Source-linked AI summary
Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification
Cameron Wilding, Mina Shaker, Fatemeh Ganji
TL;DR
Post-deployment model modifications may preserve routine behavior while causing selective deviations, complicating verification of proprietary models. The paper uses hidden adversarial-style probes within a privacy-preserving zkSNARK attestation framework and finds token-based probes broadly effective, with practical Groth16 auditing.
Problem
Selective hidden modifications can evade routine prompts and benchmarks, while existing probing work does not directly verify post-deployment model consistency under limited trust.
Method
The framework searches for drift-sensitive adversarial-style probes, commits private baseline logits, and proves hidden-probe consistency with Groth16 without revealing probes, logits, or model weights.
Results
Token-based probes were the most broadly effective family across evaluated architectures and GPUs, while end-to-end auditing took roughly 2.4 seconds at K=10 with verification near 0.84 seconds.
Takeaways & Limitations
Hidden-probe attestation provides a practical governance mechanism for checking committed-baseline consistency without exposing proprietary models or probe contents.
Takeaways & Limitations
The framework is evaluated on small models and fixed perturbation types, requires re-establishing leading probes and drift baselines per model and device, and does not claim resistance to adaptation against probe selection.
Abstract
from arXiv · showhide
Post-deployment changes to large language models can alter behavior while leaving routine outputs largely unchanged, creating a challenge for AI governance when model weights are proprietary. We present a privacy-preserving zk-SNARK-based audit framework that searches for probes designed in the spirit of adversarial examples to amplify logit drift between an approved model and a modified deployment. Our framework explores complementary probe families under different access models. Token-based probes operate in a black-box setting and require only the input interface, tokenizer, and vocabulary. Embedding-based probes require gray-box access to the embedding interface. Stress probes rely on additional interface capabilities but do not require full white-box access to model weights or architecture. This range allows probe selection to balance sensitivity, access requirements, and deployment cost. We evaluate probe constructions across LLM architectures, model-tampering scenarios representative of post-deployment attacks, and GPU platforms. Importantly, our experimental results demonstrate that token-based probes consistently deliver the strongest mean sensitivity across models and GPU platforms, although operating in a black-box setting. Our Groth16 zk-SNARK workflow remains practical as the probe set scales from 1 to 50, where proving time increases from 1.02 to 1.78 seconds, verification remains near 0.84 seconds, and proof size remains constant.
1 Introduction
Post-deployment model changes can preserve routine behavior while altering responses to carefully chosen inputs, complicating integrity verification under limited trust. The paper proposes hidden adversarial-style probes combined with zkSNARKs to provide private, model-level audit evidence.
- Selective modifications can leave ordinary performance unchanged while altering behavior on carefully chosen inputs or triggers.
- Prior probing methods expose hidden behavior, but do not directly verify post-deployment consistency with a committed baseline.
- Telemetry supports execution and workload checks but does not establish behavioral consistency with an approved model.
- Plain probe fingerprints provide statistical confidence, but secrecy and public verifiability weaken when probes or challenges become known.
- zkSNARKs allow hidden-probe audits to produce compact, publicly verifiable proofs without revealing probes, logits, or model weights.
2 Adversary Model and Related Work
The threat model centers on selective post-deployment modifications that preserve normal behavior on standard tests while causing deviations on targeted inputs. The related work motivates probing as more direct for model-semantic verification than telemetry, while recognizing a narrower guarantee.
- Adversary Model: The adversary may modify an approved checkpoint through fine-tuning, adapters, model editing, backdoors, or parameter changes after deployment.
- Adversary Model: The framework assumes faithful witness generation and focuses on selective behavioral modification rather than generic service failure.
- Adversary Model: The targeted changes include hidden capabilities, triggers, narrow safety weakening, or selective bias while preserving routine behavior and benchmark performance.
- Scope Boundary: The guarantee is limited to preventing false consistency claims on the hidden probe set, not establishing full functional equivalence on all inputs.
- Related Work: Telemetry provides indirect execution evidence, whereas probing-based approaches target model behavior and hidden modifications more directly.
3 Background Information on zkSNARK
The paper formalizes probe instability, baseline commitments, and a hidden-probe audit relation for zkSNARK verification. The proof exposes only public audit data while keeping current probe outputs and auxiliary values private.
- The instability score Δ(x) is the L2 distance between approved-model and deployed-model next-token logits for candidate probe x.
- The final hidden probe set P contains the K probes with the largest instability scores within the selected probe family.
- The public commitment C hashes baseline_logits, while the recomputed audit value C′ must match C.
