Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification
Cryptography and SecurityArtificial IntelligenceMachine Learning
Summary
The authors address the problem of detecting unauthorized changes in large language models (LLMs) after they are deployed, even when the internal model details are hidden. They create a privacy-friendly auditing method using zk-SNARKs to find special input probes that highlight differences between an approved model and a possibly altered one. Their approach supports different levels of access, from just using the model's input interface to partial internal access, allowing flexibility in how tests are performed. Their experiments show that token-based probes work best under strict black-box conditions, and their zk-SNARK system is efficient even as the number of probes increases. This method helps ensure model integrity without revealing proprietary information.
Authors
Cameron Wilding, Mina Shaker, Fatemeh Ganji
Abstract
Post-deployment changes to large language models can alter behavior while leaving routine outputs largely unchanged, creating a challenge for AI governance when model weights are proprietary. We present a privacy-preserving zk-SNARK-based audit framework that searches for probes designed in the spirit of adversarial examples to amplify logit drift between an approved model and a modified deployment. Our framework explores complementary probe families under different access models. Token-based probes operate in a black-box setting and require only the input interface, tokenizer, and vocabulary. Embedding-based probes require gray-box access to the embedding interface. Stress probes rely on additional interface capabilities but do not require full white-box access to model weights or architecture. This range allows probe selection to balance sensitivity, access requirements, and deployment cost. We evaluate probe constructions across LLM architectures, model-tampering scenarios representative of post-deployment attacks, and GPU platforms. Importantly, our experimental results demonstrate that token-based probes consistently deliver the strongest mean sensitivity across models and GPU platforms, although operating in a black-box setting. Our Groth16 zk-SNARK workflow remains practical as the probe set scales from 1 to 50, where proving time increases from 1.02 to 1.78 seconds, verification remains near 0.84 seconds, and proof size remains constant.