> Tiered Verification and Red-Team Attacks on LLM Inference
A three-tier verification framework (SHA-256 commits → Fisher-selected proofs → full ZK) with 1000x cost difference between tiers. Red-team finding: 0.1% weight poisoning produces KL=0.00 — identical output — but injects backdoors. ZK is the only defense.
// TABLE_OF_CONTENTS
Tiered Verification and Red-Team Attacks¶
Three-Level Verification Framework¶
| Tier | Method | Cost | Guarantee | Use Case |
|---|---|---|---|---|
| 1 | SHA-256 commitment chain | ~$0.001 | Trust-based | 99% of queries |
| 2 | Fisher-selected layer proofs | ~$0.10 | Probabilistic | Disputes |
| 3 | Full ZK proof | ~$2.23 | Cryptographic | Blockchain AI markets |
1000x cost difference between tiers. Optimistic model: assume honesty, escalate on dispute with slashing.
Red-Team Attack Detection¶
Tested on LLaMA-3.2-1B (1.24B params):
| Attack | Output Normal? | Analytics Detect? | ZK Detects? | Mechanism |
|---|---|---|---|---|
| Model substitution (160M for 1B) | Yes | No | Yes | Weight commitment |
| Layer skipping (8/16 layers) | Partial | No | Yes | Commitment chain |
| Weight poisoning (0.1%) | Yes (KL=0.00!) | No | Yes | Merkle root |
The Weight Poisoning Threat¶
This is the most dangerous attack: modifying 0.1% of weights produces identical output (KL divergence = 0.00) on standard inputs, but can inject arbitrary backdoors activated by specific trigger patterns.
- Output-based monitoring: useless (zero statistical divergence)
- Perplexity monitoring: useless (unchanged)
- ZK weight commitment: the only cryptographic defense
The commitment chain catches this because the Merkle root of model weights changes, even if only 0.1% of parameters are modified.
Strategic Insight¶
From the HanFei system design:
"Users only care about one thing: Did you run the correct model?"
Three realizations:
1. Level 2 (signature + re-run) covers 90% of real deployment needs
2. Level 3 (full ZK) is only necessary in decentralized AI markets (blockchain)
3. Providing GPU MSM infrastructure (hanfei-shu) is strategic positioning for when this market matures
The Long-Sequence Challenge¶
For LLaMA-3 at 8192 tokens, attention requires 275B Fp multiplications per layer — infeasible to prove directly.
Solution: Chunked sequence proving (256-token chunks) reduces attention ops by 1024x while maintaining compositional soundness through inter-chunk commitment linking.
Scaling to Production¶
The HanFei ecosystem roadmap: - hanfei-shu (术, technique): GPU MSM crate — published on crates.io - hanfei-shi (势, momentum): IPA proving backend — packaging Q2 2026 - hanfei-fa (法, method): Full ZK framework — Q3 2026
Each crate is independently useful, creating adoption momentum bottom-up.