## 4 Proposed ML Attestation Method and Workflow
### ML Attestation Token
\begin{table}
\begin{tabular}{l l l} \hline \hline
**CLAIM FIELD** & **TYPE (CBOR)** & **DESCRIPTION** \\ \hline Challenge & Byte String (3) & A unique 32-byte value from the verifier to mitigate reply attacks \\
**Model information** (Array of maps) & & A unique model identifier (e.g., DOI, Name! | Creation date) \\ Model ID & Text String (3) & A unique model identifier (e.g., \"1.0.0\") \\ Model version & Text String (3) & Version of the model (e.g., \"1.0.0\") \\ Model publisher & Text String (3) & Publisher or creator of the model \\ Hash algorithm & Text String (3) & Cryptographic hash (e.g., SHA256) used for the following claims \\ Model hash & Byte String (2) & Hash of the model weights and nonce H(w! | nonce) \\ Hash of public key & Byte String (2) & Hash of the public key of the relying party \\ \hline
**Training Summary** (Array of maps) & & Dataset name as per the creator or DOI \\ Dataset name & Text String (3) & Identifier of the dataset used for training (e.g., UUID, hash) \\ Last update & Tag (6) & Standard Date/Time string \\ \hline
**Performance** (Array of maps) & & Accuracy of the model \\ Accuracy & Floating-point (7) & F1-Score & Floating-point (7) \\ SRAM footprint & Unsigned Integer (0) & Memory footprint of the model at runtime \\ FLASH footprint & Unsigned Integer (0) & Flash memory used by the model \\ Inference latency & Floating-point (7) & Average inference time on device \\ \hline
**Model Parameters** (Array of maps) & & The format of the model input. Array of \\ Input format & Array (4) & unsigned integers. \\ Output format & Array (4) & The format of the model output. Array of \\ Quantization & List(4) & Quantization details \\ Method & Text String (3) & The quantization method used. e.g., \"8-bit\", \\ Bits & Unsigned Integer (0) & Number of bits used for quantization. e.g., 8 \\ Weight Quantization & Text String (3) & Describes the quantization method for the model \\  & & weights. e.g., “uniform”, “asymmetric” \\ Activation Quantization & Text String (3) & Describes the quantization method for activations. e.g., “symmetric”, “asymmetric” \\ Post-training & Unsigned Integer (0) & Indicates if post-training quantization was used. e.g., 1 (true), 0 (false) \\ \hline
**ML Framework** (Array of maps) & & The name of the machine learning framework used, \\ Name & Text String (3) & e.g., “TensorFlow”, “PyTorch”, “ONNX” \\ Version & Text String (3) & The version of the machine learning framework, \\  & & e.g., -2.8.0” \\ Runtime & Text String (3) & he runtime environment of the framework, e.g., \"TensorFlow Lite\", “uTensor”, “uTVM” \\ Hardware acceleration & Unsigned Integer (0) & Indicates if the model uses hardware accelerators (NPU, DSP) \\ Supported operators & List (4) & List of operators supported by the runtime framework \\ Operation N & Text String (3) & Name of each supported operation, e.g., “Conv2D”, \"BatchNorm\", “Dense” \\ \hline
**Model architecture** (Array of maps) & & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: ML-EAT token definition. Proposed generic claims and model architecture subclaims. Model architecture claims not shown are specific the ML model and framework. employed by ML frameworks. This approach enables a verifier or relying entity to use the string-encoded keys of model subclaims directly, bypassing extra processing. Conversely, adopting integer-encoded claim keys requires a prior consensus for each ML framework along with a mapped key set for all corresponding ML layers and parameters.