# Maverick: Private and Verifiable LLM Inference Made Practical via Matrix-Vector Multiplication Delegation

arXiv: https://arxiv.org/abs/2609.10264 · HTML: https://mlsanity.com/paper/2609.10264/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 20 of its 89 references that are in the map.
- First posted on arXiv 9 Sep 2026.

## Builds on (most cited first, 20 of 20)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [How is ChatGPT's behavior changing over time?](https://mlsanity.com/paper/2307.09009/) (2023)
- [Gazelle: A Low Latency Framework for Secure Neural Network Inference](https://mlsanity.com/paper/1801.05507/) (2018)
- [Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware](https://mlsanity.com/paper/1806.03287/) (2018)
- [CrypTFlow2: Practical 2-Party Secure Inference](https://mlsanity.com/paper/2010.06457/) (2020)
- [The Foundation Model Transparency Index](https://mlsanity.com/paper/2310.12941/) (2023)
- [zkLLM: Zero Knowledge Proofs for Large Language Models](https://mlsanity.com/paper/2404.16109/) (2024)
- [SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted Cloud](https://mlsanity.com/paper/1706.10268/) (2017)
- [Time-Optimal Interactive Proofs for Circuit Evaluation](https://mlsanity.com/paper/1304.3812/) (2013)
- [Artemis: Efficient Commit-and-Prove SNARKs for zkML](https://mlsanity.com/paper/2409.12055/) (2024)
- [Breaking the Layer Barrier: Remodeling Private Transformer Inference with Hybrid CKKS and MPC](https://mlsanity.com/paper/2508.19525/) (2025)
- [DataSeal: Ensuring the Verifiability of Private Computation on Encrypted Data](https://mlsanity.com/paper/2410.15215/) (2024)
- [Practical Secure Delegated Linear Algebra with Trapdoored Matrices](https://mlsanity.com/paper/2502.13060/) (2025)
- [Jolt Atlas: Verifiable Inference via Lookup Arguments in Zero Knowledge](https://mlsanity.com/paper/2602.17452/) (2026)
- [Verifiable Fully Homomorphic Encryption](https://mlsanity.com/paper/2301.07041/) (2023)
- [Efficient Encryption from Random Quasi-Cyclic Codes](https://mlsanity.com/paper/1612.05572/) (2016)
- [Prover efficient public verification of dense or sparse/structured matrix-vector multiplication](https://mlsanity.com/paper/1704.02768/) (2017)
- [Matrix Multiplication Verification Using Coding Theory](https://mlsanity.com/paper/2309.16176/) (2023)
- [Cryptanalysis on Lightweight Verifiable Homomorphic Encryption](https://mlsanity.com/paper/2502.12628/) (2025)
- [MOSAIC: Masked Outsourcing of Secure AI Computations](https://mlsanity.com/paper/2607.29221/) (2026)

## Abstract (arXiv)

Open-source large language models (LLMs) are increasingly competitive with closed-source models while offering transparency and the ability to run inference without exposing user inputs to a service provider. However, running large-scale models locally requires substantial computational resources. In practice, users may still resort to a third-party provider, giving rise to privacy and correctness concerns. Existing solutions that address these problems often impose substantial server overhead or introduce additional trust assumptions. In this paper, we present Maverick, a novel approach to private and verifiable LLM inference based on a protocol for delegating matrix-vector multiplication, a dominant operation in LLMs. At its core, Maverick provides, to our knowledge, the first information-theoretically sound verification protocol for matrix-vector multiplication delegation with transparent preprocessing, efficient (batch) verification, and virtually no server overhead. We combine this verification primitive with LPN-based pseudorandom masking to provide input privacy. We implement our matrix-vector delegation primitive and use it to build an end-to-end prototype of Maverick, which we evaluate on Qwen3-4B by measuring throughput in tokens per second. We evaluate client configurations with 1-8 threads. With one client thread and a CPU server using up to 128 threads, Maverick achieves throughput gains over local inference of up to 17x when privacy masks are generated online, 45x when they are precomputed, and 44x when only verification is required. With four client threads, the corresponding gains are 13x, 18x, and 17x. When server computation is no longer the bottleneck, client-side microbenchmarks with simulated network delay show speedups of 12x-20x, 34x-135x, and 38x-157x.