Towards Verifiable AI with Lightweight Cryptographic Proofs of Inference

Pranay Anchuri; Matteo Campanelli; Paul Cesaretti; Rosario Gennaro; Tushar M. Jois; Hasan S. Kayman; Tugce Ozdemir

cs.CRMar 19, 2026

Towards Verifiable AI with Lightweight Cryptographic Proofs of Inference

Authors: Pranay Anchuri, Matteo Campanelli, Paul Cesaretti, Rosario Gennaro, Tushar M. Jois, Hasan S. Kayman, Tugce Ozdemir

Organizations: Offchain Labs · University of Tartu, Estonia · CUNY Graduate Center · City College of New York

Abstract

When large AI models are deployed as cloud-based services, clients have no guarantee that responses are correct or were produced by the intended model. Rerunning inference locally is infeasible for large models, and existing cryptographic proof systems -- while providing strong correctness guarantees -- introduce prohibitive prover overhead (e.g., hundreds of seconds per query for billion-parameter models). We present a verification framework and protocol that replaces full cryptographic proofs with a lightweight, sampling-based approach grounded in statistical properties of neural networks. We formalize the conditions under which trace separation between functionally dissimilar models can be leveraged to argue the security of verifiable inference protocols. The prover commits to the execution trace of inference via Merkle-tree-based vector commitments and opens only a small number of entries along randomly sampled paths from output to input. This yields a protocol that trades soundness for efficiency, a tradeoff well-suited to auditing, large-scale deployment settings where repeated queries amplify detection probability, and scenarios with rationally incentivized provers who face penalties upon detection. Our approach reduces proving times by several orders of magnitude compared to state-of-the-art cryptographic proof systems, going from the order of minutes to the order of milliseconds, with moderately larger proofs. Experiments on ResNet-18 classifiers and Llama-2-7B confirm that common architectures exhibit the statistical properties our protocol requires, and that natural adversarial strategies (gradient-descent reconstruction, inverse transforms, logit swapping) fail to produce traces that evade detection. We additionally present a protocol in the refereed delegation model, where two competing servers enable correct output identification in a logarithmic number of rounds.

Figures & tables

Panel of Figure 1 — Figure 1: Path-based verification protocol. The prover commits to the full output vector for query $\mathsf{qry}$ . Then, the verifier samples one path, starting from a single output neuron, picks one random neuron per layer (red path) and checks each selected neuron’s activation using all incoming connections (blue) from parent neurons in the previous layer. At each step, the new sampled neuron is picked among the parents. Counterfeit outputs lead to detectable inconsistencies with high probability.

Panel of Figure 2 — Figure 2: Interaction flow in our protocol. The Prover computes $\mathsf{trc}=\mathsf{EvalTrace}(\mathcal{M},\mathsf{qry})$ and commits to it via a vector commitment $C_{\mathsf{trc}}={\sf VC}(\mathsf{trc})$ . Verifier runs $\mathsf{TestTrace}$ where the queries of the test algorithm to $\mathcal{M},\mathsf{trc}$ are answered by the Prover through the vector commitments $C_{\mathcal{M}},C_{\mathsf{trc}}$ . See also the alternative protocol description in \cref sec:constr.

Figure 5: Activation distributions for path-selected neurons at bottleneck block endpoints and FC layer across models. Split violin plots show the probability density for neurons traversed during path selection.

\mathcal{M}

(blue) and

\widetilde{\mathcal{M}}

(orange) distributions are separated with quartile markers and annotated mean values.

Figure 6: Cumulative distribution of model separation values ( \cref eqn:mformula) for path-selected neurons, aggregated by mean per image-round path. The x-axis shows separation magnitudes; the y-axis shows the percentage of paths below each threshold. Blue dots indicate percentile thresholds.

Figure 7: Mean activation values per path. Each point is the average activation across layers for one image-round pair.

Figure 8: Model separation values across transformer blocks between Llama-2-7b-hf and Llama-2-7b-hf-chat models. The chart shows the mean separation value (Eq. 1 ) for each transformer block. Top 3 blocks are in red. Dataset: 25 sequences.

Figure 9: Cumulative distribution of model separation ( \cref eqn:mformula) between Llama-2-7b-hf and Llama-2-7b-hf-chat, focusing on the last token (output) for each sequence (x: separation value, y: ratio of tests below that threshold, red dots: percentile thresholds). Neurons are randomly selected per layer, with mean values aggregated per path.

