Surely one wouldn't complain about infra at deepmind?

Can an expert explain how this protects against adversarial actors?

At a glance it looks like something akin to a computing a checksum that's locality sensitive, so it's robust to floating point errors, etc.

What's to stop someone from sending bad data + a matching bad checksum?

The validation procedure is described on page 8 of the TOPLOC paper: https://arxiv.org/abs/2501.16007

The checksum is validated by redoing the computation, but making use of the fact that you already have the entire response to enable greater parallelism than when generating it one token at a time.

TOPLOC attempts to detect model substitution, i.e. responses being generated by a different model than requested, it comes with certain caveats, as far as I can tell the TOPLOC paper considers verifiable learning / training as out of scope.

The underlying memory is still binary, or were you proposing an entirely new computer architecture with ternary gates?

Not necessarily new - first ternary computer was around in 1959! https://en.wikipedia.org/wiki/Setun