Pith. sign in

REVIEW 2 major objections 4 minor 49 references

Trusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AI

T0 review · 2 major / 4 minor · reviewed 2026-08-02 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Clients can audit proprietary AI by spot-checking TEE-replayed blocks, catching tampering with 65% odds from ten samples.

desk verdict Solid systems engineering, but the core detection guarantee is unsupported: spot checks verify only internal consistency, so a self-consistent fabricated trace evades Eq. 10-11. read the letter →

arxiv 2603.07466 v2 pith:E3JCUALX submitted 2026-03-08 cs.CR cs.LG

Heng Jin , Chaoyu Zhang , Hexuan Yu , Shanghao Shi , Ning Zhang , Y. Thomas Hou , Wenjing Lou This is my paper · ORCID
classification cs.CRcs.LG
keywords auditablefine-tuningtrustedexecutionenvironmentboundarystatecommitmentblockdecompositionsampling-basedverificationinferenceprobabilisticdetectionmap-reducehashing
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

AFTUNE argues that cloud fine-tuning and inference of proprietary models can be made auditable without revealing model weights or loading the full model into a trusted enclave. The paper splits training and inference into two-dimensional blocks of layers and steps, records only boundary states (activations, gradients, parameters, optimizer state), and hashes them with a GPU-parallel map-reduce scheme. A client later selects a random sample of blocks, replays each inside a TEE, and compares recomputed hashes and values against the recorded ones. The central quantitative claim is that if an adversary tampers with k of N blocks and the client verifies m of them, detection probability is 1 − C(N−k,m)/C(N,m) ≈ 1 − e^(−ρm), giving about 65% detection for a 10% compromise rate and 10 spot checks. If correct, this converts opaque API-only model services into a verifiable service at 14–36% training overhead.

What carries the argument

The load-bearing object is the two-dimensional block grid: layers partitioned into layer blocks of size B_L and training steps into step blocks of size B_S. For each block cell the protocol records only boundary activations and gradients at layer edges plus parameters and optimizer states at step edges; map-reduce hashing commits these tensors without a sequential bottleneck. Verification is sampling-based: the client picks m of N blocks to replay in a TEE, and evasion probability C(N−k,m)/C(N,m) quantifies the guarantee. Boundary continuity between blocks is what the paper relies on to chain isolated local checks into whole-trace verification.

What would settle it

Instrument a fine-tuning run in which the provider replaces a contiguous slab of several step-blocks with fabricated boundary states that are internally consistent (matching hashes and values when recomputed alone), then have the client sample only blocks inside that slab; if every sampled block passes, the paper's claimed end-to-end detection fails in that scenario.

Watch

Extended reading notes

Core claim

On its own terms, AFTUNE establishes that computational integrity of fine-tuning and inference can be verified probabilistically by decomposing the execution into blocks defined by contiguous layer and step ranges, committing to only the boundary tensors between blocks, and having the client randomly sample blocks for TEE-based recomputation. Because adjacent blocks share boundary tensors, the paper claims local checks compose into an end-to-end verification chain, while the sampling formula P_detect ≈ 1 − e^(−ρm) supplies the quantitative detection guarantee. The paper further claims that numerical tolerance checks separate legitimate floating-point variation from adversarial perturbation w

Load-bearing premise

The guarantee assumes that any tampered block, if sampled, is actually detected by recomputation; Appendix C only shows a block's recorded hashes are trustworthy when its neighbors are themselves verified, so a provider that forges a contiguous, internally consistent region of blocks can evade checks sampled within that region.

