跳转至

文章背景与核心概要

当拥有专有权重的大型语言模型（LLM）在部署后发生变动时，其内部行为可能会发生微妙的变化，而日常输出却保持不变，这给AI治理带来了巨大的挑战。本文介绍了一种基于隐私保护和zk-SNARK的审计框架，该框架利用对抗性探针来放大已批准模型与修改后部署模型之间的Logit漂移。

通过在基于Token、基于嵌入（Embedding）以及压力测试探针之间进行权衡，平衡了敏感度、访问需求和部署成本，作者展示了一种高效、可扩展且实用的验证工作流。实验证明，该方法在各种模型架构和GPU平台上均表现优异，为确保大模型在部署后的合规性和安全性提供了可靠的技术手段。

Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification

Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification

Summary

Summary

When large language models (LLMs) with proprietary weights undergo post-deployment changes, their behavior can subtly shift while routine outputs remain unchanged, posing a significant AI governance challenge. This paper introduces a privacy-preserving, zk-SNARK-based auditing framework that leverages adversarial probes to amplify logit drift between an approved model and a modified deployment. By balancing sensitivity, access requirements, and deployment costs through token-based, embedding-based, and stress probes, the authors demonstrate an efficient, scalable, and practical verification workflow.

Metadata & Publication Details

Metadata & Publication Details

Field Details
arXiv ID arXiv:2608.27954 [cs.CR]
Subjects Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG)
Authors Cameron Wilding, Mina Shaker, Fatemeh Ganji
Submitted August 28, 2026 (Last revised: August 31, 2026)
DOI 10.48550/arXiv.2608.27954
License Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 license iconview license

Abstract

大模型在部署后的变更可能会改变其行为，同时让常规输出基本保持不变，这在模型权重属于专有时给AI治理带来了挑战。我们提出了一种基于隐私保护的zk-SNARK审计框架，该框架旨在寻找受对抗样本启发设计的探针，以放大已批准模型与修改后的部署模型之间的Logit漂移。

Post-deployment changes to large language models can alter behavior while leaving routine outputs largely unchanged, creating a challenge for AI governance when model weights are proprietary. We present a privacy-preserving zk-SNARK-based audit framework that searches for probes designed in the spirit of adversarial examples to amplify logit drift between an approved model and a modified deployment.

我们的框架在不同的访问模型下探索了互补的探针族： * 基于Token的探针： 在黑盒环境中运行，仅需要输入接口、分词器（Tokenizer）和词表。 * 基于嵌入的探针： 需要对嵌入接口进行灰盒访问。 * 压力测试探针： 依赖额外的接口功能，但不需要对模型权重或架构进行完整的白盒访问。

Our framework explores complementary probe families under different access models: * Token-based probes: Operate in a black-box setting and require only the input interface, tokenizer, and vocabulary. * Embedding-based probes: Require gray-box access to the embedding interface. * Stress probes: Rely on additional interface capabilities but do not require full white-box access to model weights or architecture.

这种多样性使得探针的选择能够在敏感度、访问需求和部署成本之间取得平衡。我们在各种LLM架构、代表部署后攻击的模型篡改场景以及GPU平台上对探针构建进行了评估。

This range allows probe selection to balance sensitivity, access requirements, and deployment cost. We evaluate probe constructions across LLM architectures, model-tampering scenarios representative of post-deployment attacks, and GPU platforms.

重要的是，我们的实验结果表明，尽管在黑盒环境中运行，基于Token的探针在各个模型和GPU平台上始终表现出最强的平均敏感度。随着探针集从1个扩展到50个，我们的Groth16 zk-SNARK工作流依然切实可行：证明时间从1.02秒增加到1.78秒，验证时间保持在0.84秒左右，且证明大小保持不变。

Importantly, our experimental results demonstrate that token-based probes consistently deliver the strongest mean sensitivity across models and GPU platforms, although operating in a black-box setting. Our Groth16 zk-SNARK workflow remains practical as the probe set scales from 1 to 50, where proving time increases from 1.02 to 1.78 seconds, verification remains near 0.84 seconds, and proof size remains constant.

Access and Resources

Access and Resources