Whole-workload recomputation (reproducible packets)

How it works

For an inference-only retrofit, the AI 2040 verification plan proposes passive network taps that copy all input and output traffic to a recomputation server ¹. All AI workloads, including inference and agentic tool use, would be organized into "discrete and reproducible packets, which are transparent to the recomputation server" ¹. The server recomputes random samples of the packets to check that they are correct ¹. Reproducibility is required because the correctness checks depend on it, and inference is not reproducible by default ¹.

For later verification of R&D, the plan breaks workloads into a hierarchy of steps: full training run, training phases, gradient steps, layer forward and backward passes, GPU kernel calls and individual instructions ¹. If each step can be made reproducible (the plan notes that seeded randomness is acceptable), the granularity of evidence collection maps predictably to the level of assurance ¹. The same plan would also split data centres into isolated inference units by removing much of the back-end ("east-west") networking ¹; see Bandwidth limits and compartmentalization.

The plan illustrates the approach for 2034 ¹:

• a pool of about 33 billion H100-equivalents, its projected build-out for that year;
• a recomputation budget of 1%;
• packets of 100 H100-equivalent hours.

It charts, by the deployment's size, the probability of catching a rogue internal deployment within an hour, a week or a month ¹. The plan states that detection improves as packet size decreases ¹.

Amodo Design describes a related design for pre-training, in which each training step is the unit ²:

• The prover commits a hash of sampled weight positions before learning whether the step will be audited ².
• For audited steps, the verifier re-runs the step and accepts if the result agrees with the committed checkpoint within a calibrated tolerance ².
• Because the verifier's hardware is much slower than the prover's, the sampling rate follows from the slowdown: the verifier should nominate each step with a probability of about 0.1% if recomputing a step takes 1,000 times as long as the step itself, and a nominated audit can be interrupted by a later one ².

Amodo reports a prototype that recomputes individual inference requests, which Sampled inference recomputation covers ³.

What it establishes

The AI 2040 plan argues that random partial recomputation can verify all outputs with very high probability while using a small fraction of the original compute ¹. Like other recomputation schemes, it checks whether declared workloads were computed correctly, not whether other work ran outside them ². The plan states that it does not verify that spare compute is left unused for unapproved workloads ¹.

Threat model

• Cheating prover. The AI 2040 plan's appendix models a prover who replaces the declared computation in some packets with unauthorized work. It assumes that packets are perfectly reproducible and that the verifier audits each packet independently with the same probability ¹.
• Recomputation server. The plan calls its integrity "an extremely important aspect" of the retrofit ¹.
• Physical security. The plan relies on strong physical security to protect the verification measures from tampering ¹.
• Cooperation. Amodo's schemes assume the prover cooperates and lets the verifier install a recomputation server in its data centre ².
• Commit before audit. In Amodo's training-step design, the prover commits its evidence before it learns which steps will be audited ².