mlsanityData to 14 Oct 2026

ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor

arXiv 2609.21515 ↗First posted 18 Sep 2026cs.CR cs.LGcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Third-party adapters for open-weight language models ship as opaque weight matrices; a recipient cannot check whether an adapter hides a backdoor without trusting the publisher or inspecting the weights, the publisher's core asset. For one important class (payloads placed where a safety monitor is structurally blind), detection is unsound as a defense: every detector that factors through the declared monitor is invariant on its blind subspace, and honest and backdoored adapters overlap on every blind-subspace statistic we evaluate, because benign adaptation uses that subspace too. Rather than detect this channel, we make it structurally absent and prove that we did. The publisher builds the adapter to read the input only through directions the monitor covers and proves this in zero knowledge, revealing nothing about the read factor it certifies. The certificate is cheap because the expensive part, identifying the monitor's blind spot, is a deterministic function of the public base model, so only one linear identity is proved; the served residual is the base model's own public floor, not a prover-chosen tolerance. The result is ServeGuard, a supply-chain primitive: the publisher ships a proof-carrying adapter whose proof lets a consumer or regulator verify, without the certified read factor and without trusting the publisher, that the adapter carries no hidden channel of this class relative to the declared monitor; an admission-time typing guard binds the guarantee to the adapter bytes admitted at serving time. Across eight checkpoints up to 7B from four families, the monitoring budget is architectural: the measured frontier saturates at the value-path rank on grouped-query checkpoints but not on multi-head ones. On a 0.5B model confinement is nearly free for benign adaptation, making monitor quality the security lever.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 29 of its 49 references that are in the map. First posted on arXiv 18 Sep 2026.

Builds on

29 of 49 references.

References · 29

  1. 2024Qwen2.5 Technical Reportcited by 4,942
  2. 2023GQA: Training Generalized Multi-Query Transformer Models from Multi-Head Checkpointscited by 1,346
  3. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  5. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  6. 2021Probing Classifiers: Promises, Shortcomings, and Advancescited by 876
  7. 2018Spectral Signatures in Backdoor Attackscited by 484
  8. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
  9. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 59
  10. 2024zkLLM: Zero Knowledge Proofs for Large Language Modelscited by 51
  11. 2024garak: A Framework for Security Probing Large Language Modelscited by 49
  12. 2025Language Models are Injective and Hence Invertiblecited by 35
17 more
  1. 2024PEFTGuard: Detecting Backdoor Attacks Against Parameter-Efficient Fine-Tuningcited by 26
  2. 2024Laminator: Verifiable ML Property Cards using Hardware-assisted Attestationscited by 10
  3. 2024Artemis: Efficient Commit-and-Prove SNARKs for zkMLcited by 7
  4. 2024Oblivious Defense in ML Models: Backdoor Removal without Detectioncited by 5
  5. 2025FairZK: A Scalable System to Prove Machine Learning Fairness in Zero-Knowledgecited by 5
  6. 2026PAL*M: Property Attestation for Large Generative Modelscited by 5
  7. 2026When LoRA Betrays: Backdooring Text-to-Image Models by Masquerading as Benign Adapterscited by 4
  8. 2026Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoorscited by 4
  9. 2026Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensionscited by 3
  10. 2025textttRange-Arithmetic: Verifiable Deep Learning Inference on an Untrusted Partycited by 2
  11. 2026Position: Behavioural Assurance Cannot Verify the Safety Claims Governance Now Demandscited by 2
  12. 2026FloatDoor: Platform-Triggered Backdoors in LLMscited by 2
  13. 2026Proving Circuit Functional Equivalence in Zero Knowledgecited by 1
  14. 2026Fine-Tuning Integrity for Modern Neural Networks: Structured Drift Proofs via Norm, Rank, and Sparsity Certificatescited by 1
  15. 2026Learning Only What Valid Adapters Can Express: Subspace-Constrained Adaptation Against Fine-Tuning Poisoningcited by 1
  16. 2026Statistically Undetectable Backdoors in Deep Neural Networkscited by 1
  17. 2026Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inferencecited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025SafeSteer: Adaptive Subspace Steering for Efficient Jailbreak Defense in Vision-Language Models
  2. 2026What the Model Cannot See: Covert and Provable Text Invisibility in LLMs
  3. 2025Beyond Black-Box Obfuscation: Mechanistic Analysis and Defense of White-Box Monitors
  4. 2026Verifier-Bound Communication for LLM Agents: Certified Bounds on Covert Signaling
  5. 2025Watch the Weights: Unsupervised monitoring and control of fine-tuned LLMs
  6. 2026Attack Ensembles Expose a Safety-Utility Trade-off in Black-Box Guard Defenses Against Encoded VLM Jailbreaks
  7. 2026Unread or Unenforced? Separating Representation from Enforcement Failure in Content Guards
  8. 2026ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems