Every author block and the authorship standard said Los Angeles; Hanzo has
been in San Francisco since at least 2016. The five catalogue PDFs whose
sources changed are rebuilt so papers.hanzo.ai says so too.
Co-authored-by: Hanzo Dev <[email protected]>
An outside operator sells inference on hardware we do not own. Two properties
have to hold before we pay for it automatically: the prompt stays confidential
on a machine its owner controls, and the operator cannot bill for a model it
did not run. Confidential computing answers the first directly and the second
only by implication, and the paper keeps those apart.
It specifies the flow (measured image, launch, attestation-gated key release
from KMS, sealed session), the field checklist a verifier must actually run for
SEV-SNP, TDX and a GPU in confidential mode, and the settlement receipt that
binds the model commitment, the decoding regime and the input to the output --
adding the tokenizer digest, the sampling seed and the raw-input digest that
HIP-0901's binding does not cover, so an auditor can replay a request exactly
rather than testing it statistically.
Then it says where this stops. A measurement is a hash of bytes, not a proof
about what those bytes do; a model commitment is membership, not use. "The
advertised model produced this output" is inherited from five named
assumptions, and the receipt has no evidentiary value if any of them fails --
which is different from the one cryptographic statement available, the
Freivalds check over an exact integer accumulator. Every guarantee is
classified cryptographic, hardware-trust, economic or open, and execution
integrity on the floating-point path is open.
Grounded in the tree rather than in intent: the privacy-tier crates verify with
mocks that return success; hanzo-attest declares snp/tdx and refuses them by
name, which is where the real verifier belongs; the on-chain evidence backends
are fail-closed with an empty voucher set; and the attestation verifier they
depend on signs a 48-byte Lux header with no report-data field, so the binding
those contracts document cannot yet be checked. One vendor root is embedded,
Intel's. The reachable bench host exposes no CPU TEE, so nothing here is
measured on confidential hardware and the paper says so.
Co-authored-by: Hanzo Dev <[email protected]>
zeekayandHanzo Dev