Attested Code, Unattested Behavior: Soundness Gaps in TEE-Based Attestation for AI Inference

Language model services are increasingly deployed through remote infrastructure, where users cannot observe how a given output was produced. This opacity allows a provider to present outputs as coming from the advertised system even if the service used a different model or configuration. When such outputs affect high-stakes decisions, users and auditors therefore need more than a provider's promise that the claimed execution actually occurred. To enable verifiable AI inference, recent systems use Trusted Execution Environment (TEE)-based attestation to produce hardware-rooted evidence about inference execution. Ideally, this evidence binds the output to the model identity, inference configuration, hardware path, user input, and system-provided context. However, we observe that existing TEE-based AI systems often bind only part of the execution path. As a result, a dishonest provider can exploit the incomplete TEE evidence, which passes verification while leaving output-determining properties unbound, giving users false confidence in the advertised execution. We study these failures as soundness gaps in TEE-based attestation systems for AI inference. Across six real-world TEE-based attestation systems, we identify recurring gaps and organize them into an attestation lifecycle model, a taxonomy of nine failure classes, and eighteen runnable proof-of-concept attacks. Our results show that TEE-based attestation for AI inference is sound only when the verifier checks evidence that binds together the model identity, configuration, hardware path, user input, and system-provided context that produced the output.