DiFR: Inference Verification Despite Nondeterminism (2511.20621v1)

Abstract: As demand for LLM inference grows, it is becoming increasingly important that providers and their customers can verify that inference processes are performed correctly, without errors or tampering. However, re-running the same inference process twice often leads to different results due to benign numerical noise, making it difficult to distinguish legitimate variation from actual problems. To address this problem, we introduce Token-DiFR (Token-Divergence-From-Reference), a method for verifying inference outputs by comparing generated tokens against predictions made by a trusted reference implementation conditioned on the same random seed. Sampling seed synchronization tightly constrains valid outputs, leaving providers minimal room to deviate from correct inference, which allows output tokens themselves to serve as auditable evidence of correctness at zero additional cost to the provider. Token-DiFR reliably identifies sampling errors, simulated bugs, and model quantization, detecting 4-bit quantization with AUC $>$ 0.999 within 300 output tokens. For applications requiring sample-efficient forward-pass verification, we additionally introduce Activation-DiFR, a scheme that uses random orthogonal projections to compress activations into compact fingerprints for subsequent verification. Activation-DiFR detects 4-bit quantization with AUC $>$ 0.999 using just 2 output tokens, while reducing communication overhead by 25-75% relative to existing methods. We release an open-source integration with vLLM to accelerate practical deployment of verifiable inference.

• The paper demonstrates that the DiFR framework achieves high AUC scores (>0.999) in detecting LLM inference misconfigurations through both Token-DiFR and Activation-DiFR methods.
• It introduces a zero-communication, seed-synchronization approach coupled with activation fingerprinting to verify internal model computations and output consistency.
• Empirical results reveal rapid detection—within as few as 2 tokens—and significantly reduced communication overhead compared to previous fingerprinting techniques.

Inference Verification Despite Nondeterminism: Summary and Implications

Motivation and Problem Statement

The integrity of LLM inference is a critical technical and trust issue as LLM-powered services proliferate and are often deployed through opaque, third-party, or potentially untrusted providers. Ensuring that outputs are indeed generated using the claimed model, configuration, and inference procedure is nontrivial due to numerical nondeterminism: benign computational noise, hardware/software/parallelism drift, and inherent nondeterminacy in floating-point pipelines commonly make bitwise replication of outputs infeasible. Recent industry incidents, such as undetected inference bugs and significant cross-provider quality discrepancies, highlight the operational and security consequences of inadequate verification.

Traditional cryptographic methods such as ZKPs offer strong guarantees but are orders of magnitude too slow for production LLM inference, with proof times in thousands of seconds per token (Xing et al., 31 Jan 2025, Sun et al., 24 Apr 2024). Emerging heuristic schemes, including activation fingerprinting and distributional tests, either incur significant communication overhead or fail to tightly constrain provider behavior, allowing outputs that are statistically plausible but may not be the result of compliant sampling.

DiFR Framework: Token-DiFR and Activation-DiFR

The authors propose the DiFR (Divergence-from-Reference) framework, which instantiates two complementary strategies for post-hoc LLM inference verification:

Token-DiFR

Token-DiFR is a zero-communication, trustless method that leverages random seed synchronization to make the generation process nearly deterministic. By matching the provider's PRNG seed, a verifier can reconstruct the noise that would be injected during the sampling step (e.g., via Gumbel-Max). Thus, under a fixed seed and matching sampling parameters, valid outputs are highly constrained, typically allowing at most a few alternative tokens per position. The verifier computes a simple scalar divergence per token (the margin between the claimed token's Gumbel-augmented logit and the verifier's maximally probable token), flagging significant or systematic discrepancies as evidence of misconfiguration, error, or tampering.

This method:

• Detects major inference misconfigurations, such as model quantization, wrong seed, or temperature deviations, with high sample efficiency.
• Achieves AUC > 0.999 for 4-bit quantization detection within 300 output tokens for models like Llama 3.1 8B.
• Is robust against known attacks that defeat cross-entropy or distributional tests by adversarially tuning sampling hyperparameters.

Notably, Token-DiFR requires no inference pipeline modifications and only requires access to the output tokens and the PRNG seed, making it immediately deployable for open-source models with standardized sampling procedures.

Activation-DiFR

While Token-DiFR tightly constrains generation paths given the sampling seed, it cannot verify the detailed computation within each forward pass (it is agnostic to changes masked by similar logits but resulting from different internal states). Activation-DiFR addresses this by compressing the model's internal activations at specified positions using random orthogonal projections (following the Johnson-Lindenstrauss lemma to ensure approximate preservation of signal) to create compact activation fingerprints. The provider transmits these fingerprints; the verifier recomputes them from the claimed sequence and compares (e.g., via $\ell_2$ distance).

