{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "I-0001",
    "slug": "toploc",
    "title": "TOPLOC",
    "aliases": [
      "TOPLOC v2"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims.",
    "summary": "TOPLOC is a hashing scheme for checking that an inference provider ran the model, prompt and numerical precision it claims. During generation, the provider records a compact fingerprint of the model's largest last-layer activations. A verifier re-runs the sequence in one pass and checks that the fingerprints match within set tolerances. The tolerances absorb harmless differences between GPUs. The peer-reviewed paper reports catching every tested change to model, prompt or precision, with no false positives or negatives. Proofs take 258 bytes per 32 generated tokens. TOPLOC is open source. Prime Intellect, its developer, uses it to accept or reject work from untrusted computers in its decentralized training and data-generation runs. As of September 2026 no independent security evaluation has been published. The authors list attacks it cannot yet catch, such as speculative decoding with a cheaper model. Subtle changes are also harder to detect than large ones.",
    "technical": "- The prover commits to its activations every 32 generated tokens. It takes the top-k values of the last hidden layer, with k = 128 in the main configuration. It encodes their indices and values as a polynomial over an integer field, with a modulus chosen to be injective on the index set [[S-1000]]. The result is k two-byte coefficients. For Llama 3.1-8B-Instruct that is 258 bytes per 32 tokens, against 262 KB for storing the embeddings directly [[S-1000]].\n- The verifier decodes the proof and recomputes the top-k values with a prefill pass. It counts exponent mismatches and computes the mean and median mantissa differences. Validation succeeds if all three are below their thresholds. For bf16 the thresholds are 38, 10 and 8 [[S-1000]].\n- The hardware tests used 1× A100, 1× RTX 4090 and 2× RTX 4090 GPUs, with FlashAttention 2, PyTorch SDPA and FlexAttention. The authors read the activations through a vLLM hook [[S-1000]].\n- Prime Intellect reports that validation is up to 100 times faster than the original inference [[S-1002]] [[S-1003]]. It reports that proof generation cut tokens-per-second throughput by about 1% in INTELLECT-2 [[S-1003]].\n- Prime Intellect reports that TOPLOC v2 adds reproducible Gumbel noise for categorical sampling, so that verifiers can check token sampling. Version 2 also extends the scheme to pipeline-parallel inference [[S-1004]].\n- The package is published on PyPI as `toploc`. The latest tag is v0.1.6 [[S-1001]].",
    "category": "cryptographic-computational",
    "secondary_categories": [],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Checks that the provider produced outputs with the claimed model weights, prompt and precision."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "analysis",
    "hardware_requirement": "none",
    "prover_cooperation": "required",
    "confidentiality": "revealing",
    "depends_on": [],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.0",
      "rationale": "R2. The code is public and peer-reviewed tests ran on real GPUs, but only Prime Intellect relies on it and no one has evaluated its security independently.\n\n- **R1** met: the peer-reviewed paper sets out the design, the claim and the threat [[S-1000]]. The claim is that the provider used the stated model, prompt and precision. The threat is undisclosed changes to any of them.\n- **R2** met: a public MIT-licensed implementation exists [[S-1001]]. The paper reports results on A100 and RTX 4090 GPUs across several models, attention implementations and one- and two-GPU tensor parallelism [[S-1000]]. Prime Intellect also reports using it in a 32-billion-parameter decentralized training run [[S-1003]].\n- **R3** not met. Criterion (a) asks for reliance by another party or production-grade availability. Prime Intellect's own production use might count [[S-1003]] [[S-1004]]. No other party is documented relying on TOPLOC for a verification decision. Criterion (b) asks for an independent evaluation, and it fails. No independent audit, red-team or peer-reviewed security analysis has been published. DiFR's comparison measures detection accuracy against communication cost [[S-0016]]. It is not a security evaluation.",
      "evidence": [
        "S-1000",
        "S-1001",
        "S-1003"
      ],
      "next_level_gaps": [
