Pith. sign in

REVIEW 3 major objections 5 minor 45 references

Zero-knowledge proofs of LLM inference certify that an output fits the declared equations, but not how much computation actually produced it — so a provider can pass verification while serving a much smaller model.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 01:25 UTC pith:Y25MOPT6

load-bearing objection Attack A cleanly demonstrates the effort gap; Attack B's width-replication construction has a dimension mismatch that breaks it as written — worth a revision, not a desk reject. the 3 major comments →

arxiv 2607.28884 v1 pith:Y25MOPT6 submitted 2026-07-30 cs.CR

Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference

Chen Gong , Beijie Liu , Mengyuan Li This is my paper
classification cs.CR
keywords zero-knowledge proofsLLM inferenceghost weightseffort gapmodel substitutiontransformer invariancesproof of computationzkML
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that current zero-knowledge verification of LLM inference has an effort gap: a valid proof shows an output is consistent with a public architecture and committed private weights, but it does not show that the prover performed the computational work that architecture implies. On that basis it introduces the Hollow-LLM attack, in which a provider keeps the declared model size and parameter count but loads the architecture with ghost weights — zeroed or replicated blocks that make the larger circuit pass inputs through unchanged or reuse the same computation across replicated coordinates. The served outputs come from a small inner model, yet the verifier's circuit accepts them as coming from the large declared outer model. Two training-free constructions are given: Attack A inflates depth with zero-work residual blocks, and Attack B inflates width by replicating hidden coordinates and collapsing them at the output. If the paper is right, proof validity is not proof of faithful large-model execution, which matters for anyone relying on zero-knowledge-verified LLM services to attest model scale.

Core claim

The central claim is that a zero-knowledge proof of inference certifies membership in an NP relation — that there exist private weights for the declared architecture producing the output — but never the algorithmic path or the amount of computation. The paper shows this gap is exploitable through ghost weights, explicit algebraic structures that make the outer model under ghost weights equal the inner model on every supported prompt. A dishonest provider can therefore serve all queries with the cheap inner model, then, during an audit, produce a valid proof against the expensive outer circuit by supplying the ghost weights and replicated or zeroed witnesses; the proof is indistinguishable fr

What carries the argument

The load-bearing object is the ghost-weight witness: a set of weights for the declared outer architecture that exactly reproduces the inner model's input–output function while the actual service runs only the inner model. Four algebraic invariances of the pre-LN transformer carry the construction: the residual identity (a block whose attention and feed-forward outputs are exactly zero acts as x ↦ x), FFN zero-padding (appending zero-weight neurons leaves the FFN output unchanged), LayerNorm replicate invariance (replicated hidden states with replicated LayerNorm parameters normalize identically), and block-diagonal attention (replicated projections with replicated inputs produce identical at

Load-bearing premise

Everything depends on the ghost weights reproducing the inner model's outputs exactly under the verifier's fixed arithmetic, and Attack B additionally assumes the wider residual stream can be collapsed back to the original dimension at each attention and feed-forward block — a step the paper does not explicitly declare — so the replication invariant is preserved through the first residual add.

