PaperlayerView exact revision on arXiv

Source-linked AI summary

Characterizing Statistical Separability in TP-CRIV for Probabilistic AI Models

Teruki Sano, Minoru Kuribayashi, Masao Sakai, Shuji Isobe, Eisuke Koizumi, Zhang Zhang, Satoru Matsumoto

arXiv:2610.11163v1cs.CRcs.AI

TL;DR

Probabilistic outputs make single-query evidence insufficient for reliable TP-CRIV, raising questions about how to accumulate observations and how much evidence is needed. The paper uses a U-statistic-based characterization to connect matching and non-matching behavior with detection performance and verification budgets. In experiments, allocating queries to more independent challenges improved AUC in cases where repeated responses did not, while the study reports close theoretical–empirical agreement and budget estimates.

  • Problem

    Repeated executions of the same query can yield different verification observations, leaving open how to accumulate stochastic evidence and how much is sufficient.

    Source: §I · p. 1

  • Method

    The paper uses a U-statistic to estimate squared probabilistic discrepancy and derives an AUC and verification-budget characterization conditional on challenge-wise distributions.

    Source: §I · p. 1, §IV · p. 4

  • Results

    AUC remains below 0.7 for Llama-2 and Yi when N is small despite substantially increased m, while increasing N improves AUC even at m = 2.

    Source: C. Empirical Matching and Non-Matching… · p. 10

  • Takeaways & Limitations

    The characterization relates probabilistic model behavior to verification-level separability and the evidence budget required for a prescribed detection performance.

    Source: §I · p. 2, §VII · p. 12

    The study frames its theoretical characterization as a starting point and identifies broader empirical scope as future work.

    Source: §VII · p. 12

Abstract

from arXiv · show

Third-party challenge-response identity verification (TP-CRIV) enables an independent verifier to assess whether a claimant possesses a model identical to a remotely deployed model without directly accessing the reference model. However, for probabilistic AI models, repeated executions of the same query may produce different outputs and therefore different verification observations. This raises the question of how such stochastic evidence should be accumulated and how much evidence is required for reliable verification. In this work, we characterize statistical separability in TP-CRIV of probabilistic AI models. Specifically, we relate challenge-wise behavior of matching and non-matching provers to verification-level separability. The characterization explicitly describes how the numbers of independent challenges and repeated responses affect detection performance and enables the verification budget required for a target AUC to be estimated. We instantiate the proposed characterization for LLMs using open-ended challenges. The experiments demonstrate matching-non-matching separation, close agreement between theoretical and empirical AUCs, and consistent estimates of the minimum verification budgets. These results provide a statistical basis for relating probabilistic model behavior to verification-level separability and the evidence required for third-party verification.

I. INTRODUCTION

TP-CRIV lets an independent verifier assess a claimant’s model-identity claim without accessing the reference model, but stochastic outputs require evidence across multiple observations. This work characterizes how challenge-wise behavior and evidence allocation relate to verification performance.

A. Third-Party Challenge–Response Identity Verification

  • TP-CRIV differs from fingerprinting because the prover, not the verifier, holds the claimed reference model and must generate fresh model-dependent evidence for each challenge.The verifier evaluates the claim through the MLaaS input-output interface.Source: §I · p. 1, A. Third-Party Challenge–Response… · p. 2

I. INTRODUCTION

  • Repeated executions can produce different verification outcomes, so probabilistic TP-CRIV must accumulate stochastic evidence and determine how many observations suffice.Evidence can come from more independent challenges or repeated responses to the same challenge.Source: §I · p. 1
  • The analysis uses an unbiased U-statistic to estimate squared probability-control discrepancy, then relates matching and non-matching behavior to detection performance and verification budgets.It estimates the numbers of challenges and responses needed for a target performance.Source: §I · pp. 1–2

B. Model Fingerprinting for Probabilistic Models

  • Probabilistic fingerprinting methods use model-specific response behavior, but generally rely on reference information established in advance from a known model.Such information can include selected prompts or a trusted empirical response distribution.Source: §I · p. 1, B. Model Fingerprinting for… · p. 3

III. VERIFICATION SETTING

The setting evaluates probabilistic verification events through the MLaaS interface, using repeated observations to estimate how closely a prover controls each event’s occurrence probability.

