# A Note on Non-Composability of Layerwise Approximate Verification for Neural Inference

arXiv: https://arxiv.org/abs/2602.15756 · HTML: https://mlsanity.com/paper/2602.15756/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 3 of its 5 references that are in the map.
- First posted on arXiv 17 Feb 2026.

## Builds on (most cited first, 3 of 3)

- [Understanding and Mitigating Numerical Sources of Nondeterminism in LLM Inference](https://mlsanity.com/paper/2506.09501/) (2025)
- [SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted Cloud](https://mlsanity.com/paper/1706.10268/) (2017)
- [Numerical stability analysis of large language models](https://mlsanity.com/paper/2503.10251/) (2025)

## Abstract (arXiv)

A natural and informal approach to verifiable (or zero-knowledge) ML inference over floating-point data is: ``prove that each layer was computed correctly up to tolerance δ; therefore the final output is a reasonable inference result''. This short note gives a simple counterexample showing that this inference is false in general: for any neural network, we can construct a functionally equivalent network for which adversarially chosen approximation-magnitude errors in individual layer computations suffice to steer the final output arbitrarily (within a prescribed bounded range).