Committed Computation Traces: Hybrid Verification of Neural Network Inference Between Probabilistic Replay and Zero-Knowledge Proofs

Abstract

Organizations increasingly outsource neural network inference to third-party compute providers, and have no mechanism to confirm that the computation they paid for is the computation that ran. A provider can substitute a cheaper or quantized model, skip layers, return cached results from a previous input, or suffer silent hardware faults, and the customer observes only an output vector that looks plausible. Existing defenses sit at two extremes: probabilistic replay re-executes a random sample of inputs on independent infrastructure but detects a falsification on any given input only at the sampling rate, while zero-knowledge proof systems establish every constraint at cryptographic soundness but cost roughly three to four orders of magnitude more than the inference itself for models with hundreds of millions of parameters. This paper presents Committed Computation Trace Verification (CCTV), which occupies the gap between them. The executor commits to its full internal computation trace, the activations at every layer boundary, under a binding hash-based commitment before any verification challenge is issued. The verifier then opens and re-executes a randomly selected subset of inter-layer constraints, with challenges derived from a server-held secret key so that the sampled positions are unpredictable to the executor at commitment time. The main analytical result is that the sequential composition of neural network layers amplifies detection: a falsification introduced at any layer violates every downstream constraint unless the adversary honestly recomputes them. The expected detection probability is derived in closed form as 1 - (L-k)/((k+1)L), which for a 24-layer transformer with 5 sampled constraints gives 86.8 percent, a 4.34x improvement over probabilistic replay at an equal sampling budget. The paper gives an explicit adversary taxonomy and states the scheme's boundary plainly: an adversary that falsifies a single activation and honestly recomputes all downstream layers leaves one violated constraint and is detected at k/L, no better than replay, while gaining no computational saving. The scheme is implemented end to end over ONNX Runtime for BAAI/bge-large-en-v1.5 (335M parameters, 24 layers) and the analysis is validated empirically. Measured detection over 24,000 Monte Carlo trials is 86.7 percent against the 86.8 percent closed form, with 100 percent detection of cached replay and of model substitution, and a 0 percent false-reject rate on honest executions. Single-layer subgraphs extracted from the model reproduce its boundary tensors byte-exactly, so exact-recompute acceptance is realized rather than assumed. Committing the 52 MB trace costs 34.5 ms per input, 2.5 percent of single-threaded inference including capture, and verification at k = 5 costs 12.8 percent of a forward pass. In a full accounting from inference dispatch to receipt issuance, CCTV's added compute is 3.98x cheaper than 20 percent replay, or 4.79x with a measured Freivalds acceleration tier, in exchange for 16.8 MB of opened activations per challenged input against replay's kilobytes. The base construction uses hash-based Merkle commitments over per-layer activation digests, which are quantum-resistant and add only hashing cost; polynomial commitments are discussed as an optional upgrade path toward succinct algebraic verification.