.08797) Girish Sastry, Lennart Heim, Haydn Belfield and 16 others All 19 authors Girish Sastry, Lennart Heim, Haydn Belfield, Markus Anderljung, Miles Brundage, Julian Hazell, Cullen O’Keefe, Gillian K. Hadfield, Richard Ngo, Konstantin Pilz, George Gor, Emma Bluemke, Sarah Shoker, Janet Egan, Robert F. Trager, Shahar Avin, Adrian Weller, Yoshua Bengio and Diane Coyle 13 Feb 2024 · arXiv Argues that compute is an effective point of AI governance (detectable, excludable, quantifiable, with a concentrated supply chain) and maps how it can support visibility, allocation and enforcement, including through on-chip licensing. Cited by at least 35 works in the corpus: 32 of them among the 100 published after it, and 3 dated before it, 2 of which it cites in turn. Through chains of citations it reaches back to at least 38 works, and at least 64 of the 100 works published after it reach back to it. Citations in OpenAlex OpenAlex, an open index of scholarly works, lists at least 22 works citing it, read 7 October 2026. Its index includes works in this corpus and undercounts citations to preprints and think-tank reports, so its count is a lower bound. [Its OpenAlex record](https://openalex.org/W4391835521) [Sources register](https://scrutica.com/verification/sources#sastry) Works it cites (20) - Hwang 2018Computational Power and the Social Impact of Artificial Intelligence - Dafoe 2018AI Governance: A Research Agenda - Brundage et al. 2020Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims - Khan and Mann 2020AI Chips: What They Are and Why They Matter - Trask et al. 2020Beyond Privacy Trade-offs with Structured Transparency - Jia et al. 2021Proof-of-Learning: Definitions and Practice - Sevilla et al. 2022Compute Trends Across Three Eras of Machine Learning - Allen et al. 2022Improved Export Controls Enforcement Technology Needed for U.S. National Security - Bluemke et al. 2023Exploring the Relevance of Data Privacy-Enhancing Technologies for AI Governance Use Cases - Shavit 2023What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring - Baker 2023Nuclear Arms Control Verification and Lessons for AI Treaties - Anderljung et al. 2023Frontier AI Regulation: Managing Emerging Risks to Public Safety - Ho et al. 2023International Institutions for Advanced AI - Shoker et al. 2023Confidence-Building Measures for Artificial Intelligence: Workshop Proceedings - Grunewald and Aird 2023AI Chip Smuggling into China: Potential Paths, Quantities, and Countermeasures - Hausenloy et al. 2023Multinational AGI Consortium (MAGIC): A Proposal for International Coordination on AI - Egan and Heim 2023Oversight for Frontier AI through a Know-Your-Customer Scheme for Compute Providers - Fist and Grunewald 2023Preventing AI Chip Smuggling to China - Pilz and Heim 2023Compute at Scale: A Broad Investigation into the Data Center Industry - Pilz et al. 2023Increased Compute Efficiency and the Diffusion of AI Capabilities Works citing it (35) - Shavit 2023What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoringdated before it; cited as forthcoming - Ho et al. 2023International Institutions for Advanced AIdated before it; cites an undated pre-publication version whose author list begins with Brundage - Aarne et al. 2024Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced Computingdated before it; cited as forthcoming - Heim et al. 2024Governing Through the Cloud: The Intermediary Role of Compute Providers in AI Regulation - Heim and Koessler 2024Training Compute Thresholds: Features and Functions in AI Regulation - Reuel et al. 2024Open Problems in Technical AI Governance - Wasil et al. 2024Verification methods for international AI agreements - Scher and Thiergart 2024Mechanisms to Verify International Agreements About AI Development - Fist et al. 2024Technology to Secure the AI Chip Supply Chain: A Working Paper - Casper et al. 2025Practical Principles for AI Cost and Compute Accounting - Scholefield et al. 2025International Agreements on AI Safety: Review and Recommendations for a Conditional AI Safety Treaty - O’Gara et al. 2025Hardware-Enabled Mechanisms for Verifying Responsible AI Development - Petrie et al. 2025Flexible Hardware-Enabled Guarantees for AI Compute - Petrie and Aarne 2025Part II: Technical Options for Flexible Hardware-Enabled Guarantees - Bucknall et al. 2025In Which Areas of Technical AI Safety Could Geopolitical Rivals Cooperate? - Pilz et al. 2025Trends in AI Supercomputers - Barnett and Scher 2025AI Governance to Avoid Extinction: The Strategic Landscape and Actionable Research Questions - Grunewald and Fist 2025Countering AI Chip Smuggling Has Become a National Security Priority: An Updated Playbook for Preventing AI Chip Smuggling to the PRC - Kulp et al. 2025Insights from a Workshop on Hardware-Enabled Governance Mechanisms - Harack et al. 2025Verification for International AI Governance - Belfield 2025Domestic frontier AI regulation, an IAEA for AI, an NPT for AI, and a US-led Allied Public-Private Partnership for AI: Four institutions for governing and developing frontier AI - Kryś et al. 2025Distributed and Decentralised Training: Technical Governance Challenges in a Shifting AI Landscape - Barnett 2025Compute Requirements for Algorithmic Innovation in Frontier AI Models - Barnett et al. 2025Technical Requirements for Halting Dangerous AI Activities - Baker et al. 2025Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment - Brundage et al. 2026Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies - Monfared et al. 2026Timing and Memory Telemetry on GPUs for AI Governance - Aarne and Grunewald 2026Export Auditors as Market-Powered Export Enforcement - Ansari 2026Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty Verification - Cankaya et al. 2026Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors - Koopmanschap and Barten 2026How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI Agreements - Rahman and Tajdari 2026Detecting Hidden ML Training With Zero-Overhead Telemetry - Abdelghafar and Kulp 2026Privacy-Preserving AI Verification via Minimal Information Disclosure - Ansari 2026Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance - Kimpson et al. 2026Can Power Draw Constrain Covert Compute? Limits of Analogue Verification for AI Governance How the map is drawn (7) - Each work belongs to one of seven topics, decided by the first subject its record lists. Some topics gather several subjects: Foundations also takes compute accounting and cloud know-your-customer; Hardware-enabled mechanisms also takes flexible hardware-enabled guarantees, offline licensing, chip registries and export controls; Workload and training verification also takes proof of learning and zero-knowledge machine learning; Confidential computing also takes GPU trusted execution. - A work is dated by its first public version, the three parts of the flexHEG series by the dates on their covers; one dated only to a month or a year is drawn at