Hi,

You need an experiment run and you do not own a laboratory. So you rent space in a building from a landlord you do not trust, and into the middle of his room you put a sealed booth you bought from a specialist manufacturer. One hatch. The window is a mirror from the outside.

Before you start, an inspector arrives. He works for the company that made the booth, not for the landlord. He photographs exactly what is inside, stamps the photograph with a seal only his factory can produce, and puts on that stamp a random number you handed him that morning, which is how you know the picture was taken today and not pulled out of a drawer last year.

The landlord can stand in that room all day. He sees a mirror.

Now notice what you did not learn. Nothing about whether the experiment will produce the right answer. A perfect booth holding exactly the equipment you specified will happily produce a wrong result. You did not remove the need to trust somebody. You fired the landlord and hired a factory.

That booth is a real thing and a real business. It is what a graphics card in a data centre you will never visit now does with your prompt, and it is the one corner of this field where the money has already arrived. Notice again what it never does. Look at the answer.

Listen:

Spotify: https://open.spotify.com/episode/1zw6WCZQcTYblJv2SsYveq

Apple Podcasts: https://podcasts.apple.com/us/podcast/plain-strata/id6783455764?i=1000787227281

YouTube: https://youtu.be/JQEi7mOraUE

---

The full piece, no need to click through:

There are four serious ways to check whether a stranger's computer did the AI work it said it did. Three of them are about the answer. The fourth is about the room, and the fourth is the one currently taking money from enterprises.

The question in this field has always been the obvious one: somebody ran a model on a machine you do not own, in a building you have never visited, and handed you back some text. Why believe any of it? Three of the four answers attack that directly, by running the computation again and comparing, or by making the operator post money that anyone can dispute, or by producing a mathematical proof that the arithmetic was performed correctly.

The fourth does not look at the output at all. It says: run the model inside a box the operator physically cannot open, and have the company that manufactured the box vouch, cryptographically, that the box is genuine and that the exact software you specified is running inside it. You never verify a single multiplication. You verify the enclosure.

And that is the branch with revenue. Targon runs as subnet 4 on Bittensor, a network where anyone can plug machines in and get paid for doing AI work without asking a company for permission, and it is reported to be the highest-earning subnet for hardware-enforced enterprise workloads. Chutes, subnet 64, serves its whole model catalogue this way with no cheaper unsealed tier on the price list. Meanwhile the cryptographic branch, with by far the stronger guarantee, counts its progress in proofs generated. One side counts proofs. The other counts invoices.

Hardware attestation does not tell you the answer is right. It tells you the room was sealed, that the software you asked for is the software inside it, and that the walls came from a factory whose signature cannot be forged. That is a much weaker claim than a proof of correct execution, and it reached paying customers first anyway, because it is the only one of the four bets that also hides your data from the person running the machine. That question already has a budget line attached to it.

The whole thing sits on one small physical fact most explanations skip.

Data lives in three states: at rest on a disk, in transit across a network, and in use, loaded into working memory while a program does something with it. The first two were solved decades ago by encrypting the disk and encrypting the wire. The third was not, and it cannot be waved away, because a model cannot think about a message it cannot read. At the moment your prompt is processed, it has to be plaintext somewhere.

That somewhere is the memory of a computer somebody else owns. In an ordinary server, the operating system and the layer underneath it can map any page of physical memory into their own view and read it. That is not a flaw, it is what an operating system is for. It also means the person running the machine can read every byte of your prompt, the weights, and the output while the work happens, and until recently there was nothing to do about it except accept a promise not to look. Every privacy claim in AI today is a promise about that one moment. Confidential compute replaces the promise with a mechanism.

Enclave, from the French enclaver, to lock in, built from the Latin in plus clavis, a key. On a map, an enclave is a piece of one country's land entirely surrounded by another country's while staying under a different sovereign. Lesotho inside South Africa. An enclave in a processor is exactly that: a region of memory completely surrounded by the operating system, physically inside the machine that operating system runs, and not governed by it. Same land, different sovereign. The name is doing real work.

