Whole-workload recomputation (reproducible packets)

How it works

For an inference-only retrofit, the AI 2040 verification plan proposes passive network taps that copy all input and output traffic to a recomputation server ¹. All AI workloads, including inference and agentic tool use, would be organized into "discrete and reproducible packets, which are transparent to the recomputation server" ¹. The server recomputes random samples of the packets to check that they are correct ¹. Reproducibility is required because the correctness checks depend on it, and inference is not reproducible by default ¹.

For later verification of R&D, the plan breaks workloads into a hierarchy of steps: full training run, training phases, gradient steps, layer forward and backward passes, GPU kernel calls and individual instructions ¹. If each step can be made reproducible (the plan notes that seeded randomness is acceptable), the granularity of evidence collection maps predictably to the level of assurance ¹. The same plan would also split data centres into isolated inference units by removing much of the back-end ("east-west") networking ¹; see Bandwidth limits and compartmentalization.

The plan illustrates the approach for 2034 ¹:

• a pool of about 33 billion H100-equivalents, its projected build-out for that year;
• a recomputation budget of 1%;
• packets of 100 H100-equivalent hours.

It charts, by the deployment's size, the probability of catching a rogue internal deployment within an hour, a week or a month ¹. The plan states that detection improves as packet size decreases ¹.

Amodo describes a related design for pre-training, in which each training step is the unit ²:

• The prover commits a hash of sampled weight positions before learning whether the step will be audited ².
• For audited steps, the verifier re-runs the step and accepts if the result agrees with the committed checkpoint within a calibrated tolerance ².
• Because the verifier's hardware is much slower than the prover's, the audit rate follows from the slowdown: about 0.1% of steps if recomputing a step takes 1,000 times as long as the step itself ².

Amodo reports a prototype that recomputes individual inference requests, which Sampled inference recomputation covers ³.

What it establishes

The plan argues that random partial recomputation can verify all outputs with very high probability while using a small fraction of the original compute ¹. Like other recomputation schemes, it checks whether declared workloads were computed correctly, not whether other work ran outside them ². The plan states that it does not verify that spare compute is left unused for unapproved workloads ¹.

Threat model

• Recomputation server. The plan calls its integrity "an extremely important aspect" of the retrofit ¹.
• Physical security. The plan relies on strong physical security to protect the verification measures from tampering ¹.
• Cooperation. Amodo's schemes assume the prover cooperates and lets the verifier install a recomputation server in its data centre ².
• Commit before audit. In Amodo's training-step design, the prover commits its evidence before it learns which steps will be audited ².

Limitations

• Reproducibility cost. Making inference reproducible "may involve some cost overhead" ¹. For training, writing a checkpoint at every step would cost more than 100% overhead, which Amodo's design avoids by keeping a spare replica ².
• Hidden work. The plan notes that a company might try to encode a non-compliant workload inside one that looks compliant ¹. Work outside declared packets, including on spare compute, is not covered ^{1 2}.
• Tolerance. Amodo's training-step design accepts a recomputed step within a calibrated tolerance ². In proof-of-learning, published spoofs exploit the tolerance that verification must allow for hardware noise ⁶.
• Dependencies. The scheme relies on deterministic execution (Deterministic and bit-exact inference), complete traffic capture (Network taps and certifiers) and a secure recomputation server ¹.