the middle of it. - A line can run from a work to one dated after it: the citing work lists it as forthcoming, or its reference list was read from a later version of itself, or it cites an earlier version of the cited work (a preprint or a web copy) that came before the date this corpus gives it. The lists of the works it cites and the works citing it give each such citation’s own note where its record has one. - Before 2022 a year takes a quarter of the width of a later one, since 19 of the 158 works are dated earlier; the shaded band and the break on the axis mark where the scale changes. - A circle’s area grows with the works in the corpus that cite it, from the smallest, for none, to the largest, for 35. The newest works have had the least time to be cited: 19 of the 31 dated 2026 have no citation in the corpus yet. - The plate names the selected work and the ten works cited most often within the corpus (the earlier, where two are cited equally often), each inside its own topic and clear of the other marks and the topic names; a name set apart from its mark has a line to it, and a name with no such place is left off (the legend above the map names the selected work as well). A name on a work the selection is not linked to is set in grey. On a phone, a name the window shows only in part appears once the map is moved. - A line is drawn where the cited work appears in the citing work’s own reference list, notes or linked endnotes, or in OpenAlex’s record of the citing work alone. OpenAlex undercounts citations to preprints and think-tank reports, so for a work whose reference list could not be read, the lines drawn from it are a lower bound on what it cites. An organisation appears in each area of work where one of its documented activities falls. OrganisationChoose an organisationAMDAmodo DesignAnjunaAppleArmAttestableAWSConfident SecurityEarendilEdgeless SystemsEQTY LabEZKLFortanixGensynGoogleIntelLagrangeLucid ComputingMicrosoftMithril SecurityNEAR AINVIDIAOPAQUE SystemsPhalaSilicon DataSuper ProtocolTamperSecTinfoilUlysseanCaliptraCHIPS AllianceConfidential Computing ConsortiumDMTFIETF RATSOpen Compute ProjectPCI-SIGTCGVeraisonAI Futures ProjectApplied crypto group, Stanford UniversityAVERICentre for Future GenerationsCleverHans Lab, University of TorontoCNASCOMPASS Lab, SUSTechCSETCSISDavid Duvenaud’s lab, University of TorontoExistential Risk ObservatoryFAR.AIFASRGovAIIAPSIFPIntelligence Security LaboratoriesMATSMIRI Technical Governance TeamNetwork Security Group, ETH ZurichOpenMined FoundationOxford Martin AI Governance InitiativeRANDSafeAI Lab, University of WaterlooSASHSecure & Trustworthy Systems Group, ETH ZurichSecure Systems Group (Waterloo, KTH, Aalto)Shahin Tajik’s lab, Worcester Polytechnic InstituteVerifiable Compute FoundationARIACoefficient GivingCyberspace Administration of ChinaFuture of Life InstituteLongview PhilanthropySFF - Companies · 29 - Standards and consortia · 9 - Research · 29 - Government and funders · 6 Silicon root of trust 16 organisations: 8 companies; 4 standards bodies and consortia; 2 research organisations and university groups; 2 government agencies and funders Firmware and attestation 21 organisations: 9 companies; 8 standards bodies and consortia; 4 government agencies and funders Confidential computing 35 organisations: 21 companies; 3 standards bodies and consortia; 9 research organisations and university groups; 2 government agencies and funders Location verification 8 organisations: 1 company; 6 research organisations and university groups; 1 government agency or funder Usage accounting 16 organisations: 6 companies; 8 research organisations and university groups; 2 government agencies and funders Workload verification 36 organisations: 17 companies; 16 research organisations and university groups; 3 government agencies and funders Inspection and audit 22 organisations: 8 companies; 1 standards body or consortium; 10 research organisations and university groups; 3 government agencies and funders Spanning the areas above Standards 14 organisations, spanning the areas above: 7 companies; 6 standards bodies and consortia; 1 research organisation or university group Policy and law 24 organisations, spanning the areas above: 4 companies; 1 standards body or consortium; 15 research organisations and university groups; 4 government agencies and funders Research synthesis 16 organisations, spanning the areas above: 2 companies; 13 research organisations and university groups; 1 government agency or funder 73 organisations appear 208 times across the ten areas of work. Choose an area of work to list its organisations, or an organisation to read its record. All 73 organisations, by area of work (208 entries) Names run alphabetically within each kind. Silicon root of trust16 AMD  Apple  AWS  Earendil  Google  Microsoft  NVIDIA  TamperSec Caliptra  CHIPS Alliance  Open Compute Project  TCG FASR  Oxford Martin AI Governance Initiative Coefficient Giving  Longview Philanthropy Firmware and attestation21 AMD  Amodo Design  Arm  AWS  Google  Intel  Lucid Computing  Microsoft  NVIDIA Caliptra  Confidential Computing Consortium  DMTF  IETF RATS  Open Compute Project  PCI-SIG  TCG  Veraison ARIA  Future of Life Institute  Longview Philanthropy  SFF Confidential computing35 AMD  Anjuna  Apple  Arm  AWS  Confident Security  Edgeless Systems  EQTY Lab  Fortanix  Google  Intel  Lucid Computing  Microsoft  Mithril Security  NEAR AI  NVIDIA  OPAQUE Systems  Phala  Super Protocol  Tinfoil  Ulyssean Confidential Computing Consortium  PCI-SIG  Veraison AVERI  COMPASS Lab, SUSTech  FAR.AI  IFP  Network Security Group, ETH Zurich  OpenMined Foundation  Secure & Trustworthy Systems Group, ETH Zurich  Secure Systems Group (Waterloo, KTH, Aalto)  Verifiable Compute Foundation Future of Life Institute  Longview Philanthropy Location verification8 Lucid Computing CNAS  CSET  CSIS  IAPS  IFP  RAND Longview Philanthropy Usage accounting16 Amodo Design  Attestable  Lucid Computing  Mithril Security  NVIDIA  Ulyssean GovAI  IAPS  Intelligence Security Laboratories  MATS  MIRI Technical Governance Team  RAND  Shahin Tajik’s lab, Worcester Polytechnic Institute  Verifiable Compute Foundation Longview Philanthropy  SFF Workload verification36 Amodo Design  Apple  Attestable  AWS  EQTY Lab  EZKL  Gensyn  Google  Lagrange  Lucid Computing  Microsoft  Mithril Security  NEAR AI  OPAQUE Systems  Phala  Tinfoil  Ulyssean Applied crypto group, Stanford University  CleverHans Lab, University of Toronto  David Duvenaud’s lab, University of Toronto  FAR.AI  FASR  GovAI  IFP  Intelligence Security Laboratories  MATS  MIRI Technical Governance Team  Network Security Group, ETH Zurich  Oxford Martin AI Governance Initiative  SafeAI Lab, University of Waterloo  SASH  Secure Systems Group (Waterloo, KTH, Aalto)  Verifiable Compute Foundation Future of Life Institute  Longview Philanthropy  SFF Inspection and audit22 Amodo Design  Apple  Earendil  