Attestable

**Product and the concrete problem it solves.** Attestable is addressing a trust gap created by the rapid movement of AI from experimentation into high-consequence operations. A model provider can state that a particular model processed a particular prompt, that approved weights were loaded, or that an inference service followed a policy, but a customer normally has to trust the provider, its datacenter, its privileged operators, and the full hardware and software stack. Re-running a frontier model is usually impossible for an outside verifier because the weights are proprietary, the input may be confidential, and the computation is too large to reproduce economically. Attestable's product thesis is to make an AI computation produce a cryptographic proof of its own execution. A relying party should be able to verify that the approved computation occurred without receiving the model weights, the private input, or a complete copy of the inference environment. The practical buyer problem is therefore not generic model monitoring. It is proving provenance and policy compliance at the boundary between an AI lab and its customer, between collaborating organizations, or between an autonomous system and the authority responsible for its behavior.

**Core technology and how it works.** The company applies zero-knowledge proofs to machine-learning inference. In the company's formulation, for a model with committed weights, an input, a random seed, and an output, Attestable generates a proof of the statement that the output equals the approved model's computation over the approved input and configuration. The proof can bind model weights, input, output, decoding parameters, and policy-relevant values; a standalone verifier can check the proof without seeing the weights and without rerunning the model. This is materially different from a digital signature held by a service operator: changing the model, input, output, or proven policy should invalidate the computation-bound proof rather than merely require trusting that the signer behaved honestly. Attestable says its software-only architecture is not dependent on a trusted execution environment or a particular hardware vendor and can run across CPUs, GPUs, accelerators, and edge devices. Its technical disclosure is unusually concrete for a newly public company. An official alpha benchmark reports proof sizes of 4.35 to 7.92 MiB and verification times of 157 to 648 milliseconds on a reference CPU for tested transformer configurations, while an Attestable company post reports 85 tokens per second proven on one NVIDIA H100 for Meta's Muse Glimmer 30B model. Those are company-generated alpha results, not independent benchmarks or a production SLA.

**Market, customers, and go-to-market.** Attestable is selling an enabling layer for organizations that need AI outputs to be confidential and independently auditable at the same time. The most natural first customers are frontier model laboratories protecting valuable weights, AI infrastructure providers serving sensitive workloads, and large enterprises or governments deploying models in finance, defense, healthcare, and critical infrastructure. A proof could be checked by a customer that wants assurance that an API response came from an approved model, by an enterprise that needs to demonstrate that an automated decision followed a documented policy, or by two institutions that want to coordinate AI systems without sharing proprietary internals. The company is not publicly naming production customers, contracts, revenue, or a repeatable deployment model, so the commercial evidence is prospective. Its likely go-to-market is technical enterprise sales and design partnerships with AI labs, model hosts, and regulated operators, where integration into inference pipelines and policy gateways can create high switching costs. The adoption hurdle is also clear: proof generation adds infrastructure, latency, and engineering complexity, and buyers may initially prefer cheaper software controls or confidential-computing assurances. Attestable must show that cryptographic verification changes procurement, liability, or operational risk enough to justify the extra layer.

**Traction, funding, and third-party validation.** The company was founded in 2025 and emerged from stealth in August 2026 with an announced $20 million Seed round led by TLV Partners and Altimeter Capital, joined by Netz Capital, Cerca Partners, Halcyon Futures, Zero Knowledge Ventures, and a group of technology angels. The financing is a significant ecosystem signal for a very young mathematical-security company, particularly because the backers include Israeli cyber founders and investors with experience in AI and cryptography. Calcalist reports that the company has 15 employees, most in Israel and the remainder in California; LinkedIn lists an 11-50 employee range. Public third-party validation is currently strongest at the team and financing level. The official site has published technical material that exposes the proof statement, benchmark conditions, security assumptions, quantization limitations, and intended model-weight-security architecture rather than presenting only a category slogan. Attestable's alpha results include support for production-scale transformer inference and sub-second verification on tested configurations, but the company explicitly notes a current context-window limit of up to 16,000 tokens and integer quantization for matrix multiplications. There are no public independent reproductions, customer references, audited performance claims, patents, certifications, or government contracts in the available record. The financing therefore validates investor conviction and technical ambition, not commercial scale or field readiness.

