  Regulations increasingly call for various assurances from machine learning
(ML) model providers about their training data, training process, and the
behavior of resulting models during inference. For better transparency,
companies (e.g., Huggingface and Google) have adopted model cards and
datasheets which describe different properties of the training datasets and
models. In the same vein, we introduce the notion of an inference card to
describe the properties of a given inference (e.g., binding output to the model
and its corresponding input). We collectively refer to these as ML property
cards.
  A malicious model provider can include false information in ML property
cards, raising a need for verifiable ML property cards. We show how to realized
them using property attestation, technical mechanisms by which a prover (e.g.,
a model provider) can attest different ML properties during training and
inference to a verifier (e.g., an auditor). However, prior attestation
mechanisms based purely on cryptography are often narrowly focused (lacking
versatility) and inefficient. There is a need to efficiently attest different
types properties across the ML model training and inference pipeline.
  Recent developments make it possible to run and even train models inside
hardware-assisted trusted execution environments (TEEs), which can provide
highly efficient attestation. We propose Laminator, the first framework for
verifiable ML property cards using hardware-assisted ML property attestations
to efficiently furnish attestations for various ML properties for training and
inference. It scales to multiple verifiers, and is independent of the model
configuration.
