{ "schema_version": "1.0.0", "rubric_version": "1.0", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)", "record": { "id": "M-0001", "slug": "sampled-inference-recomputation", "title": "Sampled inference recomputation", "aliases": [ "Inference recomputation", "Recomputation-based inference verification", "Partial recomputation" ], "status": "draft", "last_reviewed": "2026-09-23", "review_interval_days": 90, "steward": null, "provenance": { "drafted_by": "ai", "reviewed_by": [] }, "risk_flags": [], "flags": [], "one_liner": "A verifier re-runs a random sample of an AI provider's logged queries on a trusted copy of the declared model and checks the outputs match.", "summary": "Sampled inference recomputation is a check that an AI provider's recorded outputs came from the model and settings it declared. The provider logs each query and response. A verifier's server re-runs a random sample on a trusted copy of the model. It flags outputs that differ by more than benign numerical noise allows. Checking costs less than generating because the verifier processes each sequence in one pass. Two schemes, TOPLOC and DiFR, have public code. DiFR has reproducible results on A100 and H200 GPUs with models of 8 to 30 billion parameters. TOPLOC's developer uses it to accept or reject work from untrusted computers. No independent red-team of the check has been published. Deployment needs full traffic capture and a secure verifier server inside the provider's facility. Unrecorded work is never checked. The noise tolerance also leaves a covert channel. An adversary who controls the prompts can widen it.", "technical": "The reference protocol has five steps [[S-0015]]:\n\n1. The serving stack writes every request and response to an append-only log, with the model release, code version and sampling seed [[S-0015]].\n2. An isolated verification server draws a private random sample of logged pairs. Its isolation can range from access controls and containers to a full air gap [[S-0015]].\n3. The server runs one prefill pass over the prompt and claimed output with the trusted model and code. This gives the next-token distribution at every position [[S-0015]] [[S-0016]].\n4. The server scores how far the claimed output diverges from the reference. Token-DiFR uses the clipped Gumbel-Max logit margin under a shared seed. Activation-DiFR uses the distance between random projections of activations [[S-0016]]. TOPLOC counts exponent and mantissa mismatches in the top-128 last-layer activations [[S-1000]].\n5. Scores beyond a threshold calibrated on trusted hardware are escalated for review [[S-0015]] [[S-0016]].\n\nVerification is cheap because it needs only the prefill pass. Decoding typically runs at 3–5 times lower hardware utilization than prefill [[S-0015]]. Amodo's prototype measured a 2–8 times performance advantage for the verifier with models of 1.5 to 120 billion parameters on H100 and H200 GPUs [[S-1006]].\n\nThe number of samples sets the chance of detection. For a false-output rate p, the chance of catching at least one false output in k independent samples is 1 − (1 − p)^k [[S-0020]]. With 3,000 samples, a 0.1% rate is caught with 95.03% probability [[S-0018]].\n\nRecomputation can also match bit for bit, which makes the check pass/fail. This exact variant needs a known hardware model, deployed weights, parallelism topology, software versions and per-pass batch size, and no atomic operations [[S-0018]] [[S-0020]].", "category": "cryptographic-computational", "secondary_categories": [], "verifies": [ { "claim": "C-0005", "role": "primary", "note": "Checks that sampled recorded outputs are consistent with the declared model, precision and sampling settings." }, { "claim": "C-0009", "role": "supporting", "note": "Bounds how much information can be hidden steganographically in checked outputs. It is not a stand-alone defence against weight exfiltration (S-0015)." }, { "claim": "C-0004", "role": "supporting", "note": "Proposed as the correctness check in inference-only retrofit plans. Completeness needs other mechanisms (S-0067, S-0017)." } ], "threat_model": "adversarial", "adversarial_evaluation": "analysis", "hardware_requirement": "retrofit-device", "prover_cooperation": "required", "confidentiality": "partial", "depends_on": [ { "target": "M-0013", "note": "Network taps or trusted logging supply the recorded inputs and outputs that are sampled." } ], "readiness": { "assessment": true, "level": "R2", "rubric_version": "1.0", "rationale": "R2. Public code and reproducible results exist, but no one has independently evaluated the check. Assessed for checking that recorded outputs came from the declared model and settings ([[C-0005]]).