arXiv CSopen access

Self-Verifying Measurement Records: Hash-Linked Evidence Graphs for Hardware Benchmarking

Self-Verifying Measurement Records: Hash-Linked Evidence Graphs for Hardware Benchmarking

arXiv:2606.27934v1 [cs.CR] 26 Jun 2026

Faruk Alpay∗ Barış Başaran Department of Computer Engineering, Bahçeşehir University, Istanbul, Turkey {faruk.alpay, baris.basaran}@bahcesehir.edu.tr

Abstract Performance numbers reported for hardware are accepted on trust: the reader cannot recompute them, the apparatus is gone, and the silicon itself can be silently wrong, with fleet studies reporting on the order of one core in a thousand returning incorrect arithmetic with no error raised. We make a reported hardware measurement a tamper-evident, independently checkable record. Every quantity that appears in the text, a table, or a figure is bound, by its content hash, to the observation and the verification behind it; the whole is a hash-linked, append-only structure, a transparency log for measurement, that a verifier audits offline without trusting its producer. Matrix products are verified by a probabilistic identity at O(kn2 ) cost under a tolerance we derive from floating-point error analysis and calibrate to the device’s own measured residual floor, so a wrong product is rejected with probability 1 − 2−k ; quantities with no such identity carry an algebraic checksum and a measured reproducibility class, which together catch a fault that recurs identically on every run. We then treat the check itself as a security object. A probe seed committed for offline reproducibility is an attack surface: a probe-aware adversary hides a corruption of 50% of the output in the probe’s null space, and a coordinated version passes a half-wrong result through a quorum of 4 bit-identical witnesses at once; a Fiat-Shamir challenge derived from the claimed output closes both while keeping the record offline. Driving the device from an unprivileged tenant’s reach, with a di/dt power virus and a thermal soak, neither moves the calibrated tolerance nor produces a silent error, which places the physical fault threat at the rare defective part or the privileged attacker and marks the boundary at which the record must compose with a hardware root of trust. We demonstrate the construction across Blackwell and Hopper accelerators, and report a measured residual-floor and reproducibility map by precision, size, and device, including that the floor the tolerance rests on is an architecture-independent invariant under which a retired device’s record is reconstructed on a successor of a different architecture, and a per-device signature that the part re-derives on demand.

1

Introduction

A reader who meets “the kernel sustains 1.7 PFLOP s−1 ” cannot check it. The number is the end of a computation whose inputs, the device, the driver, the exact shapes, and the moment-to-moment clock, are gone by the time the sentence is read, and on shared, thermally varying hardware the same run need not return the same value. Worse, the hardware can be wrong without saying so: large-fleet studies find a small but steady fraction of cores, of order one in a thousand, that produce incorrect results with no error raised [18, 10], and accelerators are not exempt. A reported performance number is therefore detached from two things at once: the evidence that it was measured, and the evidence that the underlying computation was even correct. The expectation that a stated number carry its evidence is no longer only a matter of taste. Scientific data are asked to be findable and reusable in ways that let others check them [48]; international climate accounting is built on a measure, report, and verify spine in which a figure is only as good as the trail behind ∗ Corresponding author: [email protected].

1

it [46]; and recent rules on high-impact computing systems require that records of what ran be kept [11]. We take the same stance for a benchmark: a measurement is reported well only when each number it states carries the evidence for itself, and that evidence should be checkable by a reader holding nothing but the paper’s own archive. We treat this as an integrity problem rather than a presentational one. The record must hold not only against accidental error but against a producer with reason to misreport, so we ask of it what is asked of a transparency log or a verifiable computation: that a verifier need not trust the party that produced the data [24, 6], and we make the underlying hardware itself the witness and the signer. Approach. We attach to every reported quantity the content hash of the record that produced it, and we attach to that record a verification chosen by what the quantity admits. A linear quantity, the entry of a matrix product, is checked by a probabilistic identity: for a claimed C = AB and a random probe x, the residual ∥A(Bx) − Cx∥ is small only if C is correct, and a wrong C is rejected with probability at least 1 − 2−k over k probes, at O(kn2 ) cost rather than recomputing the O(n3 ) product [14]. What makes this a measurement rather than a textbook check is the tolerance: we derive it from the rounding-error analysis of the product [16, 17] and calibrate it to the device’s own measured residual floor, so that ordinary low-precision roundoff is admitted while a genuine error is not. A nonlinear quantity, a reduction or an attention output, has no such cheap algebraic check, algorithm-based fault tolerance is known not to extend to it [20], so its record instead carries the measured run-to-run reproducibility of the kernel: bit-stable, or bounded by a measured divergence. The reported throughput itself carries its own class: a tightly bounded rate, or one that tracks the device’s clock and thermal state. Observations, verifications, reductions, the displayed quantities, and the compiled document form one hash-linked acyclic graph (Figure 1). Verifying a number is a local act: re-hash the nodes on its path and recompute the small functions that join them. The whole graph is audited in a single offline pass over one archive, with no device and no network (Section 2). Multi-stage verification. Verification is not one decision but a short transcript the record commits to, stage by stage: acquire a result, witness its residual and the calibrated tolerance, decide, and on a flagged result repair by recomputing on a higher-assurance path and re-witness (Section 3). We show two instances on the instrument. An FP8 product’s residual exceeds a tolerance calibrated at FP16; the record flags it and a higher-precision recomputation brings it back within tolerance. A single bit flipped in a correct product drives the residual far past tolerance; the identity check rejects it with the stated probability, and a recomputation repairs it. These are the loop of an error the data reveals, a fix, and a re-check, recorded in full. Cross-device corroboration. With two cards of the same model the record gains an independent check. The two devices compute the same product from identical inputs, and the difference between their outputs is itself a measured quantity: writing D[q] = q(card1 ) − q(card0 ) for the difference of a quantity across the two parts, we find D of the output is exactly zero for the deterministic kernels, so each card corroborates the other bit for bit, while D of the throughput is a small but consistent nonzero signature that two identical parts still carry (Section 6). A fault on one card breaks the agreement and is caught by the disagreement, the oldest form of a check, two witnesses, here measured rather than assumed. Hardware platform. We run on two RTX PRO 6000 Blackwell Max-Q cards, drive them to their documented limits in bandwidth, board power, and resident memory, and then measure what is not documented: the residual floor of their matrix products as a function of precision and size, which is exactly the quantity the tolerance is calibrated against. Blackwell has no detailed public timing model, and recent work characterizes it only through microbenchmarks [22, 21]; the floor and the per-card signature we report are of that kind. To check that we have not merely described one workstation, we also replay the same checks on a single RTX 5090 with 31 GiB memory and a single RTX PRO 6000 Server with 95 GiB, spanning consumer and server product configurations [35, 37]. Nothing in the method is specific to these parts, and the same record could be built for any accelerator that computes the same kinds of quantity, down to a future device whose internals differ entirely from a GPU. The point of a self-verifying record is finally a human one: a reader should trust a reported number to exactly the degree its evidence warrants, which is the calibration that

