Key Takeaways
- Raw evidence, a nonce and a script. On 16 October we asked every instance serving three confidential models for its attestation, bound to a random nonce, and published the raw responses.
- Re-check one model yourself, with no account, key or GPU: the Intel TDX quotes against Intel, the GPU evidence against NVIDIA, the nonce binding from the quote bytes.
- Know what a pass means. Genuine TDX guests with attested GPUs at that moment. Not which code they run, and not which instance answered a given request.
On 16 October 2026 we drew a random nonce and asked for the attestation evidence of every instance serving three confidential models. We published the raw responses, the nonce and the script that checked them. This tutorial re-checks one of the three, DeepSeek V3.2: nine instances, eight NVIDIA Hopper GPUs each. First online, against Intel and NVIDIA, the way the original run did it. Then the parts that need no network at all. You need no account, no API key and no GPU. At the end, what a pass proves and what it does not.
Every command below was run on 20 October 2026 on Ubuntu 24.04 with Python 3.12.3, in a fresh directory, exactly as printed. Outputs are pasted as printed; [...] marks a cut.
What was published
The files live under https://voltagegpu.com/inference-proofs/2026-10-16/. That path has no index page, so start with the README. For each model there are five files:
<model>.nonce.txt: our nonce, 32 random bytes in hex.<model>.request.txt: the request, its time and its HTTP status.<model>.evidence.json: the raw response, byte for byte. One entry per instance: an Intel TDX quote, the NVIDIA GPU evidence, a certificate, a signature and a signed body.<model>.e2e-instances.json: each instance's end-to-end public key, read from the provider's instance listing.<model>.verify.txt: the report printed on 16 October.
Plus the script, verify_inference_evidence.py, and SHA256SUMS.
One rule ties a quote to the nonce. The first 32 bytes of the quote's report_data must equal SHA256(nonce + e2e_pubkey), the nonce and the key joined as text. The GPU evidence uses the same value as its nonce. The rule comes from the model provider's public verification guide, which our inference docs point to.
Step 1: install the two verifiers
mkdir inference-check && cd inference-check python3 -m venv .venv && . .venv/bin/activate pip install -q voltage-verify==0.2.1 nv-attestation-sdk cryptography voltage-verify --version pip show nv-attestation-sdk | grep Version
voltage-verify 0.2.1 Version: 2.7.3
voltage-verify checks the Intel side. It is our open-source verifier (MIT, source). nv-attestation-sdk is NVIDIA's package for the GPU side. These are the versions the original run used.
Step 2: download one model's files and check the checksums
mkdir inference-2026-10-16 && cd inference-2026-10-16
BASE=https://voltagegpu.com/inference-proofs/2026-10-16
M=deepseek-ai_DeepSeek-V3.2-TEE
for f in README.txt SHA256SUMS verify_inference_evidence.py $M.nonce.txt $M.request.txt \
$M.evidence.json $M.e2e-instances.json $M.verify.txt; do
curl -sSfO "$BASE/$f"
done
sha256sum -c SHA256SUMS --ignore-missingREADME.txt: OK deepseek-ai_DeepSeek-V3.2-TEE.e2e-instances.json: OK deepseek-ai_DeepSeek-V3.2-TEE.evidence.json: OK deepseek-ai_DeepSeek-V3.2-TEE.nonce.txt: OK deepseek-ai_DeepSeek-V3.2-TEE.request.txt: OK deepseek-ai_DeepSeek-V3.2-TEE.verify.txt: OK verify_inference_evidence.py: OK
The checksums come from the same site as the files. They catch a broken download, not a dishonest publisher. The checks below do not depend on them.
