ai-research-survey

scan.json (28296B)

---

 {
   "paper": {
     "title": "IMMACULATE: A Practical LLM Auditing Framework via Verifiable Computation",
     "authors": [
       "Yanpei Guo",
       "Wenjie Qu",
       "Linyu Wu",
       "Shengfang Zhai",
       "Lionel Z. Wang",
       "Ming Xu",
       "Yue Liu",
       "Binhang Yuan",
       "Dawn Song",
       "Jiaheng Zhang"
     ],
     "year": 2026,
     "venue": "arXiv",
     "arxiv_id": "2602.22700"
   },
   "scan_version": 2,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "theoretical"],
   "key_findings": "IMMACULATE detects economically motivated deviations in black-box LLM API services (model substitution, quantization abuse, token overbilling) using a novel Logit Distance Distribution (LDD) metric combined with randomized auditing and verifiable computation. Per-request detection rates range from 1.3% (FP8 quantization on Qwen3) to 99% (model substitution on LLaMA3), with false positive rates below 10⁻⁵, while imposing under 1% throughput overhead on benign providers. Token overreporting is formally proven to reduce to model substitution under their hybrid computation model.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper provides a GitHub URL in the abstract and Section 1: 'Our code is published at https://github.com/guo-yanpei/Immaculate.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "Experiments use standard public benchmarks: GSM8K, TriviaQA, and WebQuestions (Section 6.1). These are publicly available datasets."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is specified (NVIDIA RTX 6000 Pro, 96GB, tensor parallelism degree 2) and frameworks are named (vLLM, HuggingFace Transformers), but no requirements.txt, Dockerfile, library versions, or environment setup details are provided."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions, README description, or scripts for replicating the main experiments are described in the paper."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 2–5 are reported as point estimates. No confidence intervals, error bars, or ± notation appears anywhere in the paper."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims BF16 and FP8/substitution LDDs are 'well-separated' and 'highly discriminative' based on visual inspection of distributions and raw proportions. No statistical significance tests (t-tests, KS tests, etc.) are applied to formally compare distributions."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 2 reports proportions for benign vs malicious under multiple thresholds with clear baselines (e.g., LLaMA3 BF16 0.017% vs FP8 1.7% vs Substitution 11% at >0.1 threshold). Table 5 reports absolute overhead values. The magnitude of effects is clear from the tabulated comparisons."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper subsamples 500 prompts per dataset (1,500 total) without justifying this choice. No power analysis or rationale for sample size adequacy is provided."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviation, variance across runs, or spread measures are reported. All results appear to be single-run point estimates."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 compares IMMACULATE against three paradigms: GPU TEE-based approaches, cryptographic approaches, and empirical methods across robustness, infrastructure-agnosticism, and efficiency. The evaluation also compares benign (BF16) vs malicious (FP8, substitution) deployments."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Comparisons reference recent work: Cai et al. (2025) for GPU TEE auditing, Sun et al. (2024, 2025a) for cryptographic and token overreporting approaches, and Gao et al. (2024) for empirical methods. These are contemporary and relevant."
       },
       "ablation_study": {
         "applies": true,
         "answer": false,
         "justification": "The system combines randomized auditing, LDD computation, and verifiable computation, but no ablation study isolates the contribution of individual components. The hyperparameter study (Table 4) varies thresholds but does not ablate system components."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The evaluation reports detection rate, false positive rate (Table 3), tail probability proportions across multiple thresholds (Table 2), and throughput overhead (Table 5)."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "Human evaluation is irrelevant for a cryptographic auditing framework. The system's output is a statistical accept/reject decision, not content requiring human judgment."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1: 'We randomly sample 200 prompts from each dataset to form an independent setup set for calibrating auditing thresholds; all remaining prompts are held out and used exclusively for evaluation.'"
