{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "I-0002",
    "slug": "difr",
    "title": "DiFR (Divergence From Reference)",
    "aliases": [
      "Token-DiFR",
      "Activation-DiFR"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "DiFR checks that an inference provider ran its declared model by comparing output tokens or activations with a trusted re-run using the same random seed.",
    "summary": "DiFR (Divergence From Reference) is a pair of methods for checking that an inference provider ran the model and settings it declared. Both tolerate the small numerical differences that make re-runs disagree. In Token-DiFR, provider and verifier share the random seed for token sampling. The verifier re-runs the sequence and scores how far each claimed token departs from the reference model's choice. Activation-DiFR compares compressed fingerprints of internal activations instead. On models of 8 to 30 billion parameters on A100 and H200 GPUs, both detected 4-bit quantization almost perfectly (AUC above 0.999). Token-DiFR did so within 300 output tokens and Activation-DiFR within 2. The code is public, with a vLLM integration, and a separate team has re-implemented it. The verifier needs the model weights and must know the provider's sampling procedure. Its statistical tolerance leaves a covert channel, which an independent study widened in a related exfiltration detector.",
    "technical": "- The specification φ fixes the architecture and weights, numerical precision, sampling hyperparameters and the seed of the pseudorandom number generator [[S-0016]].\n- Token-DiFR works with Gumbel-Max sampling. From the shared seed, both parties derive the same Gumbel noise vector g. The verifier computes post-Gumbel scores z_i = l_i + T·g_i from its reference logits l and temperature T, and takes the token it would have chosen. It scores each claimed token by the logit-margin difference between the two tokens, clipped at a maximum. Scores are pooled per batch. A batch is flagged if the statistic exceeds a threshold set on a calibration set generated under φ on trusted hardware [[S-0016]]. Verification is one prefill pass over prompt plus output [[S-0016]]. The companion exfiltration paper gives a variant for inverse-probability-transform samplers [[S-0015]].\n- Activation-DiFR has both parties generate the same random orthogonal projection P from a shared seed. P is k by D, with k much smaller than D. The provider sends f = P·a for activation vector a, possibly only for every J-th token. The verifier checks the L2 distance to its own projection [[S-0016]]. The authors report an AUC of at least 0.9999 with under 0.5 bytes per token [[S-0016]].\n- DiFR works with unmodified vLLM, which exposes per-request seeds as a standard sampling parameter [[S-0016]].\n- At temperature zero, Token-DiFR needs no seed synchronization. The verifier checks that the provider chose the most likely token at each position. The authors warn that such greedy spot checks are open to selective cheating. A provider could serve the declared model at temperature zero and a degraded one otherwise [[S-0016]].",
    "category": "cryptographic-computational",
    "secondary_categories": [],
    "verifies": [
      {
        "claim": "C-0005",
        "role": "primary",
        "note": "Checks that outputs are consistent with the declared model, precision and sampling configuration."
      },
      {
        "claim": "C-0009",
        "role": "supporting",
        "note": "Used as the estimator in a weight-exfiltration detection scheme (S-0015)."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "analysis",
    "hardware_requirement": "none",
    "prover_cooperation": "required",
    "confidentiality": "revealing",
    "depends_on": [],
    "readiness": {
      "assessment": true,
      "level": "R2",
      "rubric_version": "1.0",
      "rationale": "R2. The code is public and the results reproduce on data-centre GPUs, but only its developers rely on it and no one has independently evaluated its consistency check.\n\n- **R1** met: the paper states the verification claim, the specification the provider must follow and the trust assumptions [[S-0016]]. The assumptions are a trusted reference, calibration on trusted hardware and synchronized seeds. A companion paper embeds the method in a formal security game [[S-0015]].\n- **R2** met: public MIT-licensed code with a vLLM integration exists [[S-1005]]. Results are reproducible on A100 and H200 GPUs with models of 8 to 30 billion parameters [[S-0016]]. A separate team re-implemented it with models of up to 120 billion parameters [[S-1006]].\n- **R3** not met. On criterion (a), Amodo's prototype is a research demonstration. Amodo is not relying on DiFR for a verification decision [[S-1006]], and the code is research-grade. On criterion (b), no independent audit, red-team or peer-reviewed security analysis of DiFR's consistency check has been published as of September 2026. Amodo lists recomputation red-teaming as not started [[S-1008]]. The one independent attack targets a weight-exfiltration detector built on the same Gumbel-margin statistic [[S-1507]]. That attack bears on the supporting exfiltration use, assessed under [[M-0024]]. It does not bear on the primary use.",
      "evidence": [
        "S-0016",
        "S-0015",
        "S-1005",
        "S-1006",
        "S-1008",
        "S-1507"
      ],
      "next_level_gaps": [
        "Reliance by a party other than the developers on DiFR for a verification decision, or a production-grade release.",
        "An independent public security evaluation (audit, red-team or peer-reviewed analysis) against adaptive adversaries."
