New to ShortSpan? We distil the AI-security research that matters into practitioner takeaways — edited by Ben Williams (NCC Group).Get the weekly email
// Analysis
Inference-time governance hits hard limits in practice
Published: Thu, 10 Sep 2026 • By Natalie Kestrel
Enterprise
New research says training-time rules miss where power now lives: at deployment. A 20-item taxonomy rates inference-time monitoring, verification and enforcement. Fifteen have production substrates, but cryptographic verification lags. Fine-tuning breaks model-internal guardrails, and high-capability, self-hosting deployers sidestep most controls. Hardware-level governance becomes the fallback when platforms lose sight.
Regulators and vendors have obsessed over training runs while the real action shifted to deployment. This new paper treats the inference call, not the training job, as the unit of governance. It lays out twenty mechanisms across monitoring, verification and enforcement, rates their readiness, and then does the one thing most frameworks dodge: asks how they fare against a capable adversary.
The short version: fifteen of the twenty already exist in commercial form, but the parts you most want in a knife fight are exactly the bits still stuck in research. Cryptographic verification at inference — trusted execution environment (TEE) attestations at the API, zero-knowledge proofs of inference, and hardware-backed per-output certificates — is underproductised. Without that, logs, quotas and policy checks ride on trust rather than proof.
The buried attack path
Read the adversary analysis closely. These controls hold when the deployer cooperates and the user has modest skills. They collapse against a high-capability, state-level deployer. If the deployer self-hosts, relocates inference, or shifts to distributed or consumer hardware, platform telemetry, filters and rate limits lose jurisdiction. The model still answers, just somewhere you cannot see.
Fine-tuning is the other pressure point. Anything enforced inside the model can be removed or dulled by a well-crafted fine-tune. The paper is blunt: model-internal enforcement fails under fine-tuning. Only platform-external controls and verification that binds a model’s identity survive, and those are exactly where vendors are thin today.
The taxonomy is not hand-wavy. It is anchored in four vendors’ public and commercial surfaces, with a readiness scale and a sanity check that returned a quadratic-weighted Cohen’s kappa of 0.74. It also maps mechanisms to domestic regulation, cross-border coordination, industry self-regulation and compute marketplaces. Useful scaffolding for anyone threat-modelling a deployment or writing a policy that must survive contact with reality.
Where the handoff happens
One smart inclusion is a substitution analysis: when inference-stage controls falter, governance shifts to hardware. If you cannot bind an inference to an attested identity at the API, you try to bind the compute itself. That helps explain why consumer-grade, open-weight inference is such a headache: no platform chokepoints, and hardware obligations are thin.
The uncomfortable takeaway is not complex. Against cooperative deployers and low-to-medium users, today’s tooling is serviceable. Against a determined, well-resourced deployer, nothing in the list rates adequate. Until verification primitives land at the API and are widely adopted, assume an evasive deployer wins the footrace.
Additional analysis of the original ArXiv paper
📋Original Paper Title and Abstract
Beyond Training: A Feasibility Taxonomy for Inference-Time AI Governance
Authors: Samar Ansari
Compute governance today is a governance of training: the thresholds, reporting requirements, and frontier-AI regimes now in force attach to training compute and treat the trained model as the regulatory unit. That picture is incomplete: capability increasingly migrates to the deployment stage through inference-time scaling, agentic scaffolding, and compression onto consumer hardware. This paper asks which mechanisms are available once the regulatory object shifts from the training run to the inference call. We develop a feasibility taxonomy of twenty inference-time mechanisms across monitoring, verification, and enforcement, each rated on a four-point readiness scale against a documented four-vendor evidence base. We then stress the taxonomy against a two-dimensional adversary model (three capability tiers crossed with four adversary roles) and map each mechanism to four governance scenarios (domestic regulation, bilateral or multilateral coordination, industry self-regulation, and compute-marketplace governance). Fifteen of the twenty mechanisms have commercial technical substrates in production today, although governance-grade assurance and adversarial robustness vary substantially. The adversary analysis shows that this readiness holds only against a cooperative deployer and a low-to-medium-capability user: no mechanism rates adequate against a high-capability state-level deployer, and fine-tuning removes the model-internal components of the enforcement cluster, although platform-external controls can persist. A substitution analysis connects the taxonomy to a companion hardware paper as a conditional substitution principle describing when inference-stage and hardware-stage mechanisms provide comparable regulatory coverage under stated conditions. A second-rater reliability check on a random subset of the readiness ratings returned a quadratic-weighted Cohen's kappa of 0.74.