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by model (LLaMA3-70B, Qwen3-32B, Qwen3-30B-A3B, DeepSeek-V2-Lite), by dataset (GSM8K, TriviaQA, WebQuestions in Table 3), and by attack type (BF16, FP8, substitution)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss where IMMACULATE fails or breaks down. Low detection rates for certain configurations (e.g., Qwen3 FP8 at 1.3%) are reported but presented as acceptable rather than analyzed as failure cases. No qualitative error analysis is provided."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": false,
         "justification": "Every experiment shows the system working as intended. No approaches that were tried and abandoned, no configurations that failed, and no ablations that hurt performance are reported."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims: 'reliably distinguishes benign and malicious executions' (supported by Tables 2-3, Figures 3-4), 'under 1% throughput overhead' (supported by Table 5: 0.3-1.0%). All abstract claims are backed by results."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., 'model substitution introduces systematic bias in logit outputs') are supported by formal proofs (Propositions 4.2-4.4, Appendix C) and controlled experiments that vary the deployment regime (benign vs malicious) while holding other factors constant."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper bounds its empirical claims to 'dense and MoE models' and specifies the exact models and attacks tested. The title 'Practical LLM Auditing Framework' is broad, but the theoretical guarantees are general and the experiments are presented as validation on specific architectures, not universal proof."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Appendix F analyzes adaptive adversary strategies and proves (Proposition F.1) that honest logit commitment is the dominant strategy. The paper considers whether fabricated logits could evade detection and formally rules this out under the rationality assumption."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly defines LDD as a fidelity metric that captures 'approximation fidelity between a deployed execution and a claimed full-precision model' (Section 4.2). The proxy (LDD) is well-matched to the claim (detecting execution deviations), and Definition 4.1 formally specifies what is measured."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 specifies models by name and size: LLaMA3-70B, Qwen3-32B, Qwen3-30B-A3B, DeepSeek-V2-Lite. For open-source models with fixed weights, these identifiers are sufficient to locate the exact model checkpoints."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "Standard benchmarks (GSM8K, TriviaQA, WebQuestions) are named but the exact prompt format or template used to feed these to the models is not shown. The reader cannot reconstruct the exact prompts sent to vLLM."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": false,
         "justification": "Section 6.1 states 'Top-20 token sampling strategy' and tensor parallelism degree 2, but temperature, top-p, and max_tokens are not reported. These significantly affect model output and LDD distributions."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. IMMACULATE is a verification/auditing framework, not an agentic system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 documents: subsampling 500 prompts per dataset (1,500 total), random sampling of 200 from each for calibration setup, remaining held out for evaluation. The data pipeline from raw benchmarks to evaluation is traceable."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "The paper has no dedicated limitations, threats to validity, or discussion section addressing weaknesses. The conclusion (Section 7) is two paragraphs focused entirely on contributions and future work."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No specific threats to validity of the empirical evaluation are discussed. The threat model (Section 3) defines system assumptions but does not discuss limitations of the evaluation methodology."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 3 explicitly states scope boundaries: 'We assume Srv is rational and economically motivated,' 'A malicious server is assumed to misbehave on at least 10% of queries,' 'We exclude attacks that increase computational cost and manage to serve users with an alternative model.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Code is released but no raw experimental data (LDD distributions, per-request statistics, detection logs) is made available for independent verification. Only aggregated results in tables and figures are shown."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 6.1 describes data sources (GSM8K, TriviaQA, WebQuestions), subsampling procedure (500 per dataset), hardware (RTX 6000 Pro), software framework (vLLM), and precision formats (BF16, FP8)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data comes from standard public benchmarks."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: benchmark prompts → subsample → split into setup (200/dataset) and evaluation sets → run inference under different regimes → compute LDD → apply detection rule → report results. Each transformation step is described."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper. Funding sources are not disclosed."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: National University of Singapore, Nanyang Technological University, Independent Researcher, University of California Berkeley."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence of the funder cannot be assessed. Absence of disclosure is not absence of conflict."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement or financial interest declaration appears in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates an auditing framework (a defense/tool), not a pre-trained model's capability on benchmarks. The benchmarks serve as input sources for generating inference traffic; model knowledge of benchmark answers is irrelevant to the evaluation."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: the paper tests a tool/defense rather than model knowledge. Train/test overlap does not affect the LDD measurement."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: benchmark contamination is irrelevant when the evaluation measures auditing detection rates, not model performance on benchmark tasks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 5 reports throughput overhead (0.3–1.0%) and per-request VC cost relative to GPU inference (400–900×). Section 6.5 explains that the amortized overhead is negligible since audited requests are <10⁻⁵ of total traffic."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is specified (NVIDIA RTX 6000 Pro, 96GB, tensor parallelism degree 2) but total GPU hours, wall-clock time for the experiments, or total compute budget is not stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No results across multiple random seeds are reported. All results appear to be from single runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is not stated. Results are presented without indicating how many runs produced them."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Section 6.4 explores different hyperparameter settings for t1 and t2 (Table 4), but the total search budget (how many configurations were tried, what search method was used) is not reported."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix E describes the ceremony for selecting t1 and t2: the model provider runs both deployed and quantized models on a prescribed dataset within a TEE, then selects the (t1, t2) pair yielding the lowest false positive rate while maintaining ≥5% detection rate."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "The paper does not perform formal statistical hypothesis tests with p-values. Detection and false positive rates are reported as empirical proportions, not as statistical test outcomes requiring multiple comparison correction."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors evaluate their own IMMACULATE system against their own implementations of attacks and baselines. No discussion of author-evaluation bias or independent evaluation is present."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "Table 5 reports relative overhead (400–900× for VC vs inference) but performance is not reported as a function of compute budget. No performance curves across compute levels are shown."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses GSM8K, TriviaQA, and WebQuestions as input sources but does not discuss whether these benchmarks are representative of real-world LLM API traffic or whether the LDD distributions would generalize to production query distributions."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. IMMACULATE is a verification framework, not an agentic system."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates an auditing tool, not model knowledge on benchmarks. Temporal leakage is irrelevant to whether LDD can detect execution deviations."