Editorial extensions

If this is right

  • Clients of API-only model services can obtain verifiable evidence that fine-tuning used the agreed dataset, base model, and hyperparameters, and that inference outputs come from the contracted checkpoint.
  • Attackers who silently skip training steps, substitute a cheaper model, or poison boundaries face detection probability that compounds over repeated audits, since any first detection destroys trust.
  • Because verification runs in CPU-side TEEs on sampled blocks, auditing does not consume GPU resources and can be parallelized, making per-request inference auditing practical (roughly 1–15 seconds per verified block in the reported experiments).
  • Storage can be traded against recomputation through sparse checkpoints, down to a zero-storage mode that re-runs training once to regenerate evidence for requested blocks.
  • Under-training and model-substitution attacks become distinguishable from honest execution because commitments alone prove that training occurred, and sampling catches tampering with high probability.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extension: the detection formula assumes independent uniform sampling of blocks; a provider who knows the client's sampling distribution (or observes which blocks are being replayed) could concentrate tampering in never-sampled regions, so adaptive sampling or verifier-hiding schedules would strengthen the guarantee.
  • Extension: the verification-chain argument in Appendix C suggests a testable boundary condition: a provider that fabricates a contiguous slab of internally consistent blocks with self-consistent hashes should pass any sample drawn entirely inside that slab; chaining block commitments to each other (e.g., by including neighbor hashes) would close this gap.
  • Extension: the paper's numerical-tolerance separation (float32 vs bfloat16) implies a precision-safety model: clients can demand a minimum precision format in the contract, and the framework could be extended to automatically reject bf16 verification runs.
  • Extension: the same boundary-recording and spot-checking machinery could be applied to split learning, federated aggregation, or multi-party training, where each participant's contributed block is anchored to client-supplied inputs.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. AFTUNE proposes a framework for auditable fine-tuning and inference of proprietary cloud AI models. It decomposes training/inference into two-dimensional blocks (layers × steps), records cryptographic hashes of boundary states (activations, gradients, parameters, optimizer states), and lets a client later spot-check sampled blocks inside a TEE by recomputing from recorded boundary states and comparing hashes/numerical values. The paper derives a probabilistic detection guarantee (Eq. 10–11): if an adversary compromises k of N blocks and the client verifies m, evasion probability is C(N−k,m)/C(N,m), so detection approaches 1−e^{−ρm}. Evaluation on Llama-3.1-8B, Qwen2.5-14B, DINOv2-Giant, and ViT-Large reports 14–36% training overhead for full fine-tuning and lower overhead for LoRA and inference, with TEE-based verification times of seconds per block. The paper also analyzes numerical-tolerance attacks and shows that bfloat16 is unsafe for inference verification while float32 provides separation from adversarial perturbations.

Significance. If the central detection guarantee were sound, AFTUNE would be a practically significant step: it would offer probabilistic integrity verification for large proprietary models at much lower cost than ZKP-based approaches and without requiring the full model to fit in a TEE. The paper has real engineering strengths: a concrete block-decomposition design, an accelerator-friendly map-reduce hashing scheme, an implemented system evaluated on multiple model families, and a careful empirical study of numerical tolerance vs. adversarial perturbation margins. However, the load-bearing security claim — that a sampled tampered block is detected — is not established by the protocol as written. The paper's own Appendix C attempts to justify the provider-generated hashes through a 'verification chain,' but that chain is circular under random sampling. Since Eq. (10)–(11) and the associated deterrence claims depend on this unproven per-block detection property, the central contribution does not currently hold.

major comments (2)
  1. [§5.4, §5.7, Appendix C; Eq. (10)–(11), Algorithm 1] The probabilistic detection guarantee in Eq. (10)–(11) assumes that a compromised block, if sampled, fails verification. Algorithm 1, however, only checks that recomputing a block from its recorded boundary states reproduces the recorded hashes and values. The boundary states themselves are supplied by the untrusted provider and are not anchored to the trusted base-model hash or to client inputs except through neighboring blocks. Appendix C's 'verification chain' would supply the missing link only if the entire dependency chain back to the anchors were verified, but random sampling does not verify that chain. A provider can fabricate a contiguous, dependency-closed region — e.g., a suffix after some step-block boundary — by honestly computing forward/backward passes under any alternative model or by disabling optimizer updates, and recording the resulting boundary states. Every sampled b
  2. [§5.5 and §5.7, 'inference verification' and final-checkpoint binding] The inference protocol in §5.5 assumes a 'verified model' whose hash has been established through commitment and verification. But the same fabrication attack undermines this anchor. If the provider fabricates a training suffix that passes all sampled block checks, the final checkpoint θT is not the result of the contracted training run; it is the adversary's alternative model. The client has no way to bind the deployed inference model to the true execution, because the final checkpoint hash is also provider-generated and is never tied to the trusted base model and client data through a verified chain. Thus the end-to-end guarantee described in Section 5.1 — verifying that the claimed checkpoint was produced by executing the agreed steps on the agreed data — does not follow even when all sampled blocks pass.
minor comments (4)
  1. [§1] 'verifying fine-tuning and interference' should be 'inference'.
  2. [§5.7] Typo: 'priority' should be 'priority' in 'the client's prioritiy and verification strategy'.
  3. [Table 2] The LoRA row for Llama-3.1-8B with IC=1 appears to have malformed columns ('34.28 52.5 16%'), making the table hard to read.
  4. [Figures 5–8] The heatmap-style figures are dense; the numeric annotations are very small. A tabular or clearer color-scale presentation would improve readability.