\n\n- **R1** met: the design, the claim it verifies and its trust assumptions are published. They include a formal security game for steganographic weight exfiltration [[S-0015]].\n- **R2** met through [[I-0002|DiFR]] and [[I-0001|TOPLOC]], both assessed R2. DiFR has MIT-licensed code with a vLLM integration [[S-1005]]. It has reproducible results on A100 and H200 GPUs with models of 8 to 30 billion parameters [[S-0016]]. TOPLOC is an installable package [[S-1001]] with peer-reviewed results [[S-1000]]. Rinberg et al. evaluate the method against a stated adversary who controls the inference server [[S-0015]].\n- **R3** not met. Criterion (a), reliance by another party or production-grade availability, is arguable. TOPLOC is publicly available, and its developer uses it to accept or reject work from untrusted nodes [[S-1001]] [[S-1003]]. No other party is documented relying on sampled recomputation for a verification decision. Criterion (b), an independent evaluation, fails. As of September 2026 no independent audit, red-team or peer-reviewed security analysis of the consistency check has been published. Amodo lists recomputation red-teaming as not started [[S-1008]]. The one independent attack study targets the weight-exfiltration bound built on this mechanism [[S-1507]]. That bound is a supporting use, assessed under [[M-0024]].", "evidence": [ "S-0015", "S-0016", "S-1000", "S-1001", "S-1003", "S-1005", "S-1006", "S-1008", "S-1507" ], "next_level_gaps": [ "An independent audit, red-team or peer-reviewed security analysis of a recomputation consistency check against an adaptive adversary.", "Reliance by a party other than the developer on sampled recomputation for a verification decision, or a production-grade deployment for the high-stakes use." ], "confidence": "medium", "assessed_by": [ "ai-draft" ], "assessed_on": "2026-09-23", "status": "current", "dispute": null }, "flaws": [ { "assessment": true, "title": "Tolerance for numerical noise leaves a covert channel", "kind": "demonstrated-attack", "severity": "significant", "status": "open", "description": "Schemes that accept approximate matches can put an upper bound on an adversary's covert bandwidth, but they cannot close the channel [[S-0020]]. The weight-exfiltration detector cut exfiltratable information to under 0.5%, not to zero, on a 30-billion-parameter mixture-of-experts model under benign prompt traffic [[S-0015]]. An independent study showed that an adversary who controls the prompts roughly doubles the bits leaked per token. That cuts the slowdown from over 200 times to 60–118 times [[S-1507]]. The attack widens the exfiltration bound. It does not target the check that outputs match the declared model [[S-1507]].", "sources": [ "S-0020", "S-0015", "S-1507" ], "response": null }, { "assessment": true, "title": "Only recorded traffic is checked", "kind": "theoretical-argument", "severity": "significant", "status": "open", "description": "Recomputation checks that recorded, declared workloads are correct. It cannot show that the record is complete. The published schemes do not cover hidden workloads run on the same compute, or substituted work [[S-0017]]. Rinberg et al. say their exfiltration-detection scheme cannot stand alone [[S-0015]].", "sources": [ "S-0017", "S-0015" ], "response": null }, { "assessment": true, "title": "Some inference optimizations are not covered", "kind": "theoretical-argument", "severity": "significant", "status": "open", "description": "TOPLOC's authors state that it cannot detect speculative decoding in which a cheaper model does the decoding. They did not test whether it distinguishes types of key-value (KV) cache compression [[S-1000]]. DiFR was evaluated only on sampling from a single model. Its authors sketch an extension to one speculative-decoding algorithm but do not test it [[S-0016]].", "sources": [ "S-1000", "S-0016" ], "response": null }, { "assessment": true, "title": "Mixed hardware widens the honest baseline", "kind": "open-question", "severity": "minor", "status": "open", "description": "When honest reference runs span different