2

separates appropriate reliance from misplaced faith [25], and which a number with no attached evidence cannot support. Contributions. • A hash-linked evidence graph binding every displayed hardware-benchmark quantity to its observation and its verification, audited in one offline pass; tamper-evident under collision resistance, linear-time checkable (Section 2). • A verification for linear quantities: an identity check with a tolerance derived from rounding-error analysis and calibrated to the device’s measured residual floor, with a detection guarantee, recorded as a multi-stage transcript that reveals, repairs, and re-checks (Section 3). • A measured account of what the instrument admits: the residual floor of Blackwell matrix products by precision and size, and a reproducibility class for every workload, including atomic kernels whose run-to-run output we find nondeterministic by a measured margin (Section 5). • An algebraic check for the nonlinear quantities: attention decomposed into its two matrix products and a softmax invariant, atomic accumulation checked by a weighted checksum, so a consistent fault that run-to-run divergence cannot see is still caught (Section 4). • A two-device differential: identical-model cards that agree bit for bit on deterministic output, disagree under an injected fault, and carry a small consistent throughput signature, which turns a second card into an independent witness and a per-part fingerprint (Section 6). • Two out-of-sample single-device replays, on RTX 5090 and RTX PRO 6000 Server: the same seeded checks across consumer and server configurations, used to separate method-level invariants from device-specific performance (Section 7). • Re-verification that is portable and sub-linear: inputs from committed seeds let a reader re-check on any device, including a CPU, and a Merkle commitment over the claims audits any single number in O(log N ) (Section 9). • A directed continuation across devices: each instrument’s record commits to the hash of the record it extends, so the evidence advances in one direction, a later device only appends, and an earlier head stays valid as the record grows (Section 7). • What survives when an instrument is gone: from a retired device’s seeds, a living one of a different architecture re-derives 100% of its record, its transferable invariants, while its device-local rates are lost; a recallable signature the device answers for itself; and a random-access reading that exposes a 16× cross-die penalty the part’s streaming numbers hide (Section 8). • A security analysis of the check itself: a committed probe lets a probe-aware adversary pass a product wrong by 50% of its norm, and a coordinated version fools a quorum of 4 bit-identical witnesses at once, which a Fiat-Shamir challenge derived from the output closes on every witness while keeping the record offline and reproducible (Section 11). • A complete archive, the code, the 240 observations, the verification transcript, the graph, and a hash manifest, verifying to the root 1303d007503848af... with a standard-library checker (Section 9).

2

A hash-linked evidence graph

2.1

Nodes and content addressing

Let H be SHA-256 [32] over a canonical byte image: a JSON object with keys in lexicographic order, compact separators, UTF-8 text, every float written as the shortest decimal that round-trips to the same IEEE-754 double, and a terminating newline. Canonicalization gives a value exactly one byte image, so two parties with the same content compute the same identifier.

3

Definition 1 (Evidence graph). An evidence graph G = (V, E) has four kinds of vertex. (i) An observation o is the canonical record of one measurement: a workload or a verification step, its configuration, the environment digest, the device covariates sampled during it, the numerical fingerprint of the output, and the residual where one is computed; id(o) = H(bytes(o)). (ii) A reduction r = (f, θ, [id(ui )], v) applies a named pure function f to inputs named only by their identifiers and commits to v = f (u1 , . . . ; θ). (iii) A claim c is a quantity as rendered in the document: a value, a unit, a tolerance, a class, and the one identifier it asserts. (iv) The root names the claim identifiers the document displays. Each edge u → v stores id(v); G is acyclic with the layering root → claims → reductions → observations. Figure 1 shows the graph for one workload: observations enter on the left, a fixed set of reductions reads them by hash and produces the median rate, its dispersion, the rank correlation of rate against clock, the run-to-run divergence, and the verification residual; the claims in the prose name those reductions; the document seals the claims. Every arrow is a hash. observations

o1 o2 o3 .. . oR

reductions 9f3a...

Σ median rate

claims

document

c41e...

rate = 248.4 T S2

Σ dispersion, ρclk

7b02...

document main.pdf

Σ run-to-run div. verified S0, ρ ≤ τ

Σ Freivalds resid.

24 repeats

Figure 1: The evidence graph for one workload. Each arrow carries the content hash of the node it points at (one prefix shown per layer). A reader verifies a displayed number by re-hashing the observations, recomputing the reductions, and checking the claim against the value it names.

2.2

Offline audit

Definition 2 (Audit pass). Given the archived graph, the audit (a) recomputes id(x) for every node and checks it against the stored identifier; (b) checks every edge points at a present node; (c) recomputes each reduction from its named inputs and checks the committed value. Lemma 1 (Tamper-evidence). If any byte of any node is altered, the audit fails unless an explicit SHA-256 collision is exhibited. Proof. Altering a node changes its recomputed identifier, so step (a) fails for it unless the altered and original bytes share a hash. Editing a referrer to match an altered target changes the referrer’s identifier, and the failure propagates upward to the root. Each step needs a preimage or collision to avoid detection. Theorem 1 (Single-pass offline audit). The graph is auditable in time linear in its serialized size using only the archive, with no device, network, or re-execution. Proof. Each node is hashed once; each reduction reads inputs already present and applies a pure function linear in their number. The reductions are medians, dispersions, rank correlations, divergences, and residual aggregates, all pure functions of archived values; none consults the device. A reduction commits to its value, so the auditor recomputes rather than trusts. The reductions are deliberately simple and use only the standard library, so the check of Section 9 depends on nothing a reader must install.

4

3

Verifying linear quantities

A matrix product is the heaviest quantity these workloads report and the one that admits a cheap exactin-expectation check. For a claimed C = AB with A, B, C ∈ Rn×n and a probe matrix X ∈ Rn×k with independent standard-normal columns, write the normalized residual ρ(C) =

A(BX) − CX ∞ , ∥CX∥∞ + ε

formed in float32 so the check is more accurate than the products it inspects, at O(kn2 ) cost. Lemma 2 (Identity check, after Freivalds). If AB ̸= C then a single random probe satisfies A(Bx) = Cx with probability at most 12 , so over k independent probes the disagreement is missed with probability at most 2−k [14]. If AB = C the residual is zero in exact arithmetic. In floating point the residual of a correct product is not zero but a roundoff term. Standard analysis bounds it by γn = nu/(1 √ − nu) times the operand norms, and the probabilistic refinement replaces γn by a constant growing like n log n u [16, 17], where u is the unit roundoff of the product’s precision. We do not need the constant in closed form; we measure it. Definition 3 (Device-calibrated tolerance). Let ρ̄ be the largest residual observed over the correct repeats of a kernel at a given precision and size. The acceptance tolerance is τ = m ρ̄ for a fixed margin m = 3. A claim is verified iff ρ ≤ τ . The floor ρ̄ is a property of the silicon and the precision, not of the algorithm, and Section 5 reports it for Blackwell. Calibrating to it is what separates legitimate low-precision roundoff from a real error: a precision whose floor is high gets a correspondingly loose tolerance, and a residual that exceeds even that loose bound is not roundoff. Proposition 1 (Calibrated detection). Fix a precision with measured floor ρ̄ and tolerance τ = mρ̄. A correct product is accepted, since ρ ≤ ρ̄ ≤ τ . A product whose deviation from AB exceeds τ in a probed coordinate is rejected with probability at least 1 − 2−k . Hence a verified linear claim equals AB to within τ with confidence 1 − 2−k . Proof. Acceptance is ρ ≤ τ ; the first statement is the calibration. For the second, write D = C − AB; the check sees DX up to the float32 roundoff of the witness, which is below ρ̄ ≤ τ . If D deviates by more than τ in a probed coordinate, ∥DX∥ exceeds the witness roundoff for at least one column unless every column lies in the same measure-zero subspace, which by Lemma 2 happens with probability at most 2−k over the k independent columns. The verification transcript. A verification is recorded as a short sequence of stages, each a node in the graph: acquire the device’s result; witness its residual ρ and the tolerance τ ; decide (accept if ρ ≤ τ ); and, on a flagged result, repair by recomputing on a higher-assurance path and re-witness. The auditor of Section 2 checks that every decision follows its rule and every stage links to the next by hash, so the transcript is itself tamper-evident. Table 1 is the transcript of two demonstrations on the instrument. Table 1: Two verification transcripts on the instrument, calibrated at the FP16 floor with τ = 6.06 × 10−4 and k = 8 probes (miss probability ≤ 3.91 × 10−3 ). Precision: an FP8 product exceeds the high-precision tolerance and is repaired by recomputing with float32 accumulation. Corruption: a single injected bit flip in a correct FP16 product is rejected and repaired. Case