Attestation, from the Latin ad plus testis, a witness, the same root as testify. To attest is to call a witness. Remote attestation is calling a witness about a machine you cannot walk into, and the useful property is that the witness cannot be talked round: it is a signing key burned into the silicon at the fabrication plant. You are not asking the operator whether the machine is honest. You are asking the chip, and the chip answers in a signature the operator cannot forge.

Trusted, in the phrase trusted execution environment, is the word that misleads nearly everyone, and correcting it is worth more than any other sentence here. In security engineering, a trusted component is not one you have good reason to believe in. A trusted component is one that is able to break your security if it misbehaves. Trusted means load-bearing, not trustworthy. So a trusted execution environment is not the part of the machine you can trust, it is the part you are forced to trust. Read the term correctly and the entire critique of this technology is already sitting inside its own name.

Golden configuration sounds like marketing and is not. The word comes from mastering, and goldsmithing before that: the reference master against which every copy is judged. Here it is a fingerprint you computed yourself, in advance, from the software you meant to run.

The mechanism is smaller than the vocabulary suggests.

A server processor has a memory controller sitting between the computing cores and the memory sticks. Every read and write passes through it. A trusted execution environment changes one thing there. Certain pages of physical memory get marked as belonging to a protected domain. The controller encrypts their contents on the way out to memory and decrypts them on the way back in, using a key generated inside the chip at startup that never leaves the package. It also refuses to hand those pages to anyone outside the domain that owns them. The operating system can still ask. The hardware returns scrambled bytes, or refuses.

That is the entire trick. Not a new chip, not a second computer. One extra check in the memory controller, and one key that never crosses the edge of the package. The implementations differ mostly in how much they wrap: Intel SGX came first and sealed a single program, while Intel TDX and AMD SEV-SNP seal a whole virtual machine, so an entire server sits inside the protected domain and the layer beneath it schedules the machine without being able to read it.

And now the part that matters for this field specifically. The model does not run on the processor. A large model lives in the memory attached to a graphics card and the arithmetic happens there, so a processor enclave protects nothing about it. The weights and the intermediate values sit in graphics memory, on the far end of a cable, in plain form, on hardware the operator owns.

So confidential inference needs a second sealed room. NVIDIA's confidential computing mode, available from the H100 generation onward, makes the card's own memory a protected region with its own device key, encrypts the cable between the processor enclave and the card so the bytes crossing it are scrambled, switches off debug interfaces and performance counters (a performance counter is a side channel if you watch it long enough), and lets the card sign its own statement about itself, rooted in the manufacturer's certificates.

Which means the thing you check is never one attestation. It is a chain: the processor's statement, the card's statement, the configuration of the link between them, the firmware versions, and the fingerprint of the software that loaded the weights. Every link is a place the chain can break on a single skipped check.

Here is the picture to carry, because everything else hangs on it.

You need an experiment run. You do not own a laboratory, so you rent space in someone else's building, and you do not trust the landlord. He has keys to every room, and your materials are ones you would rather he did not see. So you buy a booth from a specialist manufacturer. Sealed. One hatch. The window is a mirror from the outside. The equipment is bolted in.

Before your experiment begins, an inspector employed by the manufacturer, not by the landlord, walks in, photographs the exact contents and layout of the booth, and stamps the photograph with a seal only the manufacturer can produce. That morning you handed the inspector a slip of paper with a random number on it, and the number appears on the stamp, which is how you know the photograph was taken today rather than pulled out of a drawer from last year.

You compare the photograph against your own blueprint. If they match, you know four things: the right equipment is inside, arranged the way you specified, in a genuine sealed booth from this manufacturer, as of this morning. The landlord can stand in the room all day. He sees a mirror.