      ],
      "confidence": "medium",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Statistical tolerance leaves a covert channel",
        "kind": "demonstrated-attack",
        "severity": "significant",
        "status": "open",
        "description": "Statistical schemes can put an upper bound on an adversary's covert bandwidth, but cannot close it [[S-0020]]. In the companion exfiltration study, the detector cut exfiltratable information to under 0.5% under benign prompt traffic. It did not cut it to zero [[S-0015]]. An independent study attacked that detector, which uses the same Gumbel-margin statistic. An adversary who controls the prompts roughly doubled the bits leaked per token. This cut the slowdown from over 200 times to 60–118 times [[S-1507]]. The attack widens the exfiltration bound. It does not target DiFR's check that outputs match the declared configuration.",
        "sources": [
          "S-0020",
          "S-0015",
          "S-1507"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Mixed hardware widens the honest baseline",
        "kind": "open-question",
        "severity": "minor",
        "status": "open",
        "description": "For Qwen3-30B-A3B, benign differences between A100 and H200 deployments broadened the honest score distribution. This made the smallest tested change, a temperature raised by 0.1, harder to separate.",
        "sources": [
          "S-0016"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Speculative decoding and multi-model sampling not evaluated",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "The algorithms and experiments cover sampling from a single LLM. Speculative decoding was not evaluated. The authors sketch an extension to one speculative-decoding algorithm, without experiments. They note that other variants would need modified verification and extra metadata.",
        "sources": [
          "S-0016"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "The verifier needs the model weights, so outsiders cannot use the method to verify providers of closed-weights models.",
        "theme": "privacy-leakage",
        "blocked_by": null,
        "sources": [
          "S-0016"
        ]
      },
      {
        "text": "The verifier must know and match the provider's sampling procedure, and in one re-implementation a sampling mismatch in a newer vLLM version produced large spurious logit differences.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-0016",
          "S-1006"
        ]
      },
      {
        "text": "No independent red-team of DiFR's consistency check has been published, Amodo rates recomputation red-teaming 'not started', and the one independent attack study targets an exfiltration detector built on the same statistic.",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": [
          "S-1008",
          "S-1507"
        ]
      }
    ],
    "challenge_themes": [
      "adversarial-validation",
      "protocol-soundness",
      "privacy-leakage",
      "performance-compatibility"
    ],
    "organizations": [],
    "people": [],
    "sources": [
      {
        "source": "S-0016",
        "supports": "method, specification, experiments, results, comparison with TOPLOC and distributional methods, deployment considerations, limitations, speculative-decoding sketch",
        "locator": "abstract; §2-3; §5; §5.1; §7.2-7.4; Appendix F"
      },
      {
        "source": "S-0015",
        "supports": "companion security game and exfiltration results using Token-DiFR estimators",
        "locator": "abstract; contributions; §4"
      },
      {
        "source": "S-1005",
        "supports": "public code, licence, vLLM and API modes",
        "locator": "README"
      },
      {
        "source": "S-1006",
        "supports": "independent re-implementation, scale and vLLM sampling mismatch",
        "locator": "whole note"
      },
      {
        "source": "S-1007",
        "supports": "re-implementation code",
        "locator": "README"
      },
      {
        "source": "S-0020",
        "supports": "limits of statistical verification",
        "locator": "§1"
      },
      {
        "source": "S-1008",
        "supports": "status of red-teaming",
        "locator": "status items"
      },
      {
        "source": "S-1507",
        "supports": "independent attack on a weight-exfiltration detector built on the Token-DiFR Gumbel-margin statistic; scope limited to the exfiltration bound",
        "locator": "abstract; introduction"
      }
    ],
    "concepts": [
      "K-0008",
      "K-0009",
      "K-0020"
    ],
    "kind": "research-prototype",
    "developer": [],
    "realises": [
      "M-0001"
    ],
    "repo": "https://github.com/adamkarvonen/difr",
    "type": "implementation",
    "url": "https://trustbutveri.fyi/implementations/difr/",
    "source_file": "content/implementations/difr.md",
    "flags_all": [
      "provider-reported",
      "ai-drafted"
    ],
