让大模型推理结果可验证，防篡改且开销极低。
TensorCommitments: A Lightweight Verifiable Inference for Language Models
- 用张量承诺绑定推理过程，生成不可逆的防篡改标签。
- 对LLaMA2仅增加0.97%计算时间，验证耗时仅增0.12%。
- 适合无强硬件客户端的云服务验证场景。
大多数大语言模型（LLMs）在外部云端运行：用户发送提示词、支付推理费用，但必须信任远程GPU未被恶意篡改。我们提出可验证推理的核心问题——如何让服务端（证明者）向客户端（验证者）证明推理过程正确，而无需重跑模型。现有密码学方法在大模型规模下过慢，非密码学方案则需强验证者显卡。我们提出张量承诺（TensorCommitments, TC），一种原生面向张量的推理证明方案。TC将推理过程绑定到一个承诺，即一旦被篡改即失效的不可逆标签，并通过多变量Terkle树组织。在LLaMA2上，TC仅增加0.97%的证明者计算时间与0.12%的验证者计算时间，同时相比需强验证者硬件的最优前序工作，在抵御定制化大模型攻击方面提升48%鲁棒性。
原文摘要 · Abstract (English)
Most large language models (LLMs) run on external clouds: users send a prompt, pay for inference, and must trust that the remote GPU executes the LLM without any adversarial tampering. We critically ask how to achieve verifiable LLM inference, where a prover (the service) must convince a verifier (the client) that an inference was run correctly without rerunning the LLM. Existing cryptographic works are too slow at the LLM scale, while non-cryptographic ones require a strong verifier GPU. We propose TensorCommitments (TCs), a tensor-native proof-of-inference scheme. TC binds the LLM inference to a commitment, an irreversible tag that breaks under tampering, organized in our multivariate Terkle Trees. For LLaMA2, TC adds only 0.97% prover and 0.12% verifier time over inference while improving robustness to tailored LLM attacks by up to 48% over the best prior work requiring a verifier GPU.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。