NeuronPool

Security

Verifiable inference

Teacher-forced logprob spot-checks catch model substitution (serving a smaller model or a more aggressive quant while billing for the listed artifact) and logit biasing. They are not a TEE, not a bit-exact replay, and not a proof that the host never saw the prompt.

What is proven

On a sampled slice of public jobs (~2 %):

  • The serving host returned per-token logprobs (top-1 + chosen-token logprob) with POST /v1/host/jobs/:id/complete.
  • A different verifier host (not the same account, not a shared pool) re-scored the produced token ids with a teacher-forced prefill (n_predict: 0 + logprobs / n_probs).
  • At K random positions, KL / top-1 agreement / chosen-token |Δ| sit inside the published tolerance for (artifact, quant, backend) in workers/src/verify-tolerance.json.
  • Same-backend top-1 agreement is calibrated to ≥ 99 %. A substituted model or a biased sampler fails those tolerances (see fixtures in workers/src/verify.test.ts).

A pass means: this job is statistically consistent with the listed artifact on that backend, not that every token was honest.

What is not proven

  • Bit-exact match across Metal / CUDA / ROCm / Vulkan / CPU. Numerical kernels differ; tolerances are statistical and published.
  • Jobs that never returned logprobs. Those are marked unverifiable and the host is dropped from the public tier (pool and self traffic keep working).
  • Prompt or response contents. Logprobs are sealed like job payloads (R2 key logprobs/{job_id}). Coordinators never log prompt/response text; verifiers receive token ids only.
  • That the host cannot cheat only when unobserved. T103 (commit-reveal) closes that gap; T102 samples after completion.
  • Private-pool jobs. Sampling is public-only so tenant isolation is unchanged.
  • Hardware attestation or a confidential VM. EDR / blessed-build trust is a separate tier (T20 / T94).

Pipeline

  1. Host complete includes logprobs[]. Missing or wrong-length arrays mark the job unverifiable and set hosts.unverifiable (public-ineligible via the existing T25 isPublicEligible gate). Completion never crashes.
  2. Cron samples ~2 % of eligible public jobs with a sealed blob.
  3. neuronpool serve --verifier registers at POST /v1/host/verifier and pulls POST /v1/host/verify/lease.
  4. Comparison uses applyEvent(..., "mismatch") twice (−20) on fail; a second mismatch quarantines (T25 math is unchanged). Verifiers are paid verify_pay at the prefill (input) token rate, capped by VERIFY_BUDGET_BPS (default 50 = 0.5 % of gross).
  5. Ops: GET /ops/verify and GET /v1/ops/verify (OPS_KEY). Counts only.

Calibrate with npx tsx scripts/calibrate-verify.ts.