       },
       "feature_leakage_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: the evaluation measures auditing framework performance, not model capability. Feature leakage concepts do not apply."
       },
       "non_independence_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: train/test independence is irrelevant when the evaluation tests a defense/tool rather than model knowledge."
       },
       "leakage_detection_method": {
         "applies": false,
         "answer": false,
         "justification": "Same as above: data leakage detection is not applicable to an auditing framework evaluation."
       }
     }
   },
   "claims": [
     {
       "claim": "LDD reliably distinguishes benign BF16 execution from FP8 quantization and model substitution across dense and MoE architectures.",
       "evidence": "Table 2 shows tail probability for TV distance >0.1: BF16 0.017% vs FP8 1.7% vs substitution 11% for LLaMA3-70B. Similar separation across all four models. Figure 4 visualizes well-separated distributions (Section 6.2).",
       "supported": "strong"
     },
     {
       "claim": "Per-request detection rates are sufficient for effective randomized auditing, with false positive rates below 10⁻⁵.",
       "evidence": "Table 3 shows per-request detection rates from 1.3% (Qwen3 FP8) to 99% (LLaMA3 substitution on WebQuestions). False positive rates estimated via extreme value theory at <10⁻⁵ (Section 6.3).",
       "supported": "moderate"
     },
     {
       "claim": "IMMACULATE imposes under 1% throughput overhead on benign servers.",
       "evidence": "Table 5: throughput loss of 0.3% for LLaMA3-70B and Qwen3-32B, 0.9% for Qwen3-30B-A3B, 1.0% for DeepSeek-V2-Lite (Section 6.5).",
       "supported": "strong"
     },
     {
       "claim": "Token overreporting reduces to a special case of model substitution under the hybrid computation model.",
       "evidence": "Proposition 4.4, proved in Appendix C.2, constructs an alternative model M' with dummy recurrent steps that produces the same output but inflated token count, showing this is functionally a model substitution.",
       "supported": "strong"
     },
     {
       "claim": "An α=0.1 dishonest server is detected with overwhelming probability over a month of auditing ~3,000 requests per day.",
       "evidence": "Section 6.3 derives: daily detection probability ≥0.3, so monthly evasion probability becomes negligible. Relies on per-request detection probability ≥10⁻³ and false positive rate ≤10⁻⁵.",
       "supported": "moderate"
     },
     {
       "claim": "A rational adversary's dominant strategy is to honestly commit runtime logits.",
       "evidence": "Proposition F.1 (Appendix F) proves that fabricating logits closer to the reference than the actual execution would require a better model approximation within the same compute budget, contradicting optimality of the deployed model.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "All results are point estimates with no error bars, confidence intervals, standard deviations, or multi-run statistics. Given that LDD distributions are stochastic (dependent on GPU non-determinism and sampling), single-run results may not be stable."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper lacks any discussion of limitations or threats to the validity of the empirical evaluation. Known limitations (single hardware platform, limited attack space, small evaluation scale vs claimed 'billions of requests/day' target) go unacknowledged."
     },
     {
       "flag": "Limited attack evaluation",
       "detail": "Only two attack types are empirically tested: FP8 quantization and model substitution (smaller model). Token overreporting is dismissed via theoretical reduction. More sophisticated attacks (subtle quality degradation, selective cheating on specific query types, partial quantization) are not evaluated."