GPU types, the spread of benign scores grows. In DiFR's tests on Qwen3-30B-A3B, mixing A100 and H200 runs made the smallest deviation tested harder to separate from honest behaviour. That deviation was a temperature raised by 0.1 [[S-0016]].", "sources": [ "S-0016" ], "response": null } ], "blockers": [ { "text": "Recording all inference traffic needs network taps and recomputation servers that can ingest it, in the worst case one recomputation-server network interface per inference front-end interface.", "theme": "coverage-hidden-compute", "blocked_by": "M-0013", "sources": [ "S-1008", "S-0067" ] }, { "text": "The recomputation server must sit inside the prover's data centre, possibly under the prover's physical control, and still be protected from a compromised provider, which Amodo rates 'not on track'.", "theme": "hardware-trust", "blocked_by": null, "sources": [ "S-1008", "S-0015" ] }, { "text": "No independent red-team of a recomputation consistency check has been published (the one independent attack study targets the weight-exfiltration bound), and Amodo rates recomputation red-teaming 'not started'.", "theme": "adversarial-validation", "blocked_by": null, "sources": [ "S-1008", "S-1507" ] }, { "text": "Tolerance-based checks need calibration on trusted hardware and exact knowledge of the provider's sampling procedure, and in one prototype a sampling-implementation mismatch produced large spurious differences.", "theme": "performance-compatibility", "blocked_by": null, "sources": [ "S-0016", "S-1006" ] }, { "text": "The verifier needs the model weights, so checking a closed-weights model requires a confidential recomputation environment inside the prover's facility.", "theme": "privacy-leakage", "blocked_by": null, "sources": [ "S-0016", "S-0017", "S-0018" ] } ], "challenge_themes": [ "coverage-hidden-compute", "hardware-trust", "adversarial-validation", "protocol-soundness", "performance-compatibility", "privacy-leakage" ], "organizations": [ "O-0100", "O-0101", "O-0201", "O-0202" ], "people": [], "sources": [ { "source": "S-0015", "supports": "reference architecture; trust assumptions; prefill-only cost; exfiltration results; stand-alone limitation", "locator": "abstract; §4.2; §5; §6.1; §8; Fig. 7" }, { "source": "S-0016", "supports": "Token-DiFR and Activation-DiFR; benign nondeterminism; detection results; weights and sampling requirements; limitations and speculative-decoding sketch", "locator": "abstract; §3.3; §5; §5.1; §7.2; §7.4; Appendix F" }, { "source": "S-0017", "supports": "TOPLOC and Token-DiFR as example schemes; recomputation server in prover's data centre; correctness vs completeness", "locator": "introduction; inference schemes" }, { "source": "S-0018", "supports": "bit-exact replay metadata; evaluation in auditing environment; sampling statistics; attribution problem", "locator": "§2b; §3.2.2; §5.2.2; Appendix A1" }, { "source": "S-0020", "supports": "statistical schemes bound but do not close covert bandwidth; detection probability; bit-exact pass/fail", "locator": "abstract; §1" }, { "source": "S-0067", "supports": "network taps feeding a recomputation server; partial recomputation of random samples", "locator": "Concrete inference-only retrofitting proposal" }, { "source": "S-1000", "supports": "TOPLOC mechanism, results and stated limitations, including untested KV-cache compression", "locator": "abstract; §4; §5; §6.1-6.4" }, { "source": "S-1001", "supports": "public TOPLOC implementation", "locator": "README; release v0.1.6" }, { "source": "S-1003", "supports": "developer use of TOPLOC to validate untrusted workers", "locator": "§2.3; §2.4.2" }, { "source": "S-1005", "supports": "public DiFR implementation with vLLM integration", "locator": "README" }, { "source": "S-1006", "supports": "prototype architecture, scale, verifier advantage and pass/fail counts", "locator": "whole note; Fig. 3" }, { "source": "S-1007", "supports": "prototype code and workflow", "locator": "README" }, { "source": "S-1008", "supports": "status of recomputation algorithms, capture, server security and red-teaming", "locator": "status items" }, { "source": "S-1507", "supports": "independent prompt-control attack on the weight-exfiltration detector; scope limited to the exfiltration bound", "locator": "abstract; results" } ], "concepts": [ "K-0001", "K-0002", "K-0008", "K-0009", "K-0014", "K-0018", "K-0020", "K-0022" ], "complements": [ "M-0002", "M-0003", "M-0012" ], "alternatives": [ "M-0004" ], "type": "mechanism", "implementations": [ { "id": "I-0011", "title": "AI 2040 inference-only verification stack", "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/" }, { "id": "I-0002", "title": "DiFR (Divergence From Reference)", "url": "https://trustbutveri.fyi/implementations/difr/" }, { "id": "I-0012", "title": "Low-trust AI compute verification system overview", "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/" }, { "id": "I-0008", "title": "SASH confidential network logger", "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/" }, { "id": "I-0001", "title": "TOPLOC", "url": "https://trustbutveri.fyi/implementations/toploc/" } ], "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/", "source_file": "content/mechanisms/sampled-inference-recomputation.md", "flags_all": [ "ai-drafted" ], "body_markdown": "## How it works\n\nThe provider records its inference traffic, and a verifier re-runs a random sample of it. The provider's serving system logs each request and response with the exact model release, code version and random seed used [[S-0015]]. Proposals for verifying international agreements use passive [[M-0013|network taps]] on the front-end network to copy all input and output traffic to a recomputation server [[S-0067]]. A verification server then re-runs a random subset of the logged inferences with a trusted copy of the model and code [[S-0015]].\n\nChecking is cheaper than generating [[S-0015]]. The verifier feeds the prompt and the claimed output through the model as one sequence. This gives the model's predictions for every position at once [[S-0016]]. Generation must produce tokens one at a time, which typically uses hardware 3–5 times less efficiently than the single pass [[S-0015]].\n\nThe comparison must tolerate numerical noise. Re-running the same inference often gives slightly different results, because floating-point arithmetic is not associative [[S-0016]] [[S-0017]]. Published schemes handle this in three ways:\n\n- [[I-0001|TOPLOC]] compares activation fingerprints. The provider records a compact encoding of the largest last-layer activations. The verifier accepts if its recomputed values differ by less than preset thresholds [[S-1000]] [[S-0017]].\n- Token-DiFR, part of [[I-0002|DiFR]], checks tokens under a shared sampling seed. The verifier scores how far each claimed token departs from the token the reference model would have chosen [[S-0016]].\n- [[M-0002|Exact replay]] needs no tolerance. Recomputation can match bit for bit if the verifier knows the hardware model, deployed weights, parallelism layout, software versions and batch size [[S-0018]] [[S-0020]].\n\nA modest random sample gives statistical assurance about the whole recorded stream [[S-0018]] [[S-0067]]. For example, if 0.1% of outputs are false, checking 3,000 random samples finds at least one with 95.03% probability [[S-0018]].\n\n## What it establishes\n\nSampled recomputation can establish two things:\n\n- It can show that recorded outputs are consistent with the declared model and settings. In DiFR's experiments, recomputation detected 4-bit quantization, a quantized key-value cache, a wrong temperature, a wrong seed and simulated sampling bugs [[S-0016]]. TOPLOC detected changes to the model, the prompt and the numerical precision [[S-1000]].\n- It can limit how much information a compromised server can hide in its responses [[S-0015]].\n\nIt cannot establish three things:\n\n- It checks only recorded workloads, so it cannot show that no other workloads ran unrecorded [[S-0017]]. Rinberg et al. say their weight-exfiltration scheme cannot be a defence on its own [[S-0015]].\n- Schemes that tolerate small differences can bound an adversary's covert bandwidth but cannot close it [[S-0020]].\n- Checks based only on activations cannot verify that tokens were sampled correctly [[S-0016]].\n\n## Threat model\n\nThe adversary controls the inference server [[S-0015]]. Rinberg et al.'s exfiltration study makes these trust assumptions, among others [[S-0015]]:\n\n- There are no side channels.\n- The verification code is trusted.\n- The log is secure and append-only.\n- Input and output messages are paired.\n- The adversary can neither see nor manipulate the sample selection.