Circularity Check

2 steps flagged · score 8.0 of 10

Eq. 10–11 assumes tampered blocks fail when sampled; the protocol only checks provider-supplied boundary hashes, so detection probability is assumed, not derived.

  1. self definitional [Section 5.7, Eq. (10)–(11); Section 5.4, verification protocol]
    "If an adversary compromises k blocks and the client randomly verifies m blocks, the probability that the adversary evades detection is: P_evade = C(Nblocks-k, m)/C(Nblocks, m) = ... (10). The detection probability P_detect = 1 - P_evade can be approximated ... P_detect ≈ 1 - e^{-ρm}. (11)"

    The formula counts a block as 'compromised' only if sampling it leads to detection. The paper gives no protocol property ensuring that a tampered block is detected when sampled: Algorithm 1 recomputes the block from boundary states and hashes recorded by the provider, then checks that recomputation matches those recorded hashes. A provider can fabricate a contiguous self-consistent region whose blocks all recompute to matching values, so none of those blocks behaves like a 'compromised' block in Eq. (10). The detection probability therefore restates the assumption that per-block detection works; it does not derive that property from the protocol.

  2. self definitional [Appendix C, 'Verification Chain and Trust Anchors']
    "However, since this block also submits its hash commitments, which remain immutable once submitted, these commitments become new trust anchors for verifying neighboring blocks, and any new attack on other blocks would still be detected."

    This is the load-bearing circular step. The trust chain asserts that a block's hash correctness derives from neighboring blocks, ultimately anchored to the base-model hash and client inputs. But a sampled block is verified only against provider-supplied boundary hashes; the chain of neighbors is not verified by random sampling. Declaring the unverified commitments of an escaped block to be 'new trust anchors' makes the anchor depend on the untrusted party's own outputs: an unverified commitment from the adversary cannot certify neighboring blocks. The verification guarantee for a sampled block is thus assumed from a chain that is never actually verified, so the probabilistic-detection claim reduces to this unproven assumption.

full rationale

The empirical evaluation (training/inference overhead, storage, verification time, numerical error measurements) is self-contained against real baselines and is not circular. The circularity is confined to the security argument. Section 5.7's Eq. (10)–(11) is a standard hypergeometric calculation, but its meaning depends on defining k as the number of blocks whose compromise is detected whenever sampled. The protocol does not establish that property: the TEE recomputes a sampled block from boundary states recorded by the provider, and hash matching only proves internal consistency of those provider-supplied tensors. A provider can choose a contiguous region closed under dependencies and populate it with internally consistent boundary states produced by an alternative execution; every sampled block in that region recomputes to its recorded hashes and passes the numerical tolerance. Appendix C attempts to repair this with a 'verification chain' linking each block to neighbors and ultimately to the base-model hash and client inputs, but random sampling never verifies the full chain, and the appendix explicitly calls the unverified commitments of an escaped block 'new trust anchors' — a self-referential step. Therefore Eq. (10)–(11) do not follow from the protocol; they assume per-block detectability, and the real detection rate for a self-consistent fabricated suffix is roughly m/N (only the boundary block between honest and fake regions fails). This makes the paper's headline probabilistic guarantee reduce by construction to its own unverified assumption. No self-citation chain or imported uniqueness theorem is involved; the circularity is in the protocol's trust anchoring, not in the related-work citations.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The scheme's only external anchors are the base-model hash and client-supplied data; every intermediate commitment is provider-generated. The security argument therefore rests on the unstated axiom that a tampered block is detectable when sampled—the exact claim Eq. 10 assumes.

