There was a post from Anthropic yesterday on "provable inference", basically demoing cryptographic proof that the model you call is indeed the model you get.

It would be much better to take this a step further and include in the proof mechanistic readouts of activations/directions/circuits so the user could detect if nerfing or moralizing is active in the response