Metraipolis › archive › dc_ab559dbf84cb

ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor — arXiv:2609.21515

Source

arXiv (en)

Original

https://arxiv.org/abs/2609.21515

License (as archived)

CC0-1.0

Archived

2026-10-10T01:43:46.961Z

SHA-256 of the archived text

e09c9b1811a3b624bb8c7b6fff4578136fa3ef7999aca51f6dd5c7b470f1bc31

Stable URL of this page

https://metraipolis.com/documento/dc_ab559dbf84cb

How to cite

ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor — arXiv:2609.21515 — arXiv (en), https://arxiv.org/abs/2609.21515 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_ab559dbf84cb (Metraipolis archive dc_ab559dbf84cb, sha256 e09c9b1811a3b624bb8c7b6fff4578136fa3ef7999aca51f6dd5c7b470f1bc31)

@misc{dcab559dbf84cb,
  title = {ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factor — arXiv:2609.21515},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.21515},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_ab559dbf84cb; sha256 e09c9b1811a3b624bb8c7b6fff4578136fa3ef7999aca51f6dd5c7b470f1bc31},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.21515. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Third-party adapters for open-weight language models ship as opaque weight matrices; a recipient cannot check whether an adapter hides a backdoor without trusting the publisher or inspecting the weights, the publisher's core asset. For one important class (payloads placed where a safety monitor is structurally blind), detection is unsound as a defense: every detector that factors through the declared monitor is invariant on its blind subspace, and honest and backdoored adapters overlap on every blind-subspace statistic we evaluate, because benign adaptation uses that subspace too. Rather than detect this channel, we make it structurally \emph{absent} and prove that we did. The publisher builds the adapter to read the input only through directions the monitor covers and proves this in zero knowledge, revealing nothing about the read factor it certifies. The certificate is cheap because the expensive part, identifying the monitor's blind spot, is a deterministic function of the \emph{public} base model, so only one linear identity is proved; the served residual is the base model's own public floor, not a prover-chosen tolerance. The result is \emph{ServeGuard}, a supply-chain primitive: the publisher ships a \emph{proof-carrying adapter} whose proof lets a consumer or regulator verify, without the certified read factor and without trusting the publisher, that the adapter carries no hidden channel of this class relative to the declared monitor; an admission-time typing guard binds the guarantee to the adapter bytes admitted at serving time. Across eight checkpoints up to 7B from four families, the monitoring budget is architectural: the measured frontier saturates at the value-path rank on grouped-query checkpoints but not on multi-head ones. On a 0.5B model confinement is nearly free for benign adaptation, making monitor quality the security lever.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-21 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.21515 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-10T01:13:42.025Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-21?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).