🔍ShortSpan Analysis of the Paper
Problem
The paper examines how governance focused on training compute is becoming insufficient as capability migrates to deployment. Inference-time scaling, agentic scaffolding, and compression onto consumer hardware allow substantial capability to be realised or amplified after training, creating a gap in existing regulatory architectures that attach obligations to training runs rather than to inference calls.
Approach
The authors assemble a feasibility taxonomy of twenty inference-time mechanisms organised into monitoring, verification and enforcement. Each mechanism is operationally defined, anchored in vendor and academic evidence from four commercial providers, and rated on a four-point readiness scale. They stress-test the taxonomy using a two-dimensional adversary model (three capability tiers crossed with four adversary roles) and map mechanisms to four governance scenarios: domestic regulation, bilateral or multilateral coordination, industry self-regulation and compute-marketplace governance. They also compare inference-stage mechanisms to hardware-level counterparts and report an inter-rater reliability check on a random subset of readiness ratings.
Key Findings
Deployment-ready substrate: Fifteen of the twenty mechanisms have commercial production substrates across major vendors, so many inference-stage controls are already available in practice.
Verification gap: Cryptographic verification primitives (TEE-bounded attestation at the API, zk proofs of inference, hardware-backed per-output certificates) are underproductised or research-stage, creating a critical assurance shortfall.
Adversary-scoped limits: The available mechanisms provide substantial coverage for cooperative deployers and low-to-medium capability users but fail against high-capability state-level deployers; no mechanism rates adequate against that adversary surface.
Fine-tuning weakness: Model-internal enforcement mechanisms are defeated by fine-tuning; only platform-external controls and verification that binds model identity can detect or constrain weight modification.
Marketplace and architectural diversity: Vendors implement key primitives in operationally different ways, fragmenting uniform regulatory application; deployment platforms can add independent overlays that both help and complicate governance.
Distributed and open-weight inference: Distributed inference networks and consumer-hosted open-weight models can evade platform-mediated monitoring, shifting the regulatory handoff to hardware-layer governance.
Limitations
The evidence base covers four commercial vendors and excludes fully unfederated open-weight and self-hosted deployments. Readiness ratings are interpretive and were assigned by a primary rater with a second rater checking a subset; inter-rater agreement on that subset corresponded to substantial agreement under a quadratic-weighted metric. The taxonomy snapshots vendor productisation as of May 2026 and will require re-rating as commercial surfaces evolve.
Implications
Offensive-security implications are central. A deployer with high resources can self-host or relocate inference to evade platform telemetry, quotas and filters, making most monitoring and enforcement mechanisms ineffective. Fine-tuners can remove model-embedded safety measures so that runtime guardrails no longer trigger. Distributed inference and consumer-hosted open-weight models allow capability to be realised without crossing platform chokepoints, degrading intermediary-based controls. Cryptographic signing of tool calls and attestation primitives offer the strongest resilience because they bind outputs to an attestable identity, but the relevant verification mechanisms are not yet fully productised at the API layer. In short, capable adversaries can bypass or neutralise many inference-stage controls unless platform-independent verification and coordinated hardware-level measures are adopted.
- It surveys hardware-level controls for AI compute, grades how feasible they are, and where they might fail, then links them to governance scenarios....
- It questions the common view that restricting AI weights automatically improves safety, showing that it can push risky use into other, harder-to-con...
- It proposes a practical zero-knowledge verification framework to prove that frontier AI models were trained with the claimed compute and process, wi...
Very concise take:
- It argues to treat capability control as a separate, explicit goal from alignment and recommends a defense-in-depth, three-layer ...
- It focuses on making distillation (model copying or repurposing) harder by tying a model’s high-level powers to internal stability constraints, an a...
- It offers a formal way to cap open-world AI autonomy with explicit safety boundaries (closure gaps and delegation envelopes), aiding containment and...