EQTY Lab  Lucid Computing  Silicon Data  TamperSec  Ulyssean Open Compute Project AVERI  CNAS  CSET  IAPS  MATS  MIRI Technical Governance Team  OpenMined Foundation  Oxford Martin AI Governance Initiative  RAND  Verifiable Compute Foundation ARIA  Coefficient Giving  Longview Philanthropy Spanning the areas above Standards14 AMD  Arm  Confident Security  Intel  Lucid Computing  Microsoft  Ulyssean Confidential Computing Consortium  DMTF  IETF RATS  Open Compute Project  PCI-SIG  TCG AVERI Policy and law24 Amodo Design  Attestable  NVIDIA  Ulyssean Confidential Computing Consortium AI Futures Project  AVERI  Centre for Future Generations  CNAS  CSET  CSIS  Existential Risk Observatory  FAR.AI  GovAI  IAPS  IFP  MIRI Technical Governance Team  Oxford Martin AI Governance Initiative  RAND  SASH Coefficient Giving  Cyberspace Administration of China  Future of Life Institute  SFF Research synthesis16 Amodo Design  Lucid Computing AI Futures Project  Centre for Future Generations  CNAS  Existential Risk Observatory  FAR.AI  FASR  GovAI  IAPS  Intelligence Security Laboratories  MIRI Technical Governance Team  Oxford Martin AI Governance Initiative  RAND  SASH ARIA TopicAll topics, 158 worksFoundations, 24Hardware-enabled mechanisms, 21Location verification, 4Workload and training verification, 43International agreements and inspection, 24Confidential computing, 36Security analyses, 6 | Work | Date | Topic | Cites | Cited by | Show on the map | | --- | --- | --- | --- | --- | --- | | [Can Power Draw Constrain Covert Compute? Limits of Analogue Verification for AI Governance](https://arxiv.org/abs/2610.07476)Kimpson et al. · arXiv | 5 Oct 2026 | Workload and training verification | cites 13 | cited by 0 | Show on the map | | [Could Underwater Data Centers Pose a Risk to AI Treaty Verification?](https://arxiv.org/abs/2609.18824)Teague et al. · arXiv | 16 Sep 2026 | International agreements and inspection | cites 2 | cited by 0 | Show on the map | | [OPEN-1B: A Fully Auditable Training Run](https://arxiv.org/abs/2609.17380)Donaghy et al. · arXiv | 15 Sep 2026 | Workload and training verification | cites 4 | cited by 0 | Show on the map | | [Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance](https://arxiv.org/abs/2609.10105)Ansari · arXiv[Sources register](https://scrutica.com/verification/sources#ansari-inference-2026) | 9 Sep 2026 | Workload and training verification | cites 17 | cited by 0 | Show on the map | | [Tracking AI Chips: Assessing Location Verification as an Export Control Enforcement Tool](https://cset.georgetown.edu/publication/tracking-ai-chips/)Feldgoise et al. · Center for Security and Emerging Technology (Issue Brief)[Sources register](https://scrutica.com/verification/sources#cset-tracking) | Sep 2026 | Location verification | cites 9 | cited by 0 | Show on the map | | [Workload Identification with Physical Side Channels for AI Governance](https://arxiv.org/abs/2609.00309)Gargiulo and Kulp · arXiv | 31 Aug 2026 | Workload and training verification | cites 9 | cited by 0 | Show on the map | | [Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification](https://arxiv.org/abs/2608.27954)Wilding et al. · arXiv | 28 Aug 2026 | Workload and training verification | cites 2 | cited by 0 | Show on the map | | [Benchmarking Confidential Computing Performance on NVIDIA Blackwell GPUs](https://arxiv.org/abs/2608.26575)Asad and Grunseid · arXiv | 27 Aug 2026 | Confidential computing | cites 1 | cited by 0 | Show on the map | The other 150 works | Work | Date | Topic | Cites | Cited by | Show on the map | | --- | --- | --- | --- | --- | --- | | [Near-Term Verification Methods for AI Chip Exports](https://arxiv.org/abs/2609.07637)Avellar and Grunewald · Institute for AI Policy and Strategy[Sources register](https://scrutica.com/verification/sources#avellar-grunewald-2026) | 19 Aug 2026 | Hardware-enabled mechanisms | cites 6 | cited by 1 | Show on the map | | [Privacy-Preserving AI Verification via Minimal Information Disclosure](https://arxiv.org/abs/2608.02774)Abdelghafar and Kulp · arXiv | 3 Aug 2026 | Workload and training verification | cites 27 | cited by 0 | Show on the map | | [De-risking Interconnect Limits for AI Verification](https://techgov.intelligence.org/blog/de-risking-interconnect-limits-for-ai-verification)Scher et al. · MIRI Technical Governance Team blog[Sources register](https://scrutica.com/verification/sources#interconnect-limits-2026) | 30 Jul 2026 | Workload and training verification | cites 10 | cited by 0 | Show on the map | | [WarpGuard: Towards Control-Flow Attestation for Heterogeneous CPU-GPU Execution](https://arxiv.org/abs/2607.13640)Lindenmeier et al. · arXiv | 15 Jul 2026 | Confidential computing | cites 3 | cited by 0 | Show on the map | | [Verifying Restrictions on Frontier AI Research](https://arxiv.org/abs/2606.28694)Scher · ICML 2026 TAIGR workshop (per its arXiv record) | 27 Jun 2026 | International agreements and inspection | cites 18 | cited by 0 | Show on the map | | [A System Overview for Near-Term, Low-Trust AI Compute Verification](https://techgov.intelligence.org/research/a-system-overview-for-near-term-low-trust-ai-compute-verification)Cankaya · MIRI Technical Governance Team (working paper)[Sources register](https://scrutica.com/verification/sources#cankaya-2026) | 23 Jun 2026 | Workload and training verification | cites 4 | cited by 1 | Show on the map | | [Unprivileged Topology Certificates for Cloud GPU Attestation](https://arxiv.org/abs/2606.24934)Alpay and Alpay · arXiv | 22 Jun 2026 | Workload and training verification | cites 4 | cited by 0 | Show on the map | | [OVIG: Optimistic Verification of AI Training Integrity via Gradient Signals](https://arxiv.org/abs/2606.21045)Su et al. · arXiv | 19 Jun 2026 | Workload and training verification | cites 7 | cited by 0 | Show on the map | | [Detecting Hidden ML Training With Zero-Overhead Telemetry](https://arxiv.org/abs/2606.19262)Rahman and Tajdari · ICML 2026 TAIGR workshop (per its arXiv record)[Sources register](https://scrutica.com/verification/sources#rahman-tajdari-telemetry) | 17 Jun 2026 | Workload and training verification | cites 15 | cited by 5 | Show on the map | | [How to Catch a GPU: A Taxonomy of Verification and Enforcement Mechanisms for International AI Agreements](https://arxiv.org/abs/2607.22619)Koopmanschap and Barten · International Conference on Large-Scale AI Risks 2026, KU Leuven (per its arXiv record)[Sources register](https://scrutica.com/verification/sources#koopmanschap-barten-2026) | 16 Jun 2026 | International agreements and inspection | cites 16 | cited by 0 | Show on the map | | [Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors](https://arxiv.org/abs/2606.10724)Cankaya et al. · arXiv | 9 Jun 2026 | Workload and training verification | cites 8 | cited by 3 | Show on the map | | [Two-Way Confidential VMs (2cVM): Collaborative Confidential Computing for Mutually Distrustful