Bit-Exact AI Inference Verification Without Performance Tradeoffs

Verifying claims about AI workloads is a prerequisite for credible AI governance of covert adversaries, yet the apparent non-determinism of GPU floating-point arithmetic forces auditors to accept approximate output matches. Covert adversaries can exploit unverifiable degrees of freedom in monitored computation. Attack vectors include steganography, unreported modification of inference software, and covert computation via unreported batch elements. Empirically, we analyze how modern inference engines (vLLM, HF transformers) produce deterministic but non-invariant outputs, without needing to set performance-compromising determinism flags, if the right information is available for recomputation and no atomic functions are called in the backend. We demonstrate that such bitwiseprecise re-computation does not require access to identical hardware, via a software-only emulation of LLM inference across multiple NVIDIA GPU variants.