\n\nThe study's published bound assumes benign prompt traffic, and an adversary who controls the prompts can widen it [[S-1507]]. The verification server's isolation can range up to a full air gap [[S-0015]].\n\nThe prover must cooperate. It must let the verifier install a recomputation server in its data centre [[S-0017]]. The verifier must hold the model weights and know the provider's sampling procedure [[S-0016]]. Tolerance thresholds come from calibration runs on trusted hardware [[S-0016]]. One low-trust system design treats physical security of the installed devices as a prerequisite [[S-0018]].\n\n## Evidence\n\n- **DiFR** detected 4-bit quantization with an AUC above 0.999 within 300 output tokens in its authors' tests [[S-0016]]. They tested Llama 3.1 8B, Qwen3-8B and Qwen3-30B-A3B on A100 and H200 GPUs, with and without tensor parallelism [[S-0016]]. The code is public [[S-1005]].\n- **TOPLOC** had no false positives or negatives in the evaluations reported in its peer-reviewed paper. The hardware tests used A100 and RTX 4090 GPUs [[S-1000]]. Prime Intellect reports using TOPLOC to verify work from untrusted inference workers in a decentralized training run. It evicted nodes whose work failed the checks [[S-1003]].\n- **Rinberg et al.** tested weight-exfiltration detection on open-weight models of 3 to 30 billion parameters [[S-0015]]. On a 30-billion-parameter mixture-of-experts model under benign prompt traffic, they report that their detector cut exfiltratable information to under 0.5% at a false-positive rate below 0.01%. That slows an adversary more than 200-fold [[S-0015]]. An independent study found that choosing the prompts roughly doubles the leakage per token and cuts the slowdown to 60–118 times [[S-1507]].\n- **Amodo** re-implemented DiFR with a traffic-capturing proxy and a ledger on Kubernetes [[S-1006]] [[S-1007]]. It tested models of 1.5 to 120 billion parameters on H100 and H200 GPUs and reported a 2–8 times performance advantage for the verifier [[S-1006]]. Of 14,891 events, 13,489 passed and 1,402 failed. Amodo's note does not give the cause of the failures [[S-1006]]. Amodo also reports that TOPLOC and DiFR are well described and are now being tested on relevant hardware and models [[S-1008]].\n\n## Limitations\n\n- Tolerance margins leave a small covert channel [[S-0020]] [[S-0015]]. An adversary who controls the prompts can widen it [[S-1507]].\n- Benign differences between A100 and H200 deployments made the smallest tested deviation harder to detect [[S-0016]].\n- DiFR's authors show that tuning the sampling temperature fools a naive cross-entropy check. Token-DiFR still detects the change [[S-0016]].\n- TOPLOC's authors state it cannot detect speculative decoding with a cheaper model [[S-1000]]. Amodo expects recomputation algorithms to need updating as model architectures and inference techniques change [[S-1008]].\n- TOPLOC's authors name spoofed last-layer activations and deliberately \"unstable\" prompts as possible attacks, which remain untested [[S-1000]].\n- A mismatch does not reveal whether evasion, a hardware fault or an evaluation error caused it [[S-0018]].\n- Amodo rates recomputation red-teaming as not started, and security of the recomputation server as not on track [[S-1008]].\n\n[[M-0004|Zero-knowledge proofs of inference]] are an alternative. They need deterministic computation as a precondition [[S-0020]].", "body_text": "How it works The provider records its inference traffic, and a verifier re-runs a random sample of it. The provider's serving system logs each request and response with the exact model release, code version and random seed used [S-0015]. Proposals for verifying international agreements use passive network taps on the front-end network to copy all input and output traffic to a recomputation server [S-0067]. A verification server then re-runs a random subset of the logged inferences with a trusted copy of the model and code [S-0015]. Checking is cheaper than generating [S-0015]. The verifier feeds the prompt and the claimed output through the model as one sequence. This gives the model's predictions for every position at once [S-0016]. Generation must produce tokens one at a time, which typically uses hardware 3–5 times less efficiently than the single pass [S-0015]. The comparison must tolerate numerical noise. Re-running the same inference often gives slightly different results, because floating-point arithmetic is not