Parties](https://arxiv.org/abs/2606.10615)Thijsman et al. · IEEE Access (accepted, per its arXiv record) | 9 Jun 2026 | Confidential computing | cites 1 | cited by 0 | Show on the map | | [Zero knowledge verification for frontier AI training is possible](https://arxiv.org/abs/2606.05433)Peigné et al. · arXiv | 3 Jun 2026 | Workload and training verification | cites 10 | cited by 1 | Show on the map | | [Bit-Exact AI Inference Verification Without Performance Tradeoffs](https://arxiv.org/abs/2606.00279)Cankaya · ICML 2026 TAIGR workshop (per its arXiv record) | 29 May 2026 | Workload and training verification | cites 8 | cited by 2 | Show on the map | | [Does Distributed Training Undermine Compute Governance?](https://arxiv.org/abs/2605.29359)Rahman · ICML 2026 TAIGR workshop (per its arXiv record)[Sources register](https://scrutica.com/verification/sources#rahman-distributed) | 28 May 2026 | Security analyses | cites 9 | cited by 1 | Show on the map | | [GPU Fingerprinting for Location Verification](https://arxiv.org/abs/2605.01930)Tee and Happel · arXiv[Sources register](https://scrutica.com/verification/sources#tee-happel-2026) | 3 May 2026 | Location verification | cites 2 | cited by 0 | Show on the map | | [Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty Verification](https://arxiv.org/abs/2604.04712)Ansari · arXiv[Sources register](https://scrutica.com/verification/sources#ansari-2026) | 6 Apr 2026 | Hardware-enabled mechanisms | cites 23 | cited by 3 | Show on the map | | [Export Auditors as Market-Powered Export Enforcement](https://www.iaps.ai/research/export-auditors-as-market-powered-export-enforcement)Aarne and Grunewald · Institute for AI Policy and Strategy (working paper) | 20 Mar 2026 | Hardware-enabled mechanisms | cites 4 | cited by 2 | Show on the map | | [Privacy-Preserving Mechanisms Enable Cheap Verifiable Inference of LLMs](https://arxiv.org/abs/2602.17223)Pal et al. · arXiv | 19 Feb 2026 | Workload and training verification | cites 3 | cited by 0 | Show on the map | | [Timing and Memory Telemetry on GPUs for AI Governance](https://arxiv.org/abs/2602.09369)Monfared et al. · arXiv | 10 Feb 2026 | Workload and training verification | cites 14 | cited by 4 | Show on the map | | [SCALE: Tackling Communication Bottlenecks in Confidential Distributed Machine Learning](https://doi.org/10.1109/HPCA68181.2026.11408582)Park et al. · IEEE HPCA 2026 | 31 Jan 2026 | Confidential computing | cites at least 4 | cited by 0 | Show on the map | | [PAL\*M: Property Attestation for Large Generative Models](https://arxiv.org/abs/2601.16199)Chantasantitam et al. · arXiv | 22 Jan 2026 | Confidential computing | cites 12 | cited by 2 | Show on the map | | [Frontier AI Auditing: Toward Rigorous Third-Party Assessment of Safety and Security Practices at Leading AI Companies](https://arxiv.org/abs/2601.11699)Brundage et al. · arXiv | 16 Jan 2026 | Foundations | cites 11 | cited by 2 | Show on the map | | [Opt-In NVIDIA Software Enables Data Center Fleet Management](https://blogs.nvidia.com/blog/optional-data-center-fleet-management-software/)NVIDIA Newsroom · NVIDIA Blog | 10 Dec 2025 | Workload and training verification | cites 1 | cited by 2 | Show on the map | | [DiFR: Inference Verification Despite Nondeterminism](https://arxiv.org/abs/2511.20621)Karvonen et al. · arXiv | 25 Nov 2025 | Workload and training verification | cites 3 | cited by 6 | Show on the map | | [An International Agreement to Prevent the Premature Creation of Artificial Superintelligence](https://arxiv.org/abs/2511.10783)Scher et al. · arXiv[Sources register](https://scrutica.com/verification/sources#miri-draft-v3) | 13 Nov 2025 | International agreements and inspection | cites 14 | cited by 7 | Show on the map | | [Verifying LLM Inference to Detect Model Weight Exfiltration](https://arxiv.org/abs/2511.02620)Rinberg et al. · arXiv | 4 Nov 2025 | Workload and training verification | cites 4 | cited by 5 | Show on the map | | [TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition](https://tee.fail/)Chuang et al. · IEEE Symposium on Security and Privacy 2026 | 28 Oct 2025 | Security analyses | cites 2 | cited by 4 | Show on the map | | [ccAI: A Compatible and Confidential System for AI Computing](https://doi.org/10.1145/3725843.3756104)Wang et al. · ACM MICRO 2025 | 17 Oct 2025 | Confidential computing | cites 13 | cited by 0 | Show on the map | | [Accelerating AI Data Center Security](https://www.iaps.ai/research/accelerating-ai-data-center-security)Grunewald and Asher Brass Gershovich · Institute for AI Policy and Strategy | 9 Sep 2025 | Security analyses | cites 3 | cited by 0 | Show on the map | | [ShadowScope: GPU Monitoring and Validation via Composable Side Channel Signals](https://arxiv.org/abs/2509.00300)Almusaddar et al. · arXiv | 30 Aug 2025 | Workload and training verification | cites 4 | cited by 3 | Show on the map | | [Faster AI Diffusion Through Hardware-Based Verification](https://ifp.org/faster-ai-diffusion-through-hardware-based-verification/)Ammann and Dalrymple · Institute for Progress | 11 Aug 2025 | Hardware-enabled mechanisms | cites 3 | cited by 0 | Show on the map | | [No Backdoors. No Kill Switches. No Spyware.](https://blogs.nvidia.com/blog/no-backdoors-no-kill-switches-no-spyware/)Reber · NVIDIA Blog | 5 Aug 2025 | Hardware-enabled mechanisms | cites 0 | cited by 1 | Show on the map | | [Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment](https://arxiv.org/abs/2507.15916)Baker et al. · arXiv[Sources register](https://scrutica.com/verification/sources#rand-six-layers) | 21 Jul 2025 | International agreements and inspection | cites 28 | cited by 19 | Show on the map | | [Compute Requirements for Algorithmic Innovation in Frontier AI Models](https://arxiv.org/abs/2507.10618)Barnett · arXiv | 13 Jul 2025 | Foundations | cites 7 | cited by 1 | Show on the map | | [Technical Requirements for Halting Dangerous AI Activities](https://arxiv.org/abs/2507.09801)Barnett et al. · arXiv | 13 Jul 2025 | International agreements and inspection | cites 13 | cited by 2 | Show on the map | | [Distributed and Decentralised Training: Technical Governance Challenges in a Shifting AI Landscape](https://arxiv.org/abs/2507.07765)Kryś et al. · ICML 2025 Technical AI Governance workshop, oral (per its arXiv record) | 10 Jul 2025 | Security analyses | cites 8 | cited by 3 | Show on the map | | [Domestic frontier AI regulation, an IAEA for AI, an NPT for AI, and a US-led Allied Public-Private Partnership for AI: Four institutions for governing and developing frontier AI](https://arxiv.org/abs/2507.06379)Belfield · arXiv | 8 Jul 2025 | International agreements and inspection | cites 15 | cited by 1 | Show on the map | | [Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computing](https://arxiv.org/abs/2507.02770)Gu et al. · arXiv | 3 Jul 2025 | Confidential computing | cites 10 | cited by 5 | Show on the map | | [Verification for International AI