**Founders and team background.** Attestable was founded by three mathematicians with a rare combination of AI-security, zero-knowledge, and frontier-model experience. CEO Yogev Bar-On worked in information security before moving to California and joining RAND Corporation, where he became involved in the intersection of AI and national security and co-authored RAND work on securing AI model weights. CTO Shahar Papini worked with Bar-On in Israel's Unit 8200, then built zero-knowledge expertise at StarkWare and later worked as a senior engineer at Ilya Sutskever's Safe Superintelligence. VP of R&D Shahar Samocha also came from StarkWare, giving the founding group direct experience with proof systems rather than relying solely on general-purpose AI engineering. The combination is unusually well matched to the problem: Bar-On brings policy and threat-model exposure around model theft, while Papini and Samocha bring specialized cryptographic engineering and exposure to the computational demands of advanced AI. The weakness is equally important for diligence. The team is small, and public sources do not document a large product, enterprise-sales, reliability, or compliance organization. Building a mathematically sound prover is only the first step; turning it into a supportable inference component that works across model architectures, accelerators, customer policies, and regulated environments requires a broader operational bench.

**Competitive dynamics.** Attestable competes against both specialized proof systems and the incumbent practice of trusting the AI provider or hardware stack. EZKL and Modulus Labs represent open-source or startup approaches to zero-knowledge machine learning, while general-purpose proof infrastructure such as RISC Zero can be adapted to verifiable computation. Trusted execution environments and remote-attestation stacks from Intel, AMD, and NVIDIA offer a different trade: they can protect execution through hardware roots of trust, but require customers to trust the chip vendor, firmware, enclave implementation, and attestation keys. Confidential-computing services from hyperscalers are an important substitute because they are already integrated into cloud procurement and may be good enough for many enterprise workloads. Attestable's claimed edge is to move the trust anchor from a large datacenter and privileged hardware into a small mathematical verifier, preserve model and data confidentiality, avoid dependence on private attestation keys, and make verification independent of model size once the proof is generated. That is a compelling architecture for hostile or multi-party environments, but not yet a moat. Proof generation cost, model coverage, developer tooling, accelerator support, precision effects, and proof-system security will determine whether the approach is deployable. A rival that delivers cheaper attestation, an open standard, or hardware-accelerated proving could narrow the differentiation quickly.

**Defense, security, and resilience dual-use relevance.** Attestable's dual-use case is substantive at the core-technology level, although no defense customer or fielded military program is publicly established. In commercial security, zero-knowledge AI proofs could verify that a hosted model used approved weights and inputs, that an autonomous agent followed a policy, or that a regulated decision was generated by an authorized computation without exposing confidential data. In national-security settings, the same properties could help an allied government verify an AI service supplied by another organization, protect frontier-model weights from tampering or theft, validate AI used in intelligence analysis or command-support workflows, and create auditable boundaries between autonomous agents operating across different trust domains. The model-weight-security rationale is especially strategic: stolen weights can transfer capability, remove safeguards, and allow an adversary to operate a model outside its creator's oversight. Attestable's architecture may reduce the trusted-computing base and provide a proof that a sensitive computation occurred, even in an infrastructure environment that cannot itself be fully trusted. The limits matter. A proof establishes that a specified computation ran; it does not prove that the model is wise, the training data is unbiased, the input is truthful, or the policy is appropriate. The company's own technical material also notes side channels, physical attacks, malicious technicians, and leakage through timing or power consumption. The defense relevance is therefore credible infrastructure resilience and assurance, not proof of operational battlefield autonomy.

**Growth stage, trajectory, and key diligence risks.** Attestable should be classified as early despite its unusually large Seed financing and technically specific public launch. It is a roughly one-year-old company with a small team, no publicly named customers, no disclosed revenue, and alpha rather than independently validated production results. The upside trajectory is attractive: if cryptographic proof becomes a required control for frontier AI, model hosting, regulated inference, or inter-organizational autonomy, Attestable could occupy a foundational verification layer with high strategic leverage and strong software margins. The diligence agenda is correspondingly demanding. First, independent researchers should reproduce proving throughput, verification latency, proof sizes, and model-quality results across representative architectures rather than relying on a single H100 demonstration. Second, customers must confirm that proof overhead is acceptable at realistic batch sizes, context lengths, streaming workloads, and accelerator mixes. Third, the company must clarify its security model, hash assumptions, implementation audit status, trusted setup requirements if any, key-management boundaries, and resistance to side-channel or denial-of-service attacks. Fourth, it must demonstrate broad framework integration and a sustainable developer experience. Fifth, enterprise and government buyers will require data residency, export-control, compliance, incident-response, and long-term support answers. Finally, management must show that the market wants cryptographic proof rather than cheaper TEE attestation or contractual assurances. The next credible milestones are independent benchmark reports, a named frontier-lab or regulated-enterprise deployment, an auditable product release, and evidence that proofs reduce a measurable security or compliance burden.