Step 3: re-run the published check
The script writes its report to <model>.verify.txt and replaces the published one, so keep a copy first.
cp $M.verify.txt published.verify.txt python verify_inference_evidence.py . $M voltage-verify
For each instance, the script runs voltage-verify quote, which fetches Intel's current data for that platform. Then it sends the GPU evidence to NVIDIA's attestation service. Nine instances took about a minute and a half. Here is what our replay of these exact commands printed:
.../verify_inference_evidence.py:60: DeprecationWarning: nv-attestation-sdk is deprecated and will reach end of support on September 15, 2026. Please migrate to the C++ SDK: https://github.com/NVIDIA/attestation-sdk. Migration guide: https://docs.nvidia.com/attestation/attestation-client-tools-sdk/latest/migration_guide.html
client = Attestation()
Using default Remote verifier URL: https://nras.attestation.nvidia.com/v3/attest/gpu
**** Attestation Successful ****
[... NVIDIA's progress lines, cut ...]
verified_at: 2026-10-20T13:08:06+00:00
nonce (ours, random 32 bytes): 28231ce10fdb9cfd72bf1199f05fdf46705966b74efe0c24fe2ee37490772b69
verifiers: voltage-verify 0.2.1; nv-attestation-sdk (NVIDIA NRAS, remote)
instances returned: 9
instance 2124d84a-d402-4914-9db4-fa4d94e2b24f
intel tdx quote : PASS (platform TCB UpToDate, QE UpToDate, TDX_01 UpToDate)
nonce binding : PASS report_data[0:32] = fda470f1a58bd95116f318242689e0370436322b753816ae4ca1ef7a659a191e
debug bit : OFF (td_attributes 0000001000000000)
key possession : PASS
nvidia gpus : PASS (8 GPU(s), arch HOPPER)
mr_td : 261ce538b435e2d0e85fc97e254bc99154c507b7a8e13d59b69f8532384f1d0bfaadfddf3fccc6e0a411203840bbee8d
[... 3 instances with the same lines ...]
instance 4c1f21af-821a-4d25-99a3-d0451a146db9
intel tdx quote : FAIL tdx.tcb ()
nonce binding : PASS report_data[0:32] = b6476aacc2f17f27113cb7f5aa3a9067b8e18aaa6064fe8ce9e0b6c6aee6b1e0
debug bit : OFF (td_attributes 0000001000000000)
key possession : PASS
nvidia gpus : PASS (8 GPU(s), arch HOPPER)
mr_td : 261ce538b435e2d0e85fc97e254bc99154c507b7a8e13d59b69f8532384f1d0bfaadfddf3fccc6e0a411203840bbee8d
[... 4 instances with the same lines as the first ...]
RESULT: 8 of 9 instance(s) fully verified (Intel quote, our nonce, key possession, NVIDIA GPUs)
1 instance(s) FAILED a check, see aboveEach instance gets five checks:
- intel tdx quote: the quote's signature chain up to Intel's root, the platform's security level according to Intel's current data, and revocation.
- nonce binding: the rule above,
report_data[0:32] == SHA256(nonce + e2e_pubkey). - debug bit: the guest's debug attribute is off.
- key possession: the signed body verifies with the instance's certificate, and it carries our nonce and this same quote.
- nvidia gpus: NVIDIA's service accepted the GPU evidence for the same nonce value.
The NVIDIA deprecation notice is printed by NVIDIA's own package. The remote check still answered on 20 October 2026.
If one instance fails: check it alone
One instance failed tdx.tcb, with nothing in the parentheses. Take its quote out and check it on its own:
jq -r '.evidence[] | select(.instance_id == "4c1f21af-821a-4d25-99a3-d0451a146db9") | .quote' \ $M.evidence.json > failed.b64 voltage-verify quote failed.b64 python verify_inference_evidence.py . $M voltage-verify 2>/dev/null | grep RESULT
[PASS] tdx.structure TDX quote v4, TEE 0x81, 4936 bytes [PASS] tdx.signatures attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA [PASS] tdx.collateral TCB info and QE identity signed by Intel (Intel PCS, fetched now) [PASS] tdx.tcb platform TCB UpToDate, QE UpToDate, TDX_01 UpToDate [PASS] tdx.revocation PCK certificate not revoked (57 entries in CRL) [PASS] tdx.revocation PCK CA certificate not revoked (0 entries in CRL) TDX: MRTD 261ce538b435e2d0e85fc97e254bc991... TCB UpToDate QE UpToDate RESULT: VERIFIED RESULT: 9 of 9 instance(s) fully verified (Intel quote, our nonce, key possession, NVIDIA GPUs)
The quote is fine, and the second full run passed all nine. The first failure was not about the quote. Each check makes four requests to Intel: platform data, quoting enclave identity and two revocation lists. voltage-verify does not retry them. If one request fails, the result is a tdx.tcb failure that carries the reason. The published script prints the detail of the fourth check in the list. In a normal run that is the TCB line. When the Intel data cannot be fetched, there is no fourth check, so the parentheses stay empty and the reason is lost. That day we also ran 54 direct checks with voltage-verify quote --json. One failed, and its JSON report gave this detail for tdx.tcb:
cannot reach https://api.trustedservices.intel.com/sgx/certification/v4/pckcrl?ca=platform&encoding=pem: [Errno 111] Connection refused
Two of our five full runs on 20 October hit one such failure, each on a different instance. The other three passed nine of nine. Once the run passes, compare it with the published report:
diff published.verify.txt $M.verify.txt
1c1 < verified_at: 2026-10-16T08:05:27+00:00 --- > verified_at: 2026-10-20T13:11:08+00:00
Only the date differs. Intel's view of a platform can change over time, so a re-check reflects Intel's data on the day you run it.