Governance](https://aigi.ox.ac.uk/wp-content/uploads/2025/07/Verification_for_International_AI_Governance.pdf)Harack et al. · Oxford Martin AI Governance Initiative[Sources register](https://scrutica.com/verification/sources#oxford-aigi-2025) | 3 Jul 2025 | International agreements and inspection | cites 32 | cited by 10 | Show on the map | | [Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments](https://arxiv.org/abs/2506.23706)Schnabl et al. · arXiv | 30 Jun 2025 | Confidential computing | cites 7 | cited by 2 | Show on the map | | [Toward a Global Regime for Compute Governance: Building the Pause Button](https://arxiv.org/abs/2506.20530)Al Ramiah et al. · arXiv[Sources register](https://scrutica.com/verification/sources#pause-button-2025) | 25 Jun 2025 | International agreements and inspection | cites 8 | cited by 4 | Show on the map | | [Confidential Inference Systems: Design principles and security risks (Version 1.0)](https://www.anthropic.com/research/confidential-inference-trusted-vms)Pattern Labs and Anthropic · Anthropic and Pattern Labs (whitepaper) | 18 Jun 2025 | Confidential computing | cites 1 | cited by 1 | Show on the map | | [Insights from a Workshop on Hardware-Enabled Governance Mechanisms](https://www.rand.org/pubs/conf_proceedings/CFA3056-1.html)Kulp et al. · RAND Corporation, Conference Proceedings CF-A3056-1[Sources register](https://scrutica.com/verification/sources#rand-cf) | 12 Jun 2025 | Hardware-enabled mechanisms | cites 5 | cited by 0 | Show on the map | | [Countering AI Chip Smuggling Has Become a National Security Priority: An Updated Playbook for Preventing AI Chip Smuggling to the PRC](https://www.cnas.org/publications/reports/countering-ai-chip-smuggling-has-become-a-national-security-priority)Grunewald and Fist · Center for a New American Security (working paper) | 11 Jun 2025 | Hardware-enabled mechanisms | cites 8 | cited by 1 | Show on the map | | [Location Verification for AI Chips (issue brief)](https://www.iaps.ai/research/location-verification-for-ai-chips)Brass · Institute for AI Policy and Strategy[Sources register](https://scrutica.com/verification/sources#iaps-location-brief-2025) | 16 May 2025 | Location verification | cites 1 | cited by 4 | Show on the map | | [AI Governance to Avoid Extinction: The Strategic Landscape and Actionable Research Questions](https://arxiv.org/abs/2505.04592)Barnett and Scher · arXiv | 7 May 2025 | International agreements and inspection | cites 19 | cited by 3 | Show on the map | | [Trends in AI Supercomputers](https://arxiv.org/abs/2504.16026)Pilz et al. · arXiv | 22 Apr 2025 | Foundations | cites 4 | cited by 7 | Show on the map | | [In Which Areas of Technical AI Safety Could Geopolitical Rivals Cooperate?](https://arxiv.org/abs/2504.12914)Bucknall et al. · ACM FAccT 2025 (per its arXiv record) | 17 Apr 2025 | International agreements and inspection | cites 12 | cited by 0 | Show on the map | | [XpuTEE: A High-Performance and Practical Heterogeneous Trusted Execution Environment for GPUs](https://doi.org/10.1145/3719653)Fan et al. · ACM Transactions on Computer Systems | 12 Apr 2025 | Confidential computing | cites at least 6 | cited by 0 | Show on the map | | [Hardware-Enabled Mechanisms for Verifying Responsible AI Development](https://arxiv.org/abs/2505.03742)O’Gara et al. · arXiv[Sources register](https://scrutica.com/verification/sources#ogara) | 2 Apr 2025 | Hardware-enabled mechanisms | cites 12 | cited by 5 | Show on the map | | [Flexible Hardware-Enabled Guarantees for AI Compute](https://arxiv.org/abs/2506.15093)Petrie et al. · arXiv[Sources register](https://scrutica.com/verification/sources#flexheg-part-1) | Apr 2025 | Hardware-enabled mechanisms | cites 10 | cited by 10 | Show on the map | | [Part II: Technical Options for Flexible Hardware-Enabled Guarantees](https://arxiv.org/abs/2506.03409)Petrie and Aarne · arXiv[Sources register](https://scrutica.com/verification/sources#flexheg-part-2) | Apr 2025 | Hardware-enabled mechanisms | cites 12 | cited by 4 | Show on the map | | [Part III: International Security Applications of Flexible Hardware-Enabled Guarantees](https://arxiv.org/abs/2506.15100)Aarne and Petrie · arXiv[Sources register](https://scrutica.com/verification/sources#flexheg-part-3) | Apr 2025 | Hardware-enabled mechanisms | cites 11 | cited by 4 | Show on the map | | [International Agreements on AI Safety: Review and Recommendations for a Conditional AI Safety Treaty](https://arxiv.org/abs/2503.18956)Scholefield et al. · arXiv | 18 Mar 2025 | International agreements and inspection | cites 11 | cited by 5 | Show on the map | | [Superintelligence Strategy: Expert Version](https://arxiv.org/abs/2503.05628)Hendrycks et al. · arXiv | 7 Mar 2025 | International agreements and inspection | cites 4 | cited by 8 | Show on the map | | [Verde: Verification via Refereed Delegation for Machine Learning Programs](https://arxiv.org/abs/2502.19405)Arun et al. · arXiv | 26 Feb 2025 | Workload and training verification | cites 6 | cited by 1 | Show on the map | | [A Survey of Zero-Knowledge Proof Based Verifiable Machine Learning](https://arxiv.org/abs/2502.18535)Peng et al. · Artificial Intelligence Review 59, 157 (2026) (per its arXiv record) | 25 Feb 2025 | Workload and training verification | cites 8 | cited by 0 | Show on the map | | [Practical Principles for AI Cost and Compute Accounting](https://arxiv.org/abs/2502.15873)Casper et al. · ICML 2025 TAIG workshop (per its arXiv record) | 21 Feb 2025 | Foundations | cites 5 | cited by 3 | Show on the map | | [TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable Inference](https://arxiv.org/abs/2501.16007)Ong et al. · arXiv | 27 Jan 2025 | Workload and training verification | cites 5 | cited by 5 | Show on the map | | [Characterization of GPU TEE Overheads in Distributed Data Parallel ML Training](https://arxiv.org/abs/2501.11771)Lee et al. · arXiv | 20 Jan 2025 | Confidential computing | cites 3 | cited by 1 | Show on the map | | [Founding Zero-Knowledge Proofs of Training on Optimum Vicinity](https://eprint.iacr.org/2025/053)Tan et al. · Cryptology ePrint Archive | 13 Jan 2025 | Workload and training verification | cites at least 1 | cited by 0 | Show on the map | | [Defending Compute Thresholds Against Legal Loopholes](https://arxiv.org/abs/2502.00003)Pistillo and Villalobos · arXiv | 3 Jan 2025 | Foundations | cites 3 | cited by 2 | Show on the map | | [Technology to Secure the AI Chip Supply Chain: A Working Paper](https://www.cnas.org/publications/reports/technology-to-secure-the-ai-chip-supply-chain-a-primer)Fist et al. · Center for a New American Security[Sources register](https://scrutica.com/verification/sources#cnas-supplychain) | 11 Dec 2024 | Hardware-enabled mechanisms | cites 13 | cited by 2 | Show on the map | | [Protocol Learning, Decentralized Frontier Risk and the No-Off Problem](https://arxiv.org/abs/2412.07890)Long · arXiv | 10 Dec 2024 | Security analyses | cites 2 | cited by 1 | Show