Published work

01 Research publications

Research publications that used the Side Channel Cloud.

1. 022026
   SASH research note — Sept 2026

   Towards Proving Frontier-Scale LLM Inference

   Pascal Berrang

   Abstract

   A proof of inference lets a provider show that an output came from a declared model on a declared input, without handing over the weights. In AI verification, a verifier can ask for such proofs on a random sample of logged requests. A provider that ran anything other than the declared model cannot produce them.

   Cost has been the standard objection. Estimates in the verification literature range from about 10,000x the cost of the inference to 500,000x. We built an open prover to find out where that cost goes.

   Our prototype proves greedy decoding of a quantised Llama-3.1 8B: prompt and answer, every layer, from the embedding table to the chosen token. On one H100, a request with a 4,096-token prompt and a 512-token answer takes 1.0 to 1.5 hours to prove, or $3.37–5.01 at list price. Checking all the proofs takes two minutes on CPU cores, without a GPU.

   Read more ↓

   Read itSASHResearch note
2. 012026
   Aug 2026

   Workload Identification with Physical Side Channels for AI Governance

   Simone Gargiulo, Gabriel Kulp

   Abstract

   AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. Here, we show that an external observer can identify the class of the workload running on an NVIDIA H200 from its power draw. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. We recorded 930 five-second traces at ~10 MHz, covering seventeen open LLM families and twenty-five non-AI workloads. Over this corpus we separate training from inference and from non-AI computation with an accuracy of 97% and a macro-averaged F1 score of 0.955, evaluated on model families unseen during training. AI workload spectral content predominantly lies below ~20 kHz and training is particularly recognizable through the memory-bound optimizer update. The GPU operator is then treated as adversarial and able to reshape the physical computation itself. Four evasion strategies are tested to disguise training as inference, producing an additional 680 adversarial traces. A detector hardened against evasion strategies, with the tested strategy held out, catches training ≥99% of the time for three of the four strategies. The fourth, diluted low-rank adaptation (LoRA), is detected 48–88% of the time with a hardened classifier, rising to ≥98% with an additional rescue rule. While these attacks are not a comprehensive evaluation against adversarial behaviour, they offer initial insights beyond genuine activities and a dataset for developing and testing stronger evasion mechanisms.

   Read more ↓

   Read itarXiv2609.00309PDFFull paperInstruments usedDC bus power tapNVIDIA H200

02 Mentions Side Channel Cloud

Content that references the side channel cloud.

1. 012026
   The Future Society · Policy memo — Sept 2026

   How To Make International AI Verification a Reality

   Kathrin Gardhouse, Nicoleta Kyosovska

   Read itThe Future SocietyPolicy memo