ai-research-survey

scan-v5.json (19625B)

---

 {
   "scan_version": 5,
   "paper_type": "benchmark-creation",
   "paper": {
     "title": "IMMACULATE: A Practical LLM Auditing Framework via Verifiable Computation",
     "authors": [
       "Yanpei Guo",
       "Wenjie Qu",
       "Linyu Wu",
       "Shengfang Zhai",
       "Lionel Z. Wang",
       "Ming Xu",
       "Yue Liu",
       "Binhang Yuan",
       "Dawn Song",
       "Jiaheng Zhang"
     ],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.22700",
     "doi": null
   },
   "checklist": {
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "All abstract claims are substantiated: <1% throughput overhead is confirmed in Table 5 (0.3%–1.0% across four models), detection of model substitution/quantization is shown in Tables 2–3, and no trusted hardware requirement is demonstrated through the TEE-free inference path.",
         "source": "haiku"
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper makes causal claims about LDD distinguishing benign from malicious execution, supported by controlled experiments running identical prompt sets under BF16 (benign), FP8 (quantization attack), and substitute model (substitution attack) conditions, with Propositions 4.2–4.4 formally proving the statistical signatures.",
         "source": "haiku"
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The paper tests four models and three datasets (1500 total prompts) but draws broad claims about compatibility with 'existing large-scale LLM deployments' without explicitly bounding generalization to the tested architectures, precision formats, or task distributions.",
         "source": "haiku"
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper proves that truthful logit commitment is optimal for rational adversaries (Appendix F), but does not discuss alternative explanations for LDD separation failure (e.g., models with unusual logit distributions, or quantization schemes designed to minimize TV distance).",
         "source": "haiku"
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper clearly distinguishes the measured quantity (logit TV-distance distribution tail probability) from the claimed property (detection of economically motivated API deviations), with formal propositions connecting each attack type to a distinct LDD signature.",
         "source": "haiku"
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations or threats-to-validity section; the conclusion only mentions future work directions without acknowledging weaknesses of the current approach.",
         "source": "haiku"
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "While the paper acknowledges that direct empirical FP estimation is infeasible (requiring EVT extrapolation) and that FP8 per-request detection is low, these are not framed as threats to validity and no systematic validity analysis is presented.",
         "source": "haiku"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what IMMACULATE does not detect (e.g., output quality degradation without measurable quantization, non-autoregressive architectures, prompt injection) or under what conditions the LDD approach would break down.",
         "source": "haiku"
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding acknowledgment or grant disclosure appears anywhere in the paper.",
         "source": "haiku"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly disclosed in the header: National University of Singapore, Nanyang Technological University, Independent Researcher, and UC Berkeley.",
         "source": "haiku"
       },
       "funder_independent_of_outcome": {
         "applies": false,
         "answer": false,
         "justification": "No funding is disclosed, so funder independence cannot be assessed.",
         "source": "haiku"
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement, patent declaration, or financial interests disclosure appears in the paper.",
         "source": "haiku"
       }
     },
     "scope_and_framing": {
       "key_terms_defined": {
         "applies": true,
         "answer": true,
         "justification": "Key terms are precisely defined: verifiable computation (Section 2.2), the hybrid computation model and its components (Section 4.1), logit distance distribution (Definition 4.1), α-dishonest execution, and auditing properties (completeness, soundness, efficiency, privacy, generality) in Section 3.",
         "source": "haiku"
       },
       "intended_contribution_clear": {
         "applies": true,
         "answer": true,
         "justification": "The introduction explicitly lists three contributions: (1) the IMMACULATE auditing framework, (2) the LDD metric enabling verification under numerical non-determinism, and (3) a prototype implementation on vLLM with <1% overhead and published code.",
         "source": "haiku"
       },
       "engagement_with_prior_work": {
         "applies": true,
         "answer": true,
         "justification": "Section 2.3 and Appendix A systematically categorize prior auditing work into three paradigms (empirical, GPU-TEE, cryptographic), Table 1 shows IMMACULATE's advantage across all three dimensions, and individual prior works are analyzed for specific limitations IMMACULATE addresses.",
         "source": "haiku"
       }
     }
   },
   "type_checklist": {
     "benchmark-creation": {
       "construct_design": {
         "construct_validity_argued": {
           "applies": true,
           "answer": true,
           "justification": "Propositions 4.2–4.4 with formal proofs (Appendix C) argue why LDD measures approximation fidelity: model substitution produces systematic logit bias, precision reduction produces increased variance, and token overreporting is formally reduced to model substitution.",
           "source": "haiku"
         },
         "difficulty_distribution_characterized": {
           "applies": true,
           "answer": false,
           "justification": "The paper evaluates only two attack severity levels (FP8 quantization and full model substitution) without characterizing a difficulty gradient or testing intermediate attack strengths (e.g., INT8, different model size gaps).",
           "source": "haiku"
         },
         "ceiling_floor_effects_checked": {
           "applies": true,
           "answer": false,
           "justification": "Per-request FP8 detection rates as low as 1.3% represent a near-floor effect for quantization detection, but the paper does not acknowledge this as a ceiling/floor problem or calculate how many audited requests are needed to achieve reliable detection in practice.",
           "source": "haiku"
         },
         "human_baseline_included": {
           "applies": false,
           "answer": false,
           "justification": "IMMACULATE is an automated auditing framework for LLM API integrity, not a benchmark measuring human-level capabilities; a human performance baseline is not applicable.",
           "source": "haiku"
         },
         "scoring_rubric_justified": {
           "applies": true,
           "answer": true,
           "justification": "The threshold selection procedure (ceremony in Appendix E, parameter study in Table 4) is described and its robustness demonstrated across a range of hyperparameter values, with the FP/detection rate trade-off characterized across four models.",
           "source": "haiku"
         }
       },
       "robustness": {
         "contamination_resistance_designed": {
           "applies": true,
           "answer": true,
           "justification": "Appendix F proves that truthful logit commitment is the dominant strategy for rational adversaries — strategic logit fabrication cannot outperform honest commitment because generating closer-to-ideal logits would require executing a better model, contradicting the cost-saving motivation.",
           "source": "haiku"
         },
         "temporal_robustness_discussed": {
           "applies": true,
           "answer": false,
           "justification": "The paper does not discuss whether LDD-based detection remains effective as quantization techniques improve, or whether threshold ceremonies must be repeated as model families evolve — there is no plan for keeping the framework current.",
           "source": "haiku"
         },
         "failure_modes_discussed": {
           "applies": true,
           "answer": false,
           "justification": "Some failure modes are implicitly present (low FP8 detection rates, EVT-based FP estimation) but the paper provides no systematic discussion of what attacks the framework cannot detect or conditions under which LDD separation would collapse.",
           "source": "haiku"
         },
         "baseline_implementations_provided": {
           "applies": true,
           "answer": true,
           "justification": "Code is published at https://github.com/guo-yanpei/Immaculate, built on vLLM and HuggingFace Transformers, with complete algorithmic pseudo-code for the server, auditor, and VC procedures in Appendices B–D.",
           "source": "haiku"
         }
       },
       "documentation": {
         "dataset_documentation_complete": {
           "applies": true,
           "answer": false,
           "justification": "The paper uses standard benchmarks (GSM8K, TriviaQA, WebQuestions) with 500 prompts each but provides no data card, preprocessing details, or documentation distinguishing the 200-prompt calibration sets from the evaluation sets beyond a one-sentence description.",
           "source": "haiku"
         },
         "licensing_and_access_clear": {
           "applies": true,
           "answer": false,
           "justification": "A GitHub URL is provided for the code but no license is mentioned in the paper, and the terms under which others can use or extend IMMACULATE are not specified.",
           "source": "haiku"
         },
         "intended_use_specified": {
           "applies": true,
           "answer": false,
           "justification": "Intended use is implied (auditing black-box LLM APIs for economically motivated deviations) but the paper does not specify what should NOT be concluded (e.g., that passing IMMACULATE audits guarantees output quality or absence of all forms of manipulation).",
           "source": "haiku"
         }
       }
     }
   },
   "claims": [
     {
       "claim": "IMMACULATE achieves under 1% throughput overhead for benign LLM servers",
       "evidence": "Table 5 shows 0.3% throughput loss for LLaMA3-70B and Qwen3-32B, 0.9% for Qwen3-30B-A3B, 1.0% for DeepSeek-V2-Lite",
       "supported": "strong"
     },
     {
       "claim": "LDD reliably distinguishes benign BF16 execution from model substitution at the per-request level",
       "evidence": "Table 3 shows model substitution detection rates of 42–99% across models and datasets with estimated FP < 10^-5",
       "supported": "strong"
     },
     {
       "claim": "LDD can detect FP8 quantization attacks sufficient for effective randomized auditing",
       "evidence": "Table 3 shows per-request FP8 detection rates of 1.3–10.3%; the paper argues 1% per-request detection suffices for the randomized scheme, but the math uses α=0.1 dishonesty rate and requires thousands of audited requests",
       "supported": "moderate"
     },
     {
       "claim": "Token overreporting is formally equivalent to model substitution under the hybrid computation model",
       "evidence": "Proposition 4.4 with proof in Appendix C.2 constructs a modified model M' with dummy recurrent steps that preserve output sequence but inflate reported token count T by K",
       "supported": "strong"
     },
     {
       "claim": "False positive rate for benign servers is below 10^-5",
       "evidence": "EVT-based tail modeling applied because direct empirical estimation was infeasible given compute constraints; all observed benign requests were correctly classified, but this is not a direct measurement",
       "supported": "moderate"
     },
     {
       "claim": "A rational adversary's dominant strategy is to commit logits from the best affordable model approximation rather than fabricate logits",
       "evidence": "Proposition F.1 proves that producing Lfake closer to M* than Mopt would require computing a better approximation within the same budget, contradicting optimality of Mopt",
       "supported": "strong"
     }
   ],
   "methodology_tags": [
     "theoretical",
     "benchmark-eval"
   ],
   "key_findings": "IMMACULATE combines randomized auditing with a novel Logit Distance Distribution (LDD) metric to detect economically motivated LLM API deviations without trusted hardware, achieving <1% throughput overhead across four tested models. Model substitution attacks are detectable at 40–99% per-request rates, while FP8 quantization yields lower 1.3–10% rates — both with estimated false positives below 10^-5. Token overreporting is formally reduced to model substitution under a hybrid computation abstraction. The adaptive adversary analysis proves that rational servers cannot benefit from logit fabrication, closing the strategic evasion loophole.",
   "red_flags": [
     {
       "flag": "FP8 detection rates near floor",
       "detail": "Per-request FP8 detection rates of 1.3–10.3% are very low; the paper asserts this is sufficient given large-scale randomized auditing but does not calculate the expected days-to-detection for a 10% FP8-using server at these rates."
