The trust problem in AI: privacy, integrity and verification
A thoughtful post on Reddit captures a growing unease in the AI community: we are being asked to trust complex systems without the means to verify what they did with our data. You can read the full discussion here: The trust problem in AI is getting worse and nobody wants to talk about it.
“You send your data to some API endpoint and hope for the best.”
The core complaint is simple: hallucinations, prompt injection and data leakage keep making headlines, while adoption races ahead in high-stakes domains like finance and healthcare. For many organisations, especially in regulated sectors, “trust us” is not a control. They need proof.
Why this matters for UK organisations
For UK teams, this is not just a technical debate – it is a compliance and risk issue. Under UK GDPR and the Data Protection Act 2018, controllers must ensure appropriate technical and organisational measures when processing personal data. The ICO has specific guidance on AI and data protection, including transparency, data minimisation and security by design (ICO guidance).
Financial services firms face additional scrutiny on outsourcing, operational resilience and third-party risk from the FCA (FCA guidance). If you cannot demonstrate where data went, which model ran, and how it was controlled, auditors will push back – as the Reddit author’s fintech has experienced.
What “verifiable inference” actually means
Verifiable inference is about proving – not asserting – that an AI prediction was run by a specific model on specific inputs, under specific controls, without leaking data. At minimum, verification should cover:
- Model identity – cryptographic proof of the exact model weights/version used.
- Execution integrity – evidence the code and environment were not tampered with.
- Data privacy – proof that plaintext data was not exposed beyond the trusted boundary.
- Policy compliance – logs and controls that map to regulatory requirements (e.g., retention, access, residency).
For readers new to some terms: a transformer is the neural network architecture behind most modern large language models (LLMs). Prompt injection is a technique where an attacker manipulates the model via crafted inputs. Hallucination refers to confident but incorrect outputs. RAG (retrieval-augmented generation) combines a model with a document retriever; it improves grounding, but introduces new security considerations in the retrieval layer.
Technologies that can prove things today
Trusted execution environments (TEEs) and remote attestation
TEEs create hardware-isolated enclaves where code and data are protected even from cloud administrators. Remote attestation produces a cryptographic report that a specific signed binary ran inside a genuine enclave.
- Microsoft Azure Confidential Computing – product docs
- AWS Nitro Enclaves – product docs
- Google Cloud Confidential Computing – product docs
In practice, TEEs can provide evidence for model version pinning, execution integrity, and data privacy in-use. Combined with robust key management (customer-managed keys) and strict logging policies, they are currently the most practical route to “provable” private inference in the cloud.
Alternatives and complements (with trade-offs)
- On-premise or on-device inference – keeps data entirely within your boundary. Good for sensitive workloads; you must manage security, patching and model governance yourself.
- Differential privacy – adds statistical noise to protect individuals in training data. Helpful for training; less applicable to per-request inference privacy.
- Homomorphic encryption (HE) – computation on encrypted data. Promising but still performance-constrained for large models (see OpenFHE).
- Secure multiparty computation (MPC) – splits computation across parties without revealing inputs. Strong guarantees, heavy operational overhead.
- zkML (zero-knowledge proofs for ML) – cryptographic proofs that a model ran correctly. Research is advancing, but proofs for modern LLMs remain too slow for production at scale (for an overview, see this zkML survey).
Bottom line: TEEs plus rigorous governance are deployable now. HE/MPC/zkML are strategically important, but not yet drop-in replacements for most enterprise inference.
Practical steps to close the AI trust gap now (UK-ready checklist)
- Do a Data Protection Impact Assessment (DPIA) for any AI that touches personal data. Map data flows, retention, and access controls (ICO guidance).
- Constrain data flows. Prefer on-premise, virtual private cloud, or confidential computing. Enforce data residency in the UK/EU if required.
- Pin model versions and record cryptographic hashes of weights or containers. Treat models like critical software assets.
- Use remote attestation where possible. Store attestation reports with request IDs to prove which binary and environment handled each inference.
- Disable logging of prompts/outputs by default. If logs are essential, hash or redact sensitive fields and set strict retention.
- Bring your own keys (BYOK) and keep them in a dedicated KMS or HSM. Limit provider access using explicit key policies.
- Guard against prompt injection. Implement input/output validation, content scanning, and isolated tool access for agent features.
- Adopt structured evaluation (evals) and red-teaming. Track hallucination rates and safety failures against your own test sets.
- Prepare an audit pack: DPIA, data flow diagrams, supplier due diligence, security certifications (e.g., ISO 27001), attestation samples, and incident response playbooks.
- For healthcare, align with the NHS Data Security and Protection Toolkit (DSPT).
What to ask AI vendors before you integrate
- Can you provide a data flow diagram and residency locations for inference and logging?
- Is there a no-retain or zero-logging mode, enforceable by contract?
- Do you support confidential computing and remote attestation? Which hardware and what evidence will we get per request?
- How do we pin and verify the exact model version at inference time?
- Can we use customer-managed keys, and what are the precise key access controls?
- What security certifications do you hold, and which controls map to UK GDPR?
- How do you mitigate prompt injection and data exfiltration through tools or connectors?
- What is your data deletion SLA and verification process?
- Do you provide model cards or documentation of known limitations and training sources?
- How can we export audit logs and evidence for our regulators and customers?
Reality check: the industry needs proofs, not promises
The Reddit author is not being paranoid. The trust bar must rise as AI moves into safety- and finance-critical decisions. The good news: there are pragmatic ways to harden privacy and integrity today, and credible roadmaps for stronger cryptographic proofs tomorrow. Regulators are already signalling what good looks like – the NIST AI Risk Management Framework and the ICO’s guidance are sensible starting points for governance and risk controls.
For builders, this is an opportunity: if you can deliver verifiable inference – evidence of model identity, private execution and policy compliance – you gain a real competitive edge. For buyers, start standardising your due diligence questions and require technical proof, not just marketing claims.
Further reading and next steps
- Original Reddit thread: The trust problem in AI is getting worse and nobody wants to talk about it
- ICO – AI and Data Protection: official guidance
- FCA – Outsourcing and operational resilience: framework
- Azure, AWS, and Google confidential computing docs linked above.
- If you are experimenting with small automations, see my practical guide to keeping data flows explicit in tools like Sheets: How to connect ChatGPT and Google Sheets (Custom GPT).
Trust in AI will not be built by press releases. It will be built by proofs.
