VoltageGPU confidential inference: attestation, real run of 2026-10-16
=====================================================================

WHAT WAS DONE
For three confidential models, we generated a random 32-byte nonce and asked our
inference provider's evidence endpoint (the one our GET /v1/attestation relays, see
https://docs.voltagegpu.com/inference#attestation) for the evidence of EVERY instance
serving the model at that moment. Each instance was then checked:

  1. Intel TDX quote: signature chain to the Intel SGX Root CA, TCB status from Intel PCS
     (fetched at verification time), PCK revocation lists.
     Tool: voltage-verify 0.2.1 (pip install voltage-verify), command `voltage-verify quote`.
  2. Nonce binding: the first 32 bytes of report_data equal SHA256(nonce + e2e_pubkey),
     e2e_pubkey being the instance's ML-KEM public key, as the provider's public guide
     documents (github.com/chutesai/chutes-api/blob/main/docs/tee-verification.md).
  3. Debug bit off (td_attributes).
  4. Key possession: attested_body is signed (RSA PKCS#1 v1.5, SHA-256) by the instance
     certificate, and carries our nonce and this same quote.
  5. NVIDIA GPU evidence: nv-attestation-sdk 2.7.3 with NVIDIA's remote attestation
     service (NRAS), nonce = the same SHA256(nonce + e2e_pubkey).

RESULTS (full report per model in <model>.verify.txt)
  deepseek-ai/DeepSeek-V3.2-TEE   9 of 9 instances fully verified (8 NVIDIA Hopper GPUs each)
  google/gemma-4-31B-turbo-TEE   29 of 29 instances fully verified (1 NVIDIA Blackwell GPU each)
  Qwen/Qwen3.8-27B-TEE           43 of 55 instances fully verified (1 NVIDIA Blackwell GPU each).
                                 The other 12 were not in the provider's public E2E key list when we
                                 read it: their quotes are genuine and up to date and their signed
                                 answers carry our nonce, but the report_data binding cannot be
                                 recomputed without the key, so they are reported as NOT CHECKABLE.
  No instance failed a check.

FILES, PER MODEL
  <model>.request.txt          the request: endpoint, nonce, time, HTTP status
  <model>.nonce.txt            our nonce
  <model>.evidence.json        the raw response, byte for byte
  <model>.e2e-instances.json   instance ids and E2E public keys, from the provider's
                               GET /e2e/instances/<chute_id>. That listing returns a few
                               instances per call, so it was read several times and merged;
                               its single-use invocation tokens are left out.
  <model>.verify.txt           the verification report
  verify_inference_evidence.py the verification script used here
  SHA256SUMS                   checksums of every file above

REPRODUCE
  Your own evidence:  NONCE=$(openssl rand -hex 32)
                      curl -H "Authorization: Bearer $VOLTAGE_API_KEY" \
                        "https://api.voltagegpu.com/v1/attestation?model=<model>&nonce=$NONCE"
  This run, re-checked: on Linux, pip install voltage-verify==0.2.1 nv-attestation-sdk cryptography
                      python verify_inference_evidence.py . <model-file-prefix> voltage-verify
  (Intel's TCB status can change over time: a later re-check reflects Intel's data of that day.)

WHAT THIS PROVES
  At that moment, the instances serving these models were genuine Intel TDX guests with an
  up-to-date TCB and debug off, answering our fresh nonce, holding the E2E key bound into
  their quote, with NVIDIA GPUs whose attestation NVIDIA's service accepted.

WHAT IT DOES NOT PROVE
  That a given chat response came from one of these instances, or which code they run:
  the provider publishes no reference measurements yet.