Technology
A floating-point number is a sign, an exponent, and a mantissa. GPU nondeterminism is mantissa-bit disagreement. XIP is the execution standard that makes every mantissa bit identical across conforming implementations. That property turns verification into arithmetic.
The Root Cause
Floating-point addition is not associative: (a + b) + c
need not equal a + (b + c). Vendors, drivers, and
compilers freely reorder reductions, fuse multiply-adds, flush
denormals differently, and select different kernels. The same
model, weights, and input yield different low-order bits on
different silicon, compounding layer by layer.
On our two-vendor rig, identical greedy decoding requests on NVIDIA-CUDA, NVIDIA-Vulkan, and AMD-Vulkan diverge in log-probabilities by the third decimal place within a single forward pass. On longer generations, the divergence flips actual output tokens.
Bit-equality is the only comparison an adversary cannot negotiate with, and it appeared unattainable across heterogeneous hardware. Tolerance-band alternatives generalize poorly: on diverse real prompts, our measurements show the gap between honest different-GPU output and cheaper-model output can invert. The check must be exact, or the economics leak.
The Design
XIP is a constrained execution mode for LLM inference, implemented as a patched open-source engine. Full method details are documented in a U.S. provisional filed July 10, 2026 and are reserved for a subsequent technical paper.
The operations that dominate inference, chiefly quantized matrix multiplication and accumulation, run as fixed-point computations whose results are independent of execution order, replacing order-sensitive floating-point reductions.
Nonlinear operations such as softmax, normalization, rotary embeddings, and activations use pinned evaluation order and exact cross-platform conformance, verified value-by-value across vendors against a golden-vector suite.
The subtlest failures were not in kernels but in which kernel the runtime silently selects: cooperative-matrix pipelines, fused attention, and fused expert routing each reintroduced vendor-dependent arithmetic. XIP pins dispatch so only conformant paths execute.
Validated on Real Hardware
All results are from a physical two-vendor rig with one NVIDIA GPU and one AMD GPU running three backends. Raw 32-bit logits were hashed at every position.
The practical result: a conforming NVIDIA GPU and a conforming AMD GPU can produce the same bytes, not merely similar answers.
| Model class | Model (quantized) | Result under XIP |
|---|---|---|
| Autoregressive dense | Qwen2.5 0.5B and 3B (Q8_0) | Byte-identical logits at every position, across all three backends, prefill and decode, across the full prompt sweep |
| Diffusion dense | LLaDA-8B (Q8_0) | Cross-vendor score divergence exactly 0.000 on all 10 sweep prompts (pre-fix honest band: ~0.23) |
| Diffusion mixture-of-experts | LLaDA-MoE-7B (64 experts, 8 active, Q8_0) | Expert routing deterministic; cross-vendor divergence exactly 0.000 on every prompt (pre-fix: ~0.28) |
Every experiment also ran the realistic economic attack: substituting a 4-bit quantization for the promised 8-bit model. Against an honest cross-vendor ceiling of exactly zero, every substituted run diverged by wide margins (0.09 to 1.10 in score distance; in the exact-hash regime, any single differing byte suffices). Both error directions validated: honest results are always accepted, substituted results are always rejected.
Determinism is not free. In the R5 spike, the XIP numeric patches added at most 8.2% single-stream decode cost versus the same contract-pinned baseline. The current exactness-first profile also gives up some stock fast paths, and long-prompt prefill is the largest unresolved performance cost. These are prototype constraints, not production targets.
XIP productization is recovering safe fast paths, tiled deterministic kernels, and prefill parallelism without relaxing byte identity. The full R5 benchmark ranges remain published in the whitepaper.
What Exactness Buys
With bit-exactness there is no judgment call left, only a hash comparison. Each of these properties follows structurally.
One independently assigned conforming audit can establish an exact match or mismatch. Mismatches escalate to referees; the routine path needs no voting, tolerance band, or k-fold replication.
An audit re-scores the claimed output in a parallel teacher-forced pass rather than re-generating token by token. The architecture projects a 10–100× compute advantage; the production rate and cost remain calibration gates.
A challenged receipt escalates to independently assigned conforming referees. They re-execute the disputed work and compare exact hashes without a vote.
Auditors are drawn by verifiable randomness from the stake-anchored registry, committed per epoch. An operator cannot know in advance which jobs will be checked.
Beyond Autoregression
Diffusion LLMs denoise in parallel and their generation schedule is not naturally reproducible. Mantissa verifies them by re-scoring rather than re-generating: the network fixes the claimed output and deterministically re-evaluates the model over it. This teacher-forced pass is bit-exact cross-vendor under XIP.
This extends verification to a model class many considered unverifiable in decentralized settings. It also covers mixture-of-experts routing, the mechanism at the heart of frontier-scale models, where a single flipped expert selection would otherwise produce a legitimately different output.
Nodes join the network only after passing the XIP conformance self-test on their own hardware:
Stated Plainly
Go Deeper
The whitepaper walks from the root cause to the receipt protocol to the economics, including the numbers that do not flatter us.