{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "M-0003",
    "slug": "reproducible-computation-packets",
    "title": "Reproducible computation packets",
    "aliases": [
      "Packet-based verification"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Organizing all AI workloads in a facility into discrete, reproducible units, so that a verifier can recompute a random sample and check each one.",
    "summary": "The AI 2040 verification plan proposes that every AI workload in a monitored facility be organized into discrete, reproducible \"packets\" that a verifier's recomputation server can see. The verifier re-runs a random sample of packets to check that they were computed as declared. In the plan's illustrations, smaller packets raise the chance of catching a rogue workload. As of September 2026, no implementation beyond recomputation of single inference requests has been published. The main obstacles are that workloads and network traffic are not reproducible by default, that the recomputation server must be secured, and that compute outside declared packets is not covered. The plan itself does not verify that spare compute is unused, and notes that non-compliant work might be hidden inside compliant-looking workloads.",
    "category": "isolation-architecture",
    "secondary_categories": [
      "cryptographic-computational"
    ],
    "verifies": [
      {
        "claim": "C-0004",
        "role": "primary",
        "note": "Proposed as the correctness check for an inference-only retrofit (S-0067)."
      },
      {
        "claim": "C-0007",
        "role": "supporting",
        "note": "Proposed for later R&D verification by treating training steps as packets (S-0067, S-0017)."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "none",
    "hardware_requirement": "retrofit-device",
    "prover_cooperation": "required",
    "confidentiality": "partial",
    "depends_on": [
      {
        "target": "M-0002",
        "note": "Packets must be reproducible, which needs deterministic execution."
      },
      {
        "target": "M-0013",
        "note": "Network taps copy traffic to the recomputation server."
      }
    ],
    "readiness": {
      "assessment": true,
      "level": "R1",
      "rubric_version": "1.0",
      "rationale": "R1: the design, its claim and its assumptions are public, but nothing beyond single-request inference recomputation has been built.\n\n- **R1** met: the AI 2040 verification plan describes the design (discrete, reproducible packets visible to a recomputation server, with random partial recomputation), the claim it serves (correct outputs in an inference-only regime, later R&D verification) and its assumptions (reproducibility, an intact recomputation server, physical security) [[S-0067]]. Amodo gives a comparable written design at the level of single training steps [[S-0017]]. The plan is the only Implementation record for this mechanism ([[I-0011]], assessed R1).\n- **R2** not met: no public implementation or end-to-end result organizes whole workloads into reproducible packets. The demonstrations are single-request inference recomputation prototypes [[S-1006]], and Amodo rates network reproducibility \"not on track\" [[S-1008]].\n\nConfidence is low because the design is described only at a high level, and the plan's appendix of calculations remains unread.",
      "evidence": [
        "S-0067",
        "S-0017",
        "S-1006",
        "S-1008"
      ],
      "next_level_gaps": [
        "A public implementation, or reproducible end-to-end results, of packet-based recomputation beyond single inference requests, under realistic model scale, hardware or a stated adversary."
      ],
      "confidence": "low",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Spare compute is outside the scheme",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "The plan states that it does not verify that spare compute is not used for unapproved workloads, because this seems very challenging [[S-0067]]. Recomputation checks the correctness of declared work, not its completeness [[S-0017]].",
        "sources": [
          "S-0067",
          "S-0017"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Non-compliant work could be encoded inside compliant-looking packets",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "The plan notes that an AI company might try to encode a non-compliant workload inside a workload that looks compliant on the surface [[S-0067]].",
        "sources": [
          "S-0067"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Workloads are not reproducible by default, and achieving reproducibility may cost performance.",
        "theme": "performance-compatibility",
        "blocked_by": "M-0002",
        "sources": [
          "S-0067"
        ]
      },
      {
        "text": "Network packets are not individually reproducible by default; making them so may need considerable software, firmware and hardware work. Amodo rates this 'not on track'.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-1008"
        ]
      },
      {
        "text": "All traffic must reach the recomputation server via network taps, and the server's integrity is critical.",
        "theme": "hardware-trust",
        "blocked_by": "M-0013",
        "sources": [
          "S-0067",
          "S-1008"
        ]
      },
      {
        "text": "Recomputing training steps needs checkpoints: writing one at every step would cost more than 100% overhead, so Amodo's design needs a spare data-parallel replica that tracks the weights instead.",
        "theme": "performance-compatibility",
        "blocked_by": null,
        "sources": [
          "S-0017"
        ]
      }
    ],
    "challenge_themes": [
      "coverage-hidden-compute",
      "performance-compatibility",
      "hardware-trust",
      "protocol-soundness"
    ],
    "organizations": [
      "O-0101",