		Threshold
Metric	Layers	$10^{-6}$	$6.7\times 10^{-5}$	$4.6\times 10^{-3}$	0.308
Minimum	$L_{1}$	100.0%	100.0%	100.0%	100.0%
	$L_{2}$	100.0%	100.0%	100.0%	100.0%
	$L_{3}$	0.1%	5.1%	99.9%	100.0%
Mean	$L_{1}$	0.0%	0.0%	2.5%	100.0%
	$L_{2}$	0.0%	0.0%	27.5%	100.0%

Table 1: % of Samples Passing Threshold by Metric & Layer

Figure 10: Pass rate analysis of mean separation values (log-scale). Individual layer curves

(L_{1},L_{2},L_{3})

and the “All Layers” requirement show

L_{1}

to be the bottleneck for attack success.

Figure 11: Model separation (Eq. 1 ) for Llama-2-7b-hf-chat at last token position, with neurons randomly selected per layer, and mean values aggregated per path. (x: separation value, y: ratio of tests below that threshold, red dots: percentile thresholds).

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

		Threshold
Method	Layers	$10^{-4}$	0.001	0.01	0.1
Pseudo Inverse	$L_{1}$	0.8%	9.2%	60.8%	100.0%
	$L_{2}$	0.0%	1.7%	17.5%	73.3%
	$L_{3}$	100.0%	100.0%	100.0%	100.0%
	All Layers	0.0%	0.0%	11.7%	73.3%
SVD	$L_{1}$	0.8%	9.2%	60.8%	100.0%

Appendix

Table 2: Percentage of Samples Passing Soundness Threshold by Method and Layer

Figure 12: Model separation values ( \cref eqn:mformula) for Llama-2-7b-hf-chat at last token position, with neurons randomly selected per layer and values aggregated by mean per path. Red dots mark key percentile points (x: separation value, y: percentage of tests below that threshold).

Figure 13: Activation distributions for path-selected neurons. Split violin plots show the probability density for neurons traversed during path selection across models trained on identical classification but different dog image subsets.

Figure 14: Cumulative distribution of model separation values. Shows separation magnitudes for path-selected neurons when both models perform dog vs cat classification with different dog training subsets.

Figure 15: Mean activation values per path for dog vs cat classification with different dog training subsets. Each point represents the average activation across layers for one image-round pair.

Figure 16: Activation distributions for path-selected neurons. Split violin plots show the probability density for neurons traversed during path selection across fine-grained dog breed classification models.

Figure 17: Cumulative distribution of model separation values. Shows separation magnitudes for path-selected neurons in fine-grained breed classification with Scottish Deerhound as the shared class.

Figure 18: Mean activation values per path for fine-grained dog breed classification models. Each point represents the average activation across layers for one image-round pair in the breed classification experiment.

Explore similar work

Privacy-Preserving Mechanisms Enable Cheap Verifiable Inference of LLMs
Feb 19, 2026Arka Pal, Louai Zahran, William Gvozdjak +2LLM Inference LLM Auditing
Ritual · MIT · Columbia University
TensorCommitments: A Lightweight Verifiable Inference for Language Models
Feb 13, 2026Oguzhan Baser, Elahe Sadeghi, Eric Wang +5LLM Inference LLM Security
Electrical and Computer Engineering, The University of Texas at Austin · Theseus AI Labs · Electrical and Computer Engineering, McGill University +1
Trusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AI
Mar 8, 2026Heng Jin, Chaoyu Zhang, Hexuan Yu +4LLM Auditing LLM Inference
Virginia Tech · Washington University in St. Louis

Feb 19, 2026J/K move · Enter open · S save

Privacy-Preserving Mechanisms Enable Cheap Verifiable Inference of LLMs

Arka Pal, Louai Zahran, William Gvozdjak, Akilesh Potti+1

Ritual · MIT · Columbia University

LLM Inference LLM Auditing

Open paper AskPDF arXiv

As large language models (LLMs) continue to grow in size, fewer users are able to host and run models locally. This has led to increased use of third-party hosting services. However, in this setting, there is a lack of guarantees on the computation performed by the inference provider. For example, a dishonest provider may replace an expensive large model with a cheaper-to-run weaker model and return the results from the weaker model to the user. Existing tools to verify inference typically rely on methods from cryptography such as zero-knowledge proofs (ZKPs), but these add significant computational overhead, and remain infeasible for use for large models. In this work, we develop a new insight -- that given a method for performing private LLM inference, one can obtain forms of verified inference at marginal extra cost. Specifically, we propose two new protocols which leverage privacy-preserving LLM inference in order to provide guarantees over the inference that was carried out. Our approaches are cheap, requiring the addition of a few extra tokens of computation, and have little to no downstream impact. As the fastest privacy-preserving inference methods are typically faster than ZK methods, the proposed protocols also improve verification runtime. Our work provides novel insights into the connections between privacy and verifiability in LLM inference.

Abstract

Explore similar work

Privacy-Preserving Mechanisms Enable Cheap Verifiable Inference of LLMs

TensorCommitments: A Lightweight Verifiable Inference for Language Models

Trusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AI