Arm Backs CoSERV, a Common API to Scale Trust in Confidential AI
Arm says attestation in confidential AI has become an ecosystem-wide problem, and argues that open standards such as CoSERV, backed by open-source code, can make trust scalable. In a blog post, the company describes CoSERV as a common way for verifiers to obtain the data they need to judge whether a system can be trusted.
- Arm says attestation in confidential AI is now an ecosystem-wide challenge because systems combine components from many suppliers.
- CoSERV is an adopted work item in the IETF RATS working group, designed as a common way for verifiers to get endorsements and reference values.
- A single API would let verifiers query, bundle and cache artifacts, using standard HTTP caching semantics.
- Arm, Fujitsu, Linaro and others are working on the open-source Veraison project to test attestation standards.
- CoSERV has pre-RFC status, so the specification is not yet finalized.
Why attestation is no longer just a data center matter
According to Arm, attestation has traditionally been an internal concern for infrastructure providers. Operators check the integrity of servers and decide whether services may run or connect to other resources, and those decisions stay within the infrastructure being managed.
AI systems change that picture. Arm points out that they increasingly combine CPUs, GPUs and other accelerators, firmware, software and services from multiple suppliers, while more parties have a stake in whether the system can be trusted. Model providers want assurance that valuable models run only in appropriately protected environments. Users want their data protected while it is processed. Infrastructure providers still need to verify the underlying platform.
As a result, Arm says, trust decisions can occur when workloads are deployed and when individual connections are made, and the information needed can come from many places across the hardware and software supply chain.
The integration tax of many languages
Remote attestation lets a system produce evidence about its identity and state so another party can decide whether to trust it. Arm stresses that evidence alone is not enough. A verifier also needs authoritative information to evaluate it, such as endorsements establishing information about hardware, or reference values describing the expected state of firmware and software.
In a heterogeneous AI system, those sources may come from multiple suppliers, each with its own mechanism. Arm calls the result an "integration tax": a growing set of vendor-specific interfaces, formats and sources that every verifier must understand. Verifiers may also be remote services or run locally inside an application or endpoint. Without a shared way to connect verifiers with the information they need, each new combination of components and suppliers risks creating another bespoke integration.
IETF RATS and the role of CoSERV
Arm points to the Internet Engineering Task Force's Remote ATtestation procedureS (RATS) working group, which provides an architectural framework for attestation and develops standards for formats, interaction models and mechanisms. The group has produced standards at different stages of maturity and adoption, including the Entity Attestation Token (EAT) and the Concise Reference Integrity Manifest (CoRIM).
Those efforts have so far focused on data formats and broad interaction patterns. Arm argues that the ecosystem now needs complete APIs. CoSERV, the Concise Selector for Endorsements and Reference Values, is an adopted work item in the RATS working group. According to Arm, it is meant to be a common conveyance mechanism through which verifiers obtain endorsements and reference values from potentially complex supply-chain sources.
Arm says the aim is not to dictate how each supplier creates its trust information, but to give verifiers a more uniform way to get it. Through a single API, a verifier can query for relevant artifacts, collect them into bundles and cache them for appropriate periods. Standard HTTP caching semantics can reduce unnecessary network traffic for artifacts that are used often but change rarely. For developers, Arm says, this layer has the potential to replace many point-to-point integrations with reusable tools and interfaces.
Open source as a proving ground
Arm says standards must work in real implementations. Arm, Fujitsu, Linaro and others are working on Veraison, an open-source project that serves as a proving ground for emerging attestation standards and provides reusable software components for developers building attestation systems.
The company describes a feedback loop: standards inform implementation, implementation exposes practical questions that are hard to spot from specifications alone, and those lessons help refine the standards before wide deployment.
CoSERV is still evolving. Arm notes that its pre-RFC status means the specification is not finalized, which leaves room for vendors and implementers to test the approach and bring real-world requirements. At OCP, Arm and Fujitsu are sharing more about the effort and why a common approach to endorsement and reference-value distribution matters for confidential computing and confidential AI.
What it means for the ecosystem
Arm frames confidential AI as one example of a broader shift toward more heterogeneous systems and more complex supply chains, where trust can no longer rely on every vendor, platform and verifier building one-off connections to every other participant.
For builders of attestation infrastructure, the practical promise is fewer bespoke integrations and more reusable components. For the wider market, the message is that strong roots of trust and secure individual components are not sufficient on their own: shared mechanisms are also needed. Because CoSERV is not yet final, the outcome depends on how much input and testing it receives from vendors and implementers.
