I think the big difference they're implying (though I haven't been able to actually /verify/ the implication yet) is that Dropbox holds the keys to decrypt that content. Infinit doesn't.
Honest question: how would you verify such a thing? Even if you audit the code, once they open-source it, how do you know that what you see is the same as what they run on their end? (Or do you mean 'verify' just in the informal sense of having them state that that is what they mean, rather than in some more formal trust-free sense?)
If it's actually secure, then the only thing which matters is what I run on my end, since the key would be generated on my end and the chunks would be encrypted on my end. If I send a server my data, then the system cannot be secure.
In the latter case, you'd look at the software that /you/ run to validate that:
1. It's using some sane form of key generation. 2. It's actually using those keys to perform encryption on the files prior to them being transmitted. 3. The original files, as well as the key material, aren't read anywhere else in the code base not necessary to do the above two.
Then, only run that version of the software. It's non-trivial, and generally expensive. This is why a lot of people prefer tools which call out to other trusted programs to actually handle the key management and encryption. Less complicated code to audit that way. (cf tarsnap)