Stage

Operation

precision

acquire repair

corruption

acquire inject repair

Residual

Decision

FP8 product FP32-accumulation recompute

−3

1.58 × 10 2.74 × 10−4

flag accept

FP16 product single bit flip in C recompute C

3.06 × 10−4 2.01 × 10−3 3.06 × 10−4

accept reject accept

5

The corruption row is the point of the construction: a residual of 2.01 × 10−3 , against a tolerance of 6.06 × 10−4 , is not a question of roundoff, and Proposition 1 makes its rejection a statement with a probability attached rather than a heuristic. The bit flip is injected deliberately, to measure the detector’s sensitivity rather than to claim such a deviation is common; how often one arises on its own, and whether a tenant can physically provoke one, is taken up in Section 12. The precision row shows the same machinery distinguishing an underprecise result, accepted by no high-precision reader, from a correct one, and recording the repair that fixes it.

4

Verifying nonlinear quantities

The identity check covers matrix products. The other heavy quantities, an attention output (a softmax over two matrix products) or an atomic accumulation, are nonlinear, and an algebraic fault-tolerance check is known not to extend to them directly [20]. Leaving them to their run-to-run reproducibility is not enough: that detects only non-reproducibility, so a fault that occurs identically on every run, the kind a deterministic but wrong kernel produces, leaves the divergence at zero and passes. We close this with a check that compares against meaning rather than against a previous run. √ Attention. An attention output is O = softmax(QK ⊤ / d) V , two matrix products around one softmax. The verifier forms the scores and the probabilities in float32, checks the softmax invariant that each probability row sums to one (we measure a worst-case row-sum error of 2.38 × 10−7 ), and compares the reference output to the claim. The two products are themselves Freivalds-checkable; the softmax is the only genuinely nonlinear step, and it is pinned by its invariant. This follows the recent line that brings algorithm-based fault tolerance to attention layers [45, 7], here as a recorded check rather than an inline one. Atomic accumulation. P A scatter or index-add P is a sum into buckets, and admits a cheap one-pass check: for random weights w, j wj outj must equal i widxi srci , the additive analogue of the Freivalds identity. It costs a single pass rather than re-running the scatter. A consistent fault is caught. Table 2 is the point. We inject a fault that is identical on every run, so its run-to-run divergence is exactly zero and a reproducibility check sees nothing wrong. The attention residual rises from a floor of 2.00 × 10−3 to 2.22 × 10−1 , and the scatter residual from 1.03 × 10−7 to 7.95 × 10−4 : both far above their floors, so the algebraic check catches what the divergence misses. The Snd quantities of Section 5 therefore carry an algebraic guard, not only a measured band. Table 2: An injected fault that is identical on every run leaves the run-to-run divergence at zero, so a reproducibility check passes it; the algebraic residual rises far above its floor and catches it.

5

Operation

Residual floor

Consistent-fault

Run-to-run div.

attention scatter

2.00 × 10 1.03 × 10−7

2.22 × 10 7.95 × 10−4

0 0

−3

−1

Caught ✓ ✓

Reproducibility classes and residual floors

Device and protocol. Measurements are on two RTX PRO 6000 Blackwell Max-Q cards (188 SMs, 95 GiB GDDR7 each, compute capability 12.0), driver 580.126.09, CUDA 13.0, PyTorch 2.12.1; the workload grid runs on one card and the differential of Section 6 on both. Each workload runs a sustained inner loop repeated 24 times under load while the SM clock, temperature, and power are sampled every 20 ms. The part is documented with a high-bandwidth GDDR7 interface and a 300 W board limit [36]; we hold FP8 gemm at 484.2 TFLOP/s under the board-power limit (Table 3), and a memory-bound stream fills 78 GiB of each card (Section 6).

6

The residual floor. The quantity that calibrates the tolerance is the Freivalds residual of a correct product. At n = 2048, 4096, 8192, and16384, the measured sequences are 1.95 × 10−4 , 2.02 × 10−4 , 1.93 × 10−4 , and 2.02 × 10−4 for FP16, 2.71 × 10−4 , 3.56 × 10−4 , 2.86 × 10−4 , and 2.89 × 10−4 for TF32, 1.51 × 10−3 , 1.78 × 10−3 , 1.53 × 10−3 , and 1.69 × 10−3 for BF16, and 1.63 × 10−3 , 1.78 × 10−3 , 1.61 × 10−3 , and 1.71 × 10−3 for FP8, in increasing-size order. Each precision stays in a narrow, size-dependent band rather than moving monotonically, while the ordering is stable: FP16 and TF32 remain below BF16 and FP8. To our knowledge this floor has not been reported for Blackwell; it is the empirical content of ρ̄ in Definition 3, and it is why a tolerance calibrated at FP16 flags an FP8 product (Table 1). Reproducibility of nonlinear quantities. Where no cheap identity exists, the record carries the measured run-to-run reproducibility instead. Table 3 gives, for every workload, the numerical class, bit-stable across repeats (S0) or bounded by a measured relative divergence (Snd), and the performance class, tightly bounded (S1) or tracking the device clock (S2). The dense gemm kernels, at all four precisions, and the streaming and reduction kernels return bit-identical output across every repeat; the atomic scatter and index-add kernels do not, diverging run to run by 3.51 × 10−5 and 7.55 × 10−5 in relative terms. This is the boundary that an algebraic fault-tolerance check cannot draw [20] and that the FP8 reproducibility question leaves open [41]: on this part, low-precision dense products are bit-stable, while atomic accumulation is the kernel class that is not. A Snd claim carries its measured divergence as its tolerance, exactly as a verified linear claim carries τ , and, by Section 4, also an algebraic check that a consistent fault cannot slip past. Table 3: What each workload admits on a single RTX PRO 6000 Blackwell Max-Q. Median is the sustained rate; Disp. the relative MAD over 24 repeats; ρclk the Spearman correlation of rate against SM clock; Perf. its class (S1 bounded, S2 clock-tracking); Output the numerical class (S0 bit-stable, Snd bounded by the measured divergence). Resid. is the Freivalds residual for the linear (gemm) workloads; the final columns record median board power, temperature, and peak resident memory. Reported quantity Workload

Var.

