Committed SAE-Feature Traces for Audited-Session Substitution Detection in Hosted LLMs
On the map: Mechanistic interpretability → Steering and probing for LLM safety
Abstract (arXiv)
Hosted-LLM providers have a silent-substitution incentive: advertise a stronger model while serving cheaper replies. Probe-after-return schemes such as SVIP leave a parallel-serve side-channel, since a dishonest provider can route the verifier's probe to the advertised model while serving ordinary users from a substitute. We propose a commit-open protocol that closes this gap. Before any opening request, the provider commits via a Merkle tree to a per-position sparse-autoencoder (SAE) feature-trace sketch of its served output at a published probe layer. A verifier opens random positions, scores them against a public named-circuit probe library calibrated with cross-backend noise, and decides with a fixed-threshold joint-consistency z-score rule. We instantiate the protocol on three backbones -- Qwen3-1.7B, Gemma-2-2B, and a 4.5x scale-up to Gemma-2-9B with a 131k-feature SAE. Of 17 attackers spanning same-family lifts, cross-family substitutes, and rank-<=128 adaptive LoRA, all are rejected at a shared, scale-stable threshold; the same attackers all evade a matched SVIP-style parallel-serve baseline. A white-box end-to-end attack that backpropagates through the frozen SAE encoder does not close the margin, and a feature-forgery attacker that never runs M_hon is bounded in closed form by an intrinsic-dimension argument. Commitment adds <=2.1% to forward-only wall-clock at batch 32.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Steering and probing for LLM safety, one of 13 directions in Mechanistic interpretability. Builds on 18 of its 31 references that are in the map. First posted on arXiv 20 Apr 2026.
Builds on
18 of 31 references.
References · 18
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
- 2025Qwen3 Technical Reportcited by 8,820
- 2024Qwen2.5 Technical Reportcited by 4,942
- 2020The Pile: An 800GB Dataset of Diverse Text for Language Modelingcited by 2,411
- 2022Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 smallcited by 1,165
- 2022In-context Learning and Induction Headscited by 964
- 2024Gemma Scope: Open Sparse Autoencoders Everywhere All At Once on Gemma 2cited by 394
- 20242 OLMo 2 Furiouscited by 340
- 2024Transcoders Find Interpretable LLM Feature Circuitscited by 200
- 2024Instructional Fingerprinting of Large Language Modelscited by 68
- 2024LLMmap: Fingerprinting For Large Language Modelscited by 58
- 2024Compact Proofs of Model Performance via Mechanistic Interpretabilitycited by 18
6 more
- 2025TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable Inferencecited by 17
- 2024Confidential Computing on NVIDIA Hopper GPUs: A Performance Benchmark Studycited by 8
- 2023Intel TDX Demystified: A Top-Down Approachcited by 7
- 2024SVIP: Towards Verifiable Inference of Open-source Large Language Modelscited by 6
- 2026Trusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AIcited by 3
- 2025Verifiable Fine-Tuning for LLMs: Zero-Knowledge Training Proofs Bound to Data Provenance and Policycited by 2
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs
- 2025Auditing Black-Box LLM APIs with a Rank-Based Uniformity Test
- 2026Ventor-QTest: Threat-Model-Driven Verification of Vendor-Hosted LLM APIs
- 2024vTune: Verifiable Fine-Tuning for LLMs Through Backdooring
- 2026IMMACULATE: A Practical LLM Auditing Framework via Verifiable Computation
- 2026Adaptively Robust LLM Monitoring via Activation Watermarking
- 2025Fast-MIA: Efficient and Scalable Membership Inference for LLMs
- 2025Subversion via Focal Points: Investigating Collusion in LLM Monitoring