Sampled inference recomputation

How it works

The provider records its inference traffic, and a verifier re-runs a random sample of it. The provider's serving system logs each request and response with the exact model release, code version and random seed used ¹. Proposals for verifying international agreements use passive network taps on the front-end network to copy all input and output traffic to a recomputation server ⁶. A verification server then re-runs a random subset of the logged inferences with a trusted copy of the model and code ¹.

Checking is cheaper than generating ¹. The verifier feeds the prompt and the claimed output through the model as one sequence. This gives the model's predictions for every position at once ². Generation must produce tokens one at a time, which typically uses hardware 3–5 times less efficiently than the single pass ¹.

The comparison must tolerate numerical noise. Re-running the same inference often gives slightly different results, because floating-point arithmetic is not associative ^{2 3}. Published schemes handle this in three ways:

• TOPLOC compares activation fingerprints. The provider records a compact encoding of the largest last-layer activations. The verifier accepts if its recomputed values differ by less than preset thresholds ^{7 3}.
• Token-DiFR, part of DiFR, checks tokens under a shared sampling seed. The verifier scores how far each claimed token departs from the token the reference model would have chosen ².
• Exact replay needs no tolerance. Recomputation can match bit for bit if the verifier knows the hardware model, deployed weights, parallelism layout, software versions and batch size ^{4 5}.

A modest random sample gives statistical assurance about the whole recorded stream ^{4 6}. For example, if 0.1% of outputs are false, checking 3,000 random samples finds at least one with 95.03% probability ⁴.

What it establishes

Sampled recomputation can establish two things:

• It can show that recorded outputs are consistent with the declared model and settings. In DiFR's experiments, recomputation detected 4-bit quantization, a quantized key-value cache, a wrong temperature, a wrong seed and simulated sampling bugs ². TOPLOC detected changes to the model, the prompt and the numerical precision ⁷.
• It can limit how much information a compromised server can hide in its responses ¹.

It cannot establish three things:

• It checks only recorded workloads, so it cannot show that no other workloads ran unrecorded ³. Rinberg et al. say their weight-exfiltration scheme cannot be a defence on its own ¹.
• Schemes that tolerate small differences can bound an adversary's covert bandwidth but cannot close it ⁵.
• Checks based only on activations cannot verify that tokens were sampled correctly ².

Threat model

The adversary controls the inference server ¹. Rinberg et al.'s exfiltration study makes these trust assumptions, among others ¹:

• There are no side channels.
• The verification code is trusted.
• The log is secure and append-only.
• Input and output messages are paired.
• The adversary can neither see nor manipulate the sample selection.

The study's published bound assumes benign prompt traffic, and an adversary who controls the prompts can widen it ¹⁴. The verification server's isolation can range up to a full air gap ¹.

The prover must cooperate. It must let the verifier install a recomputation server in its data centre ³. The verifier must hold the model weights and know the provider's sampling procedure ². Tolerance thresholds come from calibration runs on trusted hardware ². One low-trust system design treats physical security of the installed devices as a prerequisite ⁴.

Evidence

• DiFR detected 4-bit quantization with an AUC above 0.999 within 300 output tokens in its authors' tests ². They tested Llama 3.1 8B, Qwen3-8B and Qwen3-30B-A3B on A100 and H200 GPUs, with and without tensor parallelism ². The code is public ¹⁰.
• TOPLOC had no false positives or negatives in the evaluations reported in its peer-reviewed paper. The hardware tests used A100 and RTX 4090 GPUs ⁷. Prime Intellect reports using TOPLOC to verify work from untrusted inference workers in a decentralized training run. It evicted nodes whose work failed the checks ⁹.
• Rinberg et al. tested weight-exfiltration detection on open-weight models of 3 to 30 billion parameters ¹. On a 30-billion-parameter mixture-of-experts model under benign prompt traffic, they report that their detector cut exfiltratable information to under 0.5% at a false-positive rate below 0.01%. That slows an adversary more than 200-fold ¹. An independent study found that choosing the prompts roughly doubles the leakage per token and cuts the slowdown to 60–118 times ¹⁴.
• Amodo re-implemented DiFR with a traffic-capturing proxy and a ledger on Kubernetes ^{11 12}. It tested models of 1.5 to 120 billion parameters on H100 and H200 GPUs and reported a 2–8 times performance advantage for the verifier ¹¹. Of 14,891 events, 13,489 passed and 1,402 failed. Amodo's note does not give the cause of the failures ¹¹. Amodo also reports that TOPLOC and DiFR are well described and are now being tested on relevant hardware and models ¹³.

Limitations

• Tolerance margins leave a small covert channel ^{5 1}. An adversary who controls the prompts can widen it ¹⁴.
• Benign differences between A100 and H200 deployments made the smallest tested deviation harder to detect ².
• DiFR's authors show that tuning the sampling temperature fools a naive cross-entropy check. Token-DiFR still detects the change ².
• TOPLOC's authors state it cannot detect speculative decoding with a cheaper model ⁷. Amodo expects recomputation algorithms to need updating as model architectures and inference techniques change ¹³.
• TOPLOC's authors name spoofed last-layer activations and deliberately "unstable" prompts as possible attacks, which remain untested ⁷.
• A mismatch does not reveal whether evasion, a hardware fault or an evaluation error caused it ⁴.
• Amodo rates recomputation red-teaming as not started, and security of the recomputation server as not on track ¹³.

Zero-knowledge proofs of inference are an alternative. They need deterministic computation as a precondition ⁵.