ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor
ServeGuard proves open-weight adapters contain no hidden monitor-blind channel without exposing certified weights.
ServeGuard is a supply-chain method for open-weight language-model adapters that may hide backdoors in directions a safety monitor cannot see. The authors argue detection is unsound for this class because benign adapters also use that blind subspace. The publisher instead builds the adapter to read inputs only through monitor-covered directions and proves that property in zero knowledge without revealing the certified read factor. Across eight checkpoints up to 7B parameters from four families, confinement was nearly free for benign adaptation on a 0.5B model, leaving monitor quality as the main security control.
- Opaque adapters can hide backdoors in a monitor's blind subspace.
- Detection fails because benign adaptation uses that subspace too.
- ServeGuard proves reads stay inside monitor-covered directions.
- The zero-knowledge proof hides the certified read factor.
- Tested on eight checkpoints up to 7B from four families.
From the original article
1 min read at arxiv.orgThird-party adapters for open-weight language models ship as opaque weight matrices; a recipient cannot check whether an adapter hides a backdoor without trusting the publisher or inspecting the weights, the publisher's core asset.
By Dominik Dahlem · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.