What can these providers actually prove?

Every day we ask each confidential-inference provider for an attestation and check what it contains. A row is verified only when every layer that provider's architecture should be able to prove, it proves. Anything we could not reach is marked as such rather than scored — an unreachable endpoint is not a privacy finding. Methodology →

Coverage by target

Proven counts the layers this provider's shape is expected to prove — the expectation is set per architecture in REQUIRED_LAYERS_BY_SHAPE, and that bar is an editorial judgment, not a measurement. Different providers have different denominators, so compare the missing column, not the fraction alone.

How often does the attested code change?

Any client that pins an enclave measurement is betting the measurement holds still. It does not. Deploys counts transitions to a version string never seen before. Corrected accounts for deploys that begin and end between two probes: with T deploys seen over n−1 daily intervals the rate estimate is −ln(1−T/(n−1))/Δ.

Read revisits only on instance-sampled rows. There the version comes from whichever backend answered, so a return to an earlier value means we reached a different instance — Chutes' 19 revisits are one deploy plus a fleet that never finished draining, not 19 rollouts. On control-plane rows the version is read from a single document (NEAR from the gateway's compose, Tinfoil from the release feed), so it cannot show fleet structure at all and zero revisits there is guaranteed by construction rather than observed. Fleet size is not identifiable from once-a-day sampling on any row.

Per-layer detail

Cells: ✅ verified, ❌ rejected, ○ awaiting our review, — required but not exposed, — not applicable to this architecture. This matrix shows 9 of the 15 layers the probe records; the remainder are listed per row in the coverage table above.

Editorial notes

Hand-written, not computed, and therefore able to go stale. Each carries the date it was last checked against the data. Anything not on this list that you see above is machine-derived.

• 2026-06-18 RedPill phala-simple host-SSH path is closed. The fleet moved off dstack-nvidia-dev to prod dstack-nvidia-0.5.9, removing the operator host-SSH route. Now machine-tracked by the Prod OS image column, which flips on any regression. Residual gaps (mutable image tags, unpinned runtime weights) are unaddressed.
• 2026-06-18 Chutes' serving code is not measured. serve.py on the prompt-plaintext path is CFSV-excluded and in no RTMR, and the model name is not bound to the quote. A passing quote proves genuine TDX running a Chutes base image, not which model on which code.
• 2026-05-09 NEAR's gateway gap depends on the client. ALLOWED_COMPOSE_HASHES is unset server-side, so the gateway alone does not pin code. A closed-chain client that checks compose_hash against the on-chain set on Base closes it; a client that trusts the gateway does not.
• 2026-04-26 Upstream verifier decodes JWTs without checking signatures. Phala's private-ai-verifier passes verify_signature=False on NVIDIA and Intel Trust Authority tokens, and every reseller routing through it inherits that.
• 2026-08-10 The bar is hand-set, and one entry was wrong. REQUIRED_LAYERS_BY_SHAPE is a hand-edited dict with no changelog. Venice's set excluded the two layers where its prompt-path exposure actually lives, so Venice scored a full row until an outside audit pointed at them; corrected 2026-08-10. Denominators still differ per architecture, so compare the unproven layers rather than the fractions, and treat the bar as editorial until it is derived from provider claims (issue #6).