free parameters (6)
  • τ (numerical verification tolerance) = not specified
    Section 5.4: threshold for relative L2 error; the security of tolerance-based checks depends on choosing it below minimal attack perturbation, but no principled selection rule is given; evaluations imply a separation in float32.
  • Layer block size BL = e.g., 4 default
    Config knob balancing hash cost, storage, and verification error; hand-chosen in experiments, not derived.
  • Step block size BS = e.g., 8 default
    Config knob balancing hash cost, storage, and verification error; hand-chosen in experiments, not derived.
  • Chunk size C for map-reduce hashing = 4096 (1024 for ViT)
    Tuned for GPU/CPU hash throughput (Appendix F).
  • Checkpoint interval IC / activation interval IA = IC=8 default, IA=4 for inference
    Storage/computation trade-off knobs (Section 5.6).
  • Sampling count m = client-chosen
    Detection probability depends on m (Eq. 11); no required minimum is derived given the flawed detection assumption.
assumptions (4)
  • domain assumption TEE (SGX/TDX) provides hardware-rooted isolation and remote attestation
    Section 3: TEE compromise is out of scope; it is the framework's root of trust.
  • domain assumption No single parameter tensor exceeds TEE memory
    Section 3: claimed observationally true for existing models; required for block replay.
  • domain assumption Boundary continuity: within a block, states are deterministic functions of boundary states and model/optimizer state
    Section 5.2 / Solution 1; non-deterministic layers are handled by IC=1 isolation.
  • ad hoc to paper A sampled tampered block is detected by recomputation and hash/numerical comparison
    Basis of Eq. 10; not proven and false for self-consistent fabricated blocks, as block verification only checks internal consistency.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Trusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AI." pith.science (2026). https://pith.science/paper/E3JCUALX

@misc{pith2026260307466,
  author       = {Pith},
  title        = {Pith review of: Trusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AI},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/E3JCUALX}},
  note         = {Machine review of arXiv:2603.07466}
}
read the original abstract

Cloud-based infrastructure has become the dominant platform for deploying large models, particularly large language models (LLMs). Fine-tuning and inference are increasingly delegated to cloud providers for simplified deployment and access to proprietary models, yet this creates a fundamental trust gap. Although cryptographic and TEE-based verification approaches exist, prohibitive proving costs and limited TEE memory prevent them from scaling to modern LLMs, leaving clients unable to practically audit these processes. This lack of transparency creates concrete security risks that can silently compromise service integrity. We present AFTUNE, an auditable and verifiable framework that ensures the computational integrity of cloud-based fine-tuning and inference. AFTUNE incorporates a lightweight recording and spot-check mechanism that produces verifiable traces of execution. These traces enable clients to later audit whether the fine-tuning and inference processes followed the agreed configurations, by verifying sampled execution blocks inside a TEE, each covering only a small portion of the model and the execution trace. Our evaluation shows that AFTUNE adds modest overhead and makes auditing practical for clients.

Figures

Figures reproduced from arXiv: 2603.07466 by the authors.

Figure 1
Figure 1. Each rectangle represents the full model at one [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. AFTUNE workflow overview. The system operates through setup and negotiation, fine-tuning, and inference phases. During execution, the provider commits boundary state hashes to the client and stores boundary states in cloud storage. Clients can verify training or inference computations on-demand through TEE-based selective recomputation of sampled regions. Layer 4 ... Layer 5 ... Layer 6 ... Layer 7 ... Layer 8 ... L… view at source ↗
Figure 4
Figure 4. Training overhead composition across different models with the second configuration from Table [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: Training verification accuracy: parameter relative [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Inference verification accuracy: activation relative [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Parameter poisoning attacks: parameter perturba [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]
Figure 8
Figure 8. Figure 8: Adversarial example attacks: activation perturba [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Trust propagation to block Bi, j : correctness is de￾rived from the anchor through neighboring blocks. Outgoing trust flows are omitted for clarity. Note that commitments of all blocks within each row must be submitted together, estab￾lishing mutual dependencies among …
Figure 10
Figure 10. Figure 10: Impact of chunk size on hash computation time for [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 5 linked inside Pith