     },
     {
       "flag": "False positive rate not directly measured",
       "detail": "FP rate is estimated via Extreme Value Theory extrapolation because direct empirical measurement was infeasible under compute constraints — the claim of FP < 10^-5 is model-dependent and unvalidated against ground truth."
     },
     {
       "flag": "Token overreporting not empirically evaluated",
       "detail": "Token overreporting is excluded from all experiments with only a theoretical reduction to model substitution, leaving the framework's ability to detect real-world billing manipulation empirically unverified."
     },
     {
       "flag": "Threshold ceremony is heuristic and circular",
       "detail": "Section 6.4 acknowledges parameters are 'largely heuristic'; the ceremony requires the model provider to run both their deployed and reference models in a TEE, creating a dependency on honest provider cooperation during setup."
     },
     {
       "flag": "No limitations section",
       "detail": "No dedicated limitations or threats-to-validity section; the paper does not discuss attacks that could minimize LDD (e.g., quantization schemes tuned to preserve logit distributions) or failure modes for future model architectures."
     },
     {
       "flag": "Small evaluation sample",
       "detail": "Only 500 prompts per dataset (1500 total evaluation queries, 600 used for threshold calibration) — limited statistical basis for the extreme-tail probability estimates underpinning the FP < 10^-5 claim."
     }
   ],
   "cited_papers": [
     {
       "title": "Are you getting what you pay for? Auditing model substitution in LLM APIs (Cai et al., 2025)",
       "relevance": "Most closely related prior work; establishes the threat model IMMACULATE directly addresses and demonstrates GPU-TEE as a competing approach"
     },
     {
       "title": "zkLLM: Zero knowledge proofs for large language models (Sun et al., 2024)",
       "relevance": "Prior cryptographic verification approach whose integer-only arithmetic requirement IMMACULATE is designed to circumvent"
     },
     {
       "title": "zkGPT: An efficient non-interactive zero-knowledge proof framework for LLM inference (Qu et al., 2025)",
       "relevance": "Another ZKP-based LLM verification approach; context for cryptographic overhead IMMACULATE avoids"
     },
     {
       "title": "CoIn: Counting the invisible reasoning tokens in commercial opaque LLM APIs (Sun et al., 2025a)",
       "relevance": "Prior work on token overreporting detection via Merkle commitments; IMMACULATE provides a different mechanism and argues CoIn is bypassable"
     },
     {
       "title": "TopLoc: A locality sensitive hashing scheme for trustless verifiable inference (Ong et al., 2025)",
       "relevance": "Alternative verification approach for public models; motivates why proprietary model auditing requires a different approach"
     },
     {
       "title": "Model equality testing: Which model is this API serving? (Gao et al., 2024)",
       "relevance": "Statistical empirical approach to model identification; represents the competing class of approaches lacking formal guarantees"
     },
     {
       "title": "Is your LLM overcharging you? Tokenization, transparency, and incentives (Velasco et al., 2025)",
       "relevance": "Economic analysis of token overreporting incentives; complementary work addressing incentive misalignment rather than technical verification"
     },
     {
       "title": "Nondeterminism-aware optimistic verification for floating-point neural networks (Yao et al., 2025)",
       "relevance": "Prior work addressing GPU non-determinism in neural network verification; context for IMMACULATE's LDD approach to the same challenge"
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 3,
       "justification": "Directly addresses a concrete trust gap for every enterprise using commercial LLM APIs, with working code and <1% overhead that makes deployment viable today."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Challenges the assumption that auditing LLM execution requires either trusted hardware or prohibitive cryptographic overhead, demonstrating a practical middle path."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Highlights that LLM providers have documented economic incentives to silently substitute cheaper models and overbill tokens, with real forum reports as evidence of the accountability gap."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "References real forum complaints about GPT quality degradation, but the paper is technical rather than accusatory toward any specific provider."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Working code is published on GitHub built on vLLM, but running it requires access to 70B-parameter models and multi-GPU infrastructure, limiting casual reproducibility."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Dawn Song (UC Berkeley, known for security research) adds some name recognition, but there is no major AI lab affiliation and the paper evaluates only open-source models."
     }
   },
   "hn_data": {
     "threads": [],
     "top_points": 0,
     "total_points": 0,
     "total_comments": 0
   }
 }