on the map | | [Zero-Knowledge Proofs of Training for Deep Neural Networks](https://doi.org/10.1145/3658644.3670316)Abbaszadeh et al. · ACM CCS 2024 | 2 Dec 2024 | Workload and training verification | cites at least 3 | cited by 7 | Show on the map | | [Introducing the LLM distributed training simulator](https://epoch.ai/blog/introducing-the-distributed-training-interactive-simulator)Erdil and Besiroglu · Epoch AI | 29 Nov 2024 | Foundations | cites 0 | cited by 4 | Show on the map | | [Mechanisms to Verify International Agreements About AI Development](https://arxiv.org/abs/2506.15867)Scher and Thiergart · MIRI Technical Governance Team[Sources register](https://scrutica.com/verification/sources#scher-thiergart-2024) | 27 Nov 2024 | International agreements and inspection | cites 24 | cited by 20 | Show on the map | | [Whack-a-Chip: The Futility of Hardware-Centric Export Controls](https://arxiv.org/abs/2411.14425)Gupta et al. · arXiv | 21 Nov 2024 | Hardware-enabled mechanisms | cites 0 | cited by 0 | Show on the map | | [Hardware and Software Platform Inference](https://arxiv.org/abs/2411.05197)Zhang et al. · arXiv | 7 Nov 2024 | Workload and training verification | cites 1 | cited by 0 | Show on the map | | [PipeLLM: Fast and Confidential Large Language Model Services with Speculative Pipelined Encryption](https://arxiv.org/abs/2411.03357)Tan et al. · arXiv | 4 Nov 2024 | Confidential computing | cites 8 | cited by 2 | Show on the map | | [SVIP: Towards Verifiable Inference of Open-source Large Language Models](https://arxiv.org/abs/2410.22307)Sun et al. · arXiv | 29 Oct 2024 | Workload and training verification | cites 3 | cited by 3 | Show on the map | | [Fastrack: Fast IO for Secure ML using GPU TEEs](https://arxiv.org/abs/2410.15240)Wang et al. · arXiv | 20 Oct 2024 | Confidential computing | cites 3 | cited by 2 | Show on the map | | [Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark Study](https://arxiv.org/abs/2409.03992)Zhu et al. · arXiv | 6 Sep 2024 | Confidential computing | cites 2 | cited by 4 | Show on the map | | [Governing dual-use technologies: Case studies of international security agreements and lessons for AI governance](https://arxiv.org/abs/2409.02779)Wasil et al. · arXiv | 4 Sep 2024 | International agreements and inspection | cites 5 | cited by 1 | Show on the map | | [Verification methods for international AI agreements](https://arxiv.org/abs/2408.16074)Wasil et al. · arXiv[Sources register](https://scrutica.com/verification/sources#wasil-2024) | 28 Aug 2024 | International agreements and inspection | cites 9 | cited by 16 | Show on the map | | [Confidential Computing on Heterogeneous CPU-GPU Systems: Survey and Future Directions](https://arxiv.org/abs/2408.11601)Wang and Oswald · ACM Computing Surveys (accepted, per its arXiv record) | 21 Aug 2024 | Confidential computing | cites 9 | cited by 2 | Show on the map | | Interim Report: Mechanisms for Flexible Hardware-Enabled GuaranteesPetrie et al. · flexHEG project | Aug 2024 | Hardware-enabled mechanisms | reference list not read | cited by 10 | Show on the map | | [Open Problems in Technical AI Governance](https://arxiv.org/abs/2407.14981)Reuel et al. · Transactions on Machine Learning Research, 2025 (per its arXiv record) | 20 Jul 2024 | Foundations | cites 31 | cited by 16 | Show on the map | | [Ascend-CC: Confidential Computing on Heterogeneous NPU for Emerging Generative AI Workloads](https://arxiv.org/abs/2407.11888)Dhar et al. · arXiv | 16 Jul 2024 | Confidential computing | cites 9 | cited by 1 | Show on the map | | [On the Limitations of Compute Thresholds as a Governance Strategy](https://arxiv.org/abs/2407.05694)Hooker · arXiv | 8 Jul 2024 | Foundations | cites 2 | cited by 10 | Show on the map | | [Laminator: Verifiable ML Property Cards using Hardware-assisted Attestations](https://arxiv.org/abs/2406.17548)Duddu et al. · arXiv | 25 Jun 2024 | Confidential computing | cites 14 | cited by 0 | Show on the map | | [Locking Machine Learning Models into Hardware](https://arxiv.org/abs/2405.20990)Clifford et al. · arXiv | 31 May 2024 | Hardware-enabled mechanisms | cites 0 | cited by 3 | Show on the map | | [Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models](https://doi.org/10.7249/RRA2849-1)Nevo et al. · RAND Corporation, Research Report RR-A2849-1 | 30 May 2024 | Security analyses | reference list not read | cited by 18 | Show on the map | | [Training Compute Thresholds: Features and Functions in AI Regulation](https://arxiv.org/abs/2405.10799)Heim and Koessler · arXiv | 17 May 2024 | Foundations | cites 10 | cited by 18 | Show on the map | | [Near-Term Enforcement of AI Chip Export Controls Using A Firmware-Based Design for Offline Licensing](https://arxiv.org/abs/2404.18308)Petrie · arXiv[Sources register](https://scrutica.com/verification/sources#petrie-offline) | 28 Apr 2024 | Hardware-enabled mechanisms | cites 2 | cited by 8 | Show on the map | | [zkLLM: Zero Knowledge Proofs for Large Language Models](https://arxiv.org/abs/2404.16109)Sun et al. · ACM CCS 2024 (per its arXiv record) | 24 Apr 2024 | Workload and training verification | cites 5 | cited by 14 | Show on the map | | [ZKML: An Optimizing System for ML Inference in Zero-Knowledge Proofs](https://doi.org/10.1145/3627703.3650088)Chen et al. · EuroSys 2024 | 22 Apr 2024 | Workload and training verification | cites at least 1 | cited by 4 | Show on the map | | [Trustless Audits without Revealing Data or Models](https://arxiv.org/abs/2404.04500)Waiwitlikhit et al. · arXiv | 6 Apr 2024 | Workload and training verification | cites 6 | cited by 4 | Show on the map | | [Location Verification for AI Chips](https://www.iaps.ai/research/location-verification-for-ai-chips)Brass and Aarne · Institute for AI Policy and Strategy (full report)[Sources register](https://scrutica.com/verification/sources#iaps-location-report-2024) | Apr 2024 | Location verification | cites 5 | cited by 19 | Show on the map | | [Optimistic Verifiable Training by Controlling Hardware Nondeterminism](https://arxiv.org/abs/2403.09603)Srivastava et al. · NeurIPS 2024 (per its arXiv record) | 14 Mar 2024 | Workload and training verification | cites 9 | cited by 4 | Show on the map | | [Governing Through the Cloud: The Intermediary Role of Compute Providers in AI Regulation](https://arxiv.org/abs/2403.08501)Heim et al. · arXiv[Sources register](https://scrutica.com/verification/sources#govai-cloud-2024) | 13 Mar 2024 | Foundations | cites 14 | cited by 22 | Show on the map | | [Computing Power and the Governance of Artificial Intelligence](https://arxiv.org/abs/2402.08797)Sastry et al. · arXiv[Sources register](https://scrutica.com/verification/sources#sastry) | 13 Feb 2024 | Foundations | cites 20 | cited by 35 | Show on the map | | [Verifiable evaluations of machine learning models using zkSNARKs](https://arxiv.org/abs/2402.02675)South et al. · arXiv | 5 Feb 2024 | Workload and training verification | cites 8 | cited by 9 | Show on the map | | [Hardware-Enabled Governance Mechanisms: Developing Technical Solutions to Exempt Items Otherwise Classified Under Export Control Classification Numbers 3A090 and 4A090](https://www.rand.org/pubs/working_papers/WRA3056-1.html)Kulp et al. · RAND Corporation, Working Paper WR-A3056-1[Sources register](https://scrutica.com/verification/sources#rand-hem) | 18 Jan 2024 | Hardware-enabled mechanisms | cites 6 | cited by 29 | Show on the map | | [Secure, Governable Chips: Using On-Chip Mechanisms to Manage National Security Risks from AI & Advanced Computing](https://www.cnas.org/publications/reports/secure-governable-chips)Aarne et al. · Center for a New American Security (in collaboration with IAPS)[Sources register](https://scrutica.com/verification/sources#cnas-sgc) | 8 Jan 2024 | Hardware-enabled mechanisms | cites 10 | cited by 29 | Show on the map | | [CAGE: Complementing Arm CCA with GPU Extensions](https://www.ndss-symposium.org/ndss-paper/cage-complementing-arm-cca-with-gpu-extensions/)Wang et al. · NDSS 2024 | 2024 | Confidential computing | cites 8 | cited by 2 | Show on the map | | [Exploration of secure hardware solutions for safe AI deployment](https://futureoflife.org/ai-policy/hardware-backed-compute-governance/)Future of Life Institute · Future of Life Institute (with Mithril Security) | 30 Nov 2023 | Confidential computing | cites 0 | cited by 0 | Show on the map | | [Increased Compute Efficiency and the Diffusion of AI Capabilities](https://arxiv.org/abs/2311.15377)Pilz et al. · arXiv | 26 Nov 2023 | Foundations | cites 3 | cited by 12 | Show on the map | | [Experimenting with Zero-Knowledge Proofs of Training](https://doi.org/10.1145/3576915.3623202)Garg et al. · ACM CCS 2023 | 15 Nov 2023 | Workload and training verification | cites at least 2 | cited by 14 | Show on the map | | [Compute at Scale: A Broad Investigation into the Data Center Industry](https://arxiv.org/abs/2311.02651)Pilz and Heim · arXiv | 5 Nov 2023 | Foundations | cites 0 | cited by 9 | Show on the map | | [An international treaty to implement a global compute cap for advanced artificial intelligence](https://arxiv.org/abs/2311.10748)Miotti · arXiv | 1 Nov 2023 | International agreements and inspection | cites 3 | cited by 1 | Show on the map | | [Preventing AI Chip Smuggling to China](https://www.cnas.org/publications/reports/preventing-ai-chip-smuggling-to-china)Fist and Grunewald · Center for a New American Security (working paper)[Sources register](https://scrutica.com/verification/sources#cnas-smuggling-2023) | 24 Oct 2023 | Hardware-enabled mechanisms | cites 4 | cited by 16 | Show on the map | | [Oversight for Frontier AI through a Know-Your-Customer Scheme for Compute Providers](https://arxiv.org/abs/2310.13625)Egan and Heim · arXiv[Sources register](https://scrutica.com/verification/sources#egan-heim-kyc) | 20 Oct 2023 | Foundations | cites 2 | cited by 10 | Show on the map | | [Multinational AGI Consortium (MAGIC): A Proposal for International Coordination on AI](https://arxiv.org/abs/2310.09217)Hausenloy et al. · arXiv | 13 Oct 2023 | International agreements and inspection | cites 6 | cited by 8 | Show on the map | | [AI Chip Smuggling into China: Potential Paths, Quantities, and Countermeasures](https://www.iaps.ai/research/ai-chip-smuggling-into-china)Grunewald and Aird · Institute for AI Policy and Strategy | 4 Oct 2023 | Hardware-enabled mechanisms | cites 2 | cited by 9 | Show on the map | | [Creating the First Confidential GPUs](https://queue.acm.org/detail.cfm?id=3623391)Dhanuskodi et al. · ACM Queue 21(4); reprinted in Communications of the ACM 67(1) | 31 Aug 2023 | Confidential computing | reference list not read | cited by 10 | Show on the map | | [International Governance of Civilian AI: A Jurisdictional Certification Approach](https://arxiv.org/abs/2308.15514)Trager et al. · arXiv | 29 Aug 2023 | International agreements and inspection | cites 7 | cited by 9 | Show on the map | | [Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AI](https://developer.nvidia.com/blog/confidential-computing-on-h100-gpus-for-secure-and-trustworthy-ai/)Apsey et al. · NVIDIA Technical Blog | 3 Aug 2023 | Confidential computing | cites 1 | cited by 5 | Show on the map | | [Confidence-Building Measures for Artificial Intelligence: Workshop Proceedings](https://arxiv.org/abs/2308.00862)Shoker et al. · arXiv | 1 Aug 2023 | International agreements and inspection | cites 0 | cited by 2 | Show on the map | | [zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Training](https://arxiv.org/abs/2307.16273)Sun et al. · arXiv | 30 Jul 2023 | Workload and training verification | cites 8 | cited by 8 | Show on the map | | [Confidential Compute on NVIDIA Hopper H100 (WP-11459-001 v1.0)](https://images.nvidia.com/aem-dam/en-zz/Solutions/data-center/HCC-Whitepaper-v1.0.pdf)Nertney · NVIDIA whitepaper | 25 Jul 2023 | Confidential computing | cites 0 | cited by 14 | Show on the map | | [International Institutions for Advanced AI](https://arxiv.org/abs/2307.04699)Ho et al. · arXiv | 10 Jul 2023 | International agreements and inspection | cites 3 | cited by 11 | Show on the map | | [Honeycomb: Secure and Efficient GPU Executions via Static Validation](https://www.usenix.org/conference/osdi23/presentation/mai)Mai et al. · USENIX OSDI 2023 | 10 Jul 2023 | Confidential computing | cites 7 | cited by 7 | Show on the map | | [Frontier AI Regulation: Managing Emerging Risks to Public Safety](https://arxiv.org/abs/2307.03718)Anderljung et al. · arXiv | 6 Jul 2023 | Foundations | cites 3 | cited by 17 | Show on the map | | [Tools for Verifying Neural Models’ Training Data](https://arxiv.org/abs/2307.00682)Choi et al. · arXiv | 2 Jul 2023 | Workload and training verification | cites 4 | cited by 14 | Show on the map | | [ACAI: Protecting Accelerator Execution with Arm Confidential Computing Architecture](https://arxiv.org/abs/2305.15986)Sridhara et al. · USENIX Security 2024; arXiv copy is the extended version (per its arXiv record) | 25 May 2023 | Confidential computing | cites 6 | cited by 3 | Show on the map | | [Nuclear Arms Control Verification and Lessons for AI Treaties](https://arxiv.org/abs/2304.04123)Baker · arXiv | 8 Apr 2023 | International agreements and inspection | cites 2 | cited by 14 | Show on the map | | [What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring](https://arxiv.org/abs/2303.11341)Shavit · arXiv[Sources register](https://scrutica.com/verification/sources#shavit-chinchilla) | 20 Mar 2023 | Foundations | cites 9 | cited by 25 | Show on the map | | [Exploring the Relevance of Data Privacy-Enhancing Technologies for AI Governance Use Cases](https://arxiv.org/abs/2303.08956)Bluemke et al. · arXiv | 15 Mar 2023 | Confidential computing | cites 1 | cited by 2 | Show on the map | | [Improved Export Controls Enforcement Technology Needed for U.S. National