Median

Disp. (%)

ρclk

gemm gemm gemm gemm hbm_triad attention reduction reduction scatter_add index_add

fp16 bf16 tf32 fp8 f32 bf16 default deterministic atomic atomic

242.4 T 248.4 T 117.7 T 484.2 T 1510.4 G 224.9 T 1635.4 G 1635.2 G 73.0 Ge 72.8 Ge

0.188 0.055 0.063 0.022 0.019 0.596 0.004 0.013 0.510 0.073

+0.80 +0.48 -0.31 -0.12 +0.41 +0.29 -0.07 +0.19 +0.32 +0.44

Numerics Perf. S2 S1 S1 S1 S2 S1 S1 S1 S1 S1

Device state

Output

Resid.

W

S0 S0 S0 S0 S0 S0 S0 S0 Snd Snd

2.02 × 10 1.69 × 10−3 2.89 × 10−4 1.71 × 10−3 – – – – – – −4

300 300 300 300 300 300 300 300 300 299

C

GiB

90 89 88 89 85 91 85 85 86 87

4.5 4.5 4.0 4.0 60.0 1.3 8.0 8.0 12.0 12.0

◦

Figure 2 closes the performance side: throughput is flat against clock for a bounded workload and sloped for one that tracks the boost clock, which is what the rank correlation in Table 3 reports, so the class is read from the covariate, not chosen.

7

throughput

gemm/fp8 (bounded) clk = 0.12

gemm/fp16 (clock/thermal) clk = +0.80

485.00

250

484.75

248

484.50

246

484.25

244

484.00

242 1300

1320 1340 SM clock (MHz)

1360

1300

1400 1500 1600 SM clock (MHz)

Figure 2: Throughput against SM clock for a bounded (S1) and a clock-tracking (S2) workload. The slope is the evidence behind the class.

6

Cross-device differential measurement

A single card witnesses its own product through the residual of Section 3. A second card of the same model witnesses it again, independently, and the difference between the two is a measurement in its own right. For a quantity q computed on each part write the device differential D[q] = q(card1 ) − q(card0 ), a finite difference along the one axis a benchmark usually holds fixed, the identity of the silicon. We run both RTX PRO 6000 Blackwell Max-Q cards (95 GiB each) on the same inputs and read three differentials. Output agreement. For every deterministic kernel, both cards return bit-identical results: the relative difference D[ output ] of their matrix products is 0 at every size and precision (Table 4). Two parts agreeing to the last bit is the strongest corroboration a linear claim can have, an exact cross-check that needs no tolerance, and it holds because the dense products are bit-stable (Section 5) on both parts at once. The residual floors agree as well: ρ̄ is the same on the two cards, so the floor is a property of the architecture, not of the individual die. Throughput divergence. The same two cards do not run at the same speed. Their FP16 gemm throughputs differ by 2.56% and their FP8 by 2.21%, consistently in the same direction, a small fixed signature that identical models carry from manufacturing and die binning and that holds steady across runs [42]. D[ throughput ] is thus a per-part fingerprint sitting beside an output differential of zero: the cards are numerically the same machine and physically not, and a record that reports a rate without naming the card has already lost information the differential makes visible. Driven to fill their memory, each card holds 78 GiB resident while a memory-bound stream sustains 1515 GB/s. Fault detection by disagreement. When the two outputs agree bit for bit, a disagreement can only come from one side going wrong. We inject a single bit flip into one card’s product; the output differential jumps from 0 to 1.59 × 10−1 , and the corruption is caught by the discrepancy alone, while the other card, and its Freivalds residual, corroborate the correct result. This is redundancy used as evidence: a second witness that is silent when both are right and loud when one is not, recorded in the same graph as everything else.

8

Table 4: The differential between two RTX PRO 6000 Blackwell Max-Q cards on identical inputs. ρ0 , ρ1 are each card’s residual floor; D[ out ] is the relative difference of their outputs, zero wherever the kernel is deterministic. Precision fp16 fp16 fp16 bf16 bf16 bf16 tf32 tf32 tf32 fp8 fp8 fp8

7

n

ρ0

ρ1

D[out]

4096 8192 16384 4096 8192 16384 4096 8192 16384 4096 8192 16384

2.02 × 10 1.93 × 10−4 2.02 × 10−4 1.78 × 10−3 1.53 × 10−3 1.69 × 10−3 3.56 × 10−4 2.86 × 10−4 2.89 × 10−4 1.78 × 10−3 1.61 × 10−3 1.71 × 10−3

2.02 × 10 1.93 × 10−4 2.02 × 10−4 1.78 × 10−3 1.53 × 10−3 1.69 × 10−3 3.56 × 10−4 2.86 × 10−4 2.89 × 10−4 1.78 × 10−3 1.61 × 10−3 1.71 × 10−3

0 0 0 0 0 0 0 0 0 0 0 0

−4

−4

Out-of-sample device validation

The two-card result above is a differential inside one SKU. A stronger check changes the product configuration itself. We therefore replay the same seeded products, residual witnesses, and reproducibility measurements on two single-card instruments. The first is an RTX 5090: 170 SMs, 31 GiB of usable memory, driver 595.58.03, and PyTorch 2.12.1 [35]. The second is an RTX PRO 6000 Server: 188 SMs, 95 GiB, driver 590.48.01, and PyTorch 2.12.1 [37]. Both report compute capability 12.0 and CUDA 13.0, but they span consumer and server power/memory configurations. Equality of rates is therefore neither expected nor the claim. The transfer question is whether the record keeps the same semantics when the instrument changes. For device d, precision p, and size n, write Fd (p, n) = ρd (p, n),

Kd (w) = (performance class, numerical class)

for the residual floor and the class pair assigned to workload w. A device replay is evidence-preserving when the same pure reductions recompute, the linear claims use the same rule ρd ≤ mFd (fp16, nref ) with a fresh device floor, and the numerical class boundary Kd changes only where the measured divergence changes. This is weaker than bit-exact cross-device replay and stronger than a speed comparison: it asks whether the evidence language has the same meaning after the instrument changes. Table 5: Out-of-sample residual floors on RTX 5090 and RTX PRO 6000 Server compared with the primary RTX PRO 6000 Blackwell Max-Q instrument at the same reference size. Parentheses give each replay floor divided by the primary floor; each tolerance is recalibrated on its own device rather than copied across. Precision fp16 bf16 tf32 fp8

n

Max-Q floor

RTX 5090 floor

RTX PRO 6000 Server floor

8192 8192 8192 8192

1.93 × 10 1.53 × 10−3 2.86 × 10−4 1.61 × 10−3

2.23 × 10 (1.15×) 1.72 × 10−3 (1.12×) 3.60 × 10−4 (1.26×) 1.75 × 10−3 (1.08×)

1.93 × 10−4 (1.00×) 1.53 × 10−3 (1.00×) 2.86 × 10−4 (1.00×) 1.61 × 10−3 (1.00×)

−4

−4

Table 5 gives the transfer test. At n = 8192, all replay residual floors stay within a 1.00–1.26 multiplicative band of the primary instrument across FP16, BF16, TF32, and FP8. The independently calibrated tolerances are 6.68 × 10−4 on the RTX 5090 and 6.06 × 10−4 on the RTX PRO 6000 Server. The numerical boundary also transfers twice: the replays have 6 and 6 bit-stable workloads, respectively, while scatter-add and index-add remain Snd. Their measured divergences are 1.66 × 10−5 /1.29 × 10−5 on the first device and 4.02 × 10−6 /4.01 × 10−6 on the second.

