无需牺牲性能即可实现精准的AI推理验证，防止隐蔽攻击。
Bit-Exact AI Inference Verification Without Performance Tradeoffs
- 通过软件模拟实现跨GPU的比特级精确复现推理过程
- 现代推理引擎在不开启性能损耗模式下仍可产生确定性输出
- 可审计累积舍入误差，用于识别软硬件配置与潜在隐蔽计算
验证AI工作负载的真实性是可信AI治理的关键前提，尤其针对仅在检测概率高时才配合监控的隐蔽对手。然而GPU浮点运算的看似非确定性迫使审计者接受近似输出匹配，使对手可利用未验证的自由度实施攻击，如隐写、未报告的推理代码修改或通过未声明的批量元素进行隐蔽计算。我们实证分析发现，现代推理引擎（vLLM、HF transformers）在具备足够重算信息且后端无原子函数调用时，即使不启用性能牺牲的确定性标志，也能生成确定但非不变的输出。我们进一步证明，仅通过软件模拟即可在多种NVIDIA GPU型号间实现比特级精确的大型语言模型推理复现。因此，累积舍入误差可作为审计签名，而非验证的障碍。
原文摘要 · Abstract (English)
Verifying claims about AI workloads is a prerequisite for credible AI governance of covert adversaries (who comply with monitoring only when detection likelihood is high), yet the apparent non-determinism of GPU floating-point arithmetic forces auditors to accept approximate output matches. Covert adversaries can exploit unverifiable degrees of freedom in monitored computation. Attack vectors include steganography, unreported modification of inference software, and covert computation via unreported batch elements. Empirically, we analyze how modern inference engines (vLLM, HF transformers) produce deterministic but non-invariant outputs, without needing to set performance-compromising determinism flags, if the right information is available for re-computation and no atomic functions are called in the backend. We demonstrate that such bitwise-precise re-computation does not require access to identical hardware, via a software-only emulation of LLM inference across multiple NVIDIA GPU variants. Thus, accumulated rounding errors can be an auditable signature of the software and hardware setup used for inference, instead of a constraint on verifiability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。