Grade-A AI evidence reproducibility, deployed into your own cloud. Every critical AI decision recorded in a tamper-evident WORM ledger, independently timestamped, hardware-attested — and, where it matters most, reproducible bit-for-bit by a party who doesn't have to trust you.
( Why you need this )
When an AI decision is disputed — a denied claim, a clinical recommendation, a control action on live infrastructure — a log export is an assertion: trust us, this is what the model did. Regulators, incident boards and courts are moving past assertions. The EU AI Act demands tamper-evident logging for high-risk AI; US Federal Rule of Evidence 707 subjects machine-generated evidence to expert-level scrutiny. The operators who can prove rather than assert will carry the day. The AI Evidence Stack makes your critical decisions attributable, tamper-evident and — on the right model stack — independently re-runnable to the byte.
( Three uncomfortable truths )
On shared GPU infrastructure your request is batched with strangers' traffic. The batch changes the floating-point summation order; at a near-tie the top token flips; one flipped token cascades into a different answer. We demonstrate this live on a production-grade inference stack.
Recording the model hash and the prompt is not enough. Our research shows a single unrecorded parameter is sufficient to produce a different decision that still passes the partial record. Evidence must seal the complete computational closure — or it seals nothing.
A log the operator can rewrite after the fact carries exactly as much weight as the operator's word. Evidence needs to be write-once, hash-chained and independently timestamped — so alteration is detectable by anyone, without trusting the operator.
( The criterion )
The stack is the productisation of published research: proven conditions under which an AI decision is independently reproducible as evidence — and an empirical demonstration of why anything less can be forged. Together the four conditions seal the complete computational closure of the inference. Each one is necessary; remove any one and the proof collapses.
Greedy decoding — temperature 0, top-k 1 — so the decision is a pure function of its inputs. Sampling randomness is eliminated by construction, not by luck.
The exact weights, hashed and attested — not a model name, which changes silently under you. Pinned open-weight models make this provable.
The full prompt, context, tool outputs and every generation parameter, hashed into the record before execution. One unrecorded parameter breaks the closure — we proved it.
Hardware-attested inference on confidential compute (AMD SEV-SNP): cryptographic proof of which machine, which code and which configuration actually ran. Attestation proves the pin.
( The research )
Raza Sharif, CyberSecAI Ltd · 2026. Proofs of the closure conditions, the certification limits that separate reproducible decisions from merely recorded ones, and the empirical forgery demonstration. Openly published — your experts can take it apart before you buy anything.
DOI 10.5281/zenodo.22746394 →( Honest grading )
Not every model can be made reproducible, and we won't pretend otherwise. Every recorded decision is graded by what can actually be proven about it.
All four closure conditions hold: deterministic decoding on pinned open-weight models inside attested confidential compute. An independent party holding the evidence bundle re-runs the decision and gets the same bytes. This is the tier for decisions you may one day have to defend.
Frontier hosted models (closed weights, shared infrastructure) cannot satisfy the closure, so we say so. Their decisions flow into the same WORM ledger with the same integrity guarantees — graded honestly as recorded evidence, never oversold as reproducible proof.
Reproducibility covers the decision, not external side-effects — and a reproducible wrong answer is still wrong. This is an accountability layer, not a correctness oracle. If a vendor promises "fully reproducible AI" on closed hosted models, ask them for their closure conditions.
( What we deploy )
One integrated deployment. Every component on this page exists and is demonstrable today — nothing here is roadmap-ware.
( Your cloud, your keys, your data )
The evidence stack ships BYOC — bring your own cloud. It stands up inside your account, your region, your compliance boundary. Decision data never leaves your tenancy; signing keys are generated in your HSM and never exported. We operate none of it for you unless you ask us to.
Infrastructure-as-code deployment into your VPC. KMS-backed key custody, Nitro-based confidential options, single-command stand-up and tear-down.
Confidential VMs with AMD SEV-SNP attestation — the same platform our live Grade-A reference deployment runs on — with Cloud HSM key custody.
Confidential computing VMs and Managed HSM, deployed inside your subscription and your Entra governance boundary.
Sovereign, air-gapped and on-premises variants are available for critical-infrastructure operators — offline verification is a design requirement, not an afterthought.
( Where this is required )
Diagnostic support, triage and treatment recommendations end up in morbidity reviews, malpractice proceedings and regulatory submissions. Each recommendation gets a reproducible record: what the model saw, what it decided, and proof the record hasn't moved since.
driver · liability + medical device regulationEnergy, water, grid and transport operators putting AI into operational decisions face safety investigations, not just audits. When the question is "why did the system do that", the incident board needs a record it can independently re-derive — not a vendor's log export.
driver · safety cases + incident forensicsAutonomous agents acting on SCADA and industrial control systems, where a rogue action is a physical-safety event. Agent authentication for ICS via our ATTP profile, offline and air-gapped verification, and evidence hold mode for post-incident acquisition.
driver · critical-infrastructure assuranceCredit, claims, sanctions and payment decisions shaped by AI are disputed by design — by customers, regulators and counterparties. A hash-chained, independently timestamped decision record turns every dispute from an argument into a lookup.
driver · disputes + model-risk governanceWhere AI output is itself the evidence: forensic acquisition from live autonomous systems, chain-of-custody preservation, and presentation built for FRE 707 scrutiny. Replay the decision in the room, from the sealed record.
driver · admissibility + chain of custodyArticle 12 requires automatic, tamper-evident logging across the system lifetime for high-risk AI. The evidence ledger implements that obligation as cryptography rather than policy — with reproducibility as the tier above compliance.
driver · EU AI Act conformity( Engagement )
A focused engagement, not a transformation programme. Your cloud, your keys, your auditors verifying independently at the end of it.
We map your critical decisions, model estate and regulatory exposure — and grade what can be made Grade-A reproducible versus evidence-grade recorded.
The stack stands up in your AWS, GCP or Azure tenancy as infrastructure-as-code. Your keys are generated in your HSM; your data never crosses the boundary.
You get the independent-verification runbook: your auditors re-run Grade-A decisions and validate the ledger chain with standard tooling — without trusting us.
Training for engineering and compliance teams, plus the forensic procedure for evidence hold and acquisition when the day comes.