  1. [1]

    https://cloud.google.com/blog/products/identity-security/how- confidential-computing-lays-the-foundation-for-trusted-ai

    How Confidential Computing lays the foundation for trusted AI | Google Cloud Blog — cloud.google.com. https://cloud.google.com/blog/products/identity-security/how- confidential-computing-lays-the-foundation-for-trusted-ai

  2. [2]

    https://aws.amazon.com/blogs/machine-learning/large- language-model-inference-over-confidential-data-using-aws-nitro- enclaves/

    Large language model inference over confidential data using AWS Nitro Enclaves. https://aws.amazon.com/blogs/machine-learning/large- language-model-inference-over-confidential-data-using-aws-nitro- enclaves/

  3. [3]

    Zero-knowledge proofs of training for deep neural networks

    ABBASZADEH, K., PAPPAS, C., KATZ, J.,ANDPAPADOPOULOS, D. Zero-knowledge proofs of training for deep neural networks. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security(2024), pp. 4316–4330

    2024

  4. [4]

    Trustzone: Integrated hardware and software security.ARM White Paper(2004)

    ALVES, T.,ANDFELTON, D. Trustzone: Integrated hardware and software security.ARM White Paper(2004)

    2004

  5. [5]

    Fine-tune claude 3 haiku in amazon bedrock, July 2024

    ANTHROPIC. Fine-tune claude 3 haiku in amazon bedrock, July 2024

    2024

  6. [6]

    Provable data possession at untrusted stores

    ATENIESE, G., BURNS, R., CURTMOLA, R., HERRING, J., KISS- NER, L., PETERSON, Z.,ANDSONG, D. Provable data possession at untrusted stores. InProceedings of the 14th ACM Conference on Computer and Communications Security(New York, NY , USA, 2007), CCS ’07, Association for Computing Machinery, p. 598–609

    2007

  7. [7]

    E.,ANDVIJ, M

    CHETSAI, C., PORTER, D. E.,ANDVIJ, M. Graphene-SGX: A practical library OS for unmodified applications on SGX. In2017 USENIX Annual Technical Conference (USENIX ATC 17)(Santa Clara, CA, July 2017), USENIX Association, pp. 645–658

    2017

  8. [8]

    D., ZHAO, J.,ANDKOUSHANFAR, F

    CHEN, H., FU, C., ROUHANI, B. D., ZHAO, J.,ANDKOUSHANFAR, F. Deepattest: An end-to-end attestation framework for deep neural networks. InProceedings of the 46th International Symposium on Computer Architecture(2019), pp. 487–498

    2019

Show all 49 references
  1. [9]

    Tune gemini models by using supervised fine-tuning, 2025

    CLOUD, G. Tune gemini models by using supervised fine-tuning, 2025

    2025

  2. [10]

    Azure openai in azure ai foundry models, 2025

    CORPORATION, M. Azure openai in azure ai foundry models, 2025

    2025

  3. [11]

    Host llms with nvidia gpus on oci, 2025

    CORPORATION, O. Host llms with nvidia gpus on oci, 2025

    2025

  4. [12]

    Intel sgx explained

    COSTAN, V.,ANDDEVADAS, S. Intel sgx explained. InIACR Cryp- tology ePrint Archive(2016), vol. 2016, p. 086

    2016

  5. [13]

    Guardain: Protecting emerging generative ai workloads on heterogeneous npu

    DHAR, A., THORENS, C., LAZIER, L.,ANDCAVIGELLI, L. Guardain: Protecting emerging generative ai workloads on heterogeneous npu. pp. 4155–4172

  6. [14]

    EMANI, M., FOREMAN, S., SASTRY, V., XIE, Z., RASKAR, S., ARNOLD, W., THAKUR, R., VISHWANATH, V.,ANDPAPKA, M. E. A comprehensive performance study of large language models on novel ai accelerators, 2023

    2023

  7. [15]

    ET AL., A. G. The llama 3 herd of models.arXiv preprint, arXiv:2407.21783(2024)

    2024 arXiv

  8. [16]

    H., LIPTON, Z

    FEFFER, M., SINHA, A., DENG, W. H., LIPTON, Z. C.,ANDHEI- DARI, H. Red-teaming for generative ai: Silver bullet or security theater? InProceedings of the AAAI/ACM Conference on AI, Ethics, and Society(2024), vol. 7, pp. 421–437