        "An independent public security evaluation, such as an audit, red-team or peer-reviewed analysis, that tests adaptive attacks like the spoofing and speculative-decoding cases the TOPLOC authors list.",
        "A party other than Prime Intellect relying on TOPLOC for a verification decision."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Speculative decoding goes undetected",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "The TOPLOC authors state that it cannot detect speculative decoding. In speculative decoding, a provider decodes with a cheaper model and uses the larger model only for prefill.",
        "sources": [
          "S-1000"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Last-layer activations could be spoofed",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "The TOPLOC authors name spoofing of the last hidden layer's activations as a potential attack. A provider could do this by pruning intermediate layers or by using a smaller model.",
        "sources": [
          "S-1000"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Subtle modifications are harder to detect",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "The TOPLOC authors state that large changes to the model or prompt are straightforward to detect, but subtle modifications are harder. In preliminary experiments, the margin separating fp8 from bf16 generation was small. The authors did not test whether TOPLOC distinguishes types of KV-cache compression.",
        "sources": [
          "S-1000"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Tolerance leaves covert bandwidth",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "TOPLOC accepts approximate matches. A check of this kind can put an upper bound on the covert bandwidth available to an adversary, but it cannot close that bandwidth. The limit applies to all statistical verification schemes.",
        "sources": [
          "S-0020"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "No independent security evaluation has been published, and Amodo Design rates red-teaming of recomputation schemes as 'not started'.",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": [
          "S-1008"
        ]
      },
      {
        "text": "The verifier must run the model itself, which suits the paper's setting of providers serving open-weights models.",
        "theme": "privacy-leakage",
        "blocked_by": null,
        "sources": [
          "S-1000"
        ]
      }
    ],
    "challenge_themes": [
      "adversarial-validation",
      "protocol-soundness",
      "privacy-leakage"
    ],
    "organizations": [
      "O-0100"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-1000",
        "supports": "design, commitment and validation algorithm, thresholds, experiments, limitations",
        "locator": "abstract; §3.1; §4; §5.1-5.7; §6.1-6.5"
      },
      {
        "source": "S-1001",
        "supports": "public implementation, licence, release tag",
        "locator": "README; releases"
      },
      {
        "source": "S-1002",
        "supports": "provider-reported validation speed and SGLang/vLLM integrations",
        "locator": "whole post"
      },
      {
        "source": "S-1003",
        "supports": "provider-reported use in INTELLECT-2; checks; eviction of failing nodes; proof-generation overhead; validation speed",
        "locator": "§2.3; §2.4.2"
      },
      {
        "source": "S-1004",
        "supports": "provider-reported TOPLOC v2 sampling verification, pipeline-parallel extension and pipeline replay in SYNTHETIC-2",
        "locator": "verification section"
      },
      {
        "source": "S-0016",
        "supports": "independent comparison with Activation-DiFR",
        "locator": "§6; Fig. comparing communication cost"
      },
      {
        "source": "S-0017",
        "supports": "independent description of the TOPLOC scheme",
        "locator": "TOPLOC section"
      },
      {
        "source": "S-0020",
        "supports": "limits of statistical verification",
        "locator": "§1"
      },
      {
        "source": "S-1008",
        "supports": "status as an initial recomputation scheme under testing; recomputation red-teaming rated 'not started'",
        "locator": "Recomputation algorithms and Recomputation red-teaming items"
      }
    ],
    "concepts": [
      "K-0008",
      "K-0009",
      "K-0024"
    ],
    "kind": "open-source-project",
    "developer": [
      "O-0100"
    ],
    "realises": [
      "M-0001"
    ],
    "homepage": "https://www.primeintellect.ai/blog/toploc",
