Glossary
Plain-language definitions of the terms that recur in verifiable AI, with their Chinese equivalents.
A
- Agent identity智能体身份
An identifier and associated credentials that distinguish a particular AI agent, or an instance of one, from the person or organization it acts for.
- AI Assurance Level (AAL)AI 保障等级（AAL）
One of four levels in a 2026 proposal for frontier AI auditing, where higher levels give greater confidence in an audit's findings.
- AI bill of materials (AI-BOM)AI 物料清单（AI-BOM）
A machine-readable inventory of an AI system's models, datasets and dependencies, with their provenance (where each came from) and training information.
Topic: Model & data supply chain
- Attestable audit基于远程证明的审计
An evaluation run inside a trusted execution environment so that the hardware attests which model, test set and code produced the reported result.
- Attestation evidence证明证据
The claims that an attester generates for a verifier to check, such as measurements and configuration data.
- Attestation report证明报告
The data structure in which a TEE or device reports its measurements and other claims, signed with a key rooted in the hardware. Intel calls it a quote.
- Attestation result证明结果
The output a verifier produces after checking an attester's evidence. The verifier vouches for it, and a relying party uses it to make its decision.
- Attester证明方
In remote attestation, the device or environment that produces evidence about its own state so that others can judge how far to trust it.
B
- Benchmark contamination基准测试污染
The presence of a benchmark's test items in a model's training data, which can inflate the model's score on that benchmark.
- Bitwise reproducibility逐位可复现性
The property that rerunning a computation produces exactly the same bits. Floating-point arithmetic does not guarantee it when the order of operations changes, for example across hardware or batch sizes.
- Black-box audit黑盒审计
An audit in which the auditor can only query a system and observe its outputs.
- Build provenance构建溯源
Verifiable metadata describing where, when and how a software artifact was built, including the build platform and its inputs.
Topic: Model & data supply chain
C
- Confidential computing机密计算
Protecting data while it is being processed, by running the computation inside a hardware-based trusted execution environment (TEE) that supports remote attestation.
- Confidential VM机密虚拟机
A virtual machine that runs as a trusted execution environment, such as one based on AMD SEV-SNP or Intel TDX. Its memory is encrypted and isolated from the host and from the hypervisor, the software that manages virtual machines.
- Content Credentials内容凭证
The term that the Coalition for Content Provenance and Authenticity (C2PA) uses for signed provenance manifests. A manifest is attached to or linked with a media asset and records claims about the asset's origin and edits.
D
- Dataset provenance数据集溯源
A traceable record of a dataset's sources, creators, license terms and subsequent uses.
Topic: Model & data supply chain
- Delegated authorization委托授权
A mechanism through which a person grants an agent limited authority to act on their behalf. Examples are a signed mandate and an authorization token that covers only specific permissions.
- Double-blind evaluation双盲评测
An evaluation in which the evaluator never sees the model's weights and the developer never sees the test items. One way to do this is to let the weights and the test items meet only inside a secure enclave.
E
- Endorsement背书
In remote attestation, a signed statement that vouches for the integrity of an attester's capabilities, such as collecting claims and signing evidence. It usually comes from the hardware manufacturer.
F
- Formal specification形式化规约
A precise, machine-readable statement of what a system must or must not do, which determines what a formal proof actually establishes.
Topic: Formal verification
- Formal verification形式化验证
Using machine-checked mathematical proof to show that a system satisfies a precise specification for all possible inputs or executions, including ones that were never tested.
Topic: Formal verification
- Freshness新鲜性
Assurance that attestation evidence is recent enough to reflect the attester's current state. To establish freshness, the signed evidence usually includes a nonce (an unpredictable value that the verifier chooses) or a trusted timestamp.
G
- GPU confidential computingGPU 机密计算
A GPU operating mode that isolates the workload's memory from the host. It also encrypts data passing between the GPU and a confidential VM, and lets the GPU produce its own signed attestation report.
- Guaranteed safe AI可保证安全的 AI
A family of approaches in which an AI system comes with an auditable proof certificate. The certificate shows that the system satisfies a safety specification relative to a world model, a mathematical description of how the system affects the outside world.
Topic: Formal verification
H
- Hard binding硬绑定
In C2PA, one or more cryptographic hashes that tie a manifest to the exact bytes of an asset or of a portion of it.
- Hardware-enabled mechanisms (HEMs)硬件赋能机制（HEM）
Features built into AI chips or servers that can verifiably report or enforce properties such as location, usage or the amount of computing power used.
L
- Location verification位置验证
Checking where an AI chip operates, for example by timing its signed responses to landmark servers at known locations.
M
- Measurement度量值
A cryptographic hash (a digital fingerprint) of code, firmware or configuration. The hash is recorded when the item is loaded, and attestation evidence reports it.
- Model commitment模型承诺
A cryptographic value, such as a hash of the weights, that a provider publishes to bind itself to one specific model. Later proofs or audits can then refer to the commitment.
- Model signing模型签名
Attaching a cryptographic signature to model files, or to a manifest of their hashes. Users can then verify who published a model and that it has not changed since.
Topic: Model & data supply chain
- Model substitution模型替换
A provider's secret use of a different model from the one it advertises and charges for, such as a cheaper model or a quantized (lower-precision) version.
