Maverick: Private and Verifiable LLM Inference Made Practical via Matrix-Vector Multiplication Delegation
Ben Merbaum, Mohammad Amin Raeisi, Wenhao Wang, Charalampos Papamanthou, Katerina Sotiraki, Fan Zhang
cs.CR · cs.LG
Quick verdict
Claims first IT-sound MVM delegation for private+verifiable LLM inference with no server overhead; elegant, strong Qwen3-4B results; storage/latency remain.
Summary
Maverick is a system for outsourcing LLM inference to an untrusted server while hiding the client's inputs and verifying correctness. Its core is a verifiable matrix–vector multiplication delegation protocol (vMVMD) that checks a claimed Mx=y using Freivalds-style verification with t-sparse challenges over high-distance RAA codes, yielding O(m+n) client verification, information-theoretic soundness of 2^−κ, and transparent, publicly checkable preprocessing. Input privacy (pvMVMD) comes from dual-LPN pseudorandom masks that are removed in linear time via preprocessed P=MG_x; the server runs only the plain matrix–vector product, and a batch variant recursively delegates challenge projections to the server. In a Rust prototype on Qwen3-4B, with one client thread and up to 128 CPU server threads, throughput exceeds local inference by up to 17× (standard), 45× (boost), and 44× (verification-only); client-side microbenchmarks under simulated 50–100 ms RTTs show 12×–20×, 34×–135×, and 38×–157× gains. At n=2^14 the client's online work is 9.33 ms versus 116 ms for the native MVM, and verification of a full Qwen3-4B pass costs about 45 ms. Main limitations: large per-model preprocessing and client-side storage, 57.8 MB across 182 communication rounds per token in private modes (TTFT worse than local at 100 ms RTT), an acknowledged non-comparable DeepProve comparison, and no stated code release.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- vMVMD is, to the authors' knowledge, the first information-theoretically sound matrix–vector multiplication delegation protocol with transparent preprocessing and O_κ(m+n) client verification.
- Dual-LPN pseudorandom masking adds input privacy with the server still performing only one plain MVM, for O_λ,κ(m+n) total client online time.
- On Qwen3-4B with one client thread and up to 128 CPU server threads, Maverick improves throughput over local inference by up to 17× (standard), 45× (boost), and 44× (verification-only), with full-model verification costing ~45 ms.
- The pvMVMD client is up to 34.8× faster than Dumas–Zucca and 194.8× faster than Sum-Check+BaseFold (n≤2^12) while additionally providing input privacy.
- The vector-space instantiation of Slalom at the Carnival leaks linear projections of client inputs, violating its stated privacy guarantee (Appendix E).
Strengths
Provably sound, asymptotically optimal core primitive
Lemma 5.1 bounds single-check failure at (1−δ)^t + 1/(|F|−1) and Theorem 5.2 chooses t, ℓ for 2^−κ information-theoretic soundness with O_κ(m+n) verification (Table 1); preprocessing Q=G^⊤M is publicly checkable, adding no trust assumption (§4.3, §5.1).
Genuinely zero server overhead
The server performs exactly one plain field MVM (§5.3, §6.3), unlike proof systems (DeepProve needs 34.2–81.6 s proving on ≥10× smaller models) or FHE pipelines — the design goal is met by construction, not just empirically.
Rigorous, honest end-to-end evaluation
Strong primitive-level baselines
New cryptanalysis with practical impact
Weaknesses
Client-side storage bottleneck unquantified for the target use case
Privacy modes lose to local inference under realistic latency
DeepProve comparison is not apples-to-apples
Field-quantization correctness is empirical only
Preprocessing cost asymmetry and evaluation scope
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What problem does the Maverick paper solve?
It lets a computationally weak client (e.g., a phone) run an open-source LLM on an untrusted server while (a) hiding the user's prompt from that server and (b) verifying the server actually computed the model correctly — with essentially zero extra work on the server side, unlike zero-knowledge-proof or homomorphic-encryption approaches, which can be orders of magnitude slower.
How much faster is Maverick than running the model locally?
On Qwen3-4B with one client thread and a CPU server of up to 128 threads: up to 17× throughput with online privacy masking, 45× with precomputed masks, and 44× in verification-only mode. Under simulated 50–100 ms network latency, client-limited microbenchmarks show 12×–20× (standard), 34×–135× (boost), and 38×–157× (verification-only) gains over local inference.
Does the server see my prompt when using Maverick?
In standard and boost modes, no: inputs are masked with pseudorandom vectors whose security rests on the dual-LPN assumption (computational privacy), while correctness is verified information-theoretically. In verification-only mode, inputs are sent in the clear and only correctness of the inference is verified.
What are Maverick's main practical costs?
A one-time per-model preprocessing phase (135.8 s at n=2^14 per matrix, growing quadratically), large client-side storage for the preprocessed state, and heavy communication in privacy modes — about 57.8 MB over 182 rounds per token; at 100 ms RTT the time-to-first-token of the privacy modes exceeds local inference, so they suit throughput-bound rather than latency-bound use.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The metadata abstract is cut mid-sentence ('…45'), but the complete abstract appears at the start of the extracted full text; the extracted text ends cleanly after Appendix E with no observed truncation.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.