Cloud-based infrastructure has become the dominant platform for deploying large models, particularly large language models (LLMs). Fine-tuning and inference are increasingly delegated to cloud providers for simplified deployment and access to proprietary models, yet this creates a fundamental trust gap. Although cryptographic and TEE-based verification approaches exist, prohibitive proving costs and limited TEE memory prevent them from scaling to modern LLMs, leaving clients unable to practically audit these processes. This lack of transparency creates concrete security risks that can silently compromise service integrity. We present AFTUNE, an auditable and verifiable framework that ensures the computational integrity of cloud-based fine-tuning and inference. AFTUNE incorporates a lightweight recording and spot-check mechanism that produces verifiable traces of execution. These traces enable clients to later audit whether the fine-tuning and inference processes followed the agreed configurations, by verifying sampled execution blocks inside a TEE, each covering only a small portion of the model and the execution trace. Our evaluation shows that AFTUNE adds modest overhead and makes auditing practical for clients.
Figures & tables
Figure 1: Each rectangle represents the full model at one training step. The red dashed border indicates blocks that will be independently verified, each of which contains only a portion of the training procedure.
Figure 2: AFTUNE workflow overview. The system operates through setup and negotiation, fine-tuning, and inference phases. During execution, the provider commits boundary state hashes to the client and stores boundary states in cloud storage. Clients can verify training or inference computations on demand through TEE-based selective recomputation of sampled regions.
Figure 3: Two-dimensional block structure organizing the training procedure. The dashed border shows a single block spanning 4 layers and 3 steps. AFTUNE records only boundary states: activations and gradients at layer block edges, and parameters and optimizer states at step block boundaries. Each block serves as an atomic, independently verifiable unit.
Model
Method
Block Size
Train Time
Overhead
Storage
Prep Time
Verify Time
(s)
(GB)
(s)
(s)
Qwen3-14B
Baseline
-
114.9
-
-
-
-
Step TEE
-
188.3
64%
552.9
144.7
N/A 1
AFTUNE
BL=2,BS=4
146.6
28%
303.8
13.0
29.8
AFTUNE
BL=4,BS=8
134.9
17%
206.4
28.0
77.5
AFTUNE
BL=4,BS=16
128.1
11%
178.9
39.8
122.1
Table 1: Comprehensive system overhead comparison per 2048 samples. Prep time is the time to prepare blocks for verification. Verify time is per block cell in TEE.
Figure 4: Training verification accuracy: parameter relative L2 error across layer block sizes and step block sizes.
Figure 5: Inference verification accuracy: activation relative L2 error across layer block sizes and precision levels.
Figure 6: Detection probability Pdetect as a function of sampling rate π for different numbers of compromised blocks k .
Attack Type
Attack Strength
BL
BS
Strategy
π
Pdetect
Under-training
Skip 50% steps
4
8
Uniform
5%
99.3%
Skip 25% steps
87.3%
Data poisoning
10% poison rate
4
8
Uniform
20%
35.9%
4
8
Input-only
10%
97.8%
4
4
Uniform
20%
59.0%
4
4
Input-only
10%
99.9%
Table 2: Detection probability under different attack types, block configurations, and sampling strategies (Llama-3.1-8B, 2048 training samples).
Figure 7: Adversarial example attacks: activation perturbation relative L2 norm across models and layer block sizes.
Figure 9: Trust propagation to Blocki,j . Correctness is derived from the anchor through neighboring blocks. Outgoing trust flows are omitted for clarity. Note that commitments of all blocks within each row must be submitted together, establishing mutual dependencies among them.
Figure 10: Training overhead composition across different models with the second configuration from Table 1 . Top row : Time overhead proportions for Qwen3-14B, Llama-3.1-8B, DINOv2-Giant, ViT-Large (left to right), followed by legend showing hash computation, I/O, and other AFTUNE operations. Bottom row : Storage proportions for the same models, followed by legend showing activations, gradients, and parameters.
Model
BL
Infer Time (ms)
Overhead
Storage (MB)
Verify Time (s)
Qwen3-14B
-
339
-
-
-
1
391
15%
3.16
17.5
2
386
14%
1.73
20.5
4
363
7%
0.88
27.0
Llama-3.1-8B
-
341
-
-
-
1
389
14%
3.75
6.3
Appendix
Table 3: Impact of layer block size on inference verification overhead with IA=4 . Rows with BL= “-” are baselines.
Figure 11: Relative L2 norms under BadEdit and Concept-ROT backdoor attacks. The fifth and sixth blocks are compromised.
Model
IC
Training Time (s)
Overhead
Storage (GB)
Prep Time (s)
Verify Time (s)
Llama-3.1-8B
-
45.1
-
-
-
-
1
52.8
17%
117.5
-
34.2
8
52.5
16%
114.8
14.2
Qwen3-14B
-
79.7
-
-
-
-
1
90.7
14%
152.2
-
41.1
8
90.1
13%
151.1
24.9
Appendix
Table 4: LoRA fine-tuning with verification across 2048 samples. Rows with IC= “-” are baselines.
Model
Metric
SGD
AdamW
Llama-3.1-8B
Train Time (s)
76.1
114.5
Overhead
21%
33%
Storage (GB)
146.2
206.6
Prep Time (s)
15.1
22.4
Verify Time (s)
48.2
83.0
DINOv2-Giant
Train Time (s)
34.8
48.5
Appendix
Table 5: Optimizer comparison: storage, training time, overhead, and verification metrics per 2048 samples.
Key Lab of High Confidence Software Technologies (Peking University), Ministry of Education, China · School of Computer Science, Peking University, Beijing, China · Tencent, Shenzhen, China +1