hey hey, wisdom here.
lately i've been living inside two things
@eigenlabs shipped:
darkbloom.dev by
@gajesh and
ecdsa.fail by
@bbuddha_xyz. they pulled my thinking onto two lines: human coordination, people doing something together instead of waiting on a gatekeeper, and being able to see what we're handed.
you watched it with fable 5: launched to everyone, then days later a government export directive came down and access went dark, all users at once. that's not a one-off, it's the shape of what's coming. the strongest models will run sealed inside TEEs, enclaves meant to keep them from being extracted or tampered with. the future runs behind attestation. even when a thing is dark and you can't touch it, you should get to verify what you were offered.
so i built
attest.fyi.
confidential-inference providers ship a hardware seal meant to prove the model answering you is the one they promised. a provider can hold a valid seal and quietly serve a smaller or quantized model behind it. the seal is real, the model is not. nobody checks that gap.
attest.fyi does: it verifies the seal, fingerprints the model that actually answered, and posts a verdict per provider. you don't take my word for it, every verdict reproduces.
anyone can verify a provider and add their own verdict, one commit per signer, public and auditable. people get to check these systems together, and honest providers get a way to prove they're honest.
i audited the confidential-AI providers you can use today. for 57% of them, you cannot verify which model answered you. by name:
- RedPill: the one that holds up. intel tdx nvidia hopper, every response signed inside the enclave. a full pass, trustless end to end, you check it with zero trust in me.
- Venice: also passes, but its "verifiable E2EE" is just Phala underneath. the same dstack stack as RedPill, rebranded as its own.
- NanoGPT: sells "H100 per-request ECDSA." it's reselling Chutes. its own report literally says attestation_type: chutes, running on nvidia blackwell.
- Chutes: tagged "AMD SEV-SNP." it isn't. it's intel tdx nvidia blackwell, and its api only hands you an opaque token, not a quote you can check.
- PPQ: tagged "SEV-SNP Tinfoil." it's a bare proxy with no attestation at all. every attestation path 404s. the model checks out behaviourally, but there's no seal.
- NEARAI: real intel tdx seal, but it proxies closed models (claude, gpt, gemini) and the open ones are too big to fingerprint. seal real, model not checkable.
- EigenAI: a confidential proxy to closed frontier models, and it only accepts attested callers, a token minted inside EigenCompute. i can't audit it from the outside, by design. to verify it i'd have to join the network. fitting that the one i can't black-box is the one that inspired me.
side note: from past work EigenAI passes, it serves what it says it serves. but it only accepts attested callers, so i can't black-box it from the outside the way i can the others. you'd have to join the network to check it yourself. fitting that the one i can't audit blind is the one that inspired this.
so, i give you
attest.fyi
cc:
@sreeramkannan