What would settle it

Take the Attack B construction with m=2 on a standard pre-LN transformer and inspect the first residual add: if the attention output W'_o R x has dimension d while the residual stream has dimension md, the circuit as written has mismatched shapes and the witness editing fails; alternatively, evaluate both f_A_in(W_in, x) and f_A_out(W_ghost, x) under the verifier's quantized arithmetic on random prompts and compare — any mismatch would falsify the exact transcript-alignment claim.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Accepted proofs from hollowed deployments are distributed the same way as honest proofs, so neither clients nor verifiers can distinguish a hollowed model from a genuine one by proof transcripts alone.
  • Serve-time cost tracks only the inner model while proving cost tracks the declared outer circuit, so the provider captures the difference as profit; the paper's experiments show serve latency unchanged at 1× while gate count and prover time scale with declared depth and width.
  • The attack works without modifying the verifier, the circuit, the commitment scheme, or the proof system; it is a deployment-level assurance gap, not a soundness flaw.
  • The constructions are training-free and compose: depth expansion and width expansion can be applied together, reproducing the proving cost of a large honest model while executing a small one.
  • The paper states one concrete limitation: deterministic sinusoidal positional encodings rule out Attack B, since the outer circuit fixes positional values as a public function of width, leaving learned and rotary encodings compatible.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same effort gap likely extends beyond LLM inference to any zero-knowledge proof of a deterministic computation with a private witness and no metered resource: if the relation admits an easy witness, proof validity never binds prover cost; the transformer-specific ghost weights are one instance of a general phenomenon.
  • Because proof transcript alone cannot distinguish hollow from honest runs, countermeasures must come from outside the proof system — behavioral audits, challenge-based probes, ablation tests, or hardware attestation with measured execution become necessary, not optional, if the attack is real.
  • The real-world viability hinges on whether users and pricing schemes reward declared parameter count more than observed quality; the paper leaves the detection threshold as a perception-management problem, so the practical attack surface is an empirical question.
  • The paper's Attack B construction, as written, needs a declared dimension-collapsing step at each residual add; until the paper specifies such a step, the width-inflation variant is best read as a design for a modified architecture rather than a drop-in attack on stock pre-LN transformers.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper identifies an 'effort gap' in zero-knowledge LLM inference: a zk proof certifies that an output is consistent with a declared architecture and committed private weights, but does not bind the computational effort actually expended. It introduces the Hollow-LLM attack, in which a provider declares a large outer model, embeds 'ghost weights' that collapse effective computation, serves queries using a much smaller inner model, and still produces valid proofs for the outer circuit. Two algebraic constructions are given: Attack A, which inserts zero-work residual blocks to inflate depth, and Attack B, which replicates the hidden state across m coordinate blocks to inflate width. The paper also analyzes positional-encoding compatibility, reports experiments with a zkGPT-style pipeline, and discusses countermeasures. Attack A is a sound, training-free depth-inflation construction. Attack B, as written, has a dimensionality error in the output projections and a missing 1/m factor in the FFN that break the replicated-state invariant at the first layer.

Significance. The core observation — that proof of correctness of inference is not proof of large-model execution — is conceptually important and timely for the emerging zkML/zkLLM ecosystem. The paper gives a clean formalization of the threat model and a concrete, verifiable instantiation in Attack A, which convincingly demonstrates that zero-weight attention/FFN blocks act as exact residual identities under the verifier's circuit. The evaluation design cleanly separates serve-side from prove-side costs. However, the width-inflation construction (Attack B) is internally inconsistent as stated, and the empirical rows derived from it inherit the flaw. The central effort-gap claim survives, but the paper's advertised 'two training-free algebraic constructions' reduces to one sound construction plus a repairable but currently invalid one.

major comments (3)
  1. [Section 4.3.1, attention output projection] The outer hidden state is defined as x'_ell in R^{m d_model}, but the proposed output projections W'_o = W_o S_1^T and W'_o = (1/m)[W_o ... W_o] both map from R^{m d_model} to R^{d_model}. The residual add X_att = X + H_att W'_o is therefore ill-typed at the first attention block. A block-diagonal W'_o = blkdiag(W_o, ..., W_o) would preserve the replicated invariant, but as written the invariant fails and Attack B's correctness claim does not hold.
  2. [Section 4.3.1, FFN sublayer] For the FFN, W'_2 = [W_2 ... W_2] maps R^{m d_ff} to R^{d_model}, not R^{m d_model}. Moreover, applied to a replicated activation R u, W'_2 (R u) = m W_2 u, not W_2 u; the claimed equality 'W'_2 phi(W'_1 x' + b'_1) = W_2 phi(W_1 x + b_1)' is missing a 1/m factor. Biases b'_1 and b'_2 are also not specified in Attack B. The construction should use block-diagonal W'_2 = blkdiag(W_2, ..., W_2) and replicated biases.
  3. [Table 2 and Section 5.2] Because Attack B is ill-typed, the Attack B and A+B rows of Table 2 do not provide valid evidence for the width-inflation or composition claims. The reported 'Theoretical FLOPs' for Attack B (2.8x/3.9x) are also ambiguous: if these are for the declared outer circuit, they do not measure the executed computation; if they are for the executed model, they contradict the reported 1x serve time. The A+B and IM2 rows cannot be used to conclude that hollowing reproduces honest large-model proving cost until the underlying Attack B construction is repaired and the experiments are re-run.
minor comments (5)
  1. [Section 2.1] After the definition of LayerNorm, the manuscript contains the stray sentence 'I have no way to know.' This appears to be an editorial artifact and should be removed.
  2. [Appendix A] Appendix A reproduces a program-committee meta-review, including the statement that Attacks A and B are 'technically sound.' A meta-review is not part of a research submission, and in this case its assertion about Attack B is contradicted by the analysis above. This appendix should be removed.
  3. [Table 2] The column grouping 'Serve Time' and 'Theoretical FLOPs' should be clarified. A reader could read the 1x serve time and the 2.8x theoretical FLOPs as contradictory; labeling the latter as 'declared-circuit FLOPs' or similar would resolve the ambiguity.
  4. [Section 5.2] The heading 'Semantic Squivalence' is a typo; it should read 'Semantic Equivalence'.
  5. [Section 4.3.1] The bulleted list of output-projection options has an empty bullet marker in the formatted text. This is likely a formatting issue from the source; please ensure the list renders correctly.

