Found in the docs:

https://kveritas.org/docs/benchmarks - What a verifier learns:

> "A run of committed code, on attested hardware at time T, reading a model with hash m and a dataset with hash d, produced score S.” If d is a public benchmark, they also confirm it is the real benchmark, without you exposing it. The score is also cross-checked by the compute-cost certificate, which confirms the evaluation consumed the compute a real forward pass over the data requires.

They should really put that front and center. Still not a complete enough description, but something at least.