Most large language models (LLMs) run on external clouds: users send a prompt, pay for inference, and must trust that the remote GPU executes the LLM without any adversarial tampering. We critically ask how to achieve verifiable LLM inference, where a prover (the service) must convince a verifier (the client) that an inference was run correctly without rerunning the LLM. Existing cryptographic works are too slow at the LLM scale, while non-cryptographic ones require a strong verifier GPU. We propose TensorCommitments (TCs), a tensor-native proof-of-inference scheme. TC binds the LLM inference to a commitment, an irreversible tag that breaks under tampering, organized in our multivariate Terkle Trees. For LLaMA2, TC adds only 0.97% prover and 0.12% verifier time over inference while improving robustness to tailored LLM attacks by up to 48% over the best prior work requiring a verifier GPU.

翻译：大多数大型语言模型（LLM）运行于外部云端：用户发送提示词并支付推理费用，同时必须信任远程GPU在执行LLM过程中未遭受任何对抗性篡改。我们深入探讨如何实现可验证的LLM推理，即证明方（服务提供商）需向验证方（客户端）证实推理过程被正确执行，而无需重新运行整个LLM。现有密码学方案在LLM规模下效率过低，而非密码学方案则要求验证方配备高性能GPU。本文提出张量承诺（TC）——一种面向张量结构的推理证明方案。TC通过不可逆的承诺标签将LLM推理过程绑定，该标签在遭遇篡改时即失效，并组织于我们提出的多元Terkle树结构中。对于LLaMA2模型，TC仅增加0.97%的证明方时间和0.12%的验证方时间（相较于基础推理耗时），同时针对定制化LLM攻击的鲁棒性较现有最佳方案（需验证方GPU）提升达48%。