When large AI models are deployed as cloud-based services, clients have no guarantee that responses are correct or were produced by the intended model. Rerunning inference locally is infeasible for large models, and existing cryptographic proof systems -- while providing strong correctness guarantees -- introduce prohibitive prover overhead (e.g., hundreds of seconds per query for billion-parameter models). We present a verification framework and protocol that replaces full cryptographic proofs with a lightweight, sampling-based approach grounded in statistical properties of neural networks. We formalize the conditions under which trace separation between functionally dissimilar models can be leveraged to argue the security of verifiable inference protocols. The prover commits to the execution trace of inference via Merkle-tree-based vector commitments and opens only a small number of entries along randomly sampled paths from output to input. This yields a protocol that trades soundness for efficiency, a tradeoff well-suited to auditing, large-scale deployment settings where repeated queries amplify detection probability, and scenarios with rationally incentivized provers who face penalties upon detection. Our approach reduces proving times by several orders of magnitude compared to state-of-the-art cryptographic proof systems, going from the order of minutes to the order of milliseconds, with moderately larger proofs. Experiments on ResNet-18 classifiers and Llama-2-7B confirm that common architectures exhibit the statistical properties our protocol requires, and that natural adversarial strategies (gradient-descent reconstruction, inverse transforms, logit swapping) fail to produce traces that evade detection. We additionally present a protocol in the refereed delegation model, where two competing servers enable correct output identification in a logarithmic number of rounds.
Figures & tables
Figure 1: Path-based verification protocol. The prover commits to the full output vector for query qry . Then, the verifier samples one path, starting from a single output neuron, picks one random neuron per layer (red path) and checks each selected neuron’s activation using all incoming connections (blue) from parent neurons in the previous layer. At each step, the new sampled neuron is picked among the parents. Counterfeit outputs lead to detectable inconsistencies with high probability.
Figure 2: Interaction flow in our protocol. The Prover computes trc=EvalTrace(M,qry) and commits to it via a vector commitment Ctrc=VC(trc) . Verifier runs TestTrace where the queries of the test algorithm to M,trc are answered by the Prover through the vector commitments CM,Ctrc . See also the alternative protocol description in \cref sec:constr.
Figure 5: Activation distributions for path-selected neurons at bottleneck block endpoints and FC layer across models. Split violin plots show the probability density for neurons traversed during path selection. M (blue) and M (orange) distributions are separated with quartile markers and annotated mean values.
Figure 6: Cumulative distribution of model separation values ( \cref eqn:mformula) for path-selected neurons, aggregated by mean per image-round path. The x-axis shows separation magnitudes; the y-axis shows the percentage of paths below each threshold. Blue dots indicate percentile thresholds.
Figure 7: Mean activation values per path. Each point is the average activation across layers for one image-round pair.
Figure 8: Model separation values across transformer blocks between Llama-2-7b-hf and Llama-2-7b-hf-chat models. The chart shows the mean separation value (Eq. 1 ) for each transformer block. Top 3 blocks are in red. Dataset: 25 sequences.
Figure 9: Cumulative distribution of model separation ( \cref eqn:mformula) between Llama-2-7b-hf and Llama-2-7b-hf-chat, focusing on the last token (output) for each sequence (x: separation value, y: ratio of tests below that threshold, red dots: percentile thresholds). Neurons are randomly selected per layer, with mean values aggregated per path.
Threshold
Metric
Layers
10−6
6.7×10−5
4.6×10−3
0.308
Minimum
L1
100.0%
100.0%
100.0%
100.0%
L2
100.0%
100.0%
100.0%
100.0%
L3
0.1%
5.1%
99.9%
100.0%
Mean
L1
0.0%
0.0%
2.5%
100.0%
L2
0.0%
0.0%
27.5%
100.0%
Table 1: % of Samples Passing Threshold by Metric & Layer
Figure 10: Pass rate analysis of mean separation values (log-scale). Individual layer curves (L1,L2,L3) and the “All Layers” requirement show L1 to be the bottleneck for attack success.
Figure 11: Model separation (Eq. 1 ) for Llama-2-7b-hf-chat at last token position, with neurons randomly selected per layer, and mean values aggregated per path. (x: separation value, y: ratio of tests below that threshold, red dots: percentile thresholds).