associative [S-0016] [S-0017]. Published schemes handle this in three ways: - TOPLOC compares activation fingerprints. The provider records a compact encoding of the largest last-layer activations. The verifier accepts if its recomputed values differ by less than preset thresholds [S-1000] [S-0017]. - Token-DiFR, part of DiFR, checks tokens under a shared sampling seed. The verifier scores how far each claimed token departs from the token the reference model would have chosen [S-0016]. - Exact replay needs no tolerance. Recomputation can match bit for bit if the verifier knows the hardware model, deployed weights, parallelism layout, software versions and batch size [S-0018] [S-0020]. A modest random sample gives statistical assurance about the whole recorded stream [S-0018] [S-0067]. For example, if 0.1% of outputs are false, checking 3,000 random samples finds at least one with 95.03% probability [S-0018]. What it establishes Sampled recomputation can establish two things: - It can show that recorded outputs are consistent with the declared model and settings. In DiFR's experiments, recomputation detected 4-bit quantization, a quantized key-value cache, a wrong temperature, a wrong seed and simulated sampling bugs [S-0016]. TOPLOC detected changes to the model, the prompt and the numerical precision [S-1000]. - It can limit how much information a compromised server can hide in its responses [S-0015]. It cannot establish three things: - It checks only recorded workloads, so it cannot show that no other workloads ran unrecorded [S-0017]. Rinberg et al. say their weight-exfiltration scheme cannot be a defence on its own [S-0015]. - Schemes that tolerate small differences can bound an adversary's covert bandwidth but cannot close it [S-0020]. - Checks based only on activations cannot verify that tokens were sampled correctly [S-0016]. Threat model The adversary controls the inference server [S-0015]. Rinberg et al.'s exfiltration study makes these trust assumptions, among others [S-0015]: - There are no side channels. - The verification code is trusted. - The log is secure and append-only. - Input and output messages are paired. - The adversary can neither see nor manipulate the sample selection. The study's published bound assumes benign prompt traffic, and an adversary who controls the prompts can widen it [S-1507]. The verification server's isolation can range up to a full air gap [S-0015]. The prover must cooperate. It must let the verifier install a recomputation server in its data centre [S-0017]. The verifier must hold the model weights and know the provider's sampling procedure [S-0016]. Tolerance thresholds come from calibration runs on trusted hardware [S-0016]. One low-trust system design treats physical security of the installed devices as a prerequisite [S-0018]. Evidence - DiFR detected 4-bit quantization with an AUC above 0.999 within 300 output tokens in its authors' tests [S-0016]. They tested Llama 3.1 8B, Qwen3-8B and Qwen3-30B-A3B on A100 and H200 GPUs, with and without tensor parallelism [S-0016]. The code is public [S-1005]. - TOPLOC had no false positives or negatives in the evaluations reported in its peer-reviewed paper. The hardware tests used A100 and RTX 4090 GPUs [S-1000]. Prime Intellect reports using TOPLOC to verify work from untrusted inference workers in a decentralized training run. It evicted nodes whose work failed the checks [S-1003]. - Rinberg et al. tested weight-exfiltration detection on open-weight models of 3 to 30 billion parameters [S-0015]. On a 30-billion-parameter mixture-of-experts model under benign prompt traffic, they report that their detector cut exfiltratable information to under 0.5% at a false-positive rate below 0.01%. That slows an adversary more than 200-fold [S-0015]. An independent study found that choosing the prompts roughly doubles the leakage per token and cuts the slowdown to 60–118 times [S-1507]. - Amodo re-implemented DiFR with a traffic-capturing proxy and a ledger on Kubernetes [S-1006] [S-1007]. It tested models of 1.5 to 120 billion parameters on H100 and H200 GPUs and reported a 2–8 times performance advantage for the verifier [S-1006]. Of 14,891 events, 13,489 passed and 1,402 failed. Amodo's note does not give the cause of the failures [S-1006]. Amodo also reports that TOPLOC and DiFR are well described and are now being tested on relevant hardware and