A. Setting and Assumptions

  • The verifier cannot access the prover’s model and reaches the deployed model only through its ordinary inference interface.The analysis concerns verification-relevant events that vary across repeated executions, with repeated observations assumed i.i.d. under fixed generation conditions.Source: A. Setting and Assumptions · p. 3

B. Probabilistic Challenge–Response Procedure

  • Each challenge pairs a base input with a probabilistic requirement, and the prover uses its local model to generate a witness intended to meet that requirement.The verifier submits the resulting witness to the MLaaS model for repeated observations.Source: B. Probabilistic Challenge–Response… · pp. 3–4
  • A U-statistic estimates the squared discrepancy between the target and induced occurrence probabilities, and the verifier aggregates challenge-wise observations into a score.The analysis relates that discrepancy to detection performance and the challenge and response counts needed for a target.Source: B. Probabilistic Challenge–Response… · p. 4

IV. THEORETICAL ANALYSIS OF U-STATISTIC-BASED VERIFICATION

The analysis characterizes matching–non-matching separability using a U-statistic score and approximates its detection performance as a function of challenge and response counts.

IV. THEORETICAL ANALYSIS OF U-STATISTIC-BASED VERIFICATION

  • The AUC approximation depends on the challenge-wise distributions of target and induced occurrence probabilities and can estimate budgets for a prescribed minimum AUC.It derives minimum challenge counts for fixed responses and minimum response counts for fixed challenges, conditional on those distributions.Source: §IV · p. 4

A. Statistical Properties of the Challenge-Wise U-Statistic

  • For any m ≥ 2, the challenge-wise U-statistic is an unbiased estimator of squared probability-control error.The analysis assumes independent Bernoulli observations for a fixed target probability and latent occurrence probability.Source: A. Statistical Properties of the… · pp. 4–5

B. Detection Based on U-Statistic Observations

The verification score aggregates challenge-wise U-statistic observations, whose variation reflects both differences among challenges and finite response sampling.

B. Detection Based on U-Statistic Observations

  • The expected challenge-wise U-statistic is the squared probability-control error, so the aggregate score estimates its average across verification challenges.Matching and non-matching populations are compared through their expected errors.Source: B. Detection Based on U-Statistic… · p. 5
  • The score variance combines intrinsic challenge-to-challenge variation in latent error with stochastic variation from finite response sampling.The response-sampling terms depend on the number of repeated observations per challenge.Source: B. Detection Based on U-Statistic… · p. 5
  • The AUC expression relates the expected error gap between prover classes to both inter-challenge variation and finite-response variation.Once challenge-wise distributions are characterized, expected AUC can be estimated for given N and m.Source: B. Detection Based on U-Statistic… · pp. 5–6

C. Required Verification Budget for a Target AUC

The section derives minimum verification budgets for a target AUC from challenge-wise probability behavior. It distinguishes challenge-level variation from finite-sampling effects and specifies when increasing the response count can meet the target.

C. Required Verification Budget for a Target AUC

  • For target AUC α with 0.5 < α < 1, the budget derivation assumes EF > ET and requires R > A for a finite response count to meet the target.When R ≤ A, increasing m cannot meet the target because the total variance is bounded below by A.Source: C. Required Verification Budget for a… · p. 6
  • Increasing responses per challenge reduces the finite-sampling terms B/m and C/[m(m−1)], but cannot remove challenge-level variation A.As m increases, the benefit eventually diminishes because A remains.Source: C. Required Verification Budget for a… · p. 6
  • Empirical observations of pi and qi can estimate ET, EF, A, B, and C, enabling calculation of theoretical AUC and minimum N and m for a target AUC.The derivation gives the minimum challenge count for fixed m and the minimum response count for fixed N.Source: C. Required Verification Budget for a… · pp. 6–7

V. LLM INSTANTIATION

The section frames the LLM study as a test of whether model-dependent probabilistic challenges separate matching from non-matching provers and whether the theoretical analysis characterizes that separation.

