检测大模型API是否偷换模型，硬件级安全更可靠。
Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs
- 用可信执行环境（TEEs）验证模型真实身份
- 软件方法因推理不确定性失效，无法可靠检测替换
- 硬件方案可提供密码学保证，适合高可靠性场景
商业大语言模型API存在根本性信任问题：用户支付特定模型费用，却无法确保提供商如实交付。提供商可能暗中替换为成本更低的版本（如量化模型或小模型）以节省开支，同时维持原定价。本文形式化定义了模型替换问题，并在现实对抗条件下系统评估检测方法。实证分析表明，纯软件方法本质上不可靠：基于文本输出的统计测试查询开销大，对细微替换无效；依赖日志概率的方法则被生产环境中的推理非确定性所击溃。我们主张，该验证缺口可通过硬件级安全机制有效弥补。本文提出并评估了可信执行环境（TEEs）作为一项实际且稳健的解决方案。结果表明，TEEs可在仅带来适度性能损耗的情况下，提供可证明的模型完整性保障，为确保用户获得所付费模型提供了清晰可行路径。代码已公开于 https://github.com/sunblaze-ucb/llm-api-audit。
原文摘要 · Abstract (English)
Commercial Large Language Model (LLM) APIs create a fundamental trust problem: users pay for specific models but have no guarantee that providers deliver them faithfully. Providers may covertly substitute cheaper alternatives (e.g., quantized versions, smaller models) to reduce costs while maintaining advertised pricing. We formalize this model substitution problem and systematically evaluate detection methods under realistic adversarial conditions. Our empirical analysis reveals that software-only methods are fundamentally unreliable: statistical tests on text outputs are query-intensive and fail against subtle substitutions, while methods using log probabilities are defeated by inherent inference nondeterminism in production environments. We argue that this verification gap can be more effectively closed with hardware-level security. We propose and evaluate the use of Trusted Execution Environments (TEEs) as one practical and robust solution. Our findings demonstrate that TEEs can provide provable cryptographic guarantees of model integrity with only a modest performance overhead, offering a clear and actionable path to ensure users get what they pay for. Code is available at https://github.com/sunblaze-ucb/llm-api-audit
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。