What Does Verifiable Inference Get You?

Verifiable inference is the application of verifiable computing to AI systems. This is often positioned as a way to ensure that a computing provider is running a certain model, instead of using a cheaper one to cut costs. For example, from a recent paper on the subject:

For instance, a user might request the Llama-3.1-70B model for complex tasks, but a dishonest computing provider could substitute the smaller Llama-2-7B model for cost savings, while still charging for the larger model. The smaller model demands significantly less memory and processing power, giving the computing provider a strong incentive to cheat.
...
This highlights the need for verifiable inference, a mechanism designed to ensure that the model specified by the user is the one actually used during inference.

• SVIP: Towards Verifiable Inference of Open-source Large Language Models

Although model integrity is an important aspect of verifiable inference, there are more pieces to the puzzle. In particular, verifiable inference also gives the user valuable guarantees about the inputs and outputs of the model. I'll explain these below.

Verifiable inference for LLMs #

Let's say we're using a computing provider to run a language model on some input. We can express this as:

O = Mp(I)

where O is the output of the model, M is the model, P is the hyperparameters (e.g. temperature, top-p), and I is the input to the model. Unfortunately, because cloud computing providers are opaque, there's no guarantee that this is what's actually occuring. For example, a computing provider might:

1. Modify the input (the system prompt and/or user prompt) before it reaches the model.
2. Modify the parameters before they are passed to the model.
3. Use a different model.
4. Modify the output before it is returned to the user.

Therefore, a computing provider advertising verifiable inference should provide the following guarantees:

1. Input integrity: The input I that is passed to the model is the same as the input I that was sent to the computing provider.
2. Parameter integrity: The parameters P that are passed to the model are the same as the parameters P that were sent to the computing provider.
3. Model integrity: The model M that is used to generate the output is the same as the model M that was requested.
4. Output integrity: The output O that is returned by the computing provider is the same as the output O that was generated by the model.

The upshot #

Although they might seem trivial on the surface, these guarantees address real problems that developers face when integrating with AI services. For example, Anthropic has been known to silently modify the inputs to their models, and OpenAI regularly swaps out models without telling users. A verifiable inference system would give developers (and researchers) a way to understand when changes like this are occuring, to help them build more reliable systems.

The good news is that the most robust verifiable inference solutions do provide these guarantees! They tend to have some nice privacy properties as well. I'll save further details for another post, but you can find examples of such solutions here and here.

< Back to all posts