Circularity Check

0 steps flagged

No significant circularity: the ghost-weight construction is a direct algebraic witness, and the effort-gap claim restates standard NP-proof semantics rather than deriving a fitted prediction.

full rationale

The paper's derivation chain is: (i) observe that zkSNARK verification of LLM inference checks membership in the NP relation of the declared circuit (Sections 2.2 and 3.1); (ii) construct ghost weights by direct algebra so the outer circuit accepts the inner transcript (Sections 4.1–4.3); (iii) measure that proving cost scales with the outer circuit while serving cost tracks the inner model (Section 5). None of these steps fits a parameter to data and then re-predicts a closely related quantity. The ghost weights are defined from the inner weights via explicit formulas (zero matrices for added layers, block-diagonal/replicated projections for width, and a final 1/m decoder rescale), and the equalities f_Aout(W_ghost_out, x; s) = f_Ain(W_in, x; s) are proven equation-by-equation from residual identity, LayerNorm replicate invariance, softmax-over-key-positions, and coordinate-wise nonlinearities. The 'effort gap' claim is not a derived empirical prediction but a restatement of the standard property that a proof of satisfiability does not reveal witness-finding effort; the paper acknowledges the prior easy-witness work [32]–[34] in Section 2.3, so the observation is not presented as a new derivation from its own conclusion. The only overlapping-author citation, WAVE [35], appears solely in related work and does not supply any load-bearing premise for the attack construction. Disclosed limitations (e.g., deterministic sinusoidal encodings blocking Attack B, Section 4.4) are stated openly rather than hidden. Reviewer concerns about Attack B's tensor dimensions and FFN scaling are internal-consistency/correctness concerns, not circularity, and even if they invalidate one construction they do not make the central derivation circular. Overall, no circular step is present; the score reflects only the presence of a minor, non-load-bearing self-citation.

Axiom & Free-Parameter Ledger

2 free parameters · 6 axioms · 0 invented entities

Ghost weights are structured existing parameters, not new physical entities; they are committed and verifiable inside the circuit, so they carry no additional entity burden. The only hand-chosen attack parameters are the depth inflation and width replication factors used to set the declared outer size.

free parameters (2)
  • depth inflation ΔL = 6 additional layers in evaluation (6→12)
    Attacker-chosen number of identity blocks in Attack A; sets the declared outer depth. Not fitted, but a degree of freedom the attack relies on.
  • width replication factor m = m=2 in evaluation (512→1024)
    Attacker-chosen replication factor for Attack B; determines outer width d'_model = m d_model. Not fitted to data, but required for the construction; also appears in the output collapse alpha=1/m.
axioms (6)
  • domain assumption Pre-LN transformer residual form x -> x + F(LN(x)) for each sublayer
    The identity-layer construction depends on this structure; stated in Section 2.1.
  • domain assumption φ(0)=0 for the pointwise nonlinearity (GELU/ReLU/SiLU)
    Needed so zero weights make FFN output zero; stated in Section 4.1.
  • standard math LayerNorm mean and variance are invariant under exact coordinate replication
    Under exact arithmetic mean(Rx)=mean(x), var(Rx)=var(x); used throughout Attack B (Section 4.1).
  • domain assumption Attention softmax is over token positions, not feature coordinates, so replicated feature blocks produce identical scores
    Needed for both attacks and stated in Section 4.3.1.
  • domain assumption Circuit arithmetic is deterministic fixed-point with public rounding and lookup-table nonlinearities, so the algebraic equalities hold inside the verified circuit
    The paper assumes this in Section 3.1 to make the witness editing exact.
  • ad hoc to paper Attack B implicitly assumes a d-dimensional projection output can be combined with an m d-dimensional residual stream (or that the architecture declares an explicit broadcast)
    This is not stated or standard; it is the failing step in Section 4.3.1.

