Private Inference Beat stage criteria
Proposal draft-1 · no stages awarded. The current comparison publishes dated route assessments. This proposal makes the intended promotion criteria explicit for review before any ranking is introduced.
Assess a specific endpoint, protocol, client version and mode, requested model, protected fields and all plaintext-holding components. A provider brand cannot inherit its best route's stage. Unassessed is a separate state; it is never an automatic Stage 0.
| Proposed stage | Required evidence |
|---|---|
| Stage 0 · documented route | A dated review names the client, plaintext holders, reference authority and unresolved obligations. At least one Stage 1 obligation is unmet or unknown. This is an inventory/assessment state, not a confidentiality guarantee. |
| Stage 1 · verified private route | Every applicable obligation in all six assessment axes is Established with scoped proof records: hardware/TCB, live session and reply-key binding, approved reproducible code/model identity, operator-input constraints, downstream/request closure and explicit update authorization. N/A requires an architectural justification. Negative controls must reject substituted keys, models, workloads, stale evidence and unapproved updates before protected data leaves the client. |
| Stage 2 · independently sustained assurance | Stage 1 plus independent build reproduction and route verification, a public versioned reference/update history with authenticated integrity and consistency checks, and an independently reviewed approval process that prevents unilateral operator updates from silently expanding client policy. Publish reviewers, trust roots, approval/revocation/rollback rules and evidence of enforcement. |
Promotion must record rubric version, reviewer, date, exact client and workload versions, policy authority/revision, proof records and test results. Reference changes trigger dependency review; neither new samples nor an unchanged hash renew an assessment. A stage describes only the recorded versions and scope.
An adapter passing every configured check does not award a stage. Publication, provider authorization, analyst review and client acceptance remain independent facts. Historical audit-ledger verdicts do not award stages under this proposal.
The current observatory retains evidence in Git; it does not provide a certificate-transparency protocol, append-only guarantees or log consistency proofs. Stage 2 is a proposed requirement, not a claim about this repository.