Verifiable AI inference
摘要
正文阐述 AI agent（如代码审查、安全审查）输出真实性需求：Bob 需证明给定特定 agent、model version、configuration 与 input 的输出。当前无标准证明方法。介绍 trusted attestation 方案 ——inference service 或 auditor 运行 agent 并签名证书，包含输入输出哈希与签名，可独立验证哈希与签名。强调此方案仅证明权威机构生成输出，并不证明模型执行正确。进一步提出 stronger goal：inference 自身生成 cryptographic proof，无需依赖可信服务，任何人都可独立验证。指出这是 zk-proofs、zkVMs 等 verifiable computation 技术研究活跃领域，但 frontier AI 模型生成证明仍昂贵。最后说明 Verifiable AI inference 让 AI 输出实用性增强：代码审查、法律分析等可附带证明 provenance，支持高置信引证；不改变模型准确性，但使 AI 生成内容成为可验证 artifact，像 HTTPS 或代码签名般基础。
荐读理由
AI 代理能通过可信权威签名输出或生成 zk 证明来证明特定模型版本、配置和输入的输出结果，让 Bob 验证 Alice 的安全审查等成果
原文
AI agents are increasingly being used to review code, summarize documents, analyze contracts, and answer questions. In many cases, the result itself matters less than its authenticity.
Suppose Alice wants to share an AI-generated security review with Bob. Bob wants to know that the review is exactly what a particular agent produced for a particular input.
In other words, Bob wants evidence that
output = Agent(input)
for a specific agent, model version, configuration, and input, without running the same inputs, and spending tokens and time.
Today, there is no standard way to prove this.
Trusted attestation
The simplest solution is to rely on a trusted authority.
An inference service—or an independent auditor—runs the agent and signs the result.
The certificate could contain:
Agent: OpenAI Code Security Review
Model: GPT-5.5
Agent version: v3
Input hash: SHA256(...)
Output hash: SHA256(...)
Timestamp: ...
Signature: ...
Anyone with the original input and output can verify the hashes and the signature. If they match, the output is authentic.
This does not prove that the model executed correctly. It proves that the trusted authority attests that it produced this output for this input.
For many applications, that is already enough. It is no different from trusting a software publisher's code signature or a Certificate Authority on the web.
AI providers, code hosting platforms, or independent auditors could all publish signed attestations for AI-generated artifacts.
Beyond trust
A stronger goal is to remove the trusted authority entirely.
Instead of relying on a signature, the inference itself would produce a cryptographic proof that the output is exactly the result of evaluating the specified model on the specified input.
Verification would no longer depend on trusting the service that performed the inference. Anyone could verify the proof independently.
This is an active area of research. Zero-knowledge proofs, zkVMs, and other verifiable computation techniques are making progress, but generating proofs for frontier AI models remains expensive.
Why it matters
Verifiable inference would make AI outputs much more useful.
A code review could be accompanied by proof that it was generated by a specific review agent. A legal analysis could be verified to have come from a particular model version. Researchers could cite AI-generated analyses with confidence that readers are seeing the original output.
Verifiable inference does not make models more accurate or more trustworthy. It simply preserves their provenance. Whatever confidence—or skepticism—you have in a model can be carried all the way to its outputs.
AI-generated content could become a first-class, verifiable artifact, much like signed software releases or digitally signed documents are today.
As AI becomes infrastructure, verifiable inference may become as fundamental as HTTPS or code signing.
这条对你有帮助吗？