🤖 AI

IMMACULATE: A Practical LLM Auditing Framework via Verifiable Computation

IMMACULATE is a practical auditing framework that detects economically motivated deviations in black-box commercial LLMs, such as model substitution and token overbilling, by leveraging verifiable computation to achieve strong detection guarantees with minimal throughput overhead and without requiring trusted hardware or model access.

Original authors: Yanpei Guo, Wenjie Qu, Linyu Wu, Shengfang Zhai, Lionel Z. Wang, Ming Xu, Yue Liu, Binhang Yuan, Dawn Song, Jiaheng Zhang

Published 2026-02-27

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yanpei Guo, Wenjie Qu, Linyu Wu, Shengfang Zhai, Lionel Z. Wang, Ming Xu, Yue Liu, Binhang Yuan, Dawn Song, Jiaheng Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you order a gourmet steak from a high-end restaurant. You pay a premium price for a specific cut of beef, cooked to perfection. But because you can't see into the kitchen, you have to trust the chef.

The Problem:
What if the chef secretly swaps your expensive steak for a cheap, frozen burger? Or what if they use a dull knife and a low-quality pan but still charge you for the premium experience? In the world of Artificial Intelligence (AI), this is exactly what happens. Companies sell access to powerful AI models via the internet (like a black box). They claim to use a top-tier "super-brain" to answer your questions, but they might secretly use a weaker, cheaper model to save money, or they might lie about how much "computing power" they used to bill you more.

The Solution: IMMACULATE
The paper introduces IMMACULATE, a clever system that acts like a "food inspector" for AI, but without needing to break into the kitchen or see the secret recipes.

Here is how it works, using simple analogies:

1. The "Spot Check" Strategy (Randomized Auditing)

Imagine a tax auditor trying to catch a business that is cheating on its books. They can't check every single receipt in the world; that would take forever and cost a fortune. Instead, they pick a tiny, random sample of receipts to check.

The Logic: If a restaurant is cheating on 10% of its orders, and the inspector picks 3,000 random orders to check, they are almost guaranteed to catch the cheater.
In AI: The auditor doesn't check every single AI request. They send a few random questions. If the AI provider is cheating, they will likely get caught on these random checks. This keeps the cost of checking very low (less than 1% extra work).

2. The "Fingerprint" of the Math (Logit Distance Distribution)

This is the trickiest part. AI models do math with numbers that have tiny rounding errors (like how a calculator might say 1/3 is 0.33333333). Because of this, even a honest AI might give slightly different answers if you ask the same question twice. You can't just say, "Your answer is wrong because it's not identical to mine."

The Analogy:
Think of the AI's internal math as a fingerprint.

Honest AI: When an honest chef cooks a steak, the "smell" and "texture" might vary slightly every time due to the heat of the day, but it always smells like steak.
Cheating AI: If the chef swaps the steak for a burger, the smell changes completely. It's not just a little off; it's a different animal.

IMMACULATE measures the "Logit Distance Distribution" (LDD).

It doesn't check if the final answer is perfect.
Instead, it checks the "internal math steps" (the logits) the AI took to get there.
If the AI is using a cheap model or cutting corners (quantization), the "math fingerprint" will look weird and chaotic compared to the promised high-quality model. It's like the burger smelling like a burger, not a steak.

3. The "Magic Receipt" (Verifiable Computation)

How does the auditor know the AI isn't just lying about its math steps?

The Analogy:
Imagine the chef has to write down every step of the cooking process on a piece of paper, seal it in an unbreakable glass box, and hand it to you.

The box is cryptographically sealed. The chef cannot change the paper inside without breaking the glass (which is impossible).
The auditor can look at the box and verify, using a special mathematical key, that the steps inside match the rules of the "premium steak" recipe.
The auditor doesn't need to see the recipe (the AI's secret code); they just need to verify the steps were followed correctly.

Why This Matters

No Special Hardware Needed: Previous methods required expensive, special computers (like "Trusted Execution Environments") to do the checking. IMMACULATE works on standard computers.
Protects Secrets: The AI company doesn't have to show their secret code or model to the auditor. They just prove they followed the rules.
Cheap and Fast: Because it only checks a tiny fraction of requests, it doesn't slow down the service. It's like a speed camera that only flashes on a few cars but still keeps everyone driving safely.

Summary

IMMACULATE is a practical way to stop AI companies from cutting corners. It uses random spot checks to catch cheaters and mathematical fingerprints to prove they are using the right tools, all without needing to see their secret recipes or buy expensive new hardware. It brings trust back to the "black box" of AI services.

1. Problem Statement

Commercial Large Language Models (LLMs) are predominantly deployed as black-box API services. This creates a fundamental trust asymmetry:

Lack of Visibility: Users cannot see the model architecture, parameters, or internal execution states.
Economic Incentives for Deviation: Providers may silently deviate from advertised protocols to reduce costs or increase revenue. Common attacks include:
- Model Substitution: Replacing a claimed high-performance model with a cheaper, distilled, or smaller version.
- Aggressive Quantization: Using lower-precision arithmetic (e.g., FP8 instead of BF16) than advertised, potentially degrading quality.
- Token Overbilling: Inflating reported token counts (e.g., billing for hidden Chain-of-Thought tokens) without observable output signals.
Limitations of Existing Solutions:
- Trusted Execution Environments (TEEs): Require specific hardware (e.g., NVIDIA GPUs), are not infrastructure-agnostic, and incur significant costs.
- Cryptographic Proofs (ZKPs): Currently limited to integer-only arithmetic, making them inefficient for modern floating-point LLMs and incompatible with existing GPU infrastructure.
- Empirical Methods: Lack formal guarantees and are vulnerable to adaptive attacks.