9

Performance is the part that does not transfer. On the common validation shapes, the RTX 5090 sustains 217.3 and 519.1 TFLOP/s, whereas the RTX PRO 6000 Server sustains 404.2 and 797.2 TFLOP/s. Their memory triads reach 1578 and 1486 GB/s, respectively, with 24.0 and 66.0 GiB peak resident sets imposed by the replay shape. The added server result strengthens the separation: residual-floor order and the deterministic/nondeterministic boundary survive two changes of instrument, while throughput remains a device-local covariate. Continuation across devices. A replay is not only a test but an extension. Each device’s record commits to the hash of the record it continues, so the second instrument’s record folds in the first, and the evidence advances in one direction rather than sitting as a loose pile of independent files. The genesis is the primary record; the RTX 5090 extends it, and the RTX PRO 6000 Server extends that, leaving a head of d1c61484bef20151... after 2 links. Because a link is the content hash of (the prior head, the device’s summary), the head is recomputed by anyone holding the records, a later device only appends, and an earlier head stays valid as the record grows; a device may also continue from any prior head, so the record branches when two instruments extend the same point. The server link was produced by driving that card to 32768-wide products at its board-power limit, where its FP16 residual floor reads 1.99 × 10−4 , in line with the smaller sizes and extending the floor measurement upward on a third configuration.

8

Reconstruction from committed seeds and device signatures

A continuation invites the question of where it can safely go. Most directions are harmless. Two devices may extend the same head, and the structure simply branches; a record may be re-submitted, and the content hash makes it idempotent; a history may be rebuilt from the genesis with different content, and the head changes, so the substitution is visible to anyone who kept the old head [6]. One direction is not harmless. A link may point at a device that no longer exists. The hash is still valid and the chain still holds, but the evidence behind that link cannot be re-run, because the instrument is gone. This is the hazardous case: a record that is intact as a structure and hollow as evidence. Recoverable and device-local claims. We test it on a device that was retired after producing its record, by asking how much of that record a different, living instrument can bring back. The inputs were generated from committed seeds, so they regenerate on any device; we recompute the dead RTX PRO 6000 Blackwell Server Edition’s residual floor and numerical classes on an H200 NVL and check which of its claims re-derive. All of the transferable ones do: 20/20 residual floors and 8/8 numerical classes return within tolerance, for a recoverable fraction of 100%. What does not return are its 8 throughput figures, which were properties of that particular silicon, its clocks and its thermal envelope, and are gone with it. A retired instrument’s record is therefore not wholly dead: the part that was a transferable invariant is reconstructible on a successor, and only the device-local part is lost. The reconstruction is deliberately heavy, rebuilding the floor up to the dead device’s largest size, so the living instrument bears the full cost of recovering what the dead one can no longer state for itself. A recallable device signature. The living instrument also carries something the dead one cannot lend it: a recallable signature of its own. Manufacturing and architecture leave each part answering a fixed physical question the same way every time, and we read such an answer, the residual-floor vector across precisions together with a board-filling memory sweep, and fold it into a key the device re-derives on demand [23, 38]. Re-running the probe on the H200 NVL returns the same vector to within 1.3%, inside the 10% match window, so the key b552f0f2c1e1e43c... recalls the device: it is not written onto the card but read off it, and asking again gives the same answer. This is the measurement counterpart of hardware device attestation, and the kind of identity that record-keeping and product-security rules increasingly expect a high-impact accelerator to be able to present [33, 11, 12]. Interconnect latency asymmetry. The same probe reads the part’s internal geometry. A streaming sweep crosses the two on-package dies at full speed and shows nothing, as the vendor’s numbers promise. Random access does not: it is latency-bound, and the effective random-access rate falls from 662 GB/s within 10

the on-die cache to 179 GB/s on one die’s memory and to 43 GB/s once the working set spans both, a 16× step the streaming figure flattens to nothing. The curve is a device fingerprint in the sense the fingerprinting literature means [23]: a stable, structure-revealing signature that tells this class of part from another. The dense products, by contrast, stay bit-stable even with the board nearly full, so the instrument’s numerics are reproducible while its physical layout is legible. The board-filling sweep held 144 GiB at 7013 GB/s while the part sustained 3324 TFLOP/s, driven near its limits to take the measurement.

9

Archive format and offline audit

The source archive places the compiled document beside the evidence it cites (Figure 3). Document sources and figures are at the top level; an ancillary directory holds the code, the 240 observations one line each, the verification transcript, the two-device differential, both out-of-sample device replays, the graph, and a manifest of every member with its SHA-256, headed by the evidence-graph root 1303d007503848af.... anc/manifest.sha256 root 1303d007503848af... main.tex numbers.tex *_table.tex refs.bib main.bbl figures/*.pdf anc/code/*.py: workloads, verifier, graph anc/observations.jsonl anc/verification.json anc/cross_device.json anc/device_validation*.json anc/evidence_graph.json nodes and edges

Figure 3: The archive as a single sealed record: the document sources compile to the paper, the ancillary members carry the evidence, and the manifest binds them to one root hash. The checker re-hashes every member against the manifest and runs the audit pass of Section 2: python3 anc/code/verify_graph.py anc/evidence_graph.json

It uses only the standard library, recomputes every reduction, and prints the root hash on success. This is the check the paper’s numbers rest on: the residuals and reductions behind Tables 1 and 3 are recomputed from the observations, not trusted. Device-independent re-verification. The offline audit establishes integrity, that the residuals are the stated functions of the observations and nothing was altered. It does not, by itself, re-run the measurement. It does not have to be bound to the original card either. The inputs are generated from committed seeds, not shipped as data, so a reader regenerates them on any device and recomputes the cheap check there; the calibrated tolerance is what absorbs the roundoff difference between the verifying device and the original. We carry this out on the host: a GPU FP16 product is re-verified on the CPU from its seed, with a Freivalds residual of 1.97 × 10−4 against a tolerance of 7.50 × 10−4 , no GPU involved. The two-card agreement of Section 6 is the same portability at the strongest setting, a second physical device reproducing the output bit for bit. Where bit-exact reproduction is the goal rather than tolerance-bounded agreement, a deterministic kernel or a cross-hardware replay of the tensor-core operations closes the remaining gap [1, 3]. Scaling the audit. A full audit is linear in the record, which is the right cost when a record is the size of this one but the wrong cost for a computation that runs for days. The claims are the leaves of a Merkle tree whose root the document commits to (8c19dd13728bd0de... over 70 claims here), so any single number is verified against the root with an inclusion path of 7 hashes, without downloading the rest, and the per-claim audit is O(log N ) rather than O(N ). For the heavy regime where even one product is too large to recheck, the linear identity has a sub-linear interactive-proof form [44, 5] that the same record can carry; we use the cheap check here and leave that substitution to the scale that needs it. 11

