Blind Audit

The core idea is solid and could receive more development. The most important next steps would be demonstrating a non-trivial challenge script beyond toy PII detection, articulating the realistic threat model more carefully (under what circumstances would a data provider cooperate, and what attacks remain possible even with TEE guarantees?), and completing the basic academic scaffolding — a conclusion, references to the TEE and AI audit literatures, and an honest assessment of what the Merkle root commitment actually buys without a counterpart protocol linking it to training runs.

I like the approach and technical detail. One question for the authors: To what extent does this approach rely on the TEE being robust? If an adversary were to undermine or tamper with the TEE, would that allow them to undermine the effectiveness of this approach?

Another question: Under what circumstances would it really be critical for someone to verify that a training dataset was safe *other than* the model provider (which presumably has access to the training dataset and therefore does not require this kind of setup)? To some extent I understand the case for verifying this in sensitive industries. Even in this setup, one could simply imagine the frontier model provider certifying that the dataset is safe (and bearing some sort of cost if that claim ends up being false in a way that causes harm).

Nonetheless, this was a cool approach, and I would encourage the authors to consider how it could apply to other problem sets.