IMMACULATE lets customers audit black-box LLM APIs for model substitution, quantization abuse and token overbilling without trusted hardware, and in experiments detects malicious behavior while adding under 1% throughput overhead; the approach strengthens governance options for cloud model services but remains validated only in controlled settings.

Main Finding

IMMACULATE is a practical auditing framework that detects economically motivated deviations in black‑box LLM API services (model substitution, aggressive quantization, token overbilling) by combining randomized selective auditing with verifiable computation over a novel fidelity metric—the Logit Distance Distribution (LDD). It provides provable detection guarantees without trusted hardware or requiring bitwise reproducibility, is compatible with existing inference stacks, and in a prototype built on vLLM imposes only ≈1% throughput overhead.

Key Points

• Problem addressed: black‑box LLM APIs create a trust asymmetry where providers can economically benefit by secretly deviating from claimed inference/billing (cheaper models, lower precision, inflated token counts).
• Economic insight: a rational provider can only profit if misbehavior occurs on a non‑negligible fraction α of requests; therefore auditing a small random subset suffices to detect large‑scale cheating with high probability.
• Hybrid LLM abstraction: separates continuous neural transformations (subject to numerical non‑determinism) from discrete decisions (token selection, MoE routing). Fixing discrete decisions yields a continuous reproducible computation path.
• Logit Distance Distribution (LDD): distance distribution between committed runtime logits and logits recomputed under a committed full‑precision reference model; stable under benign numeric noise but discriminatory under substitution/quantization/token‑overreporting.
• Verifiable computation + discrete‑state commitments: server commits per‑step logits (or top‑K indices) and uses a VC proof to show (a) discrete decisions match committed logits, (b) recomputation under the claimed full‑precision model produces reference logits, and (c) the LDD is within admissible bounds. This avoids requiring deterministic bitwise replay.
• Randomized auditing: only a small number of randomly chosen requests are proven. Detection probability scales with α and chosen sample size; example: a few thousand audited queries can detect a 10% cheating rate with high confidence.
• Practical optimizations: top‑K distance metric to avoid committing full logits vectors; prototype on vLLM and evaluation on dense and MoE models (including LLaMA3 family examples) show separable LDD signatures for benign vs malicious executions and ≲1% runtime overhead.
• Guarantees and assumptions: completeness (honest servers accepted), soundness (α‑dishonest servers rejected with high probability), privacy (model internals remain hidden), and generality across architectures and hardware. Assumes auditor requests are indistinguishable from normal users and that the server is economically rational (malicious only if profitable on a non‑negligible fraction).

Data & Methods

• Theoretical foundations:
  • Formal hybrid computation model Mθ = (Eθ, Fθ, S, Gθ, D) separating continuous transforms and discrete decisions.
  • Definition of LDD as distribution of distances Dis(ℓi, ℓ⋆i) between executed logits and full‑precision reference logits, with distance metrics like total variation (TV) or KL.
  • Propositions showing characteristic LDD changes for model substitution (systematic bias), precision reduction (increased variance), and token overreporting (viewed as special-case substitution).
• Auditing protocol (high level):
• Model owner publishes a cryptographic commitment to the claimed full‑precision model.
• Server serves requests normally, records per‑decision runtime logits (or top‑K indices) and commits them.
• Auditor selects a random subset of requests to audit; server provides VC proofs for those queries showing recomputation under the committed full‑precision model and reporting the LDD.
• Verifier checks proofs and evaluates tail statistics of the LDD (e.g., Pr[TV(ℓ,ℓ⋆) > τ]) to accept/reject.
• Implementation & experiments:
  • Prototype implementation built on vLLM; code published: https://github.com/guo-yanpei/Immaculate.
  • Empirical evaluation on thousands of requests across dense and Mixture‑of‑Experts (MoE) models (paper shows LLaMA3‑70B examples) demonstrating well‑separated LDDs between benign and manipulated executions.
  • Metrics used: logit TV/KL distances, empirical tail probabilities; sample complexity calculations show modest audited query counts suffice for detection (examples: thousands for α~0.1).
  • Measured overhead: ≲1% throughput overhead in prototype; cryptographic proving cost amortized because only a small random subset is proved.
• Cryptographic tools:
  • Commitment primitives (hashes/Merkle) for model and runtime logits.
  • Verifiable computation (VC) to produce succinct proofs that continuous recomputation under the reference model yields claimed LDDs; uses a VC instantiation appropriate for non‑integer floating behavior via proving LDD rather than exact FP execution.
• Limitations noted in methods:
  • Threat model excludes attacks that increase computational cost while still serving users with alternative models (i.e., attacks that are not economically reducing cost).
  • Assumes auditor’s queries are indistinguishable from ordinary users (avoids targeted evasion).

Implications for AI Economics

• Reduces moral hazard and information asymmetry: IMMACULATE makes large‑scale, stealthy cost‑saving deviations (distillation, aggressive quantization, token inflation) detectible and thus more costly/risky for providers, changing the incentive calculus.
• Low-cost auditing enables credible commitment and certification: because proving cost is amortized over large volumes and audit sampling is small, auditors or buyers (platforms, enterprises, regulators) can credibly verify provider claims (model identity, precision, token billing) without prohibitive cost — facilitating enforceable SLAs and contractual warranties.
• Pricing, contracting, and competition:
  • Providers face higher expected cost of cheating (detection probability × penalty), so some will price correctly or differentiate honestly; others may invest in infrastructure to pass audits.
  • Auditable claims can become a market signal; certified honest providers may command premium pricing or preferred procurement.
  • Potentially lowers consumer risk premium for relying on black‑box APIs, fostering adoption of LLM services in revenue‑sensitive domains (finance, healthcare, autonomous agents).
• Effects on token‑based billing models and agent economics:
  • Verifiable token usage reduces the ability to overbill hidden intermediate tokens, altering the economics of agent designs that relied on opaque internal token accounting.
  • Developers of autonomous agents and high‑volume users gain tools to control marginal costs, making cost forecasts and optimization more reliable.
• Regulatory and institutional impacts:
  • Auditing frameworks like IMMACULATE could become part of compliance regimes or standards for AI service transparency and billing fairness.
  • Third‑party auditors or certification authorities could emerge, creating new economic actors and a market for audit services.
• Potential costs, strategic responses, and limits:
  • Providers must add modest proving infrastructure and may face slightly higher per‑audited‑request cost; but these are small if audits are infrequent and proofs are efficient.
  • Adaptive adversaries: if auditors are predictable or identifiable, providers could evade audits selectively; the framework assumes auditor queries are indistinguishable, so real‑world deployment must ensure randomness and secrecy of audited queries.
  • Enforcement required: detecting cheating creates social value only if detection leads to penalties or contract remedies; economic impact depends on enforcement mechanisms (legal, marketplace punishment).
  • Residual attack space: attacks that are profitable yet rare below auditing detection thresholds or that increase cost but still substitute models are outside the assumed threat model; complementary mechanisms (market monitoring, empirical metrics, or TEEs) may still be needed.
• Overall economic conclusion: IMMACULATE substantially lowers the monitoring cost for honest verification of LLM execution and billing, shifting the equilibrium toward greater provider accountability and enabling more efficient contracting and market participation—but its real‑world leverage depends on audit design, enforcement, and integration into procurement/regulatory systems.