Technical Summary: SVIP – Towards Verifiable Inference of Open-source Large Language Models

1. Problem Statement

The rapid growth of open-source Large Language Models (LLMs) has made local deployment impractical for individual users due to high computational demands. Consequently, decentralized computing has emerged as a cost-effective alternative, where users offload LLM inference to third-party providers (individuals or small companies) with surplus resources.

However, this setting introduces a critical trust issue: verifiable inference. A malicious computing provider may stealthily substitute the user-requested, large-capacity model (e.g., Llama-3.1-70B) with a smaller, less capable model (e.g., Llama-2-7B) to save computational costs, while still charging for the larger model. Since providers often offer only black-box API access, users cannot easily detect such substitutions. Existing solutions face significant limitations:

• Cryptographic methods (e.g., Zero-Knowledge Proofs) impose prohibitive computational overheads (e.g., >800 seconds per query).
• Game-theoretic protocols rely on unrealistic assumptions of rational, non-cooperative providers.
• Watermarking/Fingerprinting are typically implemented by model publishers and are unsuitable for user-provider verification scenarios.

The goal is to design a protocol that allows a user to verify with high confidence that a specific LLM was used for inference, while maintaining computational efficiency, low false positive/negative rates, and preserving completion quality.

2. Methodology

The authors propose SVIP (Secret-based Verifiable Inference Protocol), which leverages hidden representations from the LLM inference process rather than relying on cryptographic proofs.

2.1. Core Mechanism: Proxy Task on Hidden States

The protocol operates on the intuition that hidden state representations generated by a specific model contain unique signatures.

1. Data Exchange: The computing provider returns not only the generated text but also a compressed vector of the processed hidden representations ($z(x)$) from the specified model.
2. Proxy Task: A "proxy task" is trained exclusively on the hidden representations of the specified model ($M_{spec}$). This task transforms the hidden representations into a unique identifier for that model.
3. Verification: The user locally evaluates the returned vector $z(x)$ on the proxy task. If the model used was $M_{spec}$, the vector should perform well on the task; if a smaller alternative model ($M_{alt}$) was used, performance will degrade significantly.

2.2. The Simple Protocol and Its Vulnerability

Initially, a simple protocol is proposed where the user trains a binary classifier on hidden states. However, this is vulnerable to Direct Vector Optimization Attacks. A malicious provider, knowing the labeling function, could bypass the LLM entirely, optimize a vector $\tilde{z}$ directly to satisfy the classifier, and return it, thereby cheating without incurring inference costs.

2.3. The Secret-Based Protocol (SVIP)

To counteract optimization attacks, SVIP introduces a secret mechanism:

• Secret Assignment: The platform assigns a unique secret ($s$) to the user, which is never shared with the computing provider.
• Secret-Dependent Labeling: The labeling function $y(x, s)$ depends on the secret. A malicious provider cannot determine the correct label without knowing $s$.
• Secret Embedding: The secret $s$ is embedded into the task as a token $t_\psi(s)$ and concatenated with the hidden states before compression.
• Continuous Verification: The verification checks if the distance between the predicted proxy output and the secret-dependent label vector is below a threshold $\eta$.

2.4. Defense Against Adaptive Attacks

The paper analyzes two adaptive attacks:

1. Adapter Attack: An attacker trains a neural adapter to map hidden states from $M_{alt}$ to mimic $M_{spec}$ under a specific secret.
2. Secret Recovery Attack: An attacker attempts to reverse-engineer the secret $s$ from the provided embedding $t_\psi(s)$ by collecting many secret-embedding pairs.

Defense Mechanism: SVIP employs an Update Mechanism. Secrets are rotated after a threshold number of queries ($M^*$), and the entire protocol is retrained after a total number of secrets ($N^*$) have been used. This limits the data an attacker can collect under a single secret, rendering the attacks ineffective.

3. Key Contributions

• Formalization: Systematically formalized the verifiable LLM inference problem and proposed a protocol leveraging processed hidden representations.
• Secret-Based Security: Introduced a novel secret mechanism that transforms hidden representations into unique, secret-dependent identifiers, effectively neutralizing direct vector optimization attacks.
• Comprehensive Analysis: Provided a thorough security analysis against strong and adaptive adversarial scenarios (adapter and secret recovery attacks).
• Empirical Validation: Demonstrated the protocol's effectiveness across 5 specified open-source LLMs (13B to 70B parameters) and 6 alternative models.

4. Experimental Results

Experiments were conducted using the LMSYS-Chat-1M dataset and various model families (Llama, GPT-NeoX, OPT, Falcon).

• Accuracy:
  • False Negative Rate (FNR): Consistently below 5% per query (average 3.49% across models). This indicates honest providers are rarely falsely accused.
  • False Positive Rate (FPR): Consistently below 3% per query across all alternative models. This indicates dishonest providers are rarely cleared.
  • Aggregated Reliability: By aggregating results over multiple queries (e.g., $B=30$), the protocol achieves extremely low Type-I and Type-II error rates (e.g., Type-I error $\approx 1.7 \times 10^{-49}$ for Llama-3.1-70B vs. Llama-2-7B).
• Efficiency:
  • Latency: Verification adds negligible overhead, requiring < 0.01 seconds per prompt query for both the user and the provider. This is orders of magnitude faster than cryptographic alternatives (e.g., zkLLM requires ~803 seconds).
  • Memory: The provider requires ~980 MB GPU memory for the feature extractor; the user requires ~1428 MB, feasible on standard local machines.
• Robustness:
  • Adapter Attack: The protocol resists adapter attacks even when attackers collect up to 400–800 prompt samples per secret.
  • Secret Recovery: Attack success rates for recovering secrets remain below 50% even after collecting 200,000 secret-embedding pairs. With the update mechanism, SVIP can securely handle 80 to 120 million prompt queries before retraining is required.
• Generalizability: The protocol maintains low FPR/FNR on unseen datasets (ToxicChat, Web Questions, GSM8K, Verifiable-Coding-Problems), demonstrating robustness across different domains.

5. Significance and Claims

The paper claims that SVIP offers a practical balance between computational efficiency and security, making verifiable inference feasible for real-world decentralized LLM services. Unlike cryptographic methods that are too slow for real-time interaction, SVIP enables users to verify model usage with high confidence and minimal latency.

The authors emphasize that while SVIP does not offer the strict mathematical guarantees of Zero-Knowledge Proofs, its low error rates combined with hypothesis testing over multiple queries provide a "reasonable and practically meaningful level of security." The work aims to foster trust between users and computing providers, thereby encouraging the wider adoption of open-source LLMs in decentralized computing ecosystems. The authors acknowledge potential risks of misuse (e.g., reverse-engineering) but argue that the protocol's design prioritizes robustness against such vectors.