https://galadriel.com/

In the realm of artificial intelligence, verifying that an AI response genuinely came from a specific model and wasn’t tampered with presents a significant challenge. The Chain of Trust in verified AI inference provides a robust solution through multiple layers of security and cryptographic proof.

The Foundation: Trusted Execution Environment (TEE)

At the core of verified inference lies the Trusted Execution Environment (TEE), specifically AWS Nitro Enclaves. This hardware-isolated environment provides a critical security foundation:

• Complete isolation from host systems
• Encrypted memory pages
• No persistent storage
• No direct network access
• Secure key generation and storage

Building the Chain of Trust

Code Verification

The process begins with verifiable code deployment:

Source Code → Docker Image → Enclave Image → Image Hash

This deterministic build process ensures that the code running in the TEE is exactly what was audited. Anyone can verify this by reproducing the build process and comparing hashes.

TEE Initialization

When the TEE starts:

• Hardware verification ensures integrity
• A private key is generated inside the enclave
• The private key never leaves the secure environment
• A public key is derived and shared

AWS Attestation

AWS provides cryptographic proof of the environment:

• Signs the enclave image hash
• Verifies the hardware configuration
• Validates the generated public key
• Creates a signed attestation document

Runtime Verification

During operation:

User sends an inference request

LLM generates response inside TEE

Request and response are hashed (SHA256)

Hash is signed with TEE’s private key

Complete verification package is assembled:

• Original request and response
• Cryptographic hash
• TEE signature
• Public key
• AWS attestation

Verification Package

Each verified inference includes:

JSON1{
    "response": "AI generated content",
    "hash": "SHA256 of request and response",
    "signature": "TEE's signature of the hash",
    "public_key": "TEE's public key",
    "attestation": "AWS signed document"
}

Why This Matters

The Chain of Trust provides several critical guarantees:

Code Integrity

• Verified source code execution
• No possibility of tampering
• Reproducible builds

Execution Security

• Hardware-level isolation
• Protected memory
• Secure key management

Response Authenticity

• Cryptographic proof of origin
• Tamper-evident responses
• Verifiable audit trail

Platform Trust

• AWS infrastructure verification
• Hardware attestation
• Signed platform configuration

Verification Process

Anyone can verify a response by:

Checking the AWS attestation signature

Verifying the enclave image hash

Validating the TEE’s signature

Confirming the response hash

Implications for AI Safety

This Chain of Trust addresses several critical concerns in AI deployment:

Authenticity

• Guaranteed source of responses
• Verification of model used
• Proof of execution environment

Transparency

• Auditable execution
• Verifiable processes
• Clear chain of evidence

Security

• Hardware-based protection
• Cryptographic proofs
• Tamper resistance

The Chain of Trust in verified AI inference represents a significant advancement in secure and verifiable AI deployment. By combining data verification, cryptographic proofs, and platform attestation it provides a point of departure for auditable execution as a robust framework for ensuring the authenticity and integrity of AI interactions.

This system demonstrates that we can have both powerful AI capabilities and verifiable security, setting a new standard for responsible AI deployment. For more information explore Galadriel