Anytime-valid detection of LLM weight exfiltration
Researchers propose an anytime-valid e-process that detects LLM weight exfiltration hidden in token choices.
A compromised inference server can leak model weights by encoding bits in plausible token choices, while benign numerical nondeterminism also causes token mismatches. The paper introduces a prompt-level e-process calibrated on trusted benign traffic that accumulates mismatch evidence and, under a calibration-transfer assumption, bounds the chance of any false alarm over an unbounded horizon. Evaluation covers four models against a seed-blind attack and a stealthier seed-aware attack that hides bits only in near-ties. Compared with a hard per-token alarm, the e-process combines weak cross-response evidence with explicit anytime false-alarm control.
- Detects weight leakage encoded in otherwise plausible tokens.
- E-process controls false alarms over an unbounded monitoring horizon.
- Tested on four models against seed-blind and seed-aware attacks.
- Seed-aware attacker hides bits only in near-tie token choices.
From the original article
1 min read at arxiv.orgA compromised LLM inference server can leak model weights by encoding payload bits in otherwise plausible token choices. A replay of the same prompt in a trusted server can expose such deviations, but benign numerical nondeterminism also causes token mismatches. Patient attackers can therefore hide within normal variation unless evidence is combined across responses.
By Ines Ortega-Fernandez · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.