Scaling trust in confidential AI requires a common language

Confidential computing shifts trust verification from internal data center checks to multi-party decisions involving model providers, users, and infrastructure operators. As AI systems integrate components from multiple suppliers, attestation must extend beyond server integrity to include workload deployment and connection-level trust. Evidence alone is insufficient; verifiers require authoritative endorsements and reference values from hardware, firmware, and software sources across the supply chain.

The lack of a unified mechanism forces system builders to integrate vendor-specific interfaces and formats, creating an unsustainable integration tax. Each new component or supplier combination risks bespoke integrations, complicating scalability for verifiers operating locally or as remote services. The IETF’s RATS working group addresses this by developing interoperable standards like Entity Attestation Token and Concise Reference Integrity Manifest to harmonize attestation formats and interactions.

To further reduce fragmentation, the RATS working group is advancing CoSERV, a new IETF work item designed to standardize how verifiers retrieve endorsements and reference values from complex supply chains. CoSERV introduces a uniform API that enables verifiers to query, bundle, and cache trust artifacts using HTTP caching semantics, minimizing redundant network traffic for frequently used but rarely updated data.

Arm, Fujitsu, Linaro, and others are collaborating through the open-source Veraison project to implement and refine these standards. Veraison serves as both a proving ground for emerging attestation standards and a repository of reusable software components, creating a feedback loop where practical implementation informs further standardization before widespread deployment.