      "O-0201"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-0067",
        "supports": "packet design, hierarchy of workload steps, recomputation budget example, assumptions and stated gaps",
        "locator": "Concrete inference-only retrofitting proposal; Feb 2029; Early 2030; 2027; 2034 sections"
      },
      {
        "source": "S-0017",
        "supports": "step-level recomputation design for pre-training; shadow replica instead of per-step checkpoint writes; commitments before audit selection; tolerance comparison; audit rate; correctness vs completeness",
        "locator": "pre-training scheme; introduction"
      },
      {
        "source": "S-1006",
        "supports": "single-request inference recomputation prototype",
        "locator": "whole note"
      },
      {
        "source": "S-1008",
        "supports": "status of reproducible inference stack and network reproducibility",
        "locator": "status items"
      }
    ],
    "concepts": [
      "K-0009",
      "K-0014",
      "K-0016",
      "K-0020",
      "K-0025"
    ],
    "complements": [
      "M-0001",
      "M-0014"
    ],
    "alternatives": [],
    "type": "mechanism",
    "implementations": [
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/"
      }
    ],
    "url": "https://trustbutveri.fyi/mechanisms/reproducible-computation-packets/",
    "source_file": "content/mechanisms/reproducible-computation-packets.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "## How it works\n\nFor an inference-only retrofit, the AI 2040 verification plan proposes passive network taps that copy all input and output traffic to a recomputation server [[S-0067]]. All AI workloads, including inference and agentic tool use, would be organized into \"discrete and reproducible packets, which are transparent to the recomputation server\" [[S-0067]]. The server recomputes random samples of the packets to check that they are correct [[S-0067]]. Reproducibility is required because the correctness checks depend on it, and inference is not reproducible by default [[S-0067]].\n\nFor later verification of R&D, the plan breaks workloads into a hierarchy of steps: full training run, training phases, gradient steps, layer forward and backward passes, GPU kernel calls and individual instructions [[S-0067]]. If each step can be made reproducible (the plan notes that seeded randomness is acceptable), the granularity of evidence collection maps predictably to the level of assurance [[S-0067]]. The same plan would also split data centres into isolated inference units by removing much of the back-end (\"east-west\") networking [[S-0067]]; see [[M-0014]].\n\nThe plan illustrates the approach for 2034 [[S-0067]]:\n\n- a pool of about 33 billion H100-equivalents, its projected build-out for that year;\n- a recomputation budget of 1%;\n- packets of 100 H100-equivalent hours.\n\nIt charts, by the deployment's size, the probability of catching a rogue internal deployment within an hour, a week or a month [[S-0067]]. The plan states that detection improves as packet size decreases [[S-0067]].\n\nAmodo describes a related design for pre-training, in which each training step is the unit [[S-0017]]:\n\n- The prover commits a hash of sampled weight positions before learning whether the step will be audited [[S-0017]].\n- For audited steps, the verifier re-runs the step and accepts if the result agrees with the committed checkpoint within a calibrated tolerance [[S-0017]].\n- Because the verifier's hardware is much slower than the prover's, the audit rate follows from the slowdown: about 0.1% of steps if recomputing a step takes 1,000 times as long as the step itself [[S-0017]].\n\nAmodo reports a prototype that recomputes individual inference requests, which [[M-0001]] covers [[S-1006]].\n\n## What it establishes\nThe plan argues that random partial recomputation can verify all outputs with very high probability while using a small fraction of the original compute [[S-0067]]. Like other recomputation schemes, it checks whether declared workloads were computed correctly, not whether other work ran outside them [[S-0017]]. The plan states that it does not verify that spare compute is left unused for unapproved workloads [[S-0067]].\n\n## Threat model\n- **Recomputation server.** The plan calls its integrity \"an extremely important aspect\" of the retrofit [[S-0067]].\n- **Physical security.** The plan relies on strong physical security to protect the verification measures from tampering [[S-0067]].\n- **Cooperation.** Amodo's schemes assume the prover cooperates and lets the verifier install a recomputation server in its data centre [[S-0017]].\n- **Commit before audit.** In Amodo's training-step design, the prover commits its evidence before it learns which steps will be audited [[S-0017]].\n\n## Evidence\n- **Whole-workload packets.** As of September 2026, no implementation or end-to-end result of organizing whole workloads into reproducible packets has been published.\n- **Inference recomputation.** Amodo reports demonstrations of inference recomputation systems that work around nondeterminism [[S-1008]], including its own single-request prototype [[S-1006]].\n- **Reproducibility status.** Amodo rates a reproducible inference stack as not started [[S-1008]]. It rates network reproducibility as not on track, because optimizations throughout the networking stack mean that network packets are not individually reproducible by default [[S-1008]]. It suggests schemes that do not need exact packet replication as a possible alternative [[S-1008]].\n\n## Limitations\n- **Reproducibility cost.** Making inference reproducible \"may involve some cost overhead\" [[S-0067]]. For training, writing a checkpoint at every step would cost more than 100% overhead, which Amodo's design avoids by keeping a spare replica [[S-0017]].\n- **Hidden work.** The plan notes that a company might try to encode a non-compliant workload inside one that looks compliant [[S-0067]]. Work outside declared packets, including on spare compute, is not covered [[S-0067]] [[S-0017]].\n- **Dependencies.** The scheme relies on deterministic execution ([[M-0002]]), complete traffic capture ([[M-0013]]) and a secure recomputation server [[S-0067]].",
