The research program.
A verification idea enters unproven and leaves proven, standardized, and deployed in the open. Four stations carry it the whole way.
Experimentation
A multi-silicon research cluster the community can physically touch.
with VCF Learn more ↓Validation
Adversarial red-teaming against the attacks that matter most.
Government red teams Learn more ↓Standards
Open cryptographic standards that the whole industry adopts.
IETF · CCC · OCP Learn more ↓01 · Experimentation
An AI cluster the verification community can actually touch.
Hardware verification, side-channel analysis, TEE research, network inspection — this work needs physical, bare-metal access to datacenter-grade GPUs that no cloud provider offers. So we built it, and opened it to the community in partnership with the Verifiable Compute Foundation.
Multi-silicon by design. A dedicated bare-metal cluster spanning NVIDIA H100, H200, and B300 (Blackwell) and AMD Instinct MI355X — because real verification can't assume one vendor's chip. Pre-installed NVIDIA drivers, CUDA, fabric manager, and OFED. Schedule workloads via Kubernetes or Slurm.
Root of the machine. BIOS/UEFI-level access, IPMI/BMC management, custom firmware, and NVIDIA Confidential Computing enabled. Opens up directions like side-channel analysis to distinguish GPU workload types, or probing TEE boundaries under real datacenter conditions.
Physical access, supervised. Install instrumentation, swap NICs, change BIOS/firmware, and run network-level experiments on real frontier-class hardware. Need a different setup? We can reconfigure to meet your needs.
Qualifying safety and verification research groups receive compute access at no cost, allocated through an open fair-share process and covered by research funders through the Verifiable Compute Foundation. If your needs exceed the free allocation, dedicated remote capacity is also available.
Run an experiment with us →Silicon in the cluster
Verifiable Compute Foundation — operates the community research cluster with Lucid.
02 · Validation
Verification means surviving the attacks that matter most.
An architecture is only as good as the attacks it withstands. Before a government adopts verifiable compute, its own agencies need to try to break it — so we run adversarial programs with national security agencies and government research institutes, on a Builder-vs-Breaker model where the teams trying to break it are never the ones who built it.
Red-teamed for government adoption. We run structured adversarial programs with national security agencies and government research institutes — the buyers who need the strongest possible proof before they trust verifiable compute.
Builder vs Breaker. The teams trying to break the architecture are never the teams who built it. Independent red teams keep full technical authority over their own methodology and reporting.
Four capabilities under fire: data residency, compute integrity, confidentiality, and AI Passports — each one attacked, not just asserted.
The output is public. Fully documented, open-source, state-backed reference architectures — built to be demonstrated to policymakers and submitted to standards bodies.
An 18-month validation program with RISE — Research Institutes of Sweden — deploying our verification platform on their GPU infrastructure at the ICE Datacenter in Luleå. RISE's cybersecurity group runs the adversarial testing and delivers formal vulnerability and penetration-test reports, retaining full technical authority over its own methodology.
Builder
Lucid deploys the verification platform on real GPU infrastructure.
Breaker
RISE red teams attack it independently and report what breaks.
◉ ICE Datacenter — Luleå, Sweden
03 · Standards
Four questions. Four open standards.
Verifiable AI compute comes down to four questions that today are asserted but never proven. We turn each into evidence a regulator, a sovereign customer, or an auditor can independently verify — as open standards, so the whole industry can adopt them.
Sovereignty Certificates
Where, physically, is the chip running this workload? Proven by ping-based location attestation — a bound derived from the speed of light, which no VPN can fake.
View the standard at sovcert.org →Verifiable Compute Identity
Who — and which agent — is using this chip, and did it stay in scope? Human identity-proofing, sanctions screening, and signed agent delegation chains.
Attestable Audit Profile
What can the deployed model actually do? Independent, cryptographically signed evaluations bound to a specific model checkpoint.
Verifiable Compute Accounting
How much compute, of what class, by whom? Hardware-rooted FLOP counting the operator can't reset.
Standards bodies & communities we engage with
04 · Deployment
Verification, in production — and in the open.
What survives the belt doesn't stay in the lab. We ship it as part of our NeoCloud offering for government and enterprise clients — verifiable AI compute as a service — and we publish the reference architectures as open hardware so anyone can build, inspect, and certify their own.
Get in touch
Tell us about your deployment.
Bring us your security and confidentiality specs — we'll show you what verifiable compute can prove, end to end.
© 2026 Lucid Computing · Research