TOPLOC is a hashing scheme for checking that an inference provider ran the model, prompt and numerical precision it claims.
During generation, the provider records a compact fingerprint of the model's largest last-layer activations. A verifier re-runs the sequence in one pass and checks that the fingerprints match within set tolerances. The tolerances absorb harmless differences between GPUs.
The peer-reviewed paper reports catching every tested change to model, prompt or precision, with no false positives or negatives. Proofs take 258 bytes per 32 generated tokens. TOPLOC is open source.
Prime Intellect, its developer, used it in 2025 to accept or reject work from untrusted computers in decentralized training and data-generation runs. As of September 2026 no independent security evaluation has been published.
The authors list attacks it cannot yet catch, such as speculative decoding with a cheaper model. Subtle changes are also harder to detect than large ones.
Prime Intellect, its developer, has used TOPLOC in production to accept or reject work from untrusted computers, but no independent security audit or red-team has been published.
Assessed use: checking that untrusted providers used the claimed model, prompt and precision
On this page
What it is
TOPLOC is a method for checking that an inference provider used the model configuration it claims 1. It hashes intermediate activations with a compact locality-sensitive hashing scheme, a kind of hash that gives similar outputs for similar inputs 1. Researchers at Prime Intellect and Together AI published it at ICML 2025 1.
The paper targets providers that run open-weights models on their own hardware and serve them through APIs 1. It considers four undisclosed changes such a provider might make 1:
- lower precision;
- KV-cache compression;
- altered weights, whether distilled, merged or pruned;
- an altered system prompt.
The code is MIT-licensed and installable as a Python package 2. Prime Intellect reports integrations with vLLM and a fork of SGLang 3.
How it works
The provider records the 128 largest-magnitude values of the last hidden layer, and their indices, as it generates 1 8. It encodes them compactly as a polynomial and stores the result as a proof 1 8. The verifier re-runs the full sequence in a single forward pass. It recomputes the same top values and compares them with the proof 1 8.
The verifier accepts if the number of exponent mismatches and the mean and median mantissa differences are all below set thresholds 1. The thresholds absorb reorderings of the computation caused by different GPU types, tensor-parallel layouts and attention kernels 1.
Prime Intellect's INTELLECT-2 run combined TOPLOC with other checks. Each inference worker generated a TOPLOC proof for every sequence 4. Validators also checked termination, the logit distribution and deterministic data sampling 4. Prime Intellect reports that a later version, TOPLOC v2, adds reproducible Gumbel noise so that verifiers can also check token sampling 5.