Attestable Blog - From Verifiability to Model-Weight Security
Get in touch
[ AI integrity ]<br>From Verifiability to Model-Weight Security<br>How zero-knowledge proofs can reduce an entire AI datacenter’s trusted computing base to a single device, and create a new path to SL5 security.
Get in touch
Table of contents
Table of Contents
Related Resource<br>Infrastructure
Proving LLMs at Scale
A frontier model’s weights are an unusual kind of asset. They are data, but they are also capability.<br>The weights encode the result of an enormous investment in compute, training data, algorithms, engineering, and research. If they are stolen, an attacker does not merely obtain source code or confidential documents. They obtain the ability to run the model independently, remove its safeguards, modify it, fine-tune it, and use it without the developer’s oversight.<br>That makes model-weight security both a commercial and a national-security problem. As models become more capable, stealing their weights could allow a competitor to erase years of technological advantage—or allow a nation-state or terrorist organization to gain access to capabilities that the original developer had deliberately restricted.<br>RAND’s report, Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models, treats weights as the critical leverage point in frontier AI security. The report identifies 38 distinct attack vectors, ranging from compromised software dependencies and malicious insiders to advanced physical attacks and nation-state operations. It emphasizes that a failure along just one viable path can be enough to compromise the entire system.<br>This problem is central to Attestable’s history. Before founding the company, our CEO, Yogev Bar-On, co-authored the RAND report and worked with frontier AI labs and the U.S. government on AI security. The conclusion was uncomfortable: the technologies available to security teams were not sufficient to reach the required level of protection on the timetable set by AI progress.<br>We need to reach Security Level 5 faster<br>The RAND report defines five security levels.<br>At the lower levels, organizations defend against amateurs, professional criminals, insiders, and increasingly capable cyber operations. Security Level 5, or SL5, is the highest level: a system that could plausibly withstand the top-priority operations of the world’s most capable nation-states.<br>This is the threat model that matters when the asset being protected may be one of the most strategically important technologies in the world.<br>RAND concluded that an internet-connected production system cannot currently reach SL5 using off-the-shelf security products and normal industry practices. The report estimated that, even with serious prioritization, organizations could require at least five years and support from the national-security community to reach it. It also concluded that achieving SL5 for production deployments was probably not yet possible.<br>Five years is a reasonable security roadmap in many industries. It may be an unacceptable one for frontier AI.<br>If highly capable systems arrive before the infrastructure holding them can withstand a top-tier state actor, then the world may develop transformative intelligence before it develops the ability to keep that intelligence secure. Attestable was founded because closing this gap requires more than incremental improvements to existing security products. It requires new primitives that allow AI labs to leapfrog parts of the traditional security roadmap.<br>Zero-knowledge proofs offer one such primitive.<br>Stop trying to create trust<br>A modern AI datacenter is an extraordinary accumulation of trusted components.<br>We trust GPUs, CPUs, network cards, firmware, drivers, operating systems, container runtimes, orchestration software, compilers, inference frameworks, third-party libraries, monitoring agents, build systems, update mechanisms, employees, contractors, and hardware suppliers.<br>Traditional security tries to make every one of those components sufficiently trustworthy. It hardens systems, limits privileges, scans for malware, audits dependencies, monitors activity, isolates networks, and adds layer after layer of defense.<br>All of that remains important. But the architecture has an inherent weakness: the trusted computing base is enormous.<br>A sophisticated attacker does not have to defeat every defense. They need to find one path through a sprawling stack of hardware, software, people, and suppliers. The RAND report’s 38 attack vectors illustrate just how many such paths exist.<br>Zero-knowledge proofs let us ask a different question.<br>Instead of asking:<br>Is every component inside the datacenter uncompromised?<br>We can ask:<br>Can the datacenter mathematically prove that this output was produced by the approved computation?<br>That change in question is the foundation of the verifiable datacenter.<br>Turn the entire datacenter into a deterministic function<br>Malware is a side-effect of general-purpose computing....