     },
     {
       "flag": "False positive rate estimated, not measured",
       "detail": "Section 6.3 acknowledges: 'Accurately estimating the per-request false positive rate under benign execution is challenging due to the extreme rarity of tail events.' The FP rate is estimated via extreme value theory rather than directly measured, introducing model-dependency in a key metric."
     },
     {
       "flag": "Small evaluation scale",
       "detail": "Only 1,500 total evaluation queries (500 per dataset) are used, while the framework targets production services processing 'billions of requests per day.' The gap between evaluation scale and claimed deployment scale is substantial."
     }
   ],
   "cited_papers": [
     {
       "title": "Language models are few-shot learners",
       "authors": ["T. Brown", "B. Mann", "N. Ryder"],
       "year": 2020,
       "relevance": "Foundational GPT-3 paper establishing the paradigm of large-scale LLM API services that IMMACULATE audits."
     },
     {
       "title": "Evaluating large language models trained on code",
       "authors": ["M. Chen"],
       "year": 2021,
       "arxiv_id": "2107.03374",
       "relevance": "Codex/HumanEval paper relevant to LLM code generation capability evaluation."
     },
     {
       "title": "Chain-of-thought prompting elicits reasoning in large language models",
       "authors": ["J. Wei", "X. Wang", "D. Schuurmans"],
       "year": 2022,
       "relevance": "Foundational prompting technique paper; reasoning token billing is a key motivation for IMMACULATE's token overreporting detection."
     },
     {
       "title": "Are you getting what you pay for? Auditing model substitution in LLM APIs",
       "authors": ["W. Cai", "T. Shi", "X. Zhao", "D. Song"],
       "year": 2025,
       "arxiv_id": "2504.04715",
       "relevance": "Primary prior work on LLM API auditing using TEEs; key baseline comparison for IMMACULATE."
     },
     {
       "title": "COIN: Counting the invisible reasoning tokens in commercial opaque LLM APIs",
       "authors": ["G. Sun", "Z. Wang", "B. Tian"],
       "year": 2025,
       "arxiv_id": "2505.13778",
       "relevance": "Addresses token overreporting in LLM APIs via embedding-based verification; complementary approach to IMMACULATE."
     },
     {
       "title": "FrugalGPT: How to use large language models while reducing cost and improving performance",
       "authors": ["L. Chen", "M. Zaharia", "J. Zou"],
       "year": 2023,
       "arxiv_id": "2305.05176",
       "relevance": "Addresses cost optimization for LLM API usage; motivates the economic incentives IMMACULATE audits against."
     },
     {
       "title": "Efficient memory management for large language model serving with PagedAttention",
       "authors": ["W. Kwon", "Z. Li", "S. Zhuang"],
       "year": 2023,
       "relevance": "vLLM paper; the inference framework IMMACULATE is built on top of."
     },
     {
       "title": "How is ChatGPT's behavior changing over time?",
       "authors": ["L. Chen", "M. Zaharia", "J. Zou"],
       "year": 2024,
       "relevance": "Empirical evidence of LLM API behavior drift over time, motivating the need for auditing frameworks."
     },
     {
       "title": "Model equality testing: Which model is this API serving?",
       "authors": ["I. Gao", "P. Liang", "C. Guestrin"],
       "year": 2024,
       "arxiv_id": "2410.20247",
       "relevance": "Statistical approach to identifying which model an API serves; empirical auditing baseline for IMMACULATE."
     },
     {
       "title": "zkLLM: Zero knowledge proofs for large language models",
       "authors": ["H. Sun", "J. Li", "H. Zhang"],
       "year": 2024,
       "relevance": "Cryptographic verification of LLM inference; key prior work showing the overhead limitations that IMMACULATE addresses."
     },
     {
       "title": "Evaluation and benchmarking of LLM agents: A survey",
       "authors": ["M. Mohammadi", "Y. Li", "J. Lo", "W. Yip"],
       "year": 2025,
       "relevance": "Survey of LLM agent evaluation methods relevant to the survey scope of AI agent methodology."
     },
     {
       "title": "Is your LLM overcharging you? Tokenization, transparency, and incentives",
       "authors": ["A. A. Velasco", "S. Tsirtsis", "N. Okati", "M. Gomez-Rodriguez"],
       "year": 2025,
       "arxiv_id": "2505.21627",
       "relevance": "Economic analysis of LLM token billing incentive misalignment; complementary economic perspective to IMMACULATE's technical approach."
     }
   ]
 }