Fine-tuning is now the primary method for adapting large neural networks, but it also introduces new integrity risks. An untrusted party can insert backdoors, change safety behavior, or overwrite large parts of a model while claiming only small updates. Existing verification tools focus on inference correctness or full-model provenance and do not address this problem. We introduce Fine-Tuning Integrity (FTI) as a security goal for controlled model evolution. An FTI system certifies that a fine-tuned model differs from a trusted base only within a policy-defined drift class. We propose Succinct Model Difference Proofs (SMDPs) as a new cryptographic primitive for enforcing these drift constraints. SMDPs provide zero-knowledge proofs that the update to a model is norm-bounded, low-rank, or sparse. The verifier cost depends only on the structure of the drift, not on the size of the model. We give concrete SMDP constructions based on random projections, polynomial commitments, and streaming linear checks. We also prove an information-theoretic lower bound showing that some form of structure is necessary for succinct proofs. Finally, we present architecture-aware instantiations for transformers, CNNs, and MLPs, together with an end-to-end system that aggregates block-level proofs into a global certificate.

翻译：微调现在是适配大型神经网络的主要方法，但其也带来了新的完整性风险。不可信方可能插入后门、改变安全行为或覆盖模型的大部分权重，同时声称仅进行了小幅更新。现有验证工具聚焦于推理正确性或完整模型溯源，无法解决此问题。我们提出"微调完整性"（FTI）作为受控模型演进的安全目标。FTI系统可证明微调后的模型与受信任基准模型之间的差异仅在策略定义的漂移类别内。我们提出"简洁模型差异证明"（SMDPs）作为实施这些漂移约束的新型密码学原语。SMDPs为零知识证明，证明模型更新满足范数有界、低秩或稀疏性。验证者开销仅取决于漂移的结构而非模型规模。我们给出了基于随机投影、多项式承诺和流式线性验证的具体SMDP构造，并证明了信息论下界，表明简洁证明必须依赖某种结构形式。最后，我们提出了面向Transformer、CNN和MLP的架构感知实例化方案，以及将区块级证明聚合为全局证书的端到端系统。