    "repo": "https://github.com/PrimeIntellect-ai/toploc",
    "type": "implementation",
    "url": "https://trustbutveri.fyi/implementations/toploc/",
    "source_file": "content/implementations/toploc.md",
    "flags_all": [
      "provider-reported",
      "ai-drafted"
    ],
    "body_markdown": "## What it is\n\nTOPLOC is a method for checking that an inference provider used the model configuration it claims [[S-1000]]. It hashes intermediate activations with a compact locality-sensitive hashing scheme, a kind of hash that gives similar outputs for similar inputs [[S-1000]]. Researchers at Prime Intellect and Together AI published it at ICML 2025 [[S-1000]].\n\nThe paper targets providers that run open-weights models on their own hardware and serve them through APIs [[S-1000]]. It considers four undisclosed changes such a provider might make [[S-1000]]:\n\n- lower precision;\n- KV-cache compression;\n- altered weights, whether distilled, merged or pruned;\n- an altered system prompt.\n\nThe code is MIT-licensed and installable as a Python package [[S-1001]]. Prime Intellect reports integrations with vLLM and a fork of SGLang [[S-1002]].\n\n## How it works\n\nThe provider records the 128 largest-magnitude values of the last hidden layer, and their indices, as it generates [[S-1000]] [[S-0017]]. It encodes them compactly as a polynomial and stores the result as a proof [[S-1000]] [[S-0017]]. The verifier re-runs the full sequence in a single forward pass. It recomputes the same top values and compares them with the proof [[S-1000]] [[S-0017]].\n\nThe verifier accepts if the number of exponent mismatches and the mean and median mantissa differences are all below set thresholds [[S-1000]]. The thresholds absorb reorderings of the computation caused by different GPU types, tensor-parallel layouts and attention kernels [[S-1000]].\n\nPrime Intellect's INTELLECT-2 run combined TOPLOC with other checks. Each inference worker generated a TOPLOC proof for every sequence [[S-1003]]. Validators also checked termination, the logit distribution and deterministic data sampling [[S-1003]]. Prime Intellect reports that a later version, TOPLOC v2, adds reproducible Gumbel noise so that verifiers can also check token sampling [[S-1004]].\n\n## Evidence\n- The TOPLOC paper reports detecting unauthorized changes to models, prompts or precision with 100% accuracy, and no false positives or negatives in its evaluations [[S-1000]]. The tests used Llama 3.1-8B-Instruct, INTELLECT-1-Instruct and Gemma-2-9B on UltraChat prompts. A model-differentiation test also included Llama 3.1-70B-Instruct [[S-1000]]. Proofs take 258 bytes per 32 new tokens [[S-1000]].\n- Validation held across A100 and RTX 4090 GPUs, one- and two-GPU tensor parallelism, and three attention implementations [[S-1000]].\n- Prime Intellect reports using TOPLOC to verify rollouts from untrusted inference workers when training a 32-billion-parameter model [[S-1003]]. Nodes whose files fail validation are \"slashed and evicted\" [[S-1003]]. Prime Intellect also reports using TOPLOC v2 to verify thousands of nodes in SYNTHETIC-2, a distributed data-generation run [[S-1004]].\n- The authors of [[I-0002|DiFR]], a related scheme, report that Activation-DiFR Pareto-dominates TOPLOC (does at least as well on both communication cost and detection accuracy) across their tested models [[S-0016]].\n- Amodo Design's status page lists TOPLOC among initial recomputation schemes now being tested on relevant hardware and models [[S-1008]].\n\n## Limitations\nThe TOPLOC paper lists five limitations [[S-1000]]:\n\n- The margin separating fp8 from bf16 generation is small, and the authors did not test KV-cache compression.\n- The method cannot detect speculative decoding in which a cheaper model does the decoding.\n- Inference consumers could mine for \"unstable\" prompts that tend to fail validation.\n- An attacker could spoof last-layer activations by pruning intermediate layers or using a smaller model.\n- Subtle modifications are harder to detect than large ones.\n\nThe original method checks activations, not token sampling [[S-1000]]. Prime Intellect reports that TOPLOC v2 adds sampling checks [[S-1004]].\n\nTOPLOC accepts approximate matches, so it shares the general limit of statistical schemes. It can bound an adversary's covert freedom but cannot eliminate it [[S-0020]].\n\nNo independent red-team or audit has been published. All deployment evidence comes from the developer [[S-1003]] [[S-1004]].",
