S2S · Silicon-to-Signature · patent pending · compute-side root

NVIDIA attests the GPU once.
Then nothing.

Confidential-computing attestation proves the GPU is real, but only once, at startup. Every inference that happens after that is not tied to it anymore. Swap the model, reroute the device, serve a cheaper version as the full one, change the output. The hardware attestation still passes. S2S keeps watching. Every inference gets chained into a window that ties back to the hardware evidence and a code Hive sends, signed with ML-DSA-65, and anyone can check it offline.

HONEST STATUS · READ FIRST

The crypto core is built and works. 11 out of 11 tests pass (seven attack types plus other checks). The verifier makes zero network calls. Real silicon is still pending a CC-mode GPU. Every piece of origin evidence in the reference build is flagged simulated=True. Nothing on this page pretends to be a live hardware receipt, and there is no live-silicon benchmark because none exists yet. Honesty is the product.

11 / 11tests pass: 7 attacks plus other checks

≈9 µshook emit p99, off the hot path

~2000×faster than the ≈18ms synchronous signing approach

0network calls in the verifier. Sockets are blocked outright in testing.

The gap · flip the switch

One attestation at boot. Then hours of inference nobody is watching.

The blue flash on the left is nvtrust at startup: a genuine GPU check, 1 to 3 seconds, done once. Everything that streams after it is not tied to anything. Any of those dots could be a swapped model, a rerouted device, or an altered output, and the attestation stays green anyway. Flip S2S on and watch every inference link back to the evidence.

time since last hardware attestation: 0h 00m 00s · and counting S2S · OFF · inferences unbound

The seven attacks · run each one

Hardware attestation passes. S2S fails it. Every time.

These seven attacks are both our test cases and the demo. All seven pass in the crypto core today, tested against evidence flagged simulated=True. Pick an attack. The left panel is NVIDIA telling the truth. The right panel is S2S catching the lie anyway.

NVIDIA hardware attestation

VALID

Hive S2S chain of custody

BROKEN

The epoch · Kᵢ = commit(H ‖ S ‖ M ‖ Cᵢ ‖ Kᵢ₋₁) · tap any link

Each link locks in the one before it. Break one, lose everything after it.

Each inference locks in a fingerprint of the one before it. That is what closes the gap. Tap any link in the chain to tamper with it and watch every link after it die. Then heal it and watch the chain come back together.

EPOCH INTACT · 24 inferences · hash-chained · anchored to H ‖ S

The hot path · untouched

Making the receipt takes about 9µs. Serving never waits on it.

≈18 ms

signing right on the hot path. That is the simple design S2S refuses to use.

≈9 µs

S2S hook emit() p99, done without blocking. If it fails, serving keeps going, but the receipt fails closed.

Bring the silicon. We bring the watcher.

We're looking for CC-mode design partners running vLLM. You bring the GPU in CC mode. We wire up the nvtrust flow, add in Hive's code, and run the seven attacks with simulated=False. You walk away with the first inference receipts that a regulator, auditor, or court can check offline, without having to trust NVIDIA, the provider, the model owner, or Hive.

H100 SXM5 · PCIe H200 SXM5 B200 SXM6 GB200 CPU TEE · SEV-SNP / TDX

S2S · Silicon-to-Signature · patent pending · crypto core proven 11/11 · real silicon pending a CC-mode GPU · all reference-build evidence flagged simulated=True · we never fabricate a receipt · S2S proves what happened and who had it, not whether it was correct (that is zkML, out of scope) · VM-level attestation is not GPU attestation · B300 HGX fabric-manager binding gap noted, not hidden · CC-mode overhead ~2 to 5%, attestation 1 to 3s once at startup · ML-DSA-65 · NIST FIPS 204 · Hive Civilization · Wyoming, USA

NVIDIA attests the GPU once.Then nothing.