pith-pipeline@v1.3.0-alltime-deepseek · 23135 in / 21375 out tokens · 243287 ms · 2026-08-03T01:25:18.052158+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference." pith.science (2026). https://pith.science/paper/Y25MOPT6

@misc{pith2026260728884,
  author       = {Pith},
  title        = {Pith review of: Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Y25MOPT6}},
  note         = {Machine review of arXiv:2607.28884}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

As large language models (LLMs) grow in scale and are predominantly served from remote platforms, verifying faithful inference execution becomes critical (i.e., ensuring that a provider actually executes the advertised model and computational workload rather than a tampered or downsized variant). Zero-knowledge (ZK) LLM inference offers an appealing approach. It promises public verifiability and delivers per-instance guarantees of equational correctness by proving that an output is consistent with executing a public architecture under committed, private weights. Though, we show that it does not bind the effort expended to produce the output. In this paper, we formalize this overlooked effort gap and introduce the Hollow-LLM Attack, in which a dishonest provider retains the declared architecture and parameter count but embeds ghost weights whose algebraic structure collapses effective computation. These witnesses satisfy the verification circuit and yield valid proofs, even though the dishonest model owner, who serves as the prover, performs computation commensurate with a much smaller model than the declared public architecture. This creates a profitable equilibrium in which providers deliver provably correct outputs at small-model cost while overclaiming model size. Accordingly, we characterize concrete families of ghost weights that compose with standard transformer blocks and show that such hollow deployments substantially reduce serving cost with zero quality loss under the same verification circuit. These findings underscore that proof of correct inference is not proof of large-model execution and necessitate additional protections to bind correctness to verifiable computational work.

Figures

Figures reproduced from arXiv: 2607.28884 by Beijie Liu, Chen Gong, Mengyuan Li.

Figure 1
Figure 1. Figure 1: Growth trend of LLM parameters over time, distinguishing open [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Ordinary serving versus zero-knowledge serving. The provider [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Orientation diagram for the pre-LN transformer: embedding [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Attack A (add-zero-layers). The inner model’s layers (solid) are [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Attack B (enlarge-embedding by replication). The hidden state [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Positional encodings under both attacks. For learned encodings, [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

45 extracted references · 11 linked inside Pith

  1. [1]

    When backdoors speak: Understanding llm backdoor attacks through model-generated explanations,

    H. Ge, Y . Li, Q. Wang, Y . Zhang, and R. Tang, “When backdoors speak: Understanding llm backdoor attacks through model-generated explanations,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 2278–2296

    2025

  2. [2]

    Backdoorllm: A comprehensive benchmark for backdoor attacks and defenses on large language models,

    Y . Li, H. Huang, Y . Zhao, X. Ma, and J. Sun, “Backdoorllm: A comprehensive benchmark for backdoor attacks and defenses on large language models,”arXiv preprint arXiv:2408.12798, 2024

    Pith/arXiv arXiv 2024

  3. [3]

    Hidden backdoors in human-centric language models,

    S. Li, H. Liu, T. Dong, B. Z. H. Zhao, M. Xue, H. Zhu, and J. Lu, “Hidden backdoors in human-centric language models,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 3123–3140

    2021

  4. [4]

    Coin: Counting the invisible reasoning tokens in commercial opaque llm apis,

    G. Sun, Z. Wang, B. Tian, M. Liu, Z. Shen, S. He, Y . He, W. Ye, Y . Wang, and A. Li, “Coin: Counting the invisible reasoning tokens in commercial opaque llm apis,”arXiv preprint arXiv:2505.13778, 2025

    Pith/arXiv arXiv 2025

  5. [5]

    Zktorch: Compiling ml inference to zero-knowledge proofs via parallel proof accumulation,

    B.-J. Chen, L. Tang, and D. Kang, “Zktorch: Compiling ml inference to zero-knowledge proofs via parallel proof accumulation,”arXiv preprint arXiv:2507.07031, 2025

    Pith/arXiv arXiv 2025

  6. [6]

    zkllm: Zero knowledge proofs for large language models,

    H. Sun, J. Li, and H. Zhang, “zkllm: Zero knowledge proofs for large language models,” inProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, 2024, pp. 4405–4419

    2024

  7. [7]

    zkGPT: An Efficient Non-interactive Zero-knowledge Proof Framework for LLM Inference,

