ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor

Dominik Dahlem; Rui Vieira

cs.CRSep 18, 2026

ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor

Authors: Dominik Dahlem, Rui Vieira

Organizations: Red Hat AI

Abstract

Third-party adapters for open-weight language models ship as opaque weight matrices; a recipient cannot check whether an adapter hides a backdoor without trusting the publisher or inspecting the weights, the publisher's core asset. For one important class (payloads placed where a safety monitor is structurally blind), detection is unsound as a defense: every detector that factors through the declared monitor is invariant on its blind subspace, and honest and backdoored adapters overlap on every blind-subspace statistic we evaluate, because benign adaptation uses that subspace too. Rather than detect this channel, we make it structurally absent and prove that we did. The publisher builds the adapter to read the input only through directions the monitor covers and proves this in zero knowledge, revealing nothing about the read factor it certifies. The certificate is cheap because the expensive part, identifying the monitor's blind spot, is a deterministic function of the public base model, so only one linear identity is proved; the served residual is the base model's own public floor, not a prover-chosen tolerance. The result is ServeGuard, a supply-chain primitive: the publisher ships a proof-carrying adapter whose proof lets a consumer or regulator verify, without the certified read factor and without trusting the publisher, that the adapter carries no hidden channel of this class relative to the declared monitor; an admission-time typing guard binds the guarantee to the adapter bytes admitted at serving time. Across eight checkpoints up to 7B from four families, the monitoring budget is architectural: the measured frontier saturates at the value-path rank on grouped-query checkpoints but not on multi-head ones. On a 0.5B model confinement is nearly free for benign adaptation, making monitor quality the security lever.

Figures & tables

Panel of Figure 1 — Figure 1: The ServeGuard pipeline. The deployer or its proving platform compiles the public monitor $M_{\mathrm{dep}}$ from the open base, trains monitor-typed factors, commits to the certified read factor and type witness, computes the package root $h_{\mathrm{pkg}}$ binding the public write factor to $c$ , proves the typed identity against a statement carrying that root, and ships the package. A stakeholder verifies without the certified read factor; the consumer’s admission-time guard recomputes $M_{\mathrm{dep}}$ and admits only bytes opening $c$ as the typed identity. The dashed edge is the external serving-integrity obligation ( Theorem 7 ).

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Paper statement	Lean declaration
( 1 ) Inertness	Inert
Theorem 1 (a) Channel-absence	attest_sound
Theorem 1 (c) Defense	inert_of_factor_through_visible
Theorem 1 (b) Factor-through	inert_iff_factors_through
Theorem 2 Typed LoRA	lora_typed_inert
Definition 2 Served map	served

Appendix

Table 2: Paper-to-Lean correspondence (axiom-clean: propext , Classical.choice , Quot.sound only).

Object / party	Status
Adapter publisher and prover	untrusted
Read factor $A$ , witness $C$	secret, adversarial
Write factor $B$	shipped in the clear, hash-bound
Public base hash, monitor policy	trusted public statement
Monitor compiler $\mathsf{CompileMonitor}$	deterministic, reproducible
SNARK, commitment, SRS	cryptographic assumptions

Appendix

Table 3: Trust boundary of the deployed certificate.

Predicate	Statement	Role
Inertness	$\ker M\subseteq\ker V$ , certified by $A=CM$ (or $V\,N=0$ )	the defense; absence of the OI channel
Confinement	$\Inert(M,V\circ\Pi_{\mathrm{vis}})$ for any $V$	inertness by construction
Joint coverage	$\Inert(M_{1}\!\times\!M_{2},V)$	cheap dual
Behavioral bound	$\lVert GV\delta\rVert\leq\lVert G\rVert\,\varepsilon\,\lVert\delta\rVert$ for $\delta\in\ker M$	$\varepsilon$ -inertness bounded shift
Named trigger	$T\subseteq\ker V$ , certified by $V\,N=0$ with $\img N=T$	fixed public trigger

Appendix

Table 4: The defense’s predicate family ( Section 3 ). The exact predicates arise from public homogeneous identities; the behavioral row is a norm consequence of inertness.