Empirical results show AUC > 0.999 for 4-bit quantization detection with just 2 tokens, and 25–75% lower communication overhead compared to prior fingerprinting methods such as TOPLOC. This method excels at detecting subtle model degradations (quantization, internal activation drift) and can function even when seed synchronization is unavailable, supporting independent sequence-level verification.

Empirical Results and Numerical Highlights

The authors conduct rigorous experimental evaluation using Llama 3.1 8B, Qwen3-8B, and Qwen3-30B-A3B across a matrix of inference configurations: exact reference, numerically perturbed but correct, and systematically misconfigured cases (quantization, seed/temperature mismatch, simulated sampling bugs).

Key numerical findings:

• Token-DiFR robustly distinguishes compliant from misconfigured runs with very high accuracy (AUC > 0.999 at <1% FPR) within hundreds to thousands of tokens for all nontrivial deviation types.
• Activation-DiFR saturates detection with batch sizes as small as 2 for quantization – a significant advancement in verification sample efficiency.
• Pareto dominance of Activation-DiFR over TOPLOC: to reach an AUC target, Activation-DiFR requires 25–75% fewer bytes of transmission per token, dramatically improving practicality for high-frequency verification.
• Cross-entropy and distributional baselines are vulnerable to adversarial manipulation (e.g., temperature tuning) and require substantially more samples, especially for subtle configuration deviations.

Token-DiFR is also validated in an in-the-wild audit of public Llama 3.1 8B providers, showing the method’s real-world utility for spot-checking open-source deployments.

Comparative Analysis and Theoretical Implications

The DiFR framework introduces an operationally viable and technically rigorous paradigm for LLM inference verification, filling a gap left by cryptographic/activation/distributional baselines:

• Seed-conditioned verification dramatically reduces the attack surface. Given the same seed and properly replayed sampling algorithm, the space of permissible outputs is highly restricted. This property is crucial for post-hoc auditing and forensics.
• Activation fingerprinting provides a continuous integrity signal even across states that produce identical outputs, allowing fine-grained detection of any model drift or optimization-induced degradation not caught by surface-level generation checks.
• Distributional tests (e.g., MMD, RUT) can confirm statistical consistency but are inherently vulnerable to adversarial reranking, steganography, and distribution-matching attacks, and do not guarantee that specific generations were produced as claimed.

Theoretically, these results imply that for open-weight models and standardized sampling, trust in inference can be decoupled from infrastructure trust (as long as providers make PRNG seeds and, if desired, fingerprints available). This paradigm is less applicable to closed-source, high-security weights, but it establishes rigorous, scalable standards for open-model reproducibility and auditing.

Practical Considerations and Future Developments

Deployment Implications

• Openness & Standardization: Both methods require access to model weights and a well-specified sampling protocol. Standardizing sampling algorithms (e.g., using canonical implementations like vLLM) simplifies cross-provider verification and enables third-party auditing.
• Greedy/Temperature-zero mode: Token-DiFR can be used for zero-communication spot checks in deterministic settings without synchronized seeds, although this is less secure for general-purpose deployments at $T > 0$.
• Bandwidth adaptation: Activation-DiFR allows tuning the frequency and dimensionality of fingerprints to trade off between bandwidth and confidence, supporting fine control for deployment in large-scale environments.
• Combining metrics: Optimal practice entails using a suite of detectors (Token-DiFR, Activation-DiFR, cross-entropy, tail-pooled statistics) to monitor for a spectrum of potential failures.

Limitations and Future Work

• Closed-weight models: Methods requiring access to weights are not suitable for verification of commercial/closed providers, and cryptographic approaches remain computationally infeasible for these settings.
• Extended sampling algorithms: While the DiFR methodology theoretically generalizes to techniques like speculative decoding, each variant requires methodological extension and metadata capture.
• Handling benign implementation drift: Even among "reference" implementations, differences in tokenizer, chat template, or infrastructure can broaden the null distribution. Calibration strategies and user-determined thresholds must account for these.
• Verifiable machine learning ecosystems: Widespread deployment would benefit from protocol-level support for seed exposure, fingerprint API standardization, and open reference implementations.

Conclusion

The DiFR framework ("Inference Verification Despite Nondeterminism") establishes robust, fine-grained, and practically deployable methods for post-hoc verification of LLM inference, overcoming the barriers posed by numerical nondeterminism and adversarial infrastructure. The combination of Token-DiFR and Activation-DiFR yields high-confidence, low-overhead detection of even subtle misconfigurations, providing essential primitives for transparency and trust in open-source LLM services. By advocating for open, standardized sampling and verification protocols, this work lays the technical foundation for transparent, third-party-verifiable AI deployment at scale (2511.20621).