    "body_markdown": "## What it is\n\nDiFR (Divergence From Reference) is a pair of methods for checking that an inference provider performed inference correctly. The checks work despite the benign numerical noise that makes re-runs of the same model differ [[S-0016]]. Authors at the ML Alignment and Theory Scholars (MATS) programme, FAR AI, Anthropic and Harvard University introduced it in a 2025 preprint [[S-0016]].\n\n- **Token-DiFR** compares the tokens a provider generated with the predictions of a trusted reference run that uses the same random seed [[S-0016]].\n- **Activation-DiFR** compares compressed fingerprints of internal activations [[S-0016]].\n\nA companion paper uses the same family of estimators to detect model weights hidden in inference outputs [[S-0015]]. The code is public under an MIT licence [[S-1005]].\n\n## How it works\n\nThe provider commits to a specification: model and weights, numerical precision, sampling settings and random seed [[S-0016]]. Token-DiFR relies on Gumbel-Max sampling, which picks each token by adding seeded random noise to the model's scores and taking the largest. With a shared seed, the verifier knows the random noise the provider used [[S-0016]]. It can therefore compute which token the reference model would have chosen at each position, and how far the claimed token falls short of it [[S-0016]].\n\nThe verifier pools these margins over many tokens into a score. It compares the score with a threshold calibrated on trusted hardware [[S-0016]]. The verifier feeds the prompt and output through the model once, which gives logits and activations for every position at once [[S-0016]]. Because the seed pins down sampling, over 98% of tokens match exactly between provider and verifier [[S-0016]].\n\nActivation-DiFR uses a shared random orthogonal projection to compress activations into short fingerprints. The verifier compares distances between its fingerprints and the provider's [[S-0016]]. This checks the forward pass but not the sampling step [[S-0016]].\n\n## Evidence\n- The authors tested Llama 3.1 8B-Instruct, Qwen3-8B and Qwen3-30B-A3B on 2,000 UltraChat prompts [[S-0016]]. The four inference configurations were H200 with four-way tensor parallelism, A100 with and without it, and H200 without it running Hugging Face [[S-0016]].\n- The faults tested were FP8 key-value cache quantization, 4-bit model quantization, a temperature of 1.1 instead of 1.0, an incorrect seed, and a simulated sampling bug that picks uniformly among the top-k tokens 1% of the time [[S-0016]].\n- The authors report that Token-DiFR detects 4-bit quantization with an AUC above 0.999 within 300 output tokens [[S-0016]]. Activation-DiFR does so within 2 tokens, while cutting communication by 25–75% relative to existing methods [[S-0016]].\n- The authors report that Activation-DiFR Pareto-dominates [[I-0001|TOPLOC]] in communication cost against detection accuracy [[S-0016]]. They also cite a report that a distributional test called RUT failed to reliably separate 8-bit quantized models. Token-DiFR detects such differences within a few thousand tokens [[S-0016]].\n- The companion paper's detector limited exfiltratable information to under 0.5% at a false-positive rate below 0.01% on a mixture-of-experts Qwen 30B model, under benign prompt traffic [[S-0015]]. An independent study found that choosing the prompts roughly doubles the leakage per token [[S-1507]].\n- [[O-0101|Amodo Design]], a separate team, re-implemented DiFR in an asynchronous recomputation prototype [[S-1006]] [[S-1007]]. It tested the prototype on models of 1.5 to 120 billion parameters on H100 and H200 GPUs [[S-1006]].\n\n## Limitations\n- The methods need the model weights [[S-0016]]. Providers can check their own traffic and users can check open-weights models, but the methods cannot verify closed-weights providers [[S-0016]].\n- Deployment requires knowing the provider's sampling procedure [[S-0016]]. In Amodo's prototype, vLLM v0.25.1 used a different random-number implementation from the one DiFR expected. This produced large logit differences until Amodo forced the older model runner [[S-1006]].\n- For Qwen3-30B-A3B, mixing A100 and H200 reference runs made the smallest tested change harder to separate from honest runs [[S-0016]].\n- Only single-model sampling was studied. Speculative decoding was not evaluated [[S-0016]].\n- A statistical tolerance can bound covert bandwidth but cannot close it [[S-0020]].\n- Adversarial testing is limited. The authors show that simple adversarial temperature tuning defeats a cross-entropy baseline, while Token-DiFR still detects the change [[S-0016]]. An independent study reports that attacker-chosen prompts roughly double the leakage allowed by a weight-exfiltration detector built on the same Gumbel-margin statistic. This cut the detector's slowdown to 60–118 times [[S-1507]]. Amodo rates red-teaming of recomputation schemes as not started [[S-1008]].",
