ServeGuard Ships a Proof-Carrying LoRA Adapter Without Revealing the Adapter's Weights

arXiv 2609.21515·low signalXBlueskyLinkedInCopy link

Third-party adapters for open-weight models arrive as opaque weight matrices, and for backdoors hidden where a safety monitor is structurally blind, the paper argues detection is unsound in principle: every detector that factors through the declared monitor is invariant on its blind subspace, and honest and backdoored adapters overlap on every blind-subspace statistic tested, because benign adaptation uses that subspace too. ServeGuard instead has the publisher build the adapter to read input only through monitor-covered directions and prove it in zero knowledge, revealing nothing about the certified read factor. The certificate is cheap because identifying the monitor's blind spot is a deterministic function of the public base model, so only one linear identity is proved and the served residual is the base model's own public floor.