    2024

  9. [17]

    Scalable zero-knowledge proofs for non-linear functions in machine learning

    HAO, M., CHEN, H., LI, H., WENG, C., ZHANG, Y., YANG, H.,AND ZHANG, T. Scalable zero-knowledge proofs for non-linear functions in machine learning. In33rd USENIX Security Symposium (USENIX Security 24)(2024), pp. 3819–3836

    2024

  10. [18]

    J., SHEN, Y., WALLIS, P., ALLEN-ZHU, Z., LI, Y., WANG, S., ANDCHEN, W

    HU, E. J., SHEN, Y., WALLIS, P., ALLEN-ZHU, Z., LI, Y., WANG, S., ANDCHEN, W. Lora: Low-rank adaptation of large language models. arXiv preprint, arXiv:2106.09685(2021)

    2021 arXiv

  11. [19]

    A survey on hardware accelerators for large language models.Applied Sciences 15, 2 (Jan

    KACHRIS, C. A survey on hardware accelerators for large language models.Applied Sciences 15, 2 (Jan. 2025), 586

    2025

  12. [20]

    Gramine-tdx: A lightweight os kernel for confidential vms

    KUVAISKII, D., STAVRAKAKIS, D., QIN, K., XING, C., BHATOTIA, P.,ANDVIJ, M. Gramine-tdx: A lightweight os kernel for confidential vms. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security(New York, NY , USA, 2024), CCS ’24, Association for ...

    2024

  13. [21]

    Keystone: An open framework for architecting trusted execution environments

    LEE, D., KWON, M., JANG, J., AUMASSON, J.-P., BAEK, K.-H., CHOI, S., ROGERS, J., ROUSSEV, R.,ANDSONG, D. Keystone: An open framework for architecting trusted execution environments. In Proceedings of the 25th ACM International Conference on Architec- tural Support for Programm...

    2020

  14. [22]

    Character- ization of gpu tee overheads in distributed data parallel ml training, 2025

    LEE, J., WANG, Y., RAJAT, R.,ANDANNAVARAM, M. Character- ization of gpu tee overheads in distributed data parallel ml training, 2025

    2025

  15. [23]

    Verilora: Fine-tuning large language models with verifiable security via zero-knowledge proofs, 2025

    LIAO, G., WANG, T., ZHANG, S., ZHANG, J., LONG, S.,ANDTAO, D. Verilora: Fine-tuning large language models with verifiable security via zero-knowledge proofs, 2025. 14

    2025

  16. [24]

    Against the achilles’ heel: A survey on red teaming for generative models.Journal of Artificial Intelligence Research 82(2025), 687–775

    LIN, L., MU, H., ZHAI, Z., WANG, M., WANG, Y., WANG, R., GAO, J., ZHANG, Y., CHE, W., BALDWIN, T.,ET AL. Against the achilles’ heel: A survey on red teaming for generative models.Journal of Artificial Intelligence Research 82(2025), 687–775

    2025

  17. [25]

    Towards deep learning models resistant to adversarial attacks, 2019

    MADRY, A., MAKELOV, A., SCHMIDT, L., TSIPRAS, D.,AND VLADU, A. Towards deep learning models resistant to adversarial attacks, 2019

    2019

  18. [26]

    Ppfl: Privacy-preserving federated learning with trusted execution environments

    MO, F., HADDADI, H., KATEVAS, K., MARIN, E., PERINO, D.,AND KOURTELLIS, N. Ppfl: Privacy-preserving federated learning with trusted execution environments. InProceedings of the 19th annual international conference on mobile systems, applications, and services (2021), pp. 94–108

    2021

  19. [27]

    Introducing improvements to the fine-tuning api and expand- ing our custom models program

    OPENAI. Introducing improvements to the fine-tuning api and expand- ing our custom models program. https://openai.com/index/introducing- improvements-to-the-fine-tuning-api-and-expanding-our-custom- models-program/, Apr. 2024

    2024

  20. [28]

    Model optimization — openai api guides, 2025

    OPENAI. Model optimization — openai api guides, 2025

    2025

  21. [29]

    Dinov2: Learning robust visual features without supervision, 2024

    OQUAB, M., DARCET, T., MOUTAKANNI, T., VO, H., SZAFRANIEC, M., KHALIDOV, V., FERNANDEZ, P., HAZIZA, D., MASSA, F., EL- NOUBY, A., ASSRAN, M., BALLAS, N., GALUBA, W., HOWES, R., HUANG, P.-Y., LI, S.-W., MISRA, I., RABBAT, M., SHARMA, V., SYNNAEVE, G., XU, H., JEGOU, H., MAIRAL,...

