DiFR (Divergence From Reference) is a pair of methods for checking that an inference provider ran the model and settings it declared.
Both tolerate the small numerical differences between re-runs. In Token-DiFR, provider and verifier share the token-sampling seed. The verifier re-runs the sequence and scores how far each claimed token departs from the reference model's choice.
Activation-DiFR compares compressed fingerprints of internal activations instead. On models of 8 to 30 billion parameters on A100 and H200 GPUs, both detected 4-bit quantization almost perfectly (AUC above 0.999). Token-DiFR did so within 300 output tokens and Activation-DiFR within 2 tokens.
The code is public, with a vLLM integration, and another team, Amodo Design, built it into a prototype. The verifier needs the model weights and must know the provider's sampling procedure.
DiFR's statistical tolerance leaves a covert channel. In an independent study, attacker-chosen prompts roughly doubled the leakage a DiFR-based exfiltration detector allowed.
The code is public and the results reproduce on data-centre GPUs, but only its developers rely on it and no one has independently evaluated its consistency check.
Assessed use: checking that outputs match the declared model, precision and sampling settings
On this page
What it is
DiFR (Divergence From Reference) is a pair of methods for checking that an inference provider performed inference correctly. The checks work despite the benign numerical noise that makes re-runs of the same model differ 1. Authors at the ML Alignment and Theory Scholars (MATS) programme, FAR AI, Anthropic and Harvard University introduced it in a 2025 preprint 1.
- Token-DiFR compares the tokens a provider generated with the predictions of a trusted reference run that uses the same random seed 1.
- Activation-DiFR compares compressed fingerprints of internal activations 1.
A companion paper uses the same family of estimators to detect model weights hidden in inference outputs 2. The code is public under an MIT licence 3.
How it works
The provider commits to a specification: model and weights, numerical precision, sampling settings and random seed 1. Token-DiFR relies on Gumbel-Max sampling, which picks each token by adding seeded random noise to the model's scores and taking the largest. With a shared seed, the verifier knows the random noise the provider used 1. It can therefore compute which token the reference model would have chosen at each position, and how far the claimed token falls short of it 1.
The verifier pools these margins over many tokens into a score. It compares the score with a threshold calibrated on trusted hardware 1. The verifier feeds the prompt and output through the model once, which gives logits and activations for every position at once 1. Because the seed pins down sampling, over 98% of tokens match exactly between provider and verifier 1.
Activation-DiFR uses a shared random orthogonal projection to compress activations into short fingerprints. The verifier compares distances between its fingerprints and the provider's 1. This checks the forward pass but not the sampling step 1.