BlockLock introduces a method that keeps shared batched prefill while fixing only the numerical path of a protected request, achieving reproducible LLM inference. It offers two modes: BlockLock‑Rows fixes the width of rows and retains batched decode for all requests; BlockLock‑Pack packs with a terminal dummy segment and extracts the KV state of the protected request for target‑only decode. Under a per‑deployment contract, both modes preserve the target’s output bitwise when companion requests change. Experiments span five dense models (Qwen3‑8B/14B, Llama‑3.1‑8B‑Instruct, Gemma‑3‑4B/12B‑IT) on three single‑GPU setups (A6000, A100, H100), covering tinyBenchmarks and BFCL, and include initial tensor‑parallel results on two A6000 GPUs. In all tests the modes keep target sequences and Top‑20 logit bits unchanged. At equal delivered work, BlockLock‑Rows reduces latency by 53.5%‑55.0% and boosts throughput by 115.2%‑122.2% compared to vLLM Batch‑Invariant. Compared with batch‑invariant kernels it requires no custom kernels and constrains only the protected requests. Review: BlockLock delivers efficient, reproducible inference without sacrificing shared prefill compute, offering a practical trade‑off between performance and output consistency for real‑world deployments.