    2024

  22. [30]

    zkgpt: An efficient non-interactive zero-knowledge proof framework for llm inference

    QU, W., SUN, Y., LIU, X., LU, T., GUO, Y., CHEN, K.,ANDZHANG, J. zkgpt: An efficient non-interactive zero-knowledge proof framework for llm inference. In34st USENIX Security Symposium (USENIX Security 25)(2025)

    2025

  23. [31]

    L., GREGOR, F., ARNAUTOV, S., KUNKEL, R., BHATOTIA, P.,ANDFETZER, C

    QUOC, D. L., GREGOR, F., ARNAUTOV, S., KUNKEL, R., BHATOTIA, P.,ANDFETZER, C. securetf: A secure tensorflow framework. In Proceedings of the 21st International Middleware Conference(New York, NY , USA, 2020), Middleware ’20, Association for Computing Machinery, p. 44–59

    2020

  24. [32]

    Zero- knowledge ai inference with high precision.ACM CCS(2025)

    RIASI, A., WANG, H., BEHNIA, R., VO, V.,ANDHOANG, T. Zero- knowledge ai inference with high precision.ACM CCS(2025)

    2025

  25. [33]

    C.,ANDFEI-FEI, L

    RUSSAKOVSKY, O., DENG, J., SU, H., KRAUSE, J., SATHEESH, S., MA, S., HUANG, Z., KARPATHY, A., KHOSLA, A., BERNSTEIN, M., BERG, A. C.,ANDFEI-FEI, L. ImageNet Large Scale Visual Recogni- tion Challenge.International Journal of Computer Vision (IJCV) 115, 3 (2015), 211–252

    2015

  26. [34]

    SERVICES, A. W. Amazon bedrock — build generative ai applications with foundation models, 2025

    2025

  27. [35]

    Compact proofs of retrievability.J

    SHACHAM, H.,ANDWATERS, B. Compact proofs of retrievability.J. Cryptol. 26, 3 (July 2013), 442–483

    2013

  28. [36]

    C., BIRKE, R.,ANDPERRI, S

    SILVANO, C., IELMINI, D., FERRANDI, F., FIORIN, L., CURZEL, S., BENINI, L., CONTI, F., GAROFALO, A., ZAMBELLI, C., CALORE, E., SCHIFANO, S., PALESI, M., ASCIA, G., PATTI, D., PETRA, N., DECARO, D., LAVAGNO, L., URSO, T., CARDELLINI, V., CARDAR- ILLI, G. C., BIRKE, R.,ANDPERRI,...

    2025

  29. [37]

    Trusted yet flexible: High- level runtimes for secure ml inference in tees.Journal of Cybersecurity and Privacy 6, 1 (2026)

    STEIAKAKIS, N.-A.,ANDVASILIADIS, G. Trusted yet flexible: High- level runtimes for secure ml inference in tees.Journal of Cybersecurity and Privacy 6, 1 (2026)

    2026

  30. [38]

    zkllm: Zero knowledge proofs for large language models

    SUN, H., LI, J.,ANDZHANG, H. zkllm: Zero knowledge proofs for large language models. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security (2024), pp. 4405–4419

    2024

  31. [39]

    Svip: Towards verifiable inference of open-source large language models.arXiv preprint arXiv:2410.22307(2025)

    SUN, Y., LI, Y., ZHANG, Y., JIN, Y.,ANDZHANG, H. Svip: Towards verifiable inference of open-source large language models.arXiv preprint arXiv:2410.22307(2025)

    2025

  32. [40]

    Pipellm: Fast and confiden- tial large language model services with speculative pipelined encryption

    TAN, Y., TAN, C., MI, Z.,ANDCHEN, H. Pipellm: Fast and confiden- tial large language model services with speculative pipelined encryption. InProceedings of the 30th ACM International Conference on Archi- tectural Support for Programming Languages and Operating Systems, Volume ...

