NagaYu/assay-demo

Assay — catching model substitution, one receipt at a time

An inference provider promises model M (gpt2) and quietly serves a cheaper M' (distilgpt2, or an INT8 copy). Every response here carries a signed, low-dimensional sketch of its own hidden_states — an internal receipt — and a verifier recomputes a small, secretly-chosen slice of it. Coverage is 100% by construction: there is no request the audit happened to miss.

The control worth playing with

Pick receipt forgery and switch off the generation-consistency check. The audit goes blind — and every receipt it is looking at is genuinely M's.

That provider decodes with M' (so the user gets M' quality), then pushes prompt + M' output through M once with teacher forcing and reads a real sketch off that pass. Signatures verify, hashes bind, positions re-derive. The median z on that run is −25: the receipts are not merely acceptable, they sit far on the clean side of honest traffic, because the forger recomputes without the numerical jitter a real serving stack has. It is also cheaper than serving M — one parallel prefill instead of a sequential decode.

The lesson the sketch check cannot teach on its own: matching activations prove M was run over the text, not that M produced it. Switch the check back on and the same requests read p ≈ 2e-12, because a teacher-forced pass also reveals what M would have said, and at the inspected positions it disagrees with what was actually returned.

What you are looking at

The page replays 720 published receipts from real gpt2 / distilgpt2 runs — not a live toy model. Turning the deep check off replays the same receipts scoring only the sketch statistic, which is exactly recoverable from each row's z, so both views are faithful to the recorded data.

Assay detects the first four in 1–11 requests with no extra queries at all, and the forgery in 3 once the generation check is on.

Honest caveats

Research prototype, not a production security system. The TEE is simulated with a plain HMAC signature (the provider owns the key — detection comes from sketch consistency and the generation check, not from the signature). The generation check assumes greedy decoding. The sequential audit's α is stated for exact null p-values while the calibration here is estimated and shared across requests: measured false-alarm rate is 1 in 40 honest runs against a nominal 1%.

Links

• —Code: github.com/NagaYu/assay
• —Receipt corpus: NagaYu/assay-receipts
• —Model bundle: NagaYu/assay-tiny-pair