<?xml version="1.0" encoding="UTF-8"?>
<reference anchor="I-D.tsyrulnikov-rats-attested-inference-receipt" target="https://datatracker.ietf.org/doc/html/draft-tsyrulnikov-rats-attested-inference-receipt-01">
   <front>
      <title>Attested Inference Receipt (AIR): A COSE/CWT Profile for Confidential AI Inference</title>
      <author initials="B." surname="Tsyrulnikov" fullname="Borys Tsyrulnikov">
         <organization>Cyntrisec</organization>
      </author>
      <date month="March" day="14" year="2026" />
      <abstract>
	 <t>   This document defines the Attested Inference Receipt (AIR), an
   application-layer COSE_Sign1 envelope carrying CWT claims profiled
   per the Entity Attestation Token (EAT) framework.  An AIR receipt
   binds model identity, input/output hashes, attestation-linked
   metadata, and operational telemetry into a single signed artifact
   suitable for independent third-party verification of a confidential
   AI inference event.

   AIR v1 targets single-inference receipts emitted by workloads running
   inside hardware-isolated Trusted Execution Environments (TEEs).  AIR
   is attestation-linked: it carries measurements and a hash reference
   to the platform attestation evidence associated with the inference,
   but it does not replace platform-specific attestation verification.
   This version defines AWS Nitro Enclaves and Intel TDX measurement
   profiles only.  Pipeline chaining, multi-inference receipts, and
   extensibility mechanisms for additional claim or platform profiles
   are out of scope.

	 </t>
      </abstract>
   </front>
   <seriesInfo name="Internet-Draft" value="draft-tsyrulnikov-rats-attested-inference-receipt-01" />
   
</reference>