Now notice what you did not learn. Nothing about whether the experiment will produce the right answer. A perfectly sealed booth containing exactly the equipment you specified will happily produce a wrong result if your blueprint was wrong, or if the equipment is broken in a way a photograph cannot show. The seal is a statement about the room, not about the science. And notice where your confidence actually lives: not in the booth, but in the manufacturer's stamp being unforgeable and the manufacturer being honest. You did not remove the need to trust somebody. You changed who it is. You fired the landlord and hired a factory.

One extension completes it. The experiment needs a second machine, enormous, in the adjacent room, joined by a thick cable, and sealing the first booth achieves nothing if the second machine sits in the open. So it gets its own booth, its own inspector and its own stamp, and the cable between them is wrapped so nobody can splice it. Three seals, one experiment.

Before you send anything, you ask the machine for a statement about itself and include a fresh random number. Inside, the processor builds a report containing a measurement, which is a fingerprint of the exact software loaded into the protected region, plus the firmware version numbers, plus your random number, and signs it with a key derived from fuses burned into the die at the factory. The graphics card produces its own signed report in parallel.

You then perform three checks, and all three matter. Is the signature valid against the manufacturer's published certificates? That answers whether this is genuine hardware. Does the measurement match the fingerprint of the software you intended? That is the golden configuration check, and it answers whether your software is the software running. Are the firmware versions at or above your minimum? That answers whether the machine is patched against the weaknesses already known, and it is the check most often skipped, because a genuine, correctly measured, thoroughly compromised machine sails through the first two.

If all three pass, you set up an encrypted session with the enclave itself rather than with the host. Your prompt travels encrypted to a party inside the sealed room, gets decrypted in protected memory, crosses the encrypted cable to the card, and the answer comes back encrypted to you. The operator, who owns every piece of the metal, sees ciphertext arriving, ciphertext leaving, a busy graphics card, and a power bill.

One structural point is buried in that story, and squeezing two moments into one is where most confusion about this technology comes from. Three things happened at three different rhythms. The measurement happens once, when the sealed region starts. The check happens once per session, when you decide whether to talk to this machine at all. The inference happens once per request, thousands of times afterwards. An attestation does not travel with each answer. It establishes the room once, and you extend that trust across everything that follows. Anyone telling you attestation proves each output has folded the second moment into the third.

The honest assessment of this bet is the gap between two lists.

A valid, fully checked attestation proves five things: this exact software launched inside the protected region, the hardware is genuine silicon from this manufacturer, the firmware sits at this patch level, the protected memory is unreachable by the host, and the report is fresh, because your random number is inside it.

It does not prove the software is correct. A sealed, measured, genuine enclave running buggy code produces buggy output with a perfect attestation attached. It does not prove the weights are the weights you wanted, unless the measurement covers them, and measuring the serving program is not measuring the model, which is the most common gap between what these products claim and what they deliver. It does not prove the output is right, because no arithmetic is checked anywhere. It does not prove the manufacturer's keys were never extracted, and these technologies have had real, published breaks. And it says nothing about side channels, since timing and power draw are readable from outside the seal.

The sharpest way to hold it: attestation is a statement about the environment, made by the manufacturer, at a moment in time. Every word in that sentence is a limit.

Which brings the four bets into focus, because they are almost never compared correctly. Re-execution asserts a result is reproducible. Optimistic verification asserts nobody with money at stake objected inside the window. Cryptographic proving asserts the computation was performed correctly. Hardware attestation asserts the environment was uncompromised. Those are not four solutions to one problem. They are four answers to four adjacent questions, and reading them as competitors is the most common error in this area.

Here is the pattern worth carrying out of this episode.

No verification scheme removes trust. Every one relocates it, and the whole analysis of any scheme is naming where it lands. Re-execution relocates trust onto determinism, onto a floating point stack behaving identically twice. Optimistic verification relocates it onto the existence of at least one honest, funded, awake watcher. Cryptographic proving relocates it onto mathematics, and in some systems onto a setup ceremony held once, years ago, by people you will never meet. Hardware attestation relocates it onto a fabrication plant.

