通过验证大模型推理过程，防止攻击者窃取模型权重。
Verifying LLM Inference to Detect Model Weight Exfiltration
- 构建安全验证框架，识别并阻断隐写术窃取权重
- 在300亿参数模型上将可窃取信息降至0.5%以下
- 检测开销极小，适合实际部署的推理服务
随着大型AI模型价值日益提升，推理服务器中的模型权重泄露风险也持续上升。攻击者可通过隐写术将模型权重隐藏在正常输出中进行窃取。本文将权重泄露建模为安全博弈，提出一个可证明抵御隐写攻击的验证框架，并明确其信任假设。为实现验证，我们刻画了大语言模型推理中合法的非确定性来源，提出两种实用估计器。在多个开源模型（3B至30B参数）上评估，对MOE-Qwen-30B模型，该检测器使可窃取信息低于0.5%，误报率低于0.01%，相当于对攻击者造成超过200倍的性能损耗。整体表明，仅以极小代价即可实现强防护。代码已公开于：https://github.com/RoyRin/inference_verification_for_model_weight_exfiltration。
原文摘要 · Abstract (English)
As large AI models become increasingly valuable assets, the risk of model weight exfiltration from inference servers grows accordingly. An attacker controlling an inference server may exfiltrate model weights by hiding them within ordinary model responses, a strategy known as steganography. This work investigates how to verify LLM model inference to defend against such attacks and, more broadly, to detect anomalous or buggy behavior during inference. We formalize model weight exfiltration as a security game, propose a verification framework that can provably mitigate steganographic exfiltration, and specify the trust assumptions associated with our scheme. To enable verification, we characterize valid sources of non-determinism in large language model inference and introduce two practical estimators for them. We evaluate our detection framework on several open-weight models ranging from 3B to 30B parameters. On MOE-Qwen-30B, our detector reduces exfiltratable information to <0.5% with false-positive rate of <0.01%, corresponding to a >200x slowdown for adversaries. Overall, this work further establishes a foundation for defending against model weight exfiltration and demonstrates that strong protection can be achieved with minimal additional cost to inference providers. Our code is made public at: https://github.com/RoyRin/inference_verification_for_model_weight_exfiltration .
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。