    "body_text": "What it is TOPLOC is a method for checking that an inference provider used the model configuration it claims [S-1000]. It hashes intermediate activations with a compact locality-sensitive hashing scheme, a kind of hash that gives similar outputs for similar inputs [S-1000]. Researchers at Prime Intellect and Together AI published it at ICML 2025 [S-1000]. The paper targets providers that run open-weights models on their own hardware and serve them through APIs [S-1000]. It considers four undisclosed changes such a provider might make [S-1000]: - lower precision; - KV-cache compression; - altered weights, whether distilled, merged or pruned; - an altered system prompt. The code is MIT-licensed and installable as a Python package [S-1001]. Prime Intellect reports integrations with vLLM and a fork of SGLang [S-1002]. How it works The provider records the 128 largest-magnitude values of the last hidden layer, and their indices, as it generates [S-1000] [S-0017]. It encodes them compactly as a polynomial and stores the result as a proof [S-1000] [S-0017]. The verifier re-runs the full sequence in a single forward pass. It recomputes the same top values and compares them with the proof [S-1000] [S-0017]. The verifier accepts if the number of exponent mismatches and the mean and median mantissa differences are all below set thresholds [S-1000]. The thresholds absorb reorderings of the computation caused by different GPU types, tensor-parallel layouts and attention kernels [S-1000]. Prime Intellect's INTELLECT-2 run combined TOPLOC with other checks. Each inference worker generated a TOPLOC proof for every sequence [S-1003]. Validators also checked termination, the logit distribution and deterministic data sampling [S-1003]. Prime Intellect reports that a later version, TOPLOC v2, adds reproducible Gumbel noise so that verifiers can also check token sampling [S-1004]. Evidence - The TOPLOC paper reports detecting unauthorized changes to models, prompts or precision with 100% accuracy, and no false positives or negatives in its evaluations [S-1000]. The tests used Llama 3.1-8B-Instruct, INTELLECT-1-Instruct and Gemma-2-9B on UltraChat prompts. A model-differentiation test also included Llama 3.1-70B-Instruct [S-1000]. Proofs take 258 bytes per 32 new tokens [S-1000]. - Validation held across A100 and RTX 4090 GPUs, one- and two-GPU tensor parallelism, and three attention implementations [S-1000]. - Prime Intellect reports using TOPLOC to verify rollouts from untrusted inference workers when training a 32-billion-parameter model [S-1003]. Nodes whose files fail validation are \"slashed and evicted\" [S-1003]. Prime Intellect also reports using TOPLOC v2 to verify thousands of nodes in SYNTHETIC-2, a distributed data-generation run [S-1004]. - The authors of DiFR, a related scheme, report that Activation-DiFR Pareto-dominates TOPLOC (does at least as well on both communication cost and detection accuracy) across their tested models [S-0016]. - Amodo Design's status page lists TOPLOC among initial recomputation schemes now being tested on relevant hardware and models [S-1008]. Limitations The TOPLOC paper lists five limitations [S-1000]: - The margin separating fp8 from bf16 generation is small, and the authors did not test KV-cache compression. - The method cannot detect speculative decoding in which a cheaper model does the decoding. - Inference consumers could mine for \"unstable\" prompts that tend to fail validation. - An attacker could spoof last-layer activations by pruning intermediate layers or using a smaller model. - Subtle modifications are harder to detect than large ones. The original method checks activations, not token sampling [S-1000]. Prime Intellect reports that TOPLOC v2 adds sampling checks [S-1004]. TOPLOC accepts approximate matches, so it shares the general limit of statistical schemes. It can bound an adversary's covert freedom but cannot eliminate it [S-0020]. No independent red-team or audit has been published. All deployment evidence comes from the developer [S-1003] [S-1004].",
    "referenced_by": [
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "I-0002",
        "title": "DiFR (Divergence From Reference)",
        "url": "https://trustbutveri.fyi/implementations/difr/"
      },
      {
        "id": "C-0005",
        "title": "The declared model is the one being served",
        "url": "https://trustbutveri.fyi/claims/declared-model-is-served/"
      },
      {
        "id": "O-0100",
        "title": "Prime Intellect",
        "url": "https://trustbutveri.fyi/organizations/prime-intellect/"
      }
    ]
  }
}