# Laminator: Verifiable ML Property Cards using Hardware-assisted Attestations

arXiv: https://arxiv.org/abs/2406.17548 · HTML: https://mlsanity.com/paper/2406.17548/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Jun 2024.

## Built on by (most cited first, 10 of 10)

- [Atlas: A Framework for ML Lifecycle Provenance & Transparency](https://mlsanity.com/paper/2502.19567/) (2025)
- [AIBoMGen: Generating an AI Bill of Materials for Secure, Transparent, and Compliant Model Training](https://mlsanity.com/paper/2601.05703/) (2026)
- [Proof-of-Guardrail in AI Agents and What (Not) to Trust from It](https://mlsanity.com/paper/2603.05786/) (2026)
- [Combining Machine Learning Defenses without Conflicts](https://mlsanity.com/paper/2411.09776/) (2024)
- [Verifiable Fine-Tuning for LLMs: Zero-Knowledge Training Proofs Bound to Data Provenance and Policy](https://mlsanity.com/paper/2510.16830/) (2025)
- [Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines](https://mlsanity.com/paper/2601.23132/) (2026)
- [OVIG: Optimistic Verification of AI Training Integrity via Gradient Signals](https://mlsanity.com/paper/2606.21045/) (2026)
- [A Large-Scale Measurement of AI Bill of Materials Completeness in Hugging Face Models](https://mlsanity.com/paper/2607.17242/) (2026)
- [Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance](https://mlsanity.com/paper/2609.10105/) (2026)
- [ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor](https://mlsanity.com/paper/2609.21515/) (2026)

## Abstract (arXiv)

Regulations increasingly call for various assurances from machine learning (ML) model providers about their training data, training process, and model behavior. For better transparency, industry (e.g., Huggingface and Google) has adopted model cards and datasheets to describe various properties of training datasets and models. In the same vein, we introduce the notion of inference cards to describe the properties of a given inference (e.g., binding of the output to the model and its corresponding input). We coin the term ML property cards to collectively refer to these various types of cards. To prevent a malicious model provider from including false information in ML property cards, they need to be verifiable. We show how to construct verifiable ML property cards using property attestation, technical mechanisms by which a prover (e.g., a model provider) can attest to various ML properties to a verifier (e.g., an auditor). Since prior attestation mechanisms based purely on cryptography are often narrowly focused (lacking versatility) and inefficient, we need an efficient mechanism to attest different types of properties across the entire ML model pipeline. Emerging widespread support for confidential computing has made it possible to run and even train models inside hardware-assisted trusted execution environments (TEEs), which provide highly efficient attestation mechanisms. We propose Laminator, which uses TEEs to provide the first framework for verifiable ML property cards via hardware-assisted ML property attestations. Laminator is efficient in terms of overhead, scalable to large numbers of verifiers, and versatile with respect to the properties it can prove during training or inference.