Three researchers at the University of Southern California have described an attack on zero-knowledge proofs of large language model (LLM) inference. In the attack, a provider runs a much smaller model while producing valid proofs for the larger model it advertises. The paper was accepted to the 2026 IEEE Symposium on Security and Privacy, whose program lists it in a session on 20 May 2026. The authors posted it to arXiv on 30 July.[1, 2]
In zero-knowledge (ZK) inference, a provider publishes a model's architecture and a cryptographic commitment to its private weights. It then proves that an output is consistent with them, without revealing the weights. The authors say such proof systems remain sound, meaning that a false statement cannot be proved, but do not establish how much computation went into an output.[1] In their Hollow-LLM attack, the provider keeps the declared architecture and parameter count but commits to what the authors call ghost weights. The algebraic structure of these weights makes some layers pass inputs through unchanged and confines wide layers to a small active subspace. The provider can therefore serve requests with a much smaller inner model's computation while its proofs still pass verification.[1]
The authors' experiments used the proving setup of zkGPT, an existing ZK inference system. The executed model was a six-layer transformer, declared as a 12-layer model of double width. Serving time stayed at the small model's level, and output quality, measured by perplexity, did not change. Proving costs nearly matched those of an honest model of the declared size.[1]
A program-committee meta-review appended to the paper calls the motivation for overclaiming model size weak. It reasons that a large gap may be detectable and a small one may save little.[1]
The paper's threat model, the setting it assumes, covers proprietary models, whose verifiers see only the public architecture, a weight commitment and the proof. The authors write that, to their knowledge, no company offers a commercial real-time ZK inference verification service. They add that behavioral audits can raise a cheater's costs but offer no guarantee. They also write that trusted execution environments (TEEs), hardware-isolated areas for running code, lack public verifiability.[1]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
32a0c6243c6633e2c2f677fbeea9289835ebf22ecb572e2ecf270706859b2784