models [S-1008]. Limitations - Tolerance margins leave a small covert channel [S-0020] [S-0015]. An adversary who controls the prompts can widen it [S-1507]. - Benign differences between A100 and H200 deployments made the smallest tested deviation harder to detect [S-0016]. - DiFR's authors show that tuning the sampling temperature fools a naive cross-entropy check. Token-DiFR still detects the change [S-0016]. - TOPLOC's authors state it cannot detect speculative decoding with a cheaper model [S-1000]. Amodo expects recomputation algorithms to need updating as model architectures and inference techniques change [S-1008]. - TOPLOC's authors name spoofed last-layer activations and deliberately \"unstable\" prompts as possible attacks, which remain untested [S-1000]. - A mismatch does not reveal whether evasion, a hardware fault or an evaluation error caused it [S-0018]. - Amodo rates recomputation red-teaming as not started, and security of the recomputation server as not on track [S-1008]. Zero-knowledge proofs of inference are an alternative. They need deterministic computation as a precondition [S-0020].", "referenced_by": [ { "id": "M-0014", "title": "Bandwidth limits and compartmentalization", "url": "https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/" }, { "id": "M-0024", "title": "Bounding unexplained information in outputs", "url": "https://trustbutveri.fyi/mechanisms/bounding-unexplained-information/" }, { "id": "M-0002", "title": "Deterministic and bit-exact inference", "url": "https://trustbutveri.fyi/mechanisms/deterministic-inference/" }, { "id": "M-0015", "title": "Memory wiping and proofs of secure erasure", "url": "https://trustbutveri.fyi/mechanisms/memory-wiping-and-secure-erasure/" }, { "id": "M-0012", "title": "Model identity attestation", "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/" }, { "id": "M-0013", "title": "Network taps and certifiers", "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/" }, { "id": "M-0003", "title": "Reproducible computation packets", "url": "https://trustbutveri.fyi/mechanisms/reproducible-computation-packets/" }, { "id": "M-0023", "title": "Safeguard attestation", "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/" }, { "id": "M-0008", "title": "TEE remote attestation for AI workloads", "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/" }, { "id": "M-0004", "title": "Zero-knowledge proofs of inference", "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/" }, { "id": "I-0011", "title": "AI 2040 inference-only verification stack", "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/" }, { "id": "I-0002", "title": "DiFR (Divergence From Reference)", "url": "https://trustbutveri.fyi/implementations/difr/" }, { "id": "I-0012", "title": "Low-trust AI compute verification system overview", "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/" }, { "id": "I-0008", "title": "SASH confidential network logger", "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/" }, { "id": "I-0001", "title": "TOPLOC", "url": "https://trustbutveri.fyi/implementations/toploc/" }, { "id": "C-0005", "title": "The declared model is the one being served", "url": "https://trustbutveri.fyi/claims/declared-model-is-served/" }, { "id": "C-0004", "title": "This compute runs inference, not training", "url": "https://trustbutveri.fyi/claims/inference-not-training/" }, { "id": "C-0009", "title": "Model weights or data have not left the facility", "url": "https://trustbutveri.fyi/claims/weights-have-not-left/" }, { "id": "K-0008", "title": "Numerical nondeterminism", "url": "https://trustbutveri.fyi/concepts/numerical-nondeterminism/" }, { "id": "K-0009", "title": "Recomputation", "url": "https://trustbutveri.fyi/concepts/recomputation/" }, { "id": "O-0201", "title": "AI Futures Project", "url": "https://trustbutveri.fyi/organizations/ai-futures-project/" }, { "id": "O-0101", "title": "Amodo Design", "url": "https://trustbutveri.fyi/organizations/amodo-design/" }, { "id": "O-0202", "title": "Machine Intelligence Research Institute", "url": "https://trustbutveri.fyi/organizations/machine-intelligence-research-institute/" }, { "id": "O-0100", "title": "Prime Intellect", "url": "https://trustbutveri.fyi/organizations/prime-intellect/" }, { "id": "O-0160", "title": "Singapore AI Safety Hub (SASH)", "url": "https://trustbutveri.fyi/organizations/singapore-ai-safety-hub/" } ] } }