- The zkSNARK statement contains the commitment and public circuit parameters, while the witness contains current logits and auxiliary private values.
- Groth16 provides a succinct zero-knowledge proof that the hidden-probe audit relation holds without revealing probes or current model outputs.
4 Methodology
The methodology uses adversarial-style synthetic probes to expose hidden model changes, then combines probe sensitivity with private Groth16 verification for post-deployment integrity audits.
- Core idea: Synthetic probes target sensitive inputs that can reveal stealthy changes while routine prompts and benchmarks remain normal.The probes are intended as governance instruments rather than attacks and do not depend on task-specific semantics.
- Probe families: Token-based, embedding-based, and stress-style probes trade off sensitivity, model access, and deployment cost.Token probes require only the tokenizer and vocabulary; embedding probes require embedding-interface information; stress probes require stronger interface support without full white-box access.
- Probe selection: Δ(x) = ∥f_θ(x) − f_θ′(x)∥2 measures next-token logit drift between the approved and modified models at a fixed output position.Candidate probes with larger instability scores are preferred during off-circuit search.
- Probe selection: Token-space candidates include random, rare-token, delimiter, repeat, and sequence-length patterns, followed by model-specific search and selection.These constructions are non-semantic and require only the tokenizer and vocabulary size.
- Baseline commitment: The approved model’s probe responses are committed as C = H(baseline_logits), while the probes and raw logits remain private.The commitment serves as the public reference for later audits without exposing sensitive probe material.
- Private verification: Groth16 verifies repeated hidden-probe consistency efficiently because the audit circuit is stable and setup artifacts can be reused.The prover’s work remains substantial, but verifier-side cost stays very small for repeated audits.
5 Results
Token-based probes generally provide the most stable and highest mean logit drift, while other families show stronger outliers but less predictable sensitivity. Probe selection remains practical across audit sizes and GPU platforms, with cryptographic cost concentrated on proving.
- Within-family drift: Token-based probes produce the most consistent sensitivity, whereas sparse embedding and stress-style probes concentrate sensitivity in a small fraction of candidates.Within token families, drift remains consistent; other families show sharp declines and no predictable parameter effect.
- Cross-family comparison: Repeat and Delimiter token probes produce roughly four times the Δ(x) of remaining probes under LoRA plus Gaussian perturbation.After excluding outliers, MLP-targeted and attention-targeted probes perform comparably, while sparse embedding probes perform worst.
- Cross-family comparison: Rare token probes have the highest mean drift under localized Late MLP and Early Attention perturbations, despite strong outliers from targeted families.These experiments do not support a pathway-specific family advantage for stress probes.
- Cross-model validation: Token-probe effectiveness depends on the perturbation model: Repeat and Delimiter lead under LoRA-plus-Gaussian, whereas Rare leads under localized changes.This variation motivates selecting probes based on the model and deployment setting rather than transferring one probe choice across architectures.
- Groth16 performance: Proving time grows sub-linearly with K, verification stays near 0.84 seconds, and K=50 requires a 1 MB witness despite a 65-fold witness-size increase.The bulk of audit cost is borne by the prover rather than the verifier.
- Groth16 performance: Using 5–20 token probes yields total audit times between 2.157 and 2.883 seconds while preserving accuracy.The appropriate K can be calibrated separately for each model and deployment setting.
- GPU validation: GPU differences are small for LoRA plus Gaussian noise, but localized perturbations can change probe performance and some within-family rankings.Overall family rankings remain stable on Late MLP, while Early Attention shows GPU-dependent ranking changes.
- Cross-model validation: On Qwen, Random can surpass Rare for MLP perturbations, and targeted probes can approach or exceed token-probe outliers.Thus, MLP-targeted and attention-targeted labels represent generation hypotheses rather than verified pathway-specific detectors.
6 Conclusion
The framework offers hidden-probe attestation for model integrity, with token-based probes broadly effective and audits completing at low overhead. Its evaluation remains limited in model and perturbation diversity, requiring recalibration across models and devices.
- The framework verifies model integrity against a baseline commitment without revealing the probes, using a Groth16 proof over a Poseidon Merkle-tree commitment.
- Token-based probes were the most broadly effective family, and Qwen 2.5 experiments found token-space search produced the highest-mean probe type across two architectures.
- 2.4 seconds end-to-end at K=10, with verification fixed near 0.84 seconds, indicating low-overhead repeated auditing in the evaluated setting.
- The evaluation covered two small models and a fixed set of perturbation types, limiting the demonstrated scope.
- The leading probe and drift baseline must be re-established per model and per device rather than reused across them.