ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor
ServeGuard proves open-weight adapters contain no hidden monitor-blind channel without exposing certified weights.
ServeGuard is a supply-chain method for open-weight language-model adapters that may hide backdoors in directions a safety monitor cannot see. The authors argue detection is unsound for this class because benign adapters also use that blind subspace. The publisher instead builds the adapter to read inputs only through monitor-covered directions and proves that property in zero knowledge without revealing the certified read factor. Across eight checkpoints up to 7B parameters from four families, confinement was nearly free for benign adaptation on a 0.5B model, leaving monitor quality as the main security control.
- Opaque adapters can hide backdoors in a monitor's blind subspace.
- Detection fails because benign adaptation uses that subspace too.
- ServeGuard proves reads stay inside monitor-covered directions.
- The zero-knowledge proof hides the certified read factor.
- Tested on eight checkpoints up to 7B from four families.
Full article280 words · extracted from arxiv.org · click to collapse
Third-party adapters for open-weight language models ship as opaque weight matrices; a recipient cannot check whether an adapter hides a backdoor without trusting the publisher or inspecting the weights, the publisher's core asset. For one important class (payloads placed where a safety monitor is structurally blind), detection is unsound as a defense: every detector that factors through the declared monitor is invariant on its blind subspace, and honest and backdoored adapters overlap on every blind-subspace statistic we evaluate, because benign adaptation uses that subspace too. Rather than detect this channel, we make it structurally \emph{absent} and prove that we did. The publisher builds the adapter to read the input only through directions the monitor covers and proves this in zero knowledge, revealing nothing about the read factor it certifies. The certificate is cheap because the expensive part, identifying the monitor's blind spot, is a deterministic function of the \emph{public} base model, so only one linear identity is proved; the served residual is the base model's own public floor, not a prover-chosen tolerance. The result is \emph{ServeGuard}, a supply-chain primitive: the publisher ships a \emph{proof-carrying adapter} whose proof lets a consumer or regulator verify, without the certified read factor and without trusting the publisher, that the adapter carries no hidden channel of this class relative to the declared monitor; an admission-time typing guard binds the guarantee to the adapter bytes admitted at serving time. Across eight checkpoints up to 7B from four families, the monitoring budget is architectural: the measured frontier saturates at the value-path rank on grouped-query checkpoints but not on multi-head ones. On a 0.5B model confinement is nearly free for benign adaptation, making monitor quality the security lever.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21515