TOPLOC

What it is

TOPLOC is a method for checking that an inference provider used the model configuration it claims ¹. It hashes intermediate activations with a compact locality-sensitive hashing scheme, a kind of hash that gives similar outputs for similar inputs ¹. Researchers at Prime Intellect and Together AI published it at ICML 2025 ¹.

The paper targets providers that run open-weights models on their own hardware and serve them through APIs ¹. It considers four undisclosed changes such a provider might make ¹:

• lower precision;
• KV-cache compression;
• altered weights, whether distilled, merged or pruned;
• an altered system prompt.

The code is MIT-licensed and installable as a Python package ². Prime Intellect reports integrations with vLLM and a fork of SGLang ³.

How it works

The provider records the 128 largest-magnitude values of the last hidden layer, and their indices, as it generates ^{1 7}. It encodes them compactly as a polynomial and stores the result as a proof ^{1 7}. The verifier re-runs the full sequence in a single forward pass. It recomputes the same top values and compares them with the proof ^{1 7}.

The verifier accepts if the number of exponent mismatches and the mean and median mantissa differences are all below set thresholds ¹. The thresholds absorb reorderings of the computation caused by different GPU types, tensor-parallel layouts and attention kernels ¹.

Prime Intellect's INTELLECT-2 run combined TOPLOC with other checks. Each inference worker generated a TOPLOC proof for every sequence ⁴. Validators also checked termination, the logit distribution and deterministic data sampling ⁴. Prime Intellect reports that a later version, TOPLOC v2, adds reproducible Gumbel noise so that verifiers can also check token sampling ⁵.

Evidence

• The TOPLOC paper reports detecting unauthorized changes to models, prompts or precision with 100% accuracy, and no false positives or negatives in its evaluations ¹. The tests used Llama 3.1-8B-Instruct, INTELLECT-1-Instruct and Gemma-2-9B on UltraChat prompts. A model-differentiation test also included Llama 3.1-70B-Instruct ¹. Proofs take 258 bytes per 32 new tokens ¹.
• Validation held across A100 and RTX 4090 GPUs, one- and two-GPU tensor parallelism, and three attention implementations ¹.
• Prime Intellect reports using TOPLOC to verify rollouts from untrusted inference workers when training a 32-billion-parameter model ⁴. Nodes whose files fail validation are "slashed and evicted" ⁴. Prime Intellect also reports using TOPLOC v2 to verify thousands of nodes in SYNTHETIC-2, a distributed data-generation run ⁵.
• The authors of DiFR, a related scheme, report that Activation-DiFR Pareto-dominates TOPLOC (does at least as well on both communication cost and detection accuracy) across their tested models ⁶.
• Amodo Design's status page lists TOPLOC among initial recomputation schemes now being tested on relevant hardware and models ⁹.

Limitations

The TOPLOC paper lists five limitations ¹:

• The margin separating fp8 from bf16 generation is small, and the authors did not test KV-cache compression.
• The method cannot detect speculative decoding in which a cheaper model does the decoding.
• Inference consumers could mine for "unstable" prompts that tend to fail validation.
• An attacker could spoof last-layer activations by pruning intermediate layers or using a smaller model.
• Subtle modifications are harder to detect than large ones.

The original method checks activations, not token sampling ¹. Prime Intellect reports that TOPLOC v2 adds sampling checks ⁵.

TOPLOC accepts approximate matches, so it shares the general limit of statistical schemes. It can bound an adversary's covert freedom but cannot eliminate it ⁸.

No independent red-team or audit has been published. All deployment evidence comes from the developer ^{4 5}.