Verifying claims about AI workloads is a prerequisite for credible AI governance of covert adversaries (who comply with monitoring only when detection likelihood is high), yet the apparent non-determinism of GPU floating-point arithmetic forces auditors to accept approximate output matches. Covert adversaries can exploit unverifiable degrees of freedom in monitored computation. Attack vectors include steganography, unreported modification of inference software, and covert computation via unreported batch elements. Empirically, we analyze how modern inference engines (vLLM, HF transformers) produce deterministic but non-invariant outputs, without needing to set performance-compromising determinism flags, if the right information is available for re-computation and no atomic functions are called in the backend. We demonstrate that such bitwise-precise re-computation does not require access to identical hardware, via a software-only emulation of LLM inference across multiple NVIDIA GPU variants. Thus, accumulated rounding errors can be an auditable signature of the software and hardware setup used for inference, instead of a constraint on verifiability.

翻译：验证AI工作负载的主张是对抗隐秘对手（仅在检测可能性高时才配合监控）的可信AI治理的前提，然而GPU浮点运算的表观非确定性迫使审计者接受近似输出匹配。隐秘对手可利用监控计算中不可验证的自由度展开攻击，攻击向量包括隐写术、未报告的推理软件修改，以及通过未报告的批处理元素进行的隐蔽计算。通过实证分析，我们检验了现代推理引擎（vLLM、HF transformers）如何在无需设置影响性能的确定性标志的前提下，在具备正确重算信息且后端未调用原子函数时，产生确定但非不变性的输出。我们通过仅依赖软件模拟的LLM推理方法，在多种NVIDIA GPU变体上证明此类逐位精确重算无需访问相同硬件。因此，累积舍入误差可成为推理所用软件与硬件配置的可审计特征，而非对可验证性的约束。