10

Threat model and guarantees

The pieces above are, read together, a transparency log for hardware measurement: an append-only, contentaddressed structure with inclusion and consistency proofs, against which a reader checks claims without trusting their producer [24, 6]. It is worth stating plainly what a dishonest producer cannot do, because that is where the construction stops being a convenience and becomes a guarantee (Table 6). A producer cannot fabricate a reported number: a linear claim that is not the true product is rejected by the identity check with probability 1 − 2−k (Proposition 1), and a nonlinear one is caught by its algebraic guard (Section 4). A producer cannot rewrite a past record: every node is content-addressed, so a change moves the root, and a held-onto earlier head no longer extends to the new one [6]. A producer cannot equivocate, showing one history to one reader and another to another, the split-view attack that a Merkle root alone does not prevent: the cross-device differential is exactly a witness cosignature, a second physical device that independently reproduces the bits, and a reader who requires that cosignature cannot be split unless the devices themselves collude, the same defense a witness quorum gives a public log [28, 43]. A producer cannot quietly continue from a vanished device: the hazardous case of Section 8 is detected because its transferable invariants must re-derive on a living device, and a link whose evidence will not come back is a link a reader can refuse. And a producer cannot impersonate a device it does not hold: the recallable signature is a challenge the device must answer for itself. Table 6: Adversary model. Each goal a dishonest producer might pursue is denied by a property the record already carries; a verifier checks the evidence rather than trusting the producer. Adversary goal

Mechanism

Guarantee

Report a false number Alter a committed record Equivocate (split view) Continue from an absent device Impersonate a device Evade a known probe

probabilistic identity / algebraic check content addressing witness cosignature reconstruction from seeds recallable signature Fiat-Shamir challenge

rejected w.p. 1 − 2−k (Prop. 1) root changes; consistency proof fails [6] a second device reproduces the bits [43] transferable invariants must re-derive (§8) the device answers its own challenge probe bound to the output (§11)

None of these is new as a cryptographic idea; they are the working parts of a transparency log [24, 28, 6, 43]. What is new is that the witnesses are physical devices and the entries are measurements, so the cosignature is a card reproducing a result and the identity is a card answering for itself.

11

Soundness against an adaptive adversary

The identity check that anchors all of this rests on a condition it is easy to give away. Freivalds’ guarantee holds only when the probe is drawn after the product is fixed and is hidden from whoever produced it [14, 15]: a producer who knows the probe in advance can pass a wrong answer. A record that commits its probe seed so that anyone can re-verify offline has, in the same stroke, handed that seed to the adversary. We measured what this costs. Against a producer who does not know the probe, the most a wrong product can hide is the tolerance: a corruption whose residual stays under τ is by definition within the roundoff the check admits. On the H200 NVL that window is 0.1% of the output at FP16 and 0.5% at FP8, so the same admission that lets a low-precision product through also widens the room an adversary has to work in, the tolerance and the attack surface being one quantity. Against a producer who does know the probe, there is no bound at all. The residual sees a corruption E only as Ex, so an E in the null space of the committed probe, Ex = 0, is invisible at any size. We corrupt a product by 50% of its norm in that null space, and its residual against the committed probe is 2.36 × 10−4 , under the tolerance: a half-wrong result, accepted. This is not a weakness of the device but of a fixed challenge, and it is why a committed seed cannot by itself carry an adversarial guarantee. The repair keeps the record exactly as offline and reproducible as before. Derive the probe from a hash of the claimed output, a Fiat-Shamir challenge [13], so that the challenge an adversary would have to aim at 12

depends on the very output being corrupted; the same half-wrong product now has residual 6.36 × 10−1 , far above the tolerance, and is rejected. The second device closes it from the other side without any secret at all: holding the true product, it differs from the corrupted one by 1.43 of the output, so the witness cosignature catches what the single check, fooled by its own published seed, did not. The second witness, though, is the weaker of the two repairs, and it is worth seeing exactly how far it reaches. It catches the corruption above only because one device held the true product and the other the corrupted one, so they disagreed. But the two cards of Section 6 agree to the last bit, and an adversary who corrupts every witness by the same amount preserves that agreement. We put one coordinated null-space corruption, again 50% of the output, on 4 bit-identical witnesses at once: the committed check is fooled on 4/4 of them, the witnesses still agree so the redundancy sees nothing, and a half-wrong result is accepted by a quorum. Redundancy answers an accidental fault and an uncoordinated adversary; it does not answer one who corrupts all copies the same way. The Fiat-Shamir challenge does, on every copy at once, because its probe is a hash of each claimed output and the corruption has nowhere left to hide: it catches 4/4 of the same witnesses. The construction therefore reports its floors under a fixed seed, where the producer is honest and only roundoff is at stake, and ships a verifier that, in its adversarial mode, draws the probe from the output it is checking, so the soundness does not depend on a secret the archive has already published.

12

Physical stress and the trust boundary

The corruptions of Sections 3 and 4 are injected: a flipped bit, a deterministic miscomputation, placed by hand to exercise the check and measure its sensitivity. They say how the check responds to a wrong number, not how often a wrong number arises on its own. That second question is best put to the silicon directly, and it has a security form: can a tenant with no more than the access a public cloud grants physically drive the device into a wrong result, or move the tolerance the check accepts, without ever touching the output? The management plane that would make this easy is closed to a tenant. Setting the power limit, locking the clocks, or lowering the core voltage, the lever a software undervolting fault needs on a processor [31], all return insufficient permission on this instance. What remains is what any compute job can do: hold the device at sustained full load, and drive a di/dt power virus, back-to-back tensor-core bursts separated by short idles whose instantaneous current swings cause supply droop that an average power cap does not register. We ran this for 14 minutes while checking every burst with the same float32 identity, so a transient error would be caught rather than injected, and we measured the residual floor cold, after a thermal soak, and under di/dt (Table 7). Table 7: The residual floor at three physical operating points on an RTX 5090, measured over 139 264 verified products while the linear check ran continuously. The floor, which Section 11 shows is the attack surface, is invariant across them: inflation 1.00× after the thermal soak and 1.00× under di/dt. Operating point

Temp. (°C)

Residual floor ρ̄

45 80 80

2.36 × 10−4 2.36 × 10−4 2.36 × 10−4

Cold baseline Thermal soak di/dt burst

The device reached 80 ◦ C and a transient 588 W, capping its own clocks at the power limit to defend itself (throttle reason SW_POWER_CAP); the di/dt pattern held a mean 537 W, below the 575 W cap, so the averaging limiter never engaged against the current swings, yet the integrity margin did not give. The floor, which Section 11 showed is the attack surface, did not inflate under the stress a tenant can apply, and no product exceeded its anomaly threshold: 0 natural errors in 139 264 checks. This is the honest shape of the hardware threat. A healthy modern part does not hand a tenant a silent miscalculation on demand: it throttles before it breaks, and its GDDR7 carries on-die correction that masks the single-bit upset a memory-disturbance attack would aim for [26]. Silent corruption at scale is instead a property of the rare defective or marginal unit [18, 10, 27, 40], or of an attacker with privilege or special conditions a tenant lacks [31, 26, 39]. That rarity is the argument for the record, not against it: an event that one core in a thousand exhibits, or that an

13

adversary triggers deliberately, is exactly what a number carrying its own check guards against and a spot re-run misses. Two limits follow, and we state them plainly. The check defends the record: it presumes the host that produced and witnessed a number was not itself physically subverted. An adversary who can glitch the power rails of the verifier while it forms the Fiat-Shamir challenge, or who runs on a rooted device, defeats software witnessing from below; there the construction must compose with a hardware root of trust, an enclave’s asymmetric attestation key, which it complements and does not replace. And the per-card signature of Section 6 is behavioral, a throughput and a floor, sensitive to temperature and aging: it is an integrity signal that two records came from the same kind of part, not a cryptographic identity, and is read here only as the former. None of the machinery here is new cryptography; it is the disciplined application of a probabilistic identity, a public-coin challenge, and content addressing to the problem of making a hardware measurement carry its own evidence.

