{
  "schema_version": "1.2.0",
  "rubric_version": "1.1",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "K-0020",
    "slug": "sampling-and-assurance",
    "title": "Sampling and assurance",
    "aliases": [
      "random sampling",
      "spot checks",
      "statistical assurance"
    ],
    "status": "published",
    "last_reviewed": "2026-09-25",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": [
        "codex-review"
      ]
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "Checking a random sample of accelerators, workload segments or outputs rather than all of them, so that violations are caught with a calculable probability.",
    "sources": [
      {
        "source": "S-0029",
        "supports": "number of chips to sample per monitoring period to catch at least one chip from a violating run with probability p; fewer samples for larger runs; the Prover cannot predict which chips are inspected; sampled segment recomputation",
        "locator": "§3.1–3.2, Equation 1, Table 1; §5.1"
      },
      {
        "source": "S-0017",
        "supports": "hash commitment to sampled weights before the prover learns whether a step will be audited",
        "locator": "pre-training scheme"
      },
      {
        "source": "S-0067",
        "supports": "recomputation server re-runs random samples of workload packets",
        "locator": "Concrete inference-only retrofitting proposal"
      },
      {
        "source": "S-0018",
        "supports": "a covert adversary is caught if it fails to stay hidden even once; random sampling needs to catch only a single instance of cheating; physical security and randomly sampled inspections as the likely primary defences",
        "locator": "threat model; defence layers"
      }
    ],
    "related": [
      "K-0009",
      "K-0024",
      "K-0003",
      "K-0018"
    ],
    "type": "concept",
    "url": "https://trustbutveri.fyi/concepts/sampling-and-assurance/",
    "source_file": "content/concepts/sampling-and-assurance.md",
    "flags_all": [],
    "body_markdown": "Sampling-based assurance checks a random sample of accelerators, workload segments or outputs instead of all of them, and chooses the sample size so that a violation is caught with a desired probability [[S-0029]].\n\nShavit gives a formula for how many accelerators a verifier must inspect in each monitoring period to find at least one accelerator used in a rule-violating training run with a chosen probability [[S-0029]]. The required number falls as the run occupies a larger share of the prover's accelerators, so larger runs need fewer inspections [[S-0029]]. Sampling works only if the prover cannot predict what will be checked [[S-0029]] or change its records once it knows. In one scheme, the prover [[K-0024|commits]] a hash of sampled weights at each training step before it learns whether that step will be audited [[S-0017]]. The same logic applies to [[K-0009|recomputation]] of random training segments in [[M-0006|proof-of-learning]] [[S-0029]] and of random workload samples in [[M-0003|reproducible computation packets]] [[S-0067]]. Against a covert adversary, sampling works through deterrence: one system overview notes that such an adversary is caught if it fails to stay hidden even once, and expects physical security and randomly sampled inspections to be the primary defences [[S-0018]].",
    "body_text": "Sampling-based assurance checks a random sample of accelerators, workload segments or outputs instead of all of them, and chooses the sample size so that a violation is caught with a desired probability [S-0029]. Shavit gives a formula for how many accelerators a verifier must inspect in each monitoring period to find at least one accelerator used in a rule-violating training run with a chosen probability [S-0029]. The required number falls as the run occupies a larger share of the prover's accelerators, so larger runs need fewer inspections [S-0029]. Sampling works only if the prover cannot predict what will be checked [S-0029] or change its records once it knows. In one scheme, the prover commits a hash of sampled weights at each training step before it learns whether that step will be audited [S-0017]. The same logic applies to recomputation of random training segments in proof-of-learning [S-0029] and of random workload samples in reproducible computation packets [S-0067]. Against a covert adversary, sampling works through deterrence: one system overview notes that such an adversary is caught if it fails to stay hidden even once, and expects physical security and randomly sampled inspections to be the primary defences [S-0018].",
    "referenced_by": [
      {
        "id": "M-0024",
        "title": "Bounding unexplained information in outputs",
        "url": "https://trustbutveri.fyi/mechanisms/bounding-unexplained-information/"
      },
      {
        "id": "M-0019",
        "title": "Chip registries and manufacturing records",
        "url": "https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0010",
        "title": "On-chip telemetry from timing, memory and performance counters",
        "url": "https://trustbutveri.fyi/mechanisms/on-chip-telemetry/"
      },
      {
        "id": "M-0006",
        "title": "Training-transcript verification (proof-of-learning)",
        "url": "https://trustbutveri.fyi/mechanisms/proof-of-learning/"
      },
      {
        "id": "M-0003",
        "title": "Whole-workload recomputation (reproducible packets)",
        "url": "https://trustbutveri.fyi/mechanisms/reproducible-computation-packets/"
      },
      {
        "id": "M-0001",
        "title": "Sampled inference recomputation",
        "url": "https://trustbutveri.fyi/mechanisms/sampled-inference-recomputation/"
      },
      {
        "id": "M-0016",
        "title": "Timed challenge-response and memory-occupation challenges",
        "url": "https://trustbutveri.fyi/mechanisms/timed-challenge-response/"
      },
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "M-0005",
        "title": "Zero-knowledge proofs of training constraints",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-training-constraints/"
      },
      {
        "id": "I-0011",
        "title": "AI 2040 inference-only verification stack",
        "url": "https://trustbutveri.fyi/implementations/ai-2040-inference-only-verification-plan/"
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0002",
        "title": "DiFR (Divergence From Reference)",
        "url": "https://trustbutveri.fyi/implementations/difr/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "I-0008",
        "title": "SASH confidential network logger",
        "url": "https://trustbutveri.fyi/implementations/sash-confidential-network-logger/"
      },
      {
        "id": "C-0001",
        "title": "Compute stock is at most a declared amount",
        "url": "https://trustbutveri.fyi/claims/compute-stock-is-bounded/"
      },
      {
        "id": "C-0010",
        "title": "There is no undeclared relevant compute",
        "url": "https://trustbutveri.fyi/claims/no-undeclared-compute/"
      },
      {
        "id": "C-0007",
        "title": "A training run stayed within declared limits",
        "url": "https://trustbutveri.fyi/claims/training-within-declared-limits/"
      },
      {
        "id": "K-0024",
        "title": "Cryptographic commitment",
        "url": "https://trustbutveri.fyi/concepts/cryptographic-commitment/"
      },
      {
        "id": "K-0003",
        "title": "Positive and negative claims",
        "url": "https://trustbutveri.fyi/concepts/positive-and-negative-claims/"
      },
      {
        "id": "K-0009",
        "title": "Recomputation",
        "url": "https://trustbutveri.fyi/concepts/recomputation/"
      },
      {
        "id": "K-0016",
        "title": "Undeclared compute",
        "url": "https://trustbutveri.fyi/concepts/undeclared-compute/"
      },
      {
        "id": "K-0002",
        "title": "Verifier",
        "url": "https://trustbutveri.fyi/concepts/verifier/"
      }
    ]
  }
}