    "body_text": "What it is DiFR (Divergence From Reference) is a pair of methods for checking that an inference provider performed inference correctly. The checks work despite the benign numerical noise that makes re-runs of the same model differ [S-0016]. Authors at the ML Alignment and Theory Scholars (MATS) programme, FAR AI, Anthropic and Harvard University introduced it in a 2025 preprint [S-0016]. - Token-DiFR compares the tokens a provider generated with the predictions of a trusted reference run that uses the same random seed [S-0016]. - Activation-DiFR compares compressed fingerprints of internal activations [S-0016]. A companion paper uses the same family of estimators to detect model weights hidden in inference outputs [S-0015]. The code is public under an MIT licence [S-1005]. How it works The provider commits to a specification: model and weights, numerical precision, sampling settings and random seed [S-0016]. Token-DiFR relies on Gumbel-Max sampling, which picks each token by adding seeded random noise to the model's scores and taking the largest. With a shared seed, the verifier knows the random noise the provider used [S-0016]. It can therefore compute which token the reference model would have chosen at each position, and how far the claimed token falls short of it [S-0016]. The verifier pools these margins over many tokens into a score. It compares the score with a threshold calibrated on trusted hardware [S-0016]. The verifier feeds the prompt and output through the model once, which gives logits and activations for every position at once [S-0016]. Because the seed pins down sampling, over 98% of tokens match exactly between provider and verifier [S-0016]. Activation-DiFR uses a shared random orthogonal projection to compress activations into short fingerprints. The verifier compares distances between its fingerprints and the provider's [S-0016]. This checks the forward pass but not the sampling step [S-0016]. Evidence - The authors tested Llama 3.1 8B-Instruct, Qwen3-8B and Qwen3-30B-A3B on 2,000 UltraChat prompts [S-0016]. The four inference configurations were H200 with four-way tensor parallelism, A100 with and without it, and H200 without it running Hugging Face [S-0016]. - The faults tested were FP8 key-value cache quantization, 4-bit model quantization, a temperature of 1.1 instead of 1.0, an incorrect seed, and a simulated sampling bug that picks uniformly among the top-k tokens 1% of the time [S-0016]. - The authors report that Token-DiFR detects 4-bit quantization with an AUC above 0.999 within 300 output tokens [S-0016]. Activation-DiFR does so within 2 tokens, while cutting communication by 25–75% relative to existing methods [S-0016]. - The authors report that Activation-DiFR Pareto-dominates TOPLOC in communication cost against detection accuracy [S-0016]. They also cite a report that a distributional test called RUT failed to reliably separate 8-bit quantized models. Token-DiFR detects such differences within a few thousand tokens [S-0016]. - The companion paper's detector limited exfiltratable information to under 0.5% at a false-positive rate below 0.01% on a mixture-of-experts Qwen 30B model, under benign prompt traffic [S-0015]. An independent study found that choosing the prompts roughly doubles the leakage per token [S-1507]. - Amodo Design, a separate team, re-implemented DiFR in an asynchronous recomputation prototype [S-1006] [S-1007]. It tested the prototype on models of 1.5 to 120 billion parameters on H100 and H200 GPUs [S-1006]. Limitations - The methods need the model weights [S-0016]. Providers can check their own traffic and users can check open-weights models, but the methods cannot verify closed-weights providers [S-0016]. - Deployment requires knowing the provider's sampling procedure [S-0016]. In Amodo's prototype, vLLM v0.25.1 used a different random-number implementation from the one DiFR expected. This produced large logit differences until Amodo forced the older model runner [S-1006]. - For Qwen3-30B-A3B, mixing A100 and H200 reference runs made the smallest tested change harder to separate from honest runs [S-0016]. - Only single-model sampling was studied. Speculative decoding was not evaluated [S-0016]. - A statistical tolerance can bound covert bandwidth but cannot close it [S-0020]. - Adversarial testing is limited. The authors show that simple adversarial temperature tuning defeats a cross-entropy baseline, while Token-DiFR still detects the change [S-0016]. An independent study reports that attacker-chosen prompts roughly double the leakage allowed by a weight-exfiltration detector built on the same Gumbel-margin statistic. This cut the detector's slowdown to 60–118 times [S-1507]. Amodo rates red-teaming of recomputation schemes as not started [S-1008].",
    "referenced_by": [
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "I-0001",
        "title": "TOPLOC",
        "url": "https://trustbutveri.fyi/implementations/toploc/"
      },
      {
        "id": "C-0005",
        "title": "The declared model is the one being served",
        "url": "https://trustbutveri.fyi/claims/declared-model-is-served/"
      },
      {
        "id": "O-0101",
        "title": "Amodo Design",
        "url": "https://trustbutveri.fyi/organizations/amodo-design/"
      }
    ]
  }
}