13

Related work

Silent hardware errors at fleet scale [18, 10] are the reason a correct-looking number can be wrong; our linear check is a per-claim guard against exactly this, in the spirit of algorithm-based fault tolerance [20] but recorded as auditable evidence rather than applied only at run time, and using a probabilistic identity [14] with a tolerance grounded in rounding-error analysis [16, 17]. Verifying nondeterministic floating-point results on accelerators is the subject of recent work that combines worst-case bounds with empirical acceptance regions and a dispute game [49]; we share the idea of a calibrated acceptance region but place it inside a self-contained measurement record, and we report the floor it is calibrated against. Bringing algorithm-based fault tolerance to the attention layer is itself an active line [45, 7]; we use the same decomposition, recorded as a check rather than applied inline, and only at a verification size. Where even the cheap identity is too costly, verifiable-computation protocols give a sub-linear proof for matrix products [44, 5], and cross-hardware replay reproduces tensor-core arithmetic away from the original card [1, 3]. Floating-point non-associativity and its effect on reproducibility [41, 47, 9] is what our numerical classes measure; the open question of which kernels are bit-stable on current hardware is answered here for Blackwell. Blackwell has no detailed public timing model, and its subsystems have been mapped only through microbenchmarks [22, 21]; our residual floor and per-card signature are a measurement in that line, aimed at correctness rather than peak throughput. That identical-model cards differ in speed is itself documented at cluster scale [42]; we add that they nonetheless agree to the last bit on deterministic output, and we turn the difference into both an independent check and a recorded fingerprint. Content addressing and Merkle structures [29, 2], provenance models [30], repeatability studies [4], and benchmarking methodology [19] supply the record’s machinery; the FAIR principles [48] and the measure-report-verify spine of climate accounting [46] supply the expectation that a reported number be checkable, and the calibration of trust to evidence is the human side of the same concern [25]. The workloads are standard dense gemm, streaming, and fused attention [8] on Blackwell-class hardware [34] with explicitly recorded product specifications [36, 35, 37]; they are the instrument, not the result.

14

Scope and limitations

The audit establishes that the archive is internally consistent and integral, and the linear check establishes that a verified product equals AB to within τ with confidence 1 − 2−k ; neither establishes that a different device would reproduce the observations. That is the role of the reproducibility classes, which state for each quantity whether bit-stability, a bound, or a covariate dependence is what to expect on re-execution. The residual floor and the classes are measured on this RTX PRO 6000 Blackwell Max-Q model with one software stack, then replayed on RTX 5090 and RTX PRO 6000 Server; the method is device-independent, the reported numbers are not. The validation narrows the interpretation from “one workstation” to “three measured Blackwell product configurations,” not to all future Blackwell systems. The identity check covers linear quantities, and the decomposition of Section 4 extends an algebraic guard to attention and atomic accumulation, but the softmax reference and the attention scores are formed at a verification size rather than the hot-path size, and an operator with no such decomposition would fall back to the divergence class. Re-running a check needs the inputs, which the committed seeds regenerate on any device, but re-running 14

it to bit-exactness still needs the same architecture. Tamper-evidence rests on the collision resistance of SHA-256 [32], and the detection guarantee on the independence of the probe columns. The guarantees are for the record and presume the producing host is not physically subverted; the boundary where software witnessing must yield to a hardware root of trust, and the behavioral rather than cryptographic nature of the per-card signature, are treated in Section 12.

15

Conclusion

We reported hardware measurements as a record in which every number carries, by content hash, the observation and the verification behind it: a probabilistic identity with a device-calibrated tolerance for the linear quantities, a measured reproducibility class for the rest, and a multi-stage transcript that can reveal an error, repair it, and re-check. A reader audits the whole thing from one archive in a single offline pass. The construction is independent of the parts it runs on; the two RTX PRO 6000 Blackwell Max-Q cards are the instrument that let us measure the residual floor the tolerance stands on, read the differential between two nominally identical dies, and exhibit the detection it promises. The 2 replays on RTX 5090 and RTX PRO 6000 Server then show which parts of the record survive changes of instrument: the floor order and numerical class boundary do, while throughput remains a local property of the card.

References [1] Erez Badash, Dan Boneh, Ilan Komargodski, and Megha Srivastava. Hawkeye: Reproducing GPU-level nondeterminism. arXiv:2603.20421, 2026. [2] Juan Benet. IPFS: Content addressed, versioned, P2P file system. In arXiv:1407.3561, 2014. [3] Eric Boniardi, Stanley Bishop, and Alison Haire. Validation of GPU computation in decentralized, trustless networks. arXiv:2501.05374, 2025. [4] Christian Collberg and Todd A. Proebsting. Repeatability in computer systems research. Communications of the ACM, 59(3):62–69, 2016. [5] Graham Cormode, Justin Thaler, and Ke Yi. Practical verified computation with streaming interactive proofs. In Proc. Innovations in Theoretical Computer Science (ITCS), 2012. [6] Scott A. Crosby and Dan S. Wallach. Efficient data structures for tamper-evident logging. In Proceedings of the 18th USENIX Security Symposium, 2009. [7] Huangliang Dai, Shixun Wu, Hairui Zhao, Jiajun Huang, Zizhe Jian, Yue Zhu, Haiyang Hu, and Zizhong Chen. FT-Transformer: Resilient and reliable transformer with end-to-end fault tolerant attention. arXiv:2504.02211, 2025. [8] Tri Dao, Daniel Y. Fu, Stefano Ermon, Atri Rudra, and Christopher Ré. FlashAttention: Fast and memoryefficient exact attention with IO-awareness. In Advances in Neural Information Processing Systems (NeurIPS), 2022. [9] James Demmel and Hong Diep Nguyen. Parallel reproducible summation. IEEE Transactions on Computers, 64(7):2060–2070, 2015. [10] Harish Dattatraya Dixit, Sneha Pendharkar, Matt Beadon, Chris Mason, Tejasvi Chakravarthy, Bharath Muthiah, and Sriram Sankar. Silent data corruptions at scale. arXiv:2102.11245, 2021. [11] European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI act); logging and record-keeping provisions. Official Journal of the European Union, 2024. [12] European Union. Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union, 2024. [13] Amos Fiat and Adi Shamir. How to prove yourself: Practical solutions to identification and signature problems. In Advances in Cryptology: CRYPTO ’86, volume 263 of LNCS, pages 186–194. Springer, 1987. [14] Rūsin, š Freivalds. Probabilistic machines can use less running time. In Information Processing 77 (IFIP Congress), pages 839–842, 1977. [15] Shafi Goldwasser, Silvio Micali, and Charles Rackoff. The knowledge complexity of interactive proof systems. SIAM Journal on Computing, 18(1):186–208, 1989.

