Lightweight Sampling Proofs of Inference
Towards Verifiable AI with Lightweight Cryptographic Proofs of Inference
Reported benchmarks
| model | note | params |
|---|---|---|
| ResNet-18 | Adversarial evasion (gradient-descent reconstruction, inverse transforms, logit swapping) failed to escape detection. | — |
| Llama-2 7B | Same adversarial strategies tested; detection held. | 7B |
Approach
Prover commits to the inference execution trace via Merkle-tree vector commitments, then reveals only sampled entries along random paths from output back to input. No full proof is generated.
Notes
The first trace-sampling scheme aimed at LLM/DNN inference. Positions itself against zkML's >1000x prover overhead. Because the security model is statistical, the interesting audit question is the concrete detection probability as a function of how many trace paths are opened, and how a rational prover optimizes against it -- neither of which is a cryptographic-soundness argument. Authors overlap the SNARK world (Campanelli, Gennaro), so the cryptographic framing is deliberate, not naive.
Our reading
Citation neighbourhood
Builds on
- none recorded
Cited by, in this corpus
- none recorded
Edges are a proxy: paper A's text mentions B anywhere (body or bibliography). See the full graph.
Discussed in
Other recorded fields
arxiv: https://arxiv.org/abs/2603.19025 objectives: - inference trust_assumption: Statistical + game-theoretic. Explicitly "trades soundness for efficiency." Security rests on trace separation between functionally dissimilar models plus a RATIONAL prover who faces penalties on detection. Detection probability amplifies under repeated queries. This is NOT cryptographic soundness. security_model_flag: 'IMPORTANT: not comparable to the zkML sections'' soundness. A dishonest prover can pass with non-negligible probability on any single query; the guarantee is amortized over many queries plus economic penalty. Right fit for auditing / large-scale MLaaS, wrong fit for a one-shot on-chain settlement.' performance: claim: Proving time from the order of MINUTES (zkML) to the order of MILLISECONDS. concrete_numbers: null adversaries_tested: - gradient-descent reconstruction - inverse transforms - logit swapping related: - veriml - proof-of-sampling - zkml-survey