Search papers, labs, and topics across Lattice.
This paper introduces a novel verification framework for AI inference that uses lightweight, sampling-based cryptographic proofs to ensure responses are generated by the intended model. By leveraging trace separation between dissimilar models and committing to execution traces via Merkle trees, the protocol opens only a small number of randomly sampled paths, trading soundness for efficiency. Experiments on ResNet-18 and Llama-2-7B demonstrate orders-of-magnitude speedups in proving time compared to full cryptographic proofs, while effectively detecting adversarial strategies.
Cut inference verification costs by 1000x with a sampling-based cryptographic approach that catches adversarial attacks on Llama-2-7B in milliseconds.
When large AI models are deployed as cloud-based services, clients have no guarantee that responses are correct or were produced by the intended model. Rerunning inference locally is infeasible for large models, and existing cryptographic proof systems -- while providing strong correctness guarantees -- introduce prohibitive prover overhead (e.g., hundreds of seconds per query for billion-parameter models). We present a verification framework and protocol that replaces full cryptographic proofs with a lightweight, sampling-based approach grounded in statistical properties of neural networks. We formalize the conditions under which trace separation between functionally dissimilar models can be leveraged to argue the security of verifiable inference protocols. The prover commits to the execution trace of inference via Merkle-tree-based vector commitments and opens only a small number of entries along randomly sampled paths from output to input. This yields a protocol that trades soundness for efficiency, a tradeoff well-suited to auditing, large-scale deployment settings where repeated queries amplify detection probability, and scenarios with rationally incentivized provers who face penalties upon detection. Our approach reduces proving times by several orders of magnitude compared to state-of-the-art cryptographic proof systems, going from the order of minutes to the order of milliseconds, with moderately larger proofs. Experiments on ResNet-18 classifiers and Llama-2-7B confirm that common architectures exhibit the statistical properties our protocol requires, and that natural adversarial strategies (gradient-descent reconstruction, inverse transforms, logit swapping) fail to produce traces that evade detection. We additionally present a protocol in the refereed delegation model, where two competing servers enable correct output identification in a logarithmic number of rounds.
