ML Security PapersTrusting What You Cannot See: Auditable Fine-Tuning and Inference for Proprietary AI
Heng Jin 1, Chaoyu Zhang 1, Hexuan Yu 1, Shanghao Shi 2, Ning Zhang 1, Y. Thomas Hou 1, Wenjing Lou 2
Published on arXiv
2603.07466
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
AFTUNE achieves practical computation overhead while enabling selective and efficient client-side verification that cloud providers faithfully executed contracted LLM fine-tuning and inference.
AFTUNE
Novel technique introduced
Cloud-based infrastructures have become the dominant platform for deploying large models, particularly large language models (LLMs). Fine-tuning and inference are increasingly delegated to cloud providers for simplified deployment and access to proprietary models, yet this creates a fundamental trust gap: although cryptographic and TEE-based verification exist, the scale of modern LLMs renders them prohibitive, leaving clients unable to practically audit these processes. This lack of transparency creates concrete security risks that can silently compromise service integrity. We present AFTUNE, an auditable and verifiable framework that ensures the computation integrity of cloud-based fine-tuning and inference. AFTUNE incorporates a lightweight recording and spot-check mechanism that produces verifiable traces of execution. These traces enable clients to later audit whether the training and inference processes followed the agreed configurations. Our evaluation shows that AFTUNE imposes practical computation overhead while enabling selective and efficient verification, demonstrating that trustworthy model services are achievable in today's cloud environments.
Key Contributions
- AFTUNE: a lightweight recording and spot-check mechanism that produces verifiable execution traces for cloud-based LLM fine-tuning and inference
- Enables clients to audit whether cloud providers faithfully executed agreed training and inference configurations without prohibitive cryptographic overhead
- Demonstrates practical overhead while achieving selective and efficient verification of cloud LLM services
🛡️ Threat Analysis
AFTUNE provides verifiable inference schemes and auditable execution traces — exactly what ML09 covers under 'verifiable inference schemes (proving outputs weren't tampered with)'. The threat is a dishonest cloud provider silently deviating from contracted computations, producing outputs that don't reflect the agreed model or training process. The defense is cryptographic trace-based verification of both inference outputs and fine-tuning execution.