ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor
cs.CR · cs.LG
Quick verdict
Claims ZK proof-carrying LoRA adapters exclude monitor-blind backdoor channels; rigorous theory, but guarantee is monitor-relative and utility tested at 0.5B.
Summary
The paper targets a supply-chain trust gap for third-party LoRA adapters on open-weight LLMs: payloads hidden in the blind subspace (kernel) of a declared linear safety monitor are invisible to every detector that factors through that monitor, and honest adapters occupy the same subspace (88% of a trained GPT-2 value-path LoRA's norm lies in ker pi), so weight-space detection cannot separate benign from malicious. Rather than detect, ServeGuard constructs: the publisher builds the adapter so its read factor factors through the public monitor (A = CM_dep), making the hidden channel structurally absent, and proves the single linear identity A = CM_dep in zero knowledge (Halo2/KZG via EZKL), revealing nothing about the certified read factor. Because the monitor is a deterministic function of the public base model, verifiers recompute it, and the served residual is pinned at the public base floor. Evaluation spans an adversarial falsification suite (including a SteerEdit re-implementation and certificate-aware attackers), a geometry sweep over 8 checkpoints up to 7B showing the monitoring budget saturates at the value-path rank on grouped-query attention but stays high-rank on multi-head models, and a measured prover (6.4-48 s proving, 96-347 ms verification, ~2^-130 false-accept) with Lean 4-checked soundness. Limitations: the guarantee is monitor-relative; the write factor is unconstrained (a typed adapter remains 7x trigger-selective); utility is measured only at 0.5B on two modest tasks; code is promised only upon acceptance.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Detection of monitor-blind payload channels from released weights is unsound: every detector factoring through the declared monitor is invariant on ker M, and honest and backdoored adapters overlap on all kernel-activity statistics tested (88% vs 91% kernel-active on GPT-2, Section 7).
- Typing the LoRA read factor as A = CM_dep makes any operator-invisible channel of this class structurally absent, and the single linear identity A = CM_dep suffices as a zero-knowledge certificate revealing nothing about the read factor (Theorems 1, 2, 6).
- Because the deployed monitor is a deterministic function of the public base model, verification is cheap and the served blind residual is pinned exactly at the public base floor (Lemma 1, Theorem 5).
- The monitoring budget is architectural: on grouped-query checkpoints it saturates at the value-path rank, while multi-head models need e.g. 533 of 640 directions on GPT-2 for a 10x attenuation (Table 1b).
- An end-to-end Halo2/KZG implementation proves value adapters in 6.4-48 s with 96-347 ms verification and ~2^-130 false-accept, and an admission-time guard binds the guarantee to the bytes actually served (Sections 6-7, Theorem 7).
Strengths
Correct and well-motivated no-go argument
Sections 1-2 prove detectors factoring through the declared monitor are invariant on ker M, and Section 7 shows honest and backdoored adapters overlap on every kernel-activity statistic (88% vs 91% kernel-active on GPT-2; a published Alpaca LoRA at 87%), so the pivot from detection to construction-by-typing is principled, not stylistic.
The cheap-certificate insight is genuinely good design
Because M_dep is a deterministic function of the public base, the verifier recomputes it and the prover proves one linear identity A = CM_dep against public coefficients (Section 4) — no in-circuit rank, no nullspace basis; Theorem 8 formalizes the deficient-basis failure of the zero-product form as an explicit counterexample rather than a footnote.
Measured, not projected, zero-knowledge implementation
Machine-checked and adversarially falsified
Architectural finding with practical value
Weaknesses
Utility evidence stops at 0.5B
The guarantee excludes only a narrow class, and the paper says so late
Coverage is value-path, single-head, per-layer
Artifacts not yet available
Monitor governance is undressed only theoretically
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
ServeGuard addresses a narrow but well-posed supply-chain threat: LoRA adapters on a public base model that hide payloads in the kernel (blind subspace) of a declared linear safety monitor, such as the query/key map a deployed monitor reads. The paper's central move pairs a no-go with a pivot. The no-go: every detector that factors through the monitor is invariant on ker M (Section 1), and honest adapters occupy that subspace by geometry — 88% of a trained GPT-2 value-path LoRA's norm lies in ker pi, a published Alpaca LoRA sits at 87%, a random adapter at 91% (Section 7) — so weight-space detection of this channel is unsound, and prior undetectable-backdoor results ([10], [18]) reinforce it. The pivot: type the read factor as A = CM_dep so the channel is structurally absent, and prove the single linear identity in zero knowledge. Claims are carefully scoped — absence of this class relative to the declared monitor — and Sections 9 and E concede the largest gaps (unconstrained write factor, monitor-relativity, value-path-only coverage) explicitly. The claim structure is honest even where the title is breathless.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is ServeGuard in one paragraph?
ServeGuard is a supply-chain defense for LoRA adapters on open-weight LLMs. The adapter publisher constrains the adapter so it reads inputs only through directions a declared linear safety monitor covers, then proves this with a zero-knowledge proof (one linear identity, A = CM). A consumer, hub, or regulator can verify the proof without seeing the adapter's secret read factor and without trusting the publisher, certifying that no hidden channel readable only in the monitor's blind subspace exists.
Does a ServeGuard certificate mean the model has no backdoors?
No. It certifies absence of one class only: payloads that actuate through the declared monitor's blind subspace, on the value path, per layer. A typed adapter with an unconstrained write factor can still be trigger-selective through visible directions (the paper demonstrates 7x selectivity), and other projections, multi-head composition, and behavioral safety are out of scope.
How expensive is the zero-knowledge proof?
Measured on commodity hardware: 6.4-48 s to prove a value adapter, 96-347 ms to verify, 5.5-6.0 KB proofs, with false-accept probability around 2^-130 per certificate. A whole GPT-2 checkpoint with the salted commit-and-prove binding took 555 s to prove, 4.1 s to verify, and ships as a 70 KB bundle; admission checks at serving time take about 31 ms per layer.
Is the code or data available?
Not yet. The paper states that code, Lean 4 proofs, and reproduction scripts will be released publicly upon acceptance for publication. The base models measured (GPT-2, Qwen2.5-0.5B/7B, SmolLM2-1.7B) are public, and the geometric statistics need only standard linear algebra, so independent re-derivation is feasible once artifacts or a reimplementation exist.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Text extraction omitted parts of Sections 3, 5-7 and the references tail; Tables 1a-1d and Fig. 2 are referenced but not visible, so all numbers are taken from prose only.
- The metadata abstract is truncated mid-sentence and no conclusions section appears in the extraction.
- v1 preprint (18 Sep 2026); artifacts are promised but not inspectable, so implementation claims rest on the authors' prose.
- Lean formalization claims (sorry-free, axiom-clean) could not be independently checked.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.