Summary
Adapters added to AI language models can sometimes hide secret backdoors that are hard to find without looking inside the adapter itself, which is usually a private asset. The authors found that for some hidden backdoors, detectors can’t reliably tell if an adapter is safe or not because the backdoors hide where safety monitors can’t see. Instead of trying to detect these hidden channels, the authors created ServeGuard, which makes these hidden channels impossible and provides a proof that can be checked without revealing any secret information about how the adapter works. This proof helps users and regulators trust adapters without needing to access any confidential details.
What this means in practice
- •For ai deployment teams: Verify incoming adapter modules do not contain hidden backdoors without exposing proprietary model details.
- •For regulatory compliance officers: Check that AI components meet safety guarantees without needing to inspect confidential model internals.
Abstract
Third-party adapters for open-weight language models ship as opaque weight matrices; a recipient cannot check whether an adapter hides a backdoor without trusting the publisher or inspecting the weights, the publisher's core asset. For one important class (payloads placed where a safety monitor is structurally blind), detection is unsound as a defense: every detector that factors through the declared monitor is invariant on its blind subspace, and honest and backdoored adapters overlap on every blind-subspace statistic we evaluate, because benign adaptation uses that subspace too. Rather than detect this channel, we make it structurally \emph{absent} and prove that we did. The publisher builds the adapter to read the input only through directions the monitor covers and proves this in zero knowledge, revealing nothing about the read factor it certifies. The certificate is cheap because the expensive part, identifying the monitor's blind spot, is a deterministic function of the \emph{public} base model, so only one linear identity is proved; the served residual is the base model's own public floor, not a prover-chosen tolerance. The result is \emph{ServeGuard}, a supply-chain primitive: the publisher ships a \emph{proof-carrying adapter} whose proof lets a consumer or regulator verify, without the certified read factor and without trusting the publisher, that the adapter carries no hidden channel of this class relative to the declared monitor; an admission-time typing guard binds the guarantee to the adapter bytes admitted at serving time. Across eight checkpoints up to 7B from four families, the monitoring budget is architectural: the measured frontier saturates at the value-path rank on grouped-query checkpoints but not on multi-head ones. On a 0.5B model confinement is nearly free for benign adaptation, making monitor quality the security lever.