Paper

{
  "raw_xml": "<entry>\n    <id>http://arxiv.org/abs/2603.19025v1</id>\n    <title>Towards Verifiable AI with Lightweight Cryptographic Proofs of Inference</title>\n    <updated>2026-03-19T15:24:27Z</updated>\n    <link href='https://arxiv.org/abs/2603.19025v1' rel='alternate' type='text/html'/>\n    <link href='https://arxiv.org/pdf/2603.19025v1' rel='related' title='pdf' type='application/pdf'/>\n    <summary>When large AI models are deployed as cloud-based services, clients have no guarantee that responses are correct or were produced by the intended model. Rerunning inference locally is infeasible for large models, and existing cryptographic proof systems -- while providing strong correctness guarantees -- introduce prohibitive prover overhead (e.g., hundreds of seconds per query for billion-parameter models). We present a verification framework and protocol that replaces full cryptographic proofs with a lightweight, sampling-based approach grounded in statistical properties of neural networks. We formalize the conditions under which trace separation between functionally dissimilar models can be leveraged to argue the security of verifiable inference protocols. The prover commits to the execution trace of inference via Merkle-tree-based vector commitments and opens only a small number of entries along randomly sampled paths from output to input. This yields a protocol that trades soundness for efficiency, a tradeoff well-suited to auditing, large-scale deployment settings where repeated queries amplify detection probability, and scenarios with rationally incentivized provers who face penalties upon detection. Our approach reduces proving times by several orders of magnitude compared to state-of-the-art cryptographic proof systems, going from the order of minutes to the order of milliseconds, with moderately larger proofs. Experiments on ResNet-18 classifiers and Llama-2-7B confirm that common architectures exhibit the statistical properties our protocol requires, and that natural adversarial strategies (gradient-descent reconstruction, inverse transforms, logit swapping) fail to produce traces that evade detection. We additionally present a protocol in the refereed delegation model, where two competing servers enable correct output identification in a logarithmic number of rounds.</summary>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.CR'/>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.LG'/>\n    <published>2026-03-19T15:24:27Z</published>\n    <arxiv:comment>49 pages, 14 figures. Accepted at IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) 2026</arxiv:comment>\n    <arxiv:primary_category term='cs.CR'/>\n    <author>\n      <name>Pranay Anchuri</name>\n    </author>\n    <author>\n      <name>Matteo Campanelli</name>\n    </author>\n    <author>\n      <name>Paul Cesaretti</name>\n    </author>\n    <author>\n      <name>Rosario Gennaro</name>\n    </author>\n    <author>\n      <name>Tushar M. Jois</name>\n    </author>\n    <author>\n      <name>Hasan S. Kayman</name>\n    </author>\n    <author>\n      <name>Tugce Ozdemir</name>\n    </author>\n  </entry>"
}