N
- Neural network verification神经网络验证
Algorithms that prove a trained network satisfies a property for every input in a specified region. One such property is robustness to small changes in the input.
Topic: Formal verification
O
- Oblivious HTTP (OHTTP)不经意 HTTP（OHTTP）
An IETF protocol in which a relay forwards encrypted HTTP requests, so the server never sees the client's IP address and the relay never sees the request content.
P
- Privacy-enhancing technologies (PETs)隐私增强技术（PETs）
Technologies that let parties compute on data while limiting what is revealed, such as secure enclaves, secure multiparty computation and differential privacy.
- Proof assistant证明助手
Software in which proofs are written in a formal language and the computer checks every step. Lean is one example.
Topic: Formal verification
- Proof of inference推理证明
Evidence that a specific output was produced by running a specific model on a specific input.
- Proof of learning学习证明
A record of a training run that lets a verifier check that a set of weights came from that training. It includes weights saved at intervals and the data and settings used between them.
- Proof of training data训练数据证明
A protocol that lets a model trainer convince a verifier which training data produced a given set of model weights.
R
- Refereed delegation仲裁式委托
A scheme in which a client sends the same computation to several providers, and a referee settles any disagreement by recomputing only the disputed step. The client then gets the correct result as long as at least one provider is honest.
- Reference value参考值
An expected value, such as the measurement of an approved software release, that a verifier compares with the claims in attestation evidence.
- Relying party依赖方
In remote attestation, the party that uses attestation results to decide whether to trust a device, for example before sending it data or releasing a key.
- Remote attestation远程证明
A process in which a device produces signed evidence about its hardware and software state. A verifier checks the evidence, and a relying party uses the result to decide whether to trust the device.
- Reproducible build可复现构建
A build that any party can repeat from the same source code, environment and instructions to obtain bit-for-bit identical artifacts.
Topic: Model & data supply chain
- Root of trust信任根
A component, usually in hardware or firmware, that performs a critical security function and is trusted without further verification. An example is the on-chip component that holds the key used to sign attestation reports.
S
- Side-channel attack侧信道攻击
An attack that infers secret information from the physical effects of a computation instead of reading the information directly. Such effects include timing, power consumption and electromagnetic emissions.
- Soft binding软绑定
In C2PA, a fingerprint or invisible watermark that links content to its manifest and can help recover the manifest when metadata has been lost.
- Software bill of materials (SBOM)软件物料清单（SBOM）
A formal, machine-readable record of the components used to build a piece of software and their supply-chain relationships.
Topic: Model & data supply chain
- Structured access结构化访问
Letting others interact with an AI system under the developer's control, usually through a cloud interface, instead of releasing the system openly.
T
- Tamper-evident log篡改可检测日志
A log built with hash chains or hash trees so that any later deletion or alteration of entries can be detected.
- Transparency log透明日志
An append-only public log of entries such as signatures or software measurements. Anyone can check that an entry is included and detect if entries are later removed or rewritten.
Topic: Model & data supply chain
- Trusted computing base (TCB)可信计算基（TCB）
All the hardware, firmware and software that must work correctly for a system's security policy to be enforced.
- Trusted execution environment (TEE)可信执行环境（TEE）
A hardware-isolated environment for running code, such as an enclave or a confidential VM. It is designed to keep the code and data inside it confidential and unmodified, even if the operating system, the hypervisor or the cloud operator is compromised.
V
- Vericoding形式化验证代码生成（vericoding）
Generating code together with a machine-checked proof that the code meets a given formal specification. By contrast, generating code from a natural-language description gives no guarantee that the code is correct.
Topic: Formal verification
- Verifiable computation可验证计算
An arrangement in which the party that runs a computation also returns evidence that lets someone else check the result with much less work than redoing it.
- Verifiable credential可验证凭证
A credential, such as a digital driver's license or an education certificate, that records claims made by an issuer. Tampering with it can be detected, and who issued it can be checked cryptographically.
- Verifiable transparency可验证透明性
A requirement that Apple set out for Private Cloud Compute: outside researchers must be able to check the service's privacy and security guarantees and confirm that production servers run the software they inspected. Client devices enforce it by sending data only to servers whose attested measurements match a release in a public log.
- Verifier (attestation)验证方（远程证明）
In remote attestation, the party that checks an attester's evidence against reference values, endorsements and policy, and produces an attestation result.
W
- Watermark数字水印
A signal embedded in content, usually one that people cannot perceive. A detector can later find it to identify the content's source, such as the model that generated it.
- White-box audit白盒审计
An audit in which the auditor can examine a system's internals, such as weights, activations and gradients.
Z
- Zero-knowledge proof (ZKP)零知识证明（ZKP）
A cryptographic proof that convinces a verifier that a statement is true without revealing anything else. For example, it can show that an output came from a model the provider committed to, while keeping the model's weights secret.
- zk-SNARK零知识简洁非交互式知识论证（zk-SNARK）
A zero-knowledge proof system whose proofs are short, fast to verify and require no interaction between the prover and the verifier.
- zkML零知识机器学习（zkML）
The use of zero-knowledge proofs to verify machine-learning computations such as inference, training or evaluation.