Zero-Knowledge ML

See all 12 papers

Feb 16, 2026

Weight space Detection of Backdoors in LoRA Adapters

LoRA adapters let users fine-tune large language models (LLMs) efficiently. However, LoRA adapters are shared through open repositories like Hugging Face Hub \citep{huggingface_hub_docs}, making them vulnerable to backdoor attacks. Current detection methods require running the model with test input data -- making them impractical for screening thousands of adapters where the trigger for backdoor behavior is unknown. We detect poisoned adapters by analyzing their weight matrices directly, without running the model -- making our method trigger-agnostic. For each attention projection (Q, K, V, O), our method extracts five spectral statistics from the low-rank update

ΔW

, yielding a 20-dimensional signature for each adapter. A logistic regression detector trained on this representation separates benign and poisoned adapters across three model families -- Llama-3.2-3B~\citep{llama3}, Qwen2.5-3B~\citep{qwen25}, and Gemma-2-2B~\citep{gemma2} -- on unseen test adapters drawn from instruction-following, reasoning, question-answering, code, and classification tasks. Across all three architectures, the detector achieves 100% accuracy.

David Puertolas Merenciano, Ekaterina Vasyagina, Kevin Zhu +2

Algoverse AI Research · Independent

Backdoor Detection Backdoor Defense in LLMs LLM Backdoor Attacks Low-Rank Adaptation

Ask PDF

Jul 20, 2026

ChannelGuard: From Borrowed Safety to Application-Controlled Defenses in Multi-Agent LLMs

AI assistants increasingly work as teams, where one model makes a plan, others search the web, use tools, or read stored information, and another writes the final answer. This creates new security risks because harmful instructions can enter through information passed between models, not just through the user's message. Yet safety tests usually report only whether an attack succeeded, without showing what actually stopped it. We show that systems with similar safety scores can depend on very different protections. Across five agent models, attacks were stopped by a cloud provider's filter, by the model itself, or by inconsistent model behavior. This matters because protection that comes from the model or provider may disappear when either one changes. We introduce CHANNELGUARD, an application-controlled defense that checks information at each handoff without extra training or additional model calls. Across more than 5,700 test runs, it stopped all tested attacks hidden in tool outputs on all five models. On two open models, it reduced successful prompt attacks from 80% to 3% and from 77% to 10%, with no change in accuracy on 30 math problems. However, reworded attacks could still bypass the defense.

Elias Hossain, Md Mehedi Hasan Nipu, Fatema Tuj Johora Faria +4

University of Central Florida · North South University · Ahsanullah University of Science and Technology +1

LLM Agent Security Prompt Injection Attacks on AI Agents LLM Agent Safety Multi-Agent LLMs

Ask PDF

Aug 31, 2026

Capability-Gated Language Models: Security Composes, Utility Does Not

Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are reissued; inside one set of weights every request meets the same model configuration. This motivates us to define capability-gated deployment: per-principal access control inside one set of weights, whose configurations form a lattice - meets accumulate a principal's restrictions and joins pool a coalition's reach. We instantiate it by sparse rank gating over an existing nested-factorisation mechanism, guide profile search with one-pass attribution, and read every result once from a pre-registered held-out split. Security approximately composes: provably exactly at meets under a monotone-elicitation assumption we falsify pointwise. In two lineages the median held-out meet deepens suppression; the one effect surviving correction strengthens it. Utility does not: individually harmless profiles can compose to retention and fluency damage, and no compositional bound exists.

Patrikas Vanagas, Augustas Mačijauskas, Laurynas Lopata

BPTI Vilnius, Lithuania · Independent Researcher Vilnius, Lithuania · askEarth AG Zürich, Switzerland

Language Model Safety Evaluation LLM Security

Ask PDF

Abstract

Zero-Knowledge ML

Explore similar work

Weight space Detection of Backdoors in LoRA Adapters

ChannelGuard: From Borrowed Safety to Application-Controlled Defenses in Multi-Agent LLMs

Capability-Gated Language Models: Security Composes, Utility Does Not