{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "K-0020",
    "slug": "sampling-and-assurance",
    "title": "Sampling and assurance",
    "aliases": [
      "random sampling",
      "spot checks",
      "statistical assurance"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Checking a random sample of accelerators, workload segments or outputs rather than all of them, so that violations are caught with a calculable probability.",
    "sources": [
      {
        "source": "S-0029",
        "supports": "number of chips to sample per monitoring period to catch at least one chip from a violating run with probability p; fewer samples for larger runs; the Prover cannot predict which chips are inspected; sampled segment recomputation",
        "locator": "§3.1–3.2, Equation 1, Table 1; §5.1"
      },
      {
        "source": "S-0017",
        "supports": "hash commitment to sampled weights before the prover learns whether a step will be audited",
        "locator": "pre-training scheme"
      },
      {
        "source": "S-0067",
        "supports": "recomputation server re-runs random samples of workload packets",
        "locator": "Concrete inference-only retrofitting proposal"
      },
      {
        "source": "S-0018",
        "supports": "a covert adversary is caught if it fails to stay hidden even once; random sampling needs to catch only a single instance of cheating; sampled inspections as primary defences",
        "locator": "threat model; defence layers"
      }
    ],
    "related": [
      "K-0009",
      "K-0024",
      "K-0003",
      "K-0018"
    ],
    "type": "concept",
    "url": "https://trustbutveri.fyi/concepts/sampling-and-assurance/",
    "source_file": "content/concepts/sampling-and-assurance.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "Sampling-based assurance checks a random sample of accelerators, workload segments or outputs instead of all of them, and chooses the sample size so that a violation is caught with a desired probability [[S-0029]].\n\nShavit gives a formula for how many accelerators a verifier must inspect in each monitoring period to find at least one accelerator used in a rule-violating training run with a chosen probability [[S-0029]]. The required number falls as the run occupies a larger share of the prover's accelerators, so larger runs need fewer inspections [[S-0029]]. Sampling works only if the prover cannot predict what will be checked [[S-0029]] or change its records once it knows; in one scheme, the prover [[K-0024|commits]] a hash of sampled weights at each training step before it learns whether that step will be audited [[S-0017]]. The same logic applies to [[K-0009|recomputation]] of random training segments in [[M-0006|proof-of-learning]] [[S-0029]] and of random workload samples in [[M-0003|reproducible computation packets]] [[S-0067]]. Against a covert adversary, sampling works through deterrence: one system overview notes that such an adversary is caught if it fails to stay hidden even once, and treats randomly sampled inspections as a primary defence [[S-0018]].",
    "body_text": "Sampling-based assurance checks a random sample of accelerators, workload segments or outputs instead of all of them, and chooses the sample size so that a violation is caught with a desired probability [S-0029]. Shavit gives a formula for how many accelerators a verifier must inspect in each monitoring period to find at least one accelerator used in a rule-violating training run with a chosen probability [S-0029]. The required number falls as the run occupies a larger share of the prover's accelerators, so larger runs need fewer inspections [S-0029]. Sampling works only if the prover cannot predict what will be checked [S-0029] or change its records once it knows; in one scheme, the prover commits a hash of sampled weights at each training step before it learns whether that step will be audited [S-0017]. The same logic applies to recomputation of random training segments in proof-of-learning [S-0029] and of random workload samples in reproducible computation packets [S-0067]. Against a covert adversary, sampling works through deterrence: one system overview notes that such an adversary is caught if it fails to stay hidden even once, and treats randomly sampled inspections as a primary defence [S-0018].",
    "referenced_by": [
      {
        "id": "M-0024",
        "title": "Bounding unexplained information in outputs",
        "url": "https://trustbutveri.fyi/mechanisms/bounding-unexplained-information/"
      },
      {
        "id": "M-0019",
        "title": "Chip registries and manufacturing records",
        "url": "https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0010",
        "title": "On-chip telemetry from timing, memory and performance counters",
        "url": "https://trustbutveri.fyi/mechanisms/on-chip-telemetry/"
      },
      {
        "id": "M-0006",
        "title": "Proof-of-learning and training-transcript verification",
        "url": "https://trustbutveri.fyi/mechanisms/proof-of-learning/"
      },
      {
        "id": "M-0003",
        "title": "Reproducible computation packets",
        "url": "https://trustbutveri.fyi/mechanisms/reproducible-computation-packets/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "M-0016",
        "title": "Timed challenge-response and memory-occupation challenges",
        "url": "https://trustbutveri.fyi/mechanisms/timed-challenge-response/"
      },
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "M-0005",
        "title": "Zero-knowledge proofs of training constraints",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-training-constraints/"
      },
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/"
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0002",
        "title": "DiFR (Divergence From Reference)",
        "url": "https://trustbutveri.fyi/implementations/difr/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "I-0008",
        "title": "SASH confidential network logger",
        "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/"
      },
      {
        "id": "C-0001",
        "title": "Compute stock is at most a declared amount",
        "url": "https://trustbutveri.fyi/claims/compute-stock-is-bounded/"
      },
      {
        "id": "C-0010",
        "title": "There is no undeclared relevant compute",
        "url": "https://trustbutveri.fyi/claims/no-undeclared-compute/"
      },
      {
        "id": "C-0007",
        "title": "A training run stayed within declared limits",
        "url": "https://trustbutveri.fyi/claims/training-within-declared-limits/"
      },
      {
        "id": "K-0024",
        "title": "Cryptographic commitment",
        "url": "https://trustbutveri.fyi/concepts/cryptographic-commitment/"
      },
      {
        "id": "K-0003",
        "title": "Positive and negative claims",
        "url": "https://trustbutveri.fyi/concepts/positive-and-negative-claims/"
      },
      {
        "id": "K-0009",
        "title": "Recomputation",
        "url": "https://trustbutveri.fyi/concepts/recomputation/"
      },
      {
        "id": "K-0016",
        "title": "Undeclared compute",
        "url": "https://trustbutveri.fyi/concepts/undeclared-compute/"
      },
      {
        "id": "K-0002",
        "title": "Verifier",
        "url": "https://trustbutveri.fyi/concepts/verifier/"
      }
    ]
  }
}