    W. Qu, Y . Sun, X. Liu, T. Lu, Y . Guo, K. Chen, and J. Zhang, “zkGPT: An Efficient Non-interactive Zero-knowledge Proof Framework for LLM Inference,” in34st USENIX Security Symposium (USENIX Security 25), 2025

    2025

  8. [8]

    {LLMmap}: Fingerprinting for large language models,

    D. Pasquini, E. M. Kornaropoulos, and G. Ateniese, “{LLMmap}: Fingerprinting for large language models,” in34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 299–318

    2025

  9. [9]

    ezdps: An efficient and zero-knowledge ma- chine learning inference pipeline,

    H. Wang and T. Hoang, “ezdps: An efficient and zero-knowledge ma- chine learning inference pipeline,”arXiv preprint arXiv:2212.05428, 2022

    Pith/arXiv arXiv 2022

  10. [10]

    Zkml: An optimizing system for ml inference in zero-knowledge proofs,

    B.-J. Chen, S. Waiwitlikhit, I. Stoica, and D. Kang, “Zkml: An optimizing system for ml inference in zero-knowledge proofs,” in Proceedings of the Nineteenth European Conference on Computer Systems, 2024, pp. 560–574

    2024

  11. [11]

    Svip: Towards verifiable inference of open-source large language models,

    Y . Sun, Y . Li, Y . Zhang, Y . Jin, and H. Zhang, “Svip: Towards verifiable inference of open-source large language models,”arXiv preprint arXiv:2410.22307, 2024

    arXiv 2024

  12. [12]

    Are you getting what you pay for? auditing model substitution in llm apis,

    W. Cai, T. Shi, X. Zhao, and D. Song, “Are you getting what you pay for? auditing model substitution in llm apis,”arXiv preprint arXiv:2504.04715, 2025

    arXiv 2025

  13. [13]

    Auditing black-box llm apis with a rank- based uniformity test,

    X. Zhu, Y . Ye, T. Qiu, H. Zhu, S. Tan, A. Mannan, J. Michala, R. A. Popa, and W. Neiswanger, “Auditing black-box llm apis with a rank- based uniformity test,”arXiv preprint arXiv:2506.06975, 2025

    Pith/arXiv arXiv 2025

  14. [14]

    Trust, but verify,

    M. J. Yuan, C. Lospoy, S. Lai, J. Snewin, and J. Long, “Trust, but verify,” 2025. [Online]. Available: https://arxiv.org/abs/2504.13443

    Pith/arXiv arXiv 2025

  15. [15]

    Model equality testing: Which model is this api serving?

    I. Gao, P. Liang, and C. Guestrin, “Model equality testing: Which model is this api serving?”ICLR, 2025

    2025

  16. [16]

    Llms have rhythm: Fingerprinting large language models using inter-token times and network traffic analysis,

    S. Alhazbi, A. Hussain, G. Oligeri, and P. Papadimitratos, “Llms have rhythm: Fingerprinting large language models using inter-token times and network traffic analysis,”IEEE Open Journal of the Communi- cations Society, 2025

    2025

  17. [18]

    Chiron: Privacy-preserving machine learning as a service,

    T. Hunt, C. Song, R. Shokri, V . Shmatikov, and E. Witchel, “Chiron: Privacy-preserving machine learning as a service,”arXiv preprint arXiv:1803.05961, 2018

    Pith/arXiv arXiv 2018

  18. [19]

    Confidential Compute on NVIDIA Hopper H100,

    NVIDIA, “Confidential Compute on NVIDIA Hopper H100,” https://images.nvidia.com/aem-dam/en-zz/Solutions/data-center/ HCC-Whitepaper-v1.0.pdf, 2023

    2023

  19. [20]

    Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,

    R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, “Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,” inInternational conference on machine learning. PMLR, 2016, pp. 201–210

    2016

  20. [21]

    Privacy-preserving machine learning with fully homomorphic encryption for deep neural network,

    J.-W. Lee, H. Kang, Y . Lee, W. Choi, J. Eom, M. Deryabin, E. Lee, J. Lee, D. Yoo, Y .-S. Kimet al., “Privacy-preserving machine learning with fully homomorphic encryption for deep neural network,”iEEE Access, vol. 10, pp. 30 039–30 054, 2022

    2022

  21. [22]

    Precise approximation of convolutional neural networks for homomorphically encrypted data,