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
Threshold
Method
Layers
10−4
0.001
0.01
0.1
Pseudo Inverse
L1
0.8%
9.2%
60.8%
100.0%
L2
0.0%
1.7%
17.5%
73.3%
L3
100.0%
100.0%
100.0%
100.0%
All Layers
0.0%
0.0%
11.7%
73.3%
SVD
L1
0.8%
9.2%
60.8%
100.0%
Appendix
Table 2: Percentage of Samples Passing Soundness Threshold by Method and Layer
Figure 12: Model separation values ( \cref eqn:mformula) for Llama-2-7b-hf-chat at last token position, with neurons randomly selected per layer and values aggregated by mean per path. Red dots mark key percentile points (x: separation value, y: percentage of tests below that threshold).
Figure 13: Activation distributions for path-selected neurons. Split violin plots show the probability density for neurons traversed during path selection across models trained on identical classification but different dog image subsets.
Figure 14: Cumulative distribution of model separation values. Shows separation magnitudes for path-selected neurons when both models perform dog vs cat classification with different dog training subsets.
Figure 15: Mean activation values per path for dog vs cat classification with different dog training subsets. Each point represents the average activation across layers for one image-round pair.
Figure 16: Activation distributions for path-selected neurons. Split violin plots show the probability density for neurons traversed during path selection across fine-grained dog breed classification models.
Figure 17: Cumulative distribution of model separation values. Shows separation magnitudes for path-selected neurons in fine-grained breed classification with Scottish Deerhound as the shared class.
Figure 18: Mean activation values per path for fine-grained dog breed classification models. Each point represents the average activation across layers for one image-round pair in the breed classification experiment.
As large language models (LLMs) continue to grow in size, fewer users are able to host and run models locally. This has led to increased use of third-party hosting services. However, in this setting, there is a lack of guarantees on the computation performed by the inference provider. For example, a dishonest provider may replace an expensive large model with a cheaper-to-run weaker model and return the results from the weaker model to the user. Existing tools to verify inference typically rely on methods from cryptography such as zero-knowledge proofs (ZKPs), but these add significant computational overhead, and remain infeasible for use for large models. In this work, we develop a new insight -- that given a method for performing private LLM inference, one can obtain forms of verified inference at marginal extra cost. Specifically, we propose two new protocols which leverage privacy-preserving LLM inference in order to provide guarantees over the inference that was carried out. Our approaches are cheap, requiring the addition of a few extra tokens of computation, and have little to no downstream impact. As the fastest privacy-preserving inference methods are typically faster than ZK methods, the proposed protocols also improve verification runtime. Our work provides novel insights into the connections between privacy and verifiability in LLM inference.
Most large language models (LLMs) run on external clouds: users send a prompt, pay for inference, and must trust that the remote GPU executes the LLM without any adversarial tampering. We critically ask how to achieve verifiable LLM inference, where a prover (the service) must convince a verifier (the client) that an inference was run correctly without rerunning the LLM. Existing cryptographic works are too slow at the LLM scale, while non-cryptographic ones require a strong verifier GPU. We propose TensorCommitments (TCs), a tensor-native proof-of-inference scheme. TC binds the LLM inference to a commitment, an irreversible tag that breaks under tampering, organized in our multivariate Terkle Trees. For LLaMA2, TC adds only 0.97% prover and 0.12% verifier time over inference while improving robustness to tailored LLM attacks by up to 48% over the best prior work requiring a verifier GPU.
Oguzhan Baser, Elahe Sadeghi, Eric Wang +5
Electrical and Computer Engineering, The University of Texas at Austin · Theseus AI Labs · Electrical and Computer Engineering, McGill University +1
Cloud-based infrastructure has become the dominant platform for deploying large models, particularly large language models (LLMs). Fine-tuning and inference are increasingly delegated to cloud providers for simplified deployment and access to proprietary models, yet this creates a fundamental trust gap. Although cryptographic and TEE-based verification approaches exist, prohibitive proving costs and limited TEE memory prevent them from scaling to modern LLMs, leaving clients unable to practically audit these processes. This lack of transparency creates concrete security risks that can silently compromise service integrity. We present AFTUNE, an auditable and verifiable framework that ensures the computational integrity of cloud-based fine-tuning and inference. AFTUNE incorporates a lightweight recording and spot-check mechanism that produces verifiable traces of execution. These traces enable clients to later audit whether the fine-tuning and inference processes followed the agreed configurations, by verifying sampled execution blocks inside a TEE, each covering only a small portion of the model and the execution trace. Our evaluation shows that AFTUNE adds modest overhead and makes auditing practical for clients.
Heng Jin, Chaoyu Zhang, Hexuan Yu +4
Virginia Tech · Washington University in St. Louis