15

[16] Nicholas J. Higham. Accuracy and Stability of Numerical Algorithms. SIAM, 2nd edition, 2002. [17] Nicholas J. Higham and Theo Mary. A new approach to probabilistic rounding error analysis. SIAM Journal on Scientific Computing, 41(5):A2815–A2835, 2019. [18] Peter H. Hochschild, Paul Turner, Jeffrey C. Mogul, Rama Govindaraju, Parthasarathy Ranganathan, David E. Culler, and Amin Vahdat. Cores that don’t count. In Proceedings of the Workshop on Hot Topics in Operating Systems (HotOS), pages 9–16. ACM, 2021. [19] Torsten Hoefler and Roberto Belli. Scientific benchmarking of parallel computing systems. In Proc. Int. Conf. for High Performance Computing, Networking, Storage and Analysis (SC). ACM, 2015. [20] Kuang-Hua Huang and Jacob A. Abraham. Algorithm-based fault tolerance for matrix operations. IEEE Transactions on Computers, C-33(6):518–528, 1984. [21] Aaron Jarmusch and Sunita Chandrasekaran. Microbenchmarking NVIDIA’s Blackwell architecture: An in-depth architectural analysis. arXiv:2512.02189, 2025. [22] Aaron Jarmusch, Nathan Graddon, and Sunita Chandrasekaran. Dissecting the NVIDIA Blackwell architecture with microbenchmarks. arXiv:2507.10789, 2025. [23] Tomer Laor, Naif Mehanna, Antonin Durey, Vitaly Dyadyuk, Pierre Laperdrix, Clémentine Maurice, Yossi Oren, Romain Rouvoy, Walter Rudametkin, and Yuval Yarom. DRAWNAPART: A device identification technique based on remote GPU fingerprinting. In Network and Distributed System Security Symposium (NDSS), 2022. [24] Ben Laurie. Certificate transparency. Communications of the ACM, 57(10):40–46, 2014. [25] John D. Lee and Katrina A. See. Trust in automation: Designing for appropriate reliance. Human Factors, 46(1):50–80, 2004. [26] Chris S. Lin, Onur Mutlu, et al. GPUHammer: Rowhammer attacks on GPU memories are practical. In Proceedings of the 34th USENIX Security Symposium, 2025. [27] LLM-PRISM Authors. LLM-PRISM: Characterizing silent data corruption from permanent GPU faults in LLM training. arXiv:2604.10390, 2026. [28] Marcela S. Melara, Aaron Blankstein, Joseph Bonneau, Edward W. Felten, and Michael J. Freedman. CONIKS: Bringing key transparency to end users. In Proceedings of the 24th USENIX Security Symposium, 2015. [29] Ralph C. Merkle. A digital signature based on a conventional encryption function. In Advances in Cryptology: CRYPTO ’87, volume 293 of LNCS, pages 369–378. Springer, 1988. [30] Luc Moreau and Paolo Missier. PROV-DM: The PROV data model. W3c recommendation, World Wide Web Consortium (W3C), 2013. [31] Kit Murdock, David Oswald, Flavio D. Garcia, Jo Van Bulck, Daniel Gruss, and Frank Piessens. Plundervolt: Software-based fault injection attacks against Intel SGX. In IEEE Symposium on Security and Privacy (S&P), 2020. [32] National Institute of Standards and Technology. Secure hash standard (SHS). Technical Report FIPS PUB 180-4, NIST, 2015. [33] NVIDIA Corporation. NVIDIA confidential computing and device attestation for Hopper and Blackwell GPUs. Whitepaper, NVIDIA Corporation, 2024. [34] NVIDIA Corporation. NVIDIA Blackwell GPU architecture. Whitepaper, NVIDIA Corporation, 2025. [35] NVIDIA Corporation. GeForce RTX 5090: Specifications. https://www.nvidia.com/en-us/geforce/ graphics-cards/50-series/rtx-5090/, 2026. Accessed 2026-06-25. [36] NVIDIA Corporation. NVIDIA RTX PRO 6000 Blackwell Max-Q Workstation Edition: Specifications. https:// www.nvidia.com/en-us/products/workstations/professional-desktop-gpus/rtx-pro-6000-max-q/, 2026. Accessed 2026-06-25. [37] NVIDIA Corporation. NVIDIA RTX PRO 6000 Blackwell Server Edition: Specifications. https://www.nvidia. com/en-us/data-center/rtx-pro-6000-blackwell-server-edition/, 2026. Accessed 2026-06-25. [38] Ravikanth Pappu, Ben Recht, Jason Taylor, and Neil Gershenfeld. Physical one-way functions. Science, 297(5589):2026–2030, 2002. [39] Majid Sabbagh, Yunsi Fei, and David Kaeli. Lightning: Striking the secure isolation on GPU clouds with transient hardware faults. arXiv:2112.03662, 2021. [40] SDC Anatomy Authors. The anatomy of silent data corruption: GPU error pattern study and modeling guidance. arXiv:2605.04213, 2026.

16

[41] Sanjif Shanmugavelu, Mathieu Taillefumier, Christopher Culver, Oscar Hernandez, Mark Coletti, and Ada Sedova. Impacts of floating-point non-associativity on reproducibility for HPC and deep learning applications. arXiv:2408.05148, 2024. [42] Prasoon Sinha, Akhil Guliani, Rutwik Jain, Brandon Tran, Matthew D. Sinclair, and Shivaram Venkataraman. Not all GPUs are created equal: Characterizing variability in large-scale, accelerator-rich systems. In Proc. Int. Conf. for High Performance Computing, Networking, Storage and Analysis (SC). IEEE, 2022. [43] Ewa Syta, Iulia Tamas, Dylan Visher, David Isaac Wolinsky, Philipp Jovanovic, Linus Gasser, Nicolas Gailly, Ismail Khoffi, and Bryan Ford. Keeping authorities “honest or bust” with decentralized witness cosigning. In IEEE Symposium on Security and Privacy (S&P), 2016. [44] Justin Thaler. Time-optimal interactive proofs for circuit evaluation. In Advances in Cryptology: CRYPTO 2013, volume 8043 of LNCS, pages 71–89. Springer, 2013. [45] Vasileios Titopoulos, Kosmas Alexandridis, and Giorgos Dimitrakopoulos. Custom algorithm-based fault tolerance for attention layers in transformers. arXiv:2507.16676, 2025. [46] United Nations Framework Convention on Climate Change. Paris agreement, article 13: Enhanced transparency framework. United Nations, 2015. [47] Nathan Whitehead and Alex Fit-Florea. Precision & performance: Floating point and IEEE 754 compliance for NVIDIA GPUs. Technical report, NVIDIA Corporation, 2011. [48] Mark D. Wilkinson et al. The FAIR guiding principles for scientific data management and stewardship. Scientific Data, 3:160018, 2016. [49] Jianzhu Yao, Hongxu Su, Taobo Liao, Zerui Cheng, Huan Zhang, Xuechao Wang, and Pramod Viswanath. TAO: Tolerance-aware optimistic verification for floating-point neural networks. In Proceedings of the 21st European Conference on Computer Systems (EuroSys), pages 1515–1532, 2026.

17