Bit-Exact AI Inference Verification Without Performance Tradeoffs

International AI governance needs the ability to verify what is running on monitored chips in a low-trust environment. One option is to re-run inputs on verifier machines using the same software that facility owners claim they’re using. Unfortunately, the floating-point operations performed by chips might not always produce identical results. The paper demonstrates that apparent non-determinism is a consequence of rounding decisions that can be precisely predicted and reproduced using software-simulation of GPU behaviour. We presented this paper at the ICML 2026 Technical AI Governance Research (TAIGR) workshop, where this paper won a Best Paper award.

Abstract:

Verifying claims about AI workloads is a prerequisite for credible AI governance of covert adversaries (who comply with monitoring only when detection likelihood is high), yet the apparent non-determinism of GPU floating-point arithmetic forces auditors to accept approximate output matches. Covert adversaries can exploit unverifiable degrees of freedom in monitored computation. Attack vectors include steganography, unreported modification of inference software, and covert computation via unreported batch elements. Empirically, we analyze how modern inference engines (vLLM, HF transformers) produce deterministic but non-invariant outputs, without needing to set performance-compromising determinism flags, if the right information is available for re-computation and no atomic functions are called in the backend. We demonstrate that such bitwise-precise re-computation does not require access to identical hardware, via a software-only emulation of LLM inference across multiple NVIDIA GPU variants. Thus, accumulated rounding errors can be an auditable signature of the software and hardware setup used for inference, instead of a constraint on verifiability.