Controlling the Prompt Distribution Cuts Gumbel Inference Verification's Exfiltration Slowdown From 200x to 60x

arXiv (2608.23375, submitted 2026-08-24)·medium signalXBlueskyLinkedInCopy link

Gumbel-based inference verification catches weight exfiltration by only forgiving token choices consistent with honest GPU nondeterminism, and reported a greater-than-200x slowdown against a steganographic adversary under benign traffic. arXiv 2608.23375 (submitted 2026-08-24) shows that bound assumes a passive attacker, because the verifier's admissible-token-set size tracks the model's own output entropy. Prompts engineered to break grammatical and sub-word structure widen that set, and across six instruction-tuned models from 1B to 32B and three seeds, character- and script-level disruption roughly doubles bits leaked per token, dropping the slowdown to 60x-118x. The fix they propose is calibrating jitter-forgiveness thresholds against local token entropy rather than against benign-traffic averages.