V. LLM INSTANTIATION

  • The LLM study tests whether model-dependent probabilistic challenges separate matching from non-matching provers.Its objective is not to construct a complete operational verification system with a calibrated decision threshold.Source: §V · p. 7
  • The study also examines whether the theoretical analysis characterizes the separability observed in the LLM instantiation.Source: §V · p. 7
  • The section evaluates feasibility rather than a calibrated accept-or-reject verification system.Source: §V · p. 7

A. LLM Setting

The LLM setting assumes stochastic generation and compares a matching prover using the same model with a non-matching prover using a different one. The procedure uses constrained probability-targeting challenges and repeated service queries to compare verification-score distributions.

A. LLM Setting

  • Both the local and deployed LLMs use probabilistic generation with nonzero temperature, so repeated executions may produce different outputs.Matching means the prover has the same LLM as the deployed model; non-matching means it has a different LLM, with both using the same suffix-generation strategy.Source: A. LLM Setting · p. 7

B. TP-CRIV Procedure for LLMs

  • Each challenge combines a common system instruction and open-ended prompt with a target word, target occurrence probability, maximum suffix length, and prohibited fragments.The suffix must not contain the target word or prohibited fragments.Source: B. TP-CRIV Procedure for LLMs · p. 7
  • The verifier submits the prompt with the prover's suffix to the MLaaS model m times, records target-word occurrence, and aggregates challenge-wise U-statistic scores across N challenges.This study compares matching and non-matching score distributions without calibrating an operational decision threshold.Source: B. TP-CRIV Procedure for LLMs · p. 8

C. Challenge Design Principle

The challenge design asks a prover to tune target-word occurrence probability on its local model, then tests whether that control transfers differently to a matching deployed model. The suffix method combines gradient-guided search with stochastic evaluation, and the evaluation assesses control, separation, AUC agreement, and budget estimates.

C. Challenge Design Principle

  • A locally generated suffix is expected to preserve probability control on the same deployed model, while a different model's response landscape may yield a different transferred target-word probability.Across challenges, these differences may produce statistically distinct score distributions.Source: C. Challenge Design Principle · p. 8
  • Prohibiting target-related fragments and limiting suffix length are intended to suppress direct lexical insertion and constrain explicit instructions.The study tests measurable separation rather than guaranteeing identification for every LLM pair.Source: C. Challenge Design Principle · p. 8

D. Suffix Generation Method

  • The GCG-based generator searches for a short suffix that brings target-word occurrence probability on the prover's model close to the specified target.Because stochastic text generation is non-differentiable, candidate search uses a differentiable first-token teacher-forcing probability, then candidates are evaluated and reranked using stochastic occurrence rates.Source: D. Suffix Generation Method · p. 8

VI. EXPERIMENTAL EVALUATION

  • The evaluation examines probability control, empirical AUC separation, agreement between theoretical and empirical AUC, and accuracy of minimum-budget estimates.Source: §VI · pp. 8–9

A. Experimental Setup

The experiments evaluate probability control and verification-level separation across five LLMs using open-ended challenges. Separation varies by model, and verification performance depends on how queries are allocated between independent challenges and repeated responses.

A. Experimental Setup

  • The evaluation uses five LLMs and a fixed set of 500 open-ended challenges with target words and sampled occurrence probabilities.The five models serve as both prover and MLaaS target in all combinations.Source: A. Experimental Setup · p. 9

B. Probability-Control Behavior

  • Probability-control differences vary by target model; matching conditions are relatively small-error for Vicuna, Mistral, and Qwen, with less separation for Llama-2 and Yi.Table I reports empirical bE values with bA in parentheses; the suffix procedure is one concrete prover strategy, not a universally reliable solver.Source: B. Probability-Control Behavior · pp. 9–10, Table I · p. 9