    J. Lee, E. Lee, J.-W. Lee, Y . Kim, Y .-S. Kim, and J.-S. No, “Precise approximation of convolutional neural networks for homomorphically encrypted data,”IEEE Access, vol. 11, pp. 62 062–62 076, 2023

    2023

  22. [23]

    Fedml-he: An efficient homomorphic-encryption- based privacy-preserving federated learning system,

    W. Jin, Y . Yao, S. Han, J. Gu, C. Joe-Wong, S. Ravi, S. Aves- timehr, and C. He, “Fedml-he: An efficient homomorphic-encryption- based privacy-preserving federated learning system,”arXiv preprint arXiv:2303.10837, 2023

    Pith/arXiv arXiv 2023

  23. [24]

    Privacy-preserving graph-based machine learning with fully homomorphic encryption for collabora- tive anti-money laundering,

    F. Effendi and A. Chattopadhyay, “Privacy-preserving graph-based machine learning with fully homomorphic encryption for collabora- tive anti-money laundering,” inInternational Conference on Security, Privacy, and Applied Cryptography Engineering. Springer, 2024, pp. 80–105

    2024

  24. [25]

    What large language models know and what people think they know,

    M. Steyvers, H. Tejeda, A. Kumar, C. Belem, S. Karny, X. Hu, L. W. Mayer, and P. Smyth, “What large language models know and what people think they know,”Nature Machine Intelligence, vol. 7, no. 2, pp. 221–231, 2025

    2025

  25. [26]

    The risk of algorithm transparency: How algorithm complexity drives the effects on the use of advice,

    C. A. Lehmann, C. B. Haubitz, A. F ¨ugener, and U. W. Thonemann, “The risk of algorithm transparency: How algorithm complexity drives the effects on the use of advice,”Production and Operations Management, vol. 31, no. 9, pp. 3419–3434, 2022

    2022

  26. [27]

    McConnon

    A. McConnon. (2024, July) Are bigger language models always better? IBM Think Blog. [Online]. Available: https://www.ibm.com/ think/insights/are-bigger-language-models-better

    2024

  27. [28]

    Distilling the knowledge in a neural network,

    G. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network,”arXiv preprint arXiv:1503.02531, 2015

    Pith/arXiv arXiv 2015

  28. [29]

    Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter,

    V . Sanh, L. Debut, J. Chaumond, and T. Wolf, “Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter,”arXiv preprint arXiv:1910.01108, 2019

    Pith/arXiv arXiv 1910

  29. [30]

    This certificate contains details such as model size and parameters, confirming that a certain computation has been done while hiding sensitive information from the verifiers

    Ledger. (2025, 3) Zero-knowledge machine learning. Ledger Academy. “This certificate contains details such as model size and parameters, confirming that a certain computation has been done while hiding sensitive information from the verifiers”. Accessed 8 Nov 2025. [Online]. Available: https://www.ledger.com/academy/ glossary/zero-knowledge-machine-learning-zkml

    2025

  30. [31]

    (2024, 1) zkml (zero-knowledge machine learning)

    CoinGecko. (2024, 1) zkml (zero-knowledge machine learning). CoinGecko. “zkML provides a cryptographic certificate verifying an ML model’s inference, including details like model size and parameters, ensuring that a prompt has been executed without revealing sensitive data”. Accessed 8 Nov 2025. [Online]. Available: https://www.coingecko.com/en/glossary/zkml

    2024

  31. [32]

    Circuit lower bounds for nondeter- ministic quasi-polytime: an easy witness lemma for np and nqp,

    C. Murray and R. Williams, “Circuit lower bounds for nondeter- ministic quasi-polytime: an easy witness lemma for np and nqp,” in Proceedings of the 50th Annual ACM SIGACT Symposium on Theory of Computing, 2018, pp. 890–901

    2018

  32. [33]

    In search of an easy witness: Exponential time vs. probabilistic polynomial time,

    R. Impagliazzo, V . Kabanets, and A. Wigderson, “In search of an easy witness: Exponential time vs. probabilistic polynomial time,”Journal of Computer and System Sciences, vol. 65, no. 4, pp. 672–694, 2002

    2002

  33. [34]

    Proof of necessary work: Succinct state verification with fairness guarantees,

    A. Kattis and J. Bonneau, “Proof of necessary work: Succinct state verification with fairness guarantees,” inInternational Conference on Financial Cryptography and Data Security. Springer, 2023, pp. 18– 35