Step 4: the parts that need no network
Some checks need no outside service. We ran this step inside unshare -n, a shell with no network (curl could not resolve any host: exit code 6). The outputs were the same.
First, the quote signatures, up to the Intel root that voltage-verify pins:
for i in $(seq 0 8); do jq -r ".evidence[$i].quote" $M.evidence.json > quote-$i.b64; done voltage-verify quote quote-0.b64 --offline for i in $(seq 0 8); do voltage-verify quote quote-$i.b64 --offline | tail -1; done
[PASS] tdx.structure TDX quote v4, TEE 0x81, 4940 bytes [PASS] tdx.signatures attestation key, QE binding, QE report and PCK chain verify up to the pinned Intel SGX Root CA [WARN] tdx.collateral Intel collateral skipped (--offline): TCB status and revocation not checked TDX: MRTD 261ce538b435e2d0e85fc97e254bc991... TCB ? QE ? RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED RESULT: VERIFIED
The first block is quote 0 in full. The nine lines after it are one per quote. The WARN line says plainly what offline mode skips.
Next, the nonce binding and the debug bit, without any of our tools. A TDX quote is a fixed binary layout: a 48-byte header, then the guest's report. The attributes start at byte 168, the MRTD at byte 184 and report_data at byte 568. Save this as offline_check.py in the inference-check folder, one level above the evidence:
"""Offline re-check of published inference evidence: nonce binding and debug bit,
read straight from the TDX quote bytes. Standard library only, no network.
Usage: python3 offline_check.py <folder> <model-file-prefix> [nonce]"""
import base64
import hashlib
import json
import sys
from pathlib import Path
folder, prefix = Path(sys.argv[1]), sys.argv[2]
nonce = sys.argv[3] if len(sys.argv) > 3 else (folder / f"{prefix}.nonce.txt").read_text().strip()
evidence = json.loads((folder / f"{prefix}.evidence.json").read_text())["evidence"]
listing = json.loads((folder / f"{prefix}.e2e-instances.json").read_text())["instances"]
keys = {i["instance_id"]: i["e2e_pubkey"] for i in listing}
bound = 0
for inst in evidence:
q = base64.b64decode(inst["quote"])
# TDX quote v4: 48-byte header, then the TD report (attributes, MRTD, ..., report_data).
version, tee = int.from_bytes(q[0:2], "little"), int.from_bytes(q[4:8], "little")
td_attributes, mr_td, report_data = q[168:176], q[184:232], q[568:632]
key = keys.get(inst["instance_id"])
expected = hashlib.sha256((nonce + key).encode()).hexdigest() if key else None
ok = expected == report_data[:32].hex()
bound += ok
print(f'{inst["instance_id"]} v{version} tee={tee:#x} nonce {"BOUND" if ok else "NOT BOUND"} '
f'debug {"ON" if td_attributes[0] & 1 else "off"} mr_td {mr_td.hex()[:16]}...')