    "body_text": "How it works For an inference-only retrofit, the AI 2040 verification plan proposes passive network taps that copy all input and output traffic to a recomputation server [S-0067]. All AI workloads, including inference and agentic tool use, would be organized into \"discrete and reproducible packets, which are transparent to the recomputation server\" [S-0067]. The server recomputes random samples of the packets to check that they are correct [S-0067]. Reproducibility is required because the correctness checks depend on it, and inference is not reproducible by default [S-0067]. For later verification of R&D, the plan breaks workloads into a hierarchy of steps: full training run, training phases, gradient steps, layer forward and backward passes, GPU kernel calls and individual instructions [S-0067]. If each step can be made reproducible (the plan notes that seeded randomness is acceptable), the granularity of evidence collection maps predictably to the level of assurance [S-0067]. The same plan would also split data centres into isolated inference units by removing much of the back-end (\"east-west\") networking [S-0067]; see Bandwidth limits and compartmentalization. The plan illustrates the approach for 2034 [S-0067]: - a pool of about 33 billion H100-equivalents, its projected build-out for that year; - a recomputation budget of 1%; - packets of 100 H100-equivalent hours. It charts, by the deployment's size, the probability of catching a rogue internal deployment within an hour, a week or a month [S-0067]. The plan states that detection improves as packet size decreases [S-0067]. Amodo describes a related design for pre-training, in which each training step is the unit [S-0017]: - The prover commits a hash of sampled weight positions before learning whether the step will be audited [S-0017]. - For audited steps, the verifier re-runs the step and accepts if the result agrees with the committed checkpoint within a calibrated tolerance [S-0017]. - Because the verifier's hardware is much slower than the prover's, the audit rate follows from the slowdown: about 0.1% of steps if recomputing a step takes 1,000 times as long as the step itself [S-0017]. Amodo reports a prototype that recomputes individual inference requests, which Sampled inference recomputation covers [S-1006]. What it establishes The plan argues that random partial recomputation can verify all outputs with very high probability while using a small fraction of the original compute [S-0067]. Like other recomputation schemes, it checks whether declared workloads were computed correctly, not whether other work ran outside them [S-0017]. The plan states that it does not verify that spare compute is left unused for unapproved workloads [S-0067]. Threat model - Recomputation server. The plan calls its integrity \"an extremely important aspect\" of the retrofit [S-0067]. - Physical security. The plan relies on strong physical security to protect the verification measures from tampering [S-0067]. - Cooperation. Amodo's schemes assume the prover cooperates and lets the verifier install a recomputation server in its data centre [S-0017]. - Commit before audit. In Amodo's training-step design, the prover commits its evidence before it learns which steps will be audited [S-0017]. Evidence - Whole-workload packets. As of September 2026, no implementation or end-to-end result of organizing whole workloads into reproducible packets has been published. - Inference recomputation. Amodo reports demonstrations of inference recomputation systems that work around nondeterminism [S-1008], including its own single-request prototype [S-1006]. - Reproducibility status. Amodo rates a reproducible inference stack as not started [S-1008]. It rates network reproducibility as not on track, because optimizations throughout the networking stack mean that network packets are not individually reproducible by default [S-1008]. It suggests schemes that do not need exact packet replication as a possible alternative [S-1008]. Limitations - Reproducibility cost. Making inference reproducible \"may involve some cost overhead\" [S-0067]. For training, writing a checkpoint at every step would cost more than 100% overhead, which Amodo's design avoids by keeping a spare replica [S-0017]. - Hidden work. The plan notes that a company might try to encode a non-compliant workload inside one that looks compliant [S-0067]. Work outside declared packets, including on spare compute, is not covered [S-0067] [S-0017]. - Dependencies. The scheme relies on deterministic execution (Deterministic and bit-exact inference), complete traffic capture (Network taps and certifiers) and a secure recomputation server [S-0067].",
    "referenced_by": [
      {
        "id": "M-0014",
        "title": "Bandwidth limits and compartmentalization",
        "url": "https://trustbutveri.fyi/mechanisms/bandwidth-limits-and-compartmentalization/"
      },
      {
        "id": "M-0002",
        "title": "Deterministic and bit-exact inference",
        "url": "https://trustbutveri.fyi/mechanisms/deterministic-inference/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/"
      },
      {
        "id": "C-0004",
        "title": "This compute runs inference, not training",
        "url": "https://trustbutveri.fyi/claims/inference-not-training/"
      },
      {
        "id": "K-0020",
        "title": "Sampling and assurance",
        "url": "https://trustbutveri.fyi/concepts/sampling-and-assurance/"
      },
      {
        "id": "O-0101",
        "title": "Amodo Design",
        "url": "https://trustbutveri.fyi/organizations/amodo-design/"
      }
    ]
  }
}