C. Empirical Matching and Non-Matching Separation

  • For Llama-2 and Yi, increasing independent challenges improves AUC more than increasing repeated responses, even at comparable total query budgets.When N is small, AUC stays below 0.7 despite substantially increased m; improvement is marked even at m = 2 when N increases.Source: C. Empirical Matching and Non-Matching… · p. 10
  • Verification performance reflects both stochastic response noise within challenges and variation across independently generated challenges.The experiments characterize this relationship between N, m, and matching–non-matching separation.Source: C. Empirical Matching and Non-Matching… · p. 10
  • Vicuna, Mistral, and Qwen2.5 achieve strong matching–non-matching separation with smaller budgets, while Llama-2 and Yi require more accumulated evidence.Figure 3 shows representative empirical AUC heatmaps for Vicuna and Llama-2 across verification budgets.Source: Figure 3 · p. 10, C. Empirical Matching and Non-Matching… · p. 10

D. Comparison Between Theoretical and Empirical AUC

For N > 1, theoretical AUC closely reproduces empirical pooled AUC on the evaluated data, and finite theoretical minimum-budget estimates generally agree with empirical minima. The comparison also identifies approximation-sensitive cases and limits on interpreting unreached targets.

D. Comparison Between Theoretical and Empirical AUC

  • The AUC comparison reuses the same stored challenge and response data for theory and empirical resampling, so it does not independently test new challenges or prover populations.Theoretical parameters are estimated from 500 matching challenges and a pooled population of 2,000 non-matching prover–challenge instances.Source: D. Comparison Between Theoretical and… · p. 10
  • For N > 1, the maximum absolute theoretical–empirical AUC difference was 0.028; the largest deviations occurred at N = 1, particularly for large m.At (N, m) = (1, 100), empirical AUC exceeded theoretical AUC by 0.1033 for Qwen2.5, 0.1043 for Mistral, and 0.0707 for Vicuna.Source: D. Comparison Between Theoretical and… · p. 11, Figure 4 · p. 11

E. Required Numbers of Challenges and Responses

  • For finite minimum-budget pairs, theoretical estimates agreed well with empirical minima; theoretical Nmin differed by less than one challenge on average for Vicuna, Mistral, and Qwen.Theoretical mmin estimates were also close to empirical minima across finite cases.Source: E. Required Numbers of Challenges and… · pp. 11–12
  • For Llama-2, several theoretical Nmin values exceeded 100, consistent with empirical NR under the search limit N ≤ 100; NR does not show the target is unreachable beyond that range..Source: E. Required Numbers of Challenges and… · p. 12
  • When the theoretical limiting AUC remains below target, increasing m alone cannot reach it because challenge-to-challenge variance persists; empirical NR does not establish infeasibility beyond m ≤ 100.Theory and empirical search are qualitatively consistent when an empirical NR pairs with a theoretical ×.Source: E. Required Numbers of Challenges and… · p. 12
  • Near the target α, approximation error can change a finite-versus-infeasible classification, especially at small N, making boundary cases more sensitive than finite-budget estimates.These mismatches concern whether the target boundary is crossed, not merely the size of a numerical budget error.Source: E. Required Numbers of Challenges and… · p. 12

VII. CONCLUDING REMARKS AND FUTURE WORK

The paper characterizes how probabilistic behavior in TP-CRIV relates to verification-level separability and the budget needed for a target performance. LLM experiments support the characterization, while broader verification conditions remain future work.

VII. CONCLUDING REMARKS AND FUTURE WORK

  • The characterization treats stochastic responses as a control target, uses a U-statistic to observe challenge-wise probabilistic discrepancy, and connects that behavior to AUC and verification budgets.Source: §VII · p. 12
  • LLM experiments showed matching–non-matching separation, close agreement between theoretical and empirical AUCs, and consistent minimum-budget estimates in the finite regime.Source: §VII · p. 12
  • The work is a theoretical starting point; future evaluations aim to cover broader prover models, witness-generation strategies, and challenge designs.Source: §VII · pp. 12–13

APPENDIX

The appendix documents shared experimental settings and model-specific prompt templates used in the LLM evaluations.

APPENDIX

  • The appendix provides the shared LLM experimental settings and prompt templates.Source: APPENDIX · p. 13

A. Common Settings

  • The same inference settings are used on prover and MLaaS sides, with suffix-generation settings shared across provers.Table V summarizes settings for all five models.Source: A. Common Settings · p. 13, Table V · p. 13

B. Model-Specific Prompt Templates

3) Llama-2-7B-chat-hf:

Loading 2610.11163v1…