Honest drift across five accelerators.

A provider commits the trajectory of its computation. A validator re-runs a single step of it and checks that the answer reproduces. The check costs a small fraction of the work, roughly 1/N of a diffusion sample. The catch is that an honest re-run on a different GPU does not reproduce the committed step exactly, it lands a tiny distance away, and the accept tolerance has to clear that honest distance while still rejecting a substituted model. That distance is the whole ballgame, so we put real silicon behind it.

The method

For each model we generate once on a reference accelerator and dump the per-step denoising latents, header plus one record per step. That committed trajectory, identical bytes, is then shipped to every other accelerator, which re-executes the single steps outside the guidance interval and reports the relative L2 between its recomputed z_i+1 and the committed one. The autoregressive modalities (text, speech-to-text) use the same idea on the per-token logprob distribution rather than a latent. Nothing is simulated; each number below is a real server, a real model, and a real GPU.

The matrix

Two regimes fall out immediately. For text, speech, and most of the diffusion models the honest re-execution stays small across every accelerator, Blackwell included. The exception is narrow: only the two Stable Audio models climb on Blackwell, and nowhere else.

Text, where it started

Text inference is the original result the whole network rests on, so it got the most scrutiny. The check there is not a latent but a 256-dimensional random projection of the hidden state, committed per token; an honest re-execution drifts a little, a model that swapped in different weights drifts a lot. Across all five accelerators the honest mean sits at 0.025 with a worst-window tail of 0.082, comfortably under the 0.1 reject line, and Blackwell shows no elevation at all (0.025, identical to the data-center parts). The autoregressive path simply does not have the Stable Audio quirk.

The separation is the point. Committing Qwen3-8B and then serving a different model entirely, Qwen3-1.7B or Qwen3-4B, drives the sketch drift to 1.4, roughly fourteen times the honest band, an easy reject. The honest end is where it gets interesting: serving the same Qwen3-8B at q8 quantization instead of the committed precision sits right at the edge of the honest spread on the sketch alone, so the sketch by itself does not cleanly separate it. That near-lossless case is exactly what the second statistic is for, the per-token logprob distribution checked alongside the sketch. Cheap to check, hard to fake, and measured on a real engine rather than argued from a bound.

The result we did not expect

Blackwell, the newest part, reproduces honest computation with two to four times the drift of every older NVIDIA GPU. We assumed this was a code-generation artifact: our binaries ship as compute_80 PTX that the driver just-in-time compiles onto each card, and Blackwell is five architecture generations past sm_80. The fix would be easy, ship native Blackwell SASS. So we built it, CUDA 12.8, native sm_120, and re-ran the same trajectory.

So it is not the toolchain. Blackwell's tensor cores accumulate floating point in an order that the older parts do not, and native code does not change that. But the more interesting fact is which models it touches. The elevation shows up only for Stable Audio Open and Stable Audio 3, which share the stable-audio-tools transformer and decoder. ACE-Step, a different audio architecture, and Stable Diffusion image both reproduce in the normal band on the very same Blackwell card. It is one model lineage interacting with one accelerator, not a property of Blackwell or of diffusion. And it is genuinely the silicon, not just any unfamiliar architecture: Apple Metal, about as far from the NVIDIA commit as Blackwell is, reproduces those same Stable Audio models at 0.0058 and 0.0094, well inside the band. Only Blackwell's tensor cores drift on this one lineage.

Whichever it is, the calibration is the same. The honest worst case is 0.042; a substituted model lands at 0.27 to 1.0. We set the diffusion tolerance to 0.05, which admits every honest accelerator including Blackwell and still rejects a swap by five to twenty times. A fleet with no Blackwell can tighten it back toward 0.02. The tolerance is, as promised, a measured quantity, and now it is measured against the hardware that actually drifts.

The bench

Every binary in the sweep is built for a portable AVX2 baseline so it runs on any modern x86 host, not only the AVX-512 boxes the build runner happens to have. That fix came out of this work too: an audio conditioner that ran fine on Metal segfaulted on a stock cloud GPU host, because the compiler had baked in instructions the host CPU did not have. Lab work tends to surface that kind of thing.

The thresholds calibrate themselves

A table of numbers is only useful if the network can set its tolerances from it without a human in the loop, because anyone can bring a model our engine supports and we cannot pre-measure every one. So the validator does not ship a hand-set threshold per model. It derives each tolerance from the honest drift distribution it already sees while auditing, for every metric on this page, and tightens toward the real tail as evidence accrues. A new model serves at a conservative ceiling, accumulates honest re-checks, and converges to its own number.

Three things keep that sound. The derived value is clamped so it is never looser than the ceiling. It counts only accepted re-checks, so a caught cheat never enters the honest distribution. And it requires enough distinct providers that no single operator can move it. Validators gossip their distributions and agree on one tolerance per model, so the whole network adjudicates against the same calibrated set. The measurement on this page is the seed; the network grows the rest.