Verifying compute location

Underwriting credible location‑contingent commitments with evidence

John Hoopes
CAISH Hardware Assurance Programme
22 August 2026

Where is this device?

Anchors at known coordinates probe the attester; nonce challenge
Receipt: signed, timestamped response — a time series of signed pings
Physics: round trip can't beat the speed of light — hard outer bound
Corroborative: authenticated GNSS, camera feeds, satellite imagery, UWB, NFC
Anna + Ryan went deep here — the SovCert measurement program
[frag 1] E — say: "E is the evidence — a sequence of signed stamps: s-one, s-two, up to s-m"
[frag 2] C — say: "C is the claim under test — a pair: a declared location, ell, and a time interval, T"
[frag 3] concrete output: append-only signed evidence logs

A receipt doesn't point at a location — it erases everything outside a circle
Assessment = intersection of many circles
Per-anchor bundling = redundancy discounting — same path never counted twice
Q travels with the map: prior, interval, anchor honesty ε ("epsilon"), attester posture, forgery cost
Bar: pairwise verification — sufficient to convince a skeptical verifier
[frag 1] say: "The evaluation function takes the claim and the evidence, and returns an assessment — a posterior, pi, with its qualifiers, Q"
pi = the posterior — the belief map you'll see in the demo
[frag 2] Bayes ("bays") — say: "Pi of x — the probability the machine was at x, given the evidence — is proportional to the likelihood of the evidence given x, times the prior"
shorthand (safe with any mathematician): "posterior is proportional to likelihood times prior"
x = a candidate location — one grid cell of the demo's map
P(E|x) — say: "P of E given x — how plausible this evidence would be, had the machine been at x"
(pocket: P(E|x) factorizes across anchors — per-anchor bundling, redundancy discounting)
[frag 3] output — say: "the location credibility assessment — the pair pi and Q: the belief map, plus the assumptions it rests on"
→ FLIP TO THE VIZ TAB HERE — watch belief update receipt by receipt, ~60s

Sample sets of pings from the evidence logs; now ask policy questions
Containment: P(inside authorized zone) = posterior mass in the polygon
Change detection: has it moved? (time series) · Co-location: same data center?
Absence of evidence → flag; cryptographic authorization certificates lapse
[frag 1] containment: π is mass per grid cell over interval T, sums to 1
say: "The probability of conformance is the sum of pi of x over every cell x inside the authorized zone Z"
zone = union of disjoint cells → P(inside) is exactly the sum of their masses
continuous intuition: area under the posterior within the geofence — same object
[frag 2] say: "The verdict is an indicator: one if the probability of conformance clears the threshold tau, zero otherwise"
τ ("tau") is a policy judgment (false accusation vs missed evasion) — deliberately outside evidence evaluation
[frag 3] concrete output: boolean or probability — no more
(pocket: boundary cells = implementation choice; result conditional on Q)
ZK "extremely feasible" (Pascal) · MPC likely feasible (Pascal, Jack Cheng) — open problems

Anna Katariina Wisakanto  ·  anna@wisakanto.com
Ryan Bevin  ·  rbevin01@qub.ac.uk
John Hoopes  ·  john@johnx.co