    2025

  33. [41]

    H2:towards efficient large-scale llm training on hyper-heterogeneous cluster over 1,000 chips, 2025

    TANG, D., ZHOU, J., HU, J., LI, S., ZHENG, H., PEI, Z., WANG, H.,ANDZHANG, X. H2:towards efficient large-scale llm training on hyper-heterogeneous cluster over 1,000 chips, 2025

    2025

  34. [42]

    Visual transform- ers: Token-based image representation and processing for computer vision, 2020

    WU, B., XU, C., DAI, X., WAN, A., ZHANG, P., YAN, Z., TOMIZUKA, M., GONZALEZ, J., KEUTZER, K.,ANDVAJDA, P. Visual transform- ers: Token-based image representation and processing for computer vision, 2020

    2020

  35. [43]

    zkpytorch: A hierarchical optimized compiler for zero-knowledge machine learning.Cryptology ePrint Archive(2025)

    XIE, T., LU, T., FANG, Z., WANG, S., ZHANG, Z., JIA, Y., SONG, D.,ANDZHANG, J. zkpytorch: A hierarchical optimized compiler for zero-knowledge machine learning.Cryptology ePrint Archive(2025)

    2025

  36. [44]

    Men- talchat16k: A benchmark dataset for conversational mental health as- sistance.arXiv preprint arXiv:2503.13509(2025)

    XU, J., WEI, T., HOU, B., ORZECHOWSKI, P., YANG, S., JIN, R., PAULBECK, R., WAGENAAR, J., DEMIRIS, G.,ANDSHEN, L. Men- talchat16k: A benchmark dataset for conversational mental health as- sistance.arXiv preprint arXiv:2503.13509(2025)

    2025 arXiv

  37. [45]

    Hex- iscale: Accommodating large language model training over heteroge- neous environment, 2025

    YAN, R., JIANG, Y., NIE, X., FU, F., CUI, B.,ANDYUAN, B. Hex- iscale: Accommodating large language model training over heteroge- neous environment, 2025

    2025

  38. [46]

    Qwen2.5 technical report.arXiv preprint, arXiv:2412.15115 (2025)

    YANG, A., YANG, B., ZHANG, B., HUI, B., ZHENG, B., YU, B., LI, C., LIU, D., HUANG, F., WEI, H., LIN, H., YANG, J., TU, J., ZHANG, J., YANG, J., YANG, J., ZHOU, J., LIN, J., DANG, K., LU, K., BAO, K., YANG, K., YU, L., LI, M., XUE, M., ZHANG, P., ZHU, Q., MEN, R., LIN, R., LI, ...

    2025 arXiv

  39. [47]

    vtune: Ver- ifiable fine-tuning for llms through backdooring.arXiv preprint arXiv:2411.06611(2024)

    ZHANG, E., PAL, A., POTTI, A.,ANDGOLDBLUM, M. vtune: Ver- ifiable fine-tuning for llms through backdooring.arXiv preprint arXiv:2411.06611(2024)

    2024 arXiv

  40. [48]

    En- abling execution assurance of federated learning at untrusted partic- ipants

    ZHANG, X., LI, F., ZHANG, Z., LI, Q., WANG, C.,ANDWU, J. En- abling execution assurance of federated learning at untrusted partic- ipants. InIEEE INFOCOM 2020-IEEE Conference on Computer Communications(2020), IEEE, pp. 1877–1886

    2020

  41. [49]

    Sear: Secure and efficient aggregation for byzantine-robust federated learning.IEEE Transactions on Dependable and Secure Computing 19, 5 (2021), 3329–3342

    ZHAO, L., JIANG, J., FENG, B., WANG, Q., SHEN, C.,ANDLI, Q. Sear: Secure and efficient aggregation for byzantine-robust federated learning.IEEE Transactions on Dependable and Secure Computing 19, 5 (2021), 3329–3342. 15 A Possible Attacks Below we outline several classes of pr...

    2021

Pith tools

Reviewed August 2, 2026 · model on record in the stance chip above.