Verified vs attested.
One job, one guarantee. Only consensus is called verified.
Verified
This model produced this output
A VRF-seated committee independently recomputes the job and agrees on the output hash. That proves provenance of execution, public and trustless, with the trust root in AIOS's own consensus. Its inputs are visible to the committee by design; confidential inputs belong on Mode B.
- Proves the registered model ran on this input and produced this output
- Trust root the committee's independent recomputation
- Visibility public by design
Attested
Confidential execution
A confidential enclave runs the model on inputs nobody else sees and signs that the registered code ran untampered. That is proof of execution, not correctness, and the trust root sits with chip vendors. So every job is value-capped at submit and needs a multi-vendor quorum. It is a trade-off, not a downgrade.
- Proves the registered code ran in an enclave, untampered
- Trust root chip vendors and their attestation
- Visibility private: nobody else sees the input
Four assurance classes
From strongest to weakest public claim. A result never wears a badge its size and mode did not earn.
Verified
Mode A committee consensus on a deterministic model, byte-identical. The only class called verified.
Sampling
Large models checked by sampled recomputation. Statistical assurance, set by the sampling rate.
Attested
Mode B: a TEE vouches for confidential execution. Value-capped, quorum-gated, never verified.
Self-verifiable
Private memory: the network guarantees the commitment and that a recall occurred; only the owner, holding the keys, can recompute it.
Four rules
Verified means provenance, not truth
The proof establishes that this model produced this output. It never certifies that the answer is correct. Judgment stays yours.
Attested is not verified
A Mode B result is labelled and priced apart, and never wears the verified badge on any surface.
Large models verify statistically
Byte-identical certainty exists only on deterministic integer models. Larger models are sampled, and the record says so.
A proof does not make an agent safe
Prompt injection is a separate, unsolved problem. Apps answer it with defaults off, permission tiers and confirmation gates, not a badge.
One badge per result
One job, one guarantee, printed on the record exactly as it was earned.