If the binary you are using is signed, and the signature is well-known via a side channel, you can at least make sure you're running the same binary.

If the binary was built from a known source, and the build is reproducible, you can even be sure that the binary really represent the code in question; bugging a compiler so that it injects a malicious payload and keeps a crypto signature the same is a bit hard. (But the whole "trusting trust" chain applies.)