    2023

  34. [35]

    Wave: Leveraging architecture observation for privacy-preserving model oversight,

    H. Xu, C. Gong, B. Liu, H. Zheng, B. Chen, and M. Li, “Wave: Leveraging architecture observation for privacy-preserving model oversight,” ser. ASPLOS ’26. New York, NY , USA: Association for Computing Machinery, 2026, p. 2212–2231. [Online]. Available: https://doi.org/10.1145/3779212.3790247

    arXiv 2026

  35. [36]

    Slalom: Fast, verifiable and private ex- ecution of neural networks in trusted hardware,

    F. Tramer and D. Boneh, “Slalom: Fast, verifiable and private ex- ecution of neural networks in trusted hardware,”arXiv preprint arXiv:1806.03287, 2018

    Pith/arXiv arXiv 2018

  36. [37]

    Darknight: An acceler- ated framework for privacy and integrity preserving deep learning using trusted hardware,

    H. Hashemi, Y . Wang, and M. Annavaram, “Darknight: An acceler- ated framework for privacy and integrity preserving deep learning using trusted hardware,” inMICRO-54: 54th Annual IEEE/ACM International Symposium on Microarchitecture, 2021, pp. 212–224

    2021

  37. [38]

    Sok: Sgx. fail: How stuff gets exposed,

    S. Van Schaik, A. Seto, T. Yurek, A. Batori, B. AlBassam, D. Genkin, A. Miller, E. Ronen, Y . Yarom, and C. Garman, “Sok: Sgx. fail: How stuff gets exposed,” in2024 IEEE symposium on security and privacy (SP). IEEE, 2024, pp. 4143–4162

    2024

  38. [39]

    Downfall: Exploiting speculative data gathering,

    D. Moghimi, “Downfall: Exploiting speculative data gathering,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023, pp. 7179–7193

    2023

  39. [40]

    Sgaxe: How sgx fails in practice,

    S. Van Schaik, A. Kwong, D. Genkin, and Y . Yarom, “Sgaxe: How sgx fails in practice,” 2020

    2020

  40. [41]

    Sgx-step: An open-source framework for precise dissection and practical exploitation of intel sgx enclaves,

    J. Van Bulck and F. Piessens, “Sgx-step: An open-source framework for precise dissection and practical exploitation of intel sgx enclaves,” in39th Annual Computer Security Applications Conference (ACSAC). ACM, 2023

    2023

  41. [42]

    Sgxpectre: Stealing intel secrets from sgx enclaves via speculative execution,

    G. Chen, S. Chen, Y . Xiao, Y . Zhang, Z. Lin, and T. H. Lai, “Sgxpectre: Stealing intel secrets from sgx enclaves via speculative execution,” in2019 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 2019, pp. 142–157

    2019

  42. [43]

    Leaky cauldron on the dark land: Under- standing memory side-channel hazards in sgx,

    W. Wang, G. Chen, X. Pan, Y . Zhang, X. Wang, V . Bindschaedler, H. Tang, and C. A. Gunter, “Leaky cauldron on the dark land: Under- standing memory side-channel hazards in sgx,” inProceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, 2017, pp. 2421–2434

    2017

  43. [44]

    Verillm: A lightweight framework for publicly verifiable decentralized inference,

    K. Wang, Z. Zhao, X. Song, Z. Li, L. Xia, C. Tong, B. Shi, W. Qu, E. Yang, and L. Ai, “Verillm: A lightweight framework for publicly verifiable decentralized inference,”arXiv preprint arXiv:2509.24257, 2025

    arXiv 2025

  44. [45]

    Detectllm: Leveraging log rank information for zero-shot detection of machine-generated text,

    J. Su, T. Zhuo, D. Wang, and P. Nakov, “Detectllm: Leveraging log rank information for zero-shot detection of machine-generated text,” inFindings of the Association for Computational Linguistics: EMNLP 2023, 2023, pp. 12 395–12 412. Ethics considerations Our work is a methodological and systems-oriented study of zero-knowledge verified LLM inference. We f...

    2023

  45. [46]

    In many settings, users evaluate models based on output quality rather than parameter count

    The motivation for inflating the declared model size is weak. In many settings, users evaluate models based on output quality rather than parameter count. If the gap between claimed and actual model size is large, the attack may become detectable; if the gap is small, the economic benefit may be limited. The paper lacks a more detailed discussion of reali...