Security](https://www.csis.org/analysis/improved-export-controls-enforcement-technology-needed-us-national-security)Allen et al. · Center for Strategic and International Studies | 30 Nov 2022 | Hardware-enabled mechanisms | cites 0 | cited by 7 | Show on the map | | [StrongBox: A GPU TEE on Arm Endpoints](https://doi.org/10.1145/3548606.3560627)Deng et al. · ACM CCS 2022 | 7 Nov 2022 | Confidential computing | cites at least 2 | cited by 9 | Show on the map | | [Artificial Intelligence and Arms Control](https://arxiv.org/abs/2211.00065)Scharre and Lamberth · Center for a New American Security, October 2022 (per its arXiv record) | 22 Oct 2022 | International agreements and inspection | cites 4 | cited by 3 | Show on the map | | [Scaling up Trustless DNN Inference with Zero-Knowledge Proofs](https://arxiv.org/abs/2210.08674)Kang et al. · arXiv | 17 Oct 2022 | Workload and training verification | cites 2 | cited by 9 | Show on the map | | [CRONUS: Fault-isolated, Secure and High-performance Heterogeneous Computing for Trusted Execution Environment](https://doi.org/10.1109/MICRO56248.2022.00019)Jiang et al. · IEEE/ACM MICRO 2022 | Oct 2022 | Confidential computing | cites at least 2 | cited by 7 | Show on the map | | [SAGE: Software-based Attestation for GPU Execution](https://arxiv.org/abs/2209.03125)Ivanov et al. · arXiv | 7 Sep 2022 | Confidential computing | cites 6 | cited by 6 | Show on the map | | [Machine Learning with Confidential Computing: A Systematization of Knowledge](https://arxiv.org/abs/2208.10134)Mo et al. · ACM Computing Surveys (accepted, per its arXiv record) | 22 Aug 2022 | Confidential computing | cites 8 | cited by 5 | Show on the map | | [Proof-of-Learning is Currently More Broken Than You Think](https://arxiv.org/abs/2208.03567)Fang et al. · IEEE EuroS&P 2023 (per its arXiv record) | 6 Aug 2022 | Workload and training verification | cites 2 | cited by 12 | Show on the map | | [Confidential Machine Learning within Graphcore IPUs](https://arxiv.org/abs/2205.09005)Vaswani et al. · arXiv | 18 May 2022 | Confidential computing | cites 5 | cited by 2 | Show on the map | | [The MIT Supercloud Workload Classification Challenge](https://arxiv.org/abs/2204.05839)Tang et al. · IPDPS ADOPT’22 workshop (per its arXiv record) | 12 Apr 2022 | Workload and training verification | cites 0 | cited by 4 | Show on the map | | [Compute Trends Across Three Eras of Machine Learning](https://arxiv.org/abs/2202.05924)Sevilla et al. · IJCNN 2022 (per its arXiv record) | 11 Feb 2022 | Foundations | cites 0 | cited by 16 | Show on the map | | [Filling gaps in trustworthy development of AI](https://doi.org/10.1126/science.abi7176)Avin et al. · Science 374(6573) | 10 Dec 2021 | Foundations | cites 1 | cited by 1 | Show on the map | | [zkCNN: Zero Knowledge Proofs for Convolutional Neural Network Predictions and Accuracy](https://doi.org/10.1145/3460120.3485379)Liu et al. · ACM CCS 2021 | 12 Nov 2021 | Workload and training verification | reference list not read | cited by 12 | Show on the map | | [Why and How Governments Should Monitor AI Development](https://arxiv.org/abs/2108.12427)Whittlestone and Clark · arXiv | 28 Aug 2021 | Foundations | cites 0 | cited by 4 | Show on the map | | [“Adversarial Examples” for Proof-of-Learning](https://arxiv.org/abs/2108.09454)Zhang et al. · IEEE S&P 2022 (per its arXiv record) | 21 Aug 2021 | Workload and training verification | cites 1 | cited by 8 | Show on the map | | [Mystique: Efficient Conversions for Zero-Knowledge Proofs with Applications to Machine Learning](https://www.usenix.org/conference/usenixsecurity21/presentation/weng)Weng et al. · USENIX Security 2021 | 2 Jun 2021 | Workload and training verification | cites 0 | cited by 4 | Show on the map | | [Proof-of-Learning: Definitions and Practice](https://arxiv.org/abs/2103.05633)Jia et al. · IEEE S&P 2021 (per its arXiv record) | 9 Mar 2021 | Workload and training verification | cites 1 | cited by 20 | Show on the map | | [AI Verification: Mechanisms to Ensure AI Arms Control Compliance](https://cset.georgetown.edu/publication/ai-verification/)Mittelsteadt · Center for Security and Emerging Technology (Issue Brief) | Feb 2021 | International agreements and inspection | cites 1 | cited by 4 | Show on the map | | [Beyond Privacy Trade-offs with Structured Transparency](https://arxiv.org/abs/2012.08347)Trask et al. · arXiv | 15 Dec 2020 | Foundations | cites 1 | cited by 6 | Show on the map | | [Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims](https://arxiv.org/abs/2004.07213)Brundage et al. · arXiv | 15 Apr 2020 | Foundations | cites 4 | cited by 14 | Show on the map | | [AI Chips: What They Are and Why They Matter](https://cset.georgetown.edu/publication/ai-chips-what-they-are-and-why-they-matter/)Khan and Mann · Center for Security and Emerging Technology (Issue Brief) | Apr 2020 | Foundations | cites 1 | cited by 6 | Show on the map | | [Telekine: Secure Computing with Cloud GPUs](https://www.usenix.org/conference/nsdi20/presentation/hunt)Hunt et al. · USENIX NSDI 2020 | 25 Feb 2020 | Confidential computing | cites 4 | cited by 7 | Show on the map | | [Enabling Rack-scale Confidential Computing using Heterogeneous Trusted Execution Environment](https://doi.org/10.1109/SP40000.2020.00054)Zhu et al. · IEEE Symposium on Security and Privacy 2020 (preprint arXiv:1904.04782) | 9 Apr 2019 | Confidential computing | cites 3 | cited by 11 | Show on the map | | [Heterogeneous Isolated Execution for Commodity GPUs](https://doi.org/10.1145/3297858.3304021)Jang et al. · ASPLOS 2019 | 4 Apr 2019 | Confidential computing | cites at least 2 | cited by 21 | Show on the map | | [Graviton: Trusted Execution Environments on GPUs](https://www.usenix.org/conference/osdi18/presentation/volos)Volos et al. · USENIX OSDI 2018 | 8 Oct 2018 | Confidential computing | cites 0 | cited by 19 | Show on the map | | [AI Governance: A Research Agenda](https://cdn.governance.ai/GovAI-Research-Agenda.pdf)Dafoe · Centre for the Governance of AI, Future of Humanity Institute, University of Oxford | 27 Aug 2018 | Foundations | cites 1 | cited by 4 | Show on the map | | [Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware](https://arxiv.org/abs/1806.03287)Tramèr and Boneh · ICLR 2019 (per its arXiv record) | 8 Jun 2018 | Confidential computing | cites 2 | cited by 11 | Show on the map | | [Computational Power and the Social Impact of Artificial Intelligence](https://arxiv.org/abs/1803.08971)Hwang · arXiv / SSRN | 23 Mar 2018 | Foundations | cites 0 | cited by 5 | Show on the map | | [SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted Cloud](https://arxiv.org/abs/1706.10268)Ghodsi et al. · NeurIPS 2017 (per its arXiv record) | 30 Jun 2017 | Workload and training verification | cites 0 | cited by 12 | Show on the map | | [Intel SGX Explained](https://eprint.iacr.org/2016/086)Costan and Devadas · IACR Cryptology ePrint Archive 2016/086 | 2016 | Confidential computing | reference list not read | cited by 12 | Show on the map |