Once you have that, you can read any new verification proposal in about thirty seconds. Skip the mechanism. Find the relocation. Ask whether you prefer that party to the one you started with. It works well outside this field: an audit relocates trust from a company to an auditor, a notary from the signer to the state. Nobody in that list eliminated anything.

A smaller pattern hides here too. The random number you send is a challenge and the signed statement containing it is the response, the same shape as the dispute window in the optimistic branch, compressed from days to microseconds and answered by silicon rather than by a watcher with money at stake. Same primitive, wildly different clock.

Two things worth sitting with.

The first is where this field ended up. Cryptocurrency began as a project to remove trusted third parties from money, and its central achievement was replacing an institution with a mechanism. Then it arrived at decentralized AI, reached for a root of trust manufactured by one of roughly three companies on the planet capable of making it, and put that at the foundation of a permissionless compute layer. There is no ideological account of that. It happened because it worked and because it sold. Whether that is a betrayal or a mature accommodation with physical reality is a live question, and both readings can be argued. What cannot be defended is failing to notice.

The second is stranger. This technology guarantees the container rather than the content. It tells you the room was sealed and says nothing about what was said inside it, and it sits at the centre of a field whose entire anxiety is about content: is the model lying, is the output right, was the model you paid for even loaded. The field built a very good answer to a question adjacent to the one keeping it awake, and then found that the adjacent question was the one with a budget.

Technologies do not win because they answer the deepest question. They win because they answer a question somebody is already paying to have answered.

Walk Chutes, subnet 64, and name each piece as it appears.

A request enters a subnet, which is a market with an incentive mechanism attached: operators compete to serve, validators score the work, and payouts follow the score. Before the request goes anywhere, the validator runs the whole check. The processor's signature against the manufacturer's public keys is the inspector's stamp. The card's attestation is the second sealed room. The measurements compared against the golden configuration are your blueprint. The firmware versions are the patch level.

The setting is what makes this the interesting case. The party checking is a validator whose job is catching operators cheating, and the operators are anonymous and economically motivated. This is attestation used exactly as designed, in an environment that genuinely contains adversaries, rather than in a corporate datacentre where the adversary is a compliance auditor.

Now the part that only appears if you stop reading the four bets as rivals. A crypto-economic layer is still running underneath all of it: the validator checking the seal is itself economically motivated, and the operator has money staked. So this subnet is not running one bet. It runs attestation for confidentiality and stake-backed scoring for correctness, stacked, with the incentive mechanism covering exactly what the seal cannot see. The seal proves the room. The stake covers the answer. That stacking is the actual state of the art, and it is invisible from any comparison table.

And there is a reason this is spreading now. Bittensor rewrote its emission curve this year so idle subnet slots collapse toward nothing, and within weeks several subnets repositioned toward private inference. A network that stopped paying for merely existing pushed its participants toward what people were actually buying.

The correlation nobody is pricing: every system on this branch shares one root of trust, so the first time a major attestation service is proven forgeable at scale, they fail simultaneously. The other three branches have no such shared failure mode, and that correlation does not appear in anyone's risk model.

The demand question, which matters more. Europe's transparency obligations became applicable in August while the heavier high-risk obligations slid to the end of 2027, so the cheap claim survived on schedule and the expensive claim got sixteen months of runway. If regulatory demand asks for confidentiality rather than correctness, this branch gets the next five years of funding.

Two honesty guards before we leave. The revenue claims here come from inside the ecosystems making them, and nobody outside has audited the books. And the technology seals the machine against its owner, not against itself: if the program inside the room is quietly writing your prompts to a file, the walls are working perfectly and you are still being read.

---

The two voices are AI. The research and writing are mine.

Decentralized AI, layer by layer.

Dastan,