Search papers, labs, and topics across Lattice.
The paper introduces AEX, a non-intrusive attestation extension for JSON-based LLM APIs that cryptographically binds client-visible requests to corresponding outputs or committed streaming outputs. AEX supports realistic deployments through request-binding modes, signed request-transform receipts, and source-output/output-transform receipts, addressing concerns about unofficial API endpoints and ensuring verifiable request-output relations. The authors provide a protocol design, security analysis, an OpenAI-compatible profile, and a TypeScript prototype to demonstrate AEX's feasibility and utility.
Worried about shadow LLM APIs? AEX cryptographically proves the request-output relationship at the API boundary, ensuring the response you see actually corresponds to your request.
Hosted large language models are increasingly accessed through remote APIs, but the API boundary still offers little direct evidence that a returned output actually corresponds to the client-visible request. Recent audits of shadow APIs show that unofficial or intermediary endpoints can diverge from claimed behavior, while existing approaches such as fingerprinting, model-equality testing, verifiable inference, and TEE attestation either remain inferential or answer different questions. We propose AEX, a non-intrusive attestation extension for existing JSON-based LLM APIs. AEX preserves request, response, tool-calling, streaming, and error semantics, and instead adds a signed top-level attestation object that binds a client-visible request projection to either a complete response object or a committed streaming output. To support realistic deployments, AEX provides explicit request-binding modes, signed request-transform receipts for trusted intermediaries, and source-output / output-transform receipts for trusted output rewriting. For streaming, it separates checkpoint proofs for verified prefixes of an unmodified source stream from complete-output lineage for outputs that have been rewritten, buffered, aggregated, or re-packaged, preventing transformed outputs from being mistaken for source-stream prefixes. AEX therefore makes a deliberately narrow claim: a trusted issuer attests to a specific request-output relation, or to a specific complete-output lineage, at the API boundary. We present the protocol design, threat model, verification state machine, security and privacy analysis, an OpenAI-compatible chat-completions profile, and a reference TypeScript prototype with local conformance tests and microbenchmarks.
