Proposal Explorer

Add claims to see which ones the mechanisms address.

Operational use

• Operational use Sampled inference recomputation for checking that untrusted providers used the claimed model, prompt and precision

Built for an adversarial prover

Sampled inference recomputation

No new hardware needed

Sampled inference recomputation

Attack testing records published testing for this use. It does not by itself show independent review, a formal proof or that a deployed system is secure.

• Sampled inference recomputation, TOPLOC: Analysis

Family findings

• Sampled inference recomputation

  Context for TOPLOC. Findings from the mechanism family appear here as context. They apply to an implementation only when its own record lists them, under the conditions stated there.

  • Tolerance for numerical noise leaves a covert channel in Sampled inference recomputation

    Schemes that accept approximate matches can put an upper bound on an adversary's covert bandwidth, but they cannot close the channel. The weight-exfiltration detector cut exfiltratable information to under 0.5%, not to zero, on a 30-billion-parameter mixture-of-experts model under benign prompt traffic. Its authors called the channel's size under adversarial prompts an open empirical question. An independent study showed that an adversary who controls the prompts roughly doubles the bits leaked per token. Across six models, that cut the slowdown from 146–254 times under benign prompts to 60–118 times. The attack widens the exfiltration bound. It does not target the check that outputs match the declared model. ^{6 7 8}

    Known failure · Demonstrated attack · Significant · Open. On the record

    Related mechanism Operational use Deterministic and bit-exact inference: Bit-exact inference would remove the numerical tolerance if exact replay can be deployed with the required weights and configuration. A pointer, not evidence that this failure is mitigated. Add

  • Only recorded traffic is checked in Sampled inference recomputation

    Recomputation checks that recorded, declared workloads are correct. It cannot show that the record is complete. The published schemes do not cover hidden workloads run on the same compute, or substituted work. Rinberg et al. say their exfiltration-detection scheme cannot stand alone. ^{7 9}

    Scope limitation · Theoretical argument. On the record

    Related mechanism Proposed Network taps and certifiers: Taps copy and hash all traffic on the monitored links, which bears on whether the traffic record is complete. They do not show what else ran on the same chips. A pointer, not evidence that this failure is mitigated. Add

  • Some inference optimizations are not covered in Sampled inference recomputation

    TOPLOC's authors state that it cannot detect speculative decoding in which a cheaper model does the decoding. They did not test whether it distinguishes types of key-value (KV) cache compression. DiFR was evaluated only on sampling from a single model. Its authors sketch an extension to one speculative-decoding algorithm but do not test it. ^{1 10}

    Known failure · Theoretical argument · Significant · Open. On the record

  • Mixed hardware widens the honest baseline in Sampled inference recomputation

    When honest reference runs span different GPU types, the spread of benign scores grows. In DiFR's tests on Qwen3-30B-A3B, pooling A100 and H200 runs left Token-DiFR unable to separate the two smallest tested changes, a temperature of 1.1 instead of 1.0 and a simulated top-2 sampling bug, at the target false-positive rate, while cross-entropy separated them. Matched provider and verifier environments, or pooling that weights rare large deviations, restored detection. ¹⁰

    Known failure · Open question · Minor · Open. On the record

Open significant failures

2 failures in 1 mechanism

• Speculative decoding goes undetected in TOPLOC

  The TOPLOC authors state that it cannot detect speculative decoding. In speculative decoding, a provider decodes with a cheaper model and uses the larger model only for prefill. ¹

  Known failure · Theoretical argument · Significant · Open. On the record

• Tolerance leaves covert bandwidth in TOPLOC

  TOPLOC accepts approximate matches. A check of this kind can put an upper bound on the covert bandwidth available to an adversary, but it cannot close that bandwidth. The limit applies to all statistical verification schemes. ⁶

  Known failure · Theoretical argument · Significant · Open. On the record

Open questions

• Last-layer activations could be spoofed in TOPLOC

  The TOPLOC authors name spoofing of the last hidden layer's activations as a potential attack. A provider could do this by pruning intermediate layers or by using a smaller model. ¹

  Open question · Open question. On the record

• Subtle modifications are harder to detect in TOPLOC

  The TOPLOC authors state that large changes to the model or prompt are straightforward to detect, but subtle modifications are harder. In preliminary experiments, the margin separating fp8 from bf16 generation was small. The authors did not test whether TOPLOC distinguishes types of KV-cache compression. ¹

  Open question · Open question. On the record

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

The records connect no other mechanism to this proposal's gaps, open failures or dependencies.

Blockers

2 blockers recorded

• Sampled inference recomputation
  • No independent security evaluation has been published, and Amodo Design rates red-teaming of recomputation schemes as 'not started'. Adversarial validation ¹¹
  • The verifier must run the model itself, which suits the paper's setting of providers serving open-weights models. Privacy & leakage ¹

From the family or selected implementation's record. ?

Model weights

Unspecified for Sampled inference recomputation. Check the implementation record.

Inputs and outputs

Unspecified for Sampled inference recomputation. Check the implementation record.

Training data

Unspecified for Sampled inference recomputation. Check the implementation record.

Sampled inference recomputation

• Proposed AI 2040 inference-only verification stack Proposed architecture, AI Futures Project
• Research demo DiFR (Divergence From Reference) Research prototype
• Proposed Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• Proposed SASH confidential network logger Research prototype, Singapore AI Safety Hub (SASH)
• Operational use TOPLOC Open-source project, Prime Intellect

1. TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable Inference, J. M. Ong et al. (2025). Original
2. PrimeIntellect-ai/toploc (GitHub repository), Prime Intellect (2025). Original
3. INTELLECT-2: A Reasoning Model Trained Through Globally Decentralized Reinforcement Learning, Prime Intellect Team et al. (2025). Original
4. SYNTHETIC-2, Prime Intellect (2025). Original
5. SYNTHETIC-2 Release: Four Million Collaboratively Generated Reasoning Traces, Prime Intellect (2025). Original
6. Bit-Exact AI Inference Verification Without Performance Tradeoffs, N. Cankaya (2026). Original
7. Verifying LLM Inference to Detect Model Weight Exfiltration, R. Rinberg et al. (2025). Original
8. Adversarial Entropy Inflation Against Gumbel-Based Inference Verification, N. Kezins (2026). Original
9. Example Schemes for Verifying High-Stakes AI Agreements, Amodo Design (2026). Original
10. DiFR: Inference Verification Despite Nondeterminism, A. Karvonen et al. (2025). Original
11. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). Original