print(f"{bound} of {len(evidence)} quotes carry SHA256(nonce + e2e_pubkey) in report_data")python3 ../offline_check.py . $M python3 ../offline_check.py . $M 0000000000000000000000000000000000000000000000000000000000000000 | tail -2
2124d84a-d402-4914-9db4-fa4d94e2b24f v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... 8fe1275c-a5a2-47e9-9d47-091f3242ef5a v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... e2db3683-5be1-4a33-a47c-cd422caadf3a v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... 8c94bf65-2006-4de3-a526-f9f4e55c2604 v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... 4c1f21af-821a-4d25-99a3-d0451a146db9 v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... b45cd4dc-7e41-468d-bc42-39aa7d6cfb3a v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... bd6f497a-64a1-4b5c-8ca6-45657db054dd v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... 2bd97006-3ea4-4973-8f15-04ecb856f5e8 v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... c39fa043-d22c-4ed5-bb71-d46644793740 v4 tee=0x81 nonce BOUND debug off mr_td 261ce538b435e2d0... 9 of 9 quotes carry SHA256(nonce + e2e_pubkey) in report_data c39fa043-d22c-4ed5-bb71-d46644793740 v4 tee=0x81 nonce NOT BOUND debug off mr_td 261ce538b435e2d0... 0 of 9 quotes carry SHA256(nonce + e2e_pubkey) in report_data
With the published nonce, all nine quotes are bound. With any other nonce, none is. The MRTD values match the published report.
Reading report_data from the bytes only counts if those bytes are covered by Intel's signature. Flip one bit of report_data and check again:
python3 - quote-0.b64 tampered.b64 <<'PY' import base64, sys q = bytearray(base64.b64decode(open(sys.argv[1]).read())) q[568] ^= 1 # flip one bit of report_data open(sys.argv[2], "w").write(base64.b64encode(q).decode()) PY voltage-verify quote tampered.b64 --offline
[PASS] tdx.structure TDX quote v4, TEE 0x81, 4940 bytes [FAIL] tdx.signatures quote signature does not verify with the attestation key: TDX: MRTD 261ce538b435e2d0e85fc97e254bc991... TCB ? QE ? RESULT: NOT VERIFIED (tdx.signatures)
So the two offline checks work together. The signature proves the bytes are Intel's. The byte reading proves those bytes commit to the nonce. Two things cannot be checked offline. The platform's security level and revocation need Intel's current data. The GPU evidence needs NVIDIA's service.
What this proves, and what it does not
Proved, for DeepSeek V3.2 at 08:04 UTC on 16 October 2026. Each of the nine instances serving the model:
- returned a genuine Intel TDX quote. Its signature chain verifies up to Intel's root (offline), and Intel's data on 20 October rates the platform UpToDate (online);
- had debug off;
- put
SHA256(our nonce + its E2E public key)in its quote. So the quote was made after that nonce existed, and it commits to that key; - signed a body carrying our nonce and that same quote;
- had eight NVIDIA Hopper GPUs whose evidence NVIDIA's attestation service accepted, for the same nonce value.
All nine report the same MRTD (261ce538...), the TDX measurement of the guest's initial contents.
Not proved:
- Which code the instances run. No reference measurements are published yet. The MRTD is a value you can compare over time, not a verdict.
- That a given chat response came from one of these instances. The evidence covers the instances, not each response.
- Anything about the path from you to the instance. Requests go through VoltageGPU's API over TLS. There is no end-to-end encryption from your client into the enclave.
- Freshness relative to you. We drew this nonce, so you trust our date. For your own guarantee, draw your own nonce and call
GET /v1/attestation. That needs an inference key. - Who issued the signing certificate. The certificate behind "key possession" arrives in the same response, issued by the provider's own certificate authority. The script checks the signature, not that issuer.
- Instances missing from the provider's key listing. Their binding cannot be recomputed. In the same run, 12 of 55 Qwen 3.8 instances are reported NOT CHECKABLE for that reason.
- A GPU result that will last. The GPU check depends on NVIDIA's service and on a Python package NVIDIA no longer supports. It still answered on 20 October 2026.
Every proof we publish, with the command to rerun it, is at /proofs. The same Intel check works on a bare quote from any cloud: Verify an Intel TDX quote from any cloud. To fetch evidence for your own nonce, create an inference key and start with the quickstart.