Sampling and assurance

Sampling-based assurance checks a random sample of accelerators, workload segments or outputs instead of all of them, and chooses the sample size so that a violation is caught with a desired probability ¹.

Shavit gives a formula for how many accelerators a verifier must inspect in each monitoring period to find at least one accelerator used in a rule-violating training run with a chosen probability ¹. The required number falls as the run occupies a larger share of the prover's accelerators, so larger runs need fewer inspections ¹. Sampling works only if the prover cannot predict what will be checked ¹ or change its records once it knows; in one scheme, the prover commits a hash of sampled weights at each training step before it learns whether that step will be audited ². The same logic applies to recomputation of random training segments in proof-of-learning ¹ and of random workload samples in reproducible computation packets ³. Against a covert adversary, sampling works through deterrence: one system overview notes that such an adversary is caught if it fails to stay hidden even once, and treats randomly sampled inspections as a primary defence ⁴.