I think it would catch that, at least for open weights. From the repo docs [1] it looks like this type of attestation is even supported for open weight models: you commit with the public weights and publish the seed, so anyone can recompute the commitment from the Hugging Face files and check the provider is running the exact checkpoint and quantization they say they are. That's what they did with their Maverick demo. That said, it only works for greedy decoding and short contexts for now, and it's 70-95x the GPU time, so there may be cheaper ways to do this like TEEs.

[1] https://github.com/anthropics/FlashProve/blob/main/docs/what...

Maybe it's possible to tell by looking at the size of that error?

> The integer version is generally expected and empirically tested to be within some small error rate of true floating-point inference generically (even taking into account non-determinism of floating-point computations), though this does not cover adversarially designed prompts.