2. Methodology: The IMMACULATE Framework

IMMACULATE addresses these challenges by combining probabilistic randomized auditing with verifiable computation (VC) and a novel metric called Logit Distance Distribution (LDD).

A. Core Insight: Probabilistic Auditing

Instead of verifying every request (which is computationally prohibitive), the auditor (Adt) sends a small, random subset of queries mimicking normal user traffic.

Rationale: A rational provider only benefits from cheating on a non-negligible fraction ( $\alpha$ ) of requests.
Detection: If a server cheats on $\ge 10\%$ of requests, auditing a small random sample (e.g., a few thousand per day) yields an overwhelming probability of detection.
Overhead: The cryptographic overhead is amortized over billions of daily requests, resulting in negligible impact on benign servers.

B. Solving Non-Determinism: Logit Distance Distribution (LDD)

LLM inference on modern GPUs is non-deterministic due to floating-point arithmetic variations, making exact bitwise verification impossible. IMMACULATE introduces LDD to measure approximation fidelity:

Hybrid Computation Model: The LLM is abstracted as a sequence of continuous transformations (neural ops) and discrete decisions (token sampling/routing).
Control-Flow Alignment: To compare a deployed model ( $M$ ) against a claimed full-precision reference ( $M^*$ ), the framework forces $M^*$ to make the same discrete decisions as $M$ . This aligns the execution paths.
LDD Metric: The system measures the distance between the logits ( $\ell$ $ℓ$ ) produced by the deployed model and the logits ( $\ell^*$ $ℓ^{*}$ ) produced by the aligned reference model.
- Benign Execution: Numerical noise results in a stable, predictable distribution of small distances.
- Malicious Execution: Model substitution or aggressive quantization introduces systematic biases or large variances, causing the distance distribution to shift significantly (e.g., heavier tails).

C. The Auditing Protocol

Setup: The model owner commits to the full-precision reference model ( $M^*$ ) via a cryptographic hash.
Inference: For every request, the server runs the standard inference, records the logits at discrete decision points, and commits to them.
Audit Trigger: The auditor sends a random query. If selected for audit, the auditor reveals their identity.
Proof Generation: The server uses Verifiable Computation (VC) to prove:
- Discrete decisions were derived from the committed logits.
- Continuous transformations were computed using the reference model $M^*$ .
- The final output is consistent with the decisions.
- The LDD (distance between $\ell$ and $\ell^*$ ) is computed and reported.
Verification: The auditor checks if the LDD falls within the expected statistical bounds for benign execution.

3. Key Contributions

IMMACULATE Framework: A practical auditing system for black-box LLMs that provides strong integrity guarantees without requiring trusted hardware (TEEs) or access to model internals.
Logit Distance Distribution (LDD): A novel fidelity metric that quantifies the gap between deployed and claimed models under numerical non-determinism, enabling verification of floating-point computations.
Economic Efficiency: Demonstrates that selective auditing combined with LDD incurs minimal overhead (<1% throughput loss) while offering provable detection guarantees against economically motivated attacks.
Infrastructure Agnosticism: Compatible with existing inference stacks (e.g., vLLM) and hardware (GPUs, TPUs), unlike TEE-based solutions.

4. Experimental Results

The authors evaluated IMMACULATE on dense (LLaMA3-70B, Qwen3-32B) and MoE (Qwen3-30B-A3B, DeepSeek-V2-Lite) models using datasets like GSM8K and TriviaQA.

Detection Effectiveness:
- Model Substitution: LDD distributions showed a pronounced right-shift. Detection rates were extremely high (e.g., 95–99% for Qwen3 substitution).
- Aggressive Quantization (FP8 vs. BF16): FP8 execution increased the tail probability of logit distances. Detection rates ranged from 1.3% to 10.3% per request (sufficient for randomized auditing).
- False Positive Rate (FPR): Using Extreme Value Theory (EVT) to model benign tails, the estimated FPR was < $10^{-5}$ .
System Overhead:
- Throughput: End-to-end throughput loss for benign servers was < 1% (ranging from 0.3% to 1.0% across models).
- VC Cost: While VC on CPU-TEE is ~400–900x slower than GPU inference, the fact that it is triggered on only a tiny fraction of requests makes the total cost negligible.
Scalability: The framework successfully distinguishes benign and malicious executions across various architectures and datasets.

5. Significance

IMMACULATE represents a significant step toward transparency and accountability in the commercial LLM ecosystem.

Trust without Compromise: It allows users to verify service integrity without forcing providers to expose proprietary models or adopt expensive, specialized hardware.
Economic Deterrence: By making it statistically probable to detect cheating, it removes the economic incentive for providers to silently degrade service quality or overbill.
Practical Deployment: The <1% overhead and compatibility with existing infrastructure (vLLM) suggest that this framework can be deployed in production environments immediately, bridging the gap between theoretical cryptographic verification and real-world AI services.

In summary, IMMACULATE shifts the paradigm from "trust but verify" to "verify without trust," providing a robust, economical, and mathematically grounded solution for auditing the "black box" of modern AI.