Publications / Hollow-LLM

Hollow-LLM · IEEE S&P 2026

Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference

Chen Gong, Beijie Liu, and Mengyuan Li

2026 IEEE Symposium on Security and Privacy (S&P 2026).

PDF DOI arXiv BibTeX

A large declared architecture can contain much less effective computation than its dimensions suggest. Hollow-LLM shows how a model owner can commit to structured private weights, serve responses using a smaller model, and still produce valid zero-knowledge proofs for the larger declared architecture.

USC Bovard Auditorium in warm evening light, with its red-brick tower against a blue sky.
Bovard Auditorium, University of Southern California. Photo: EEJCC / Wikimedia Commons, CC0.

What a proof of inference establishes

A typical zero-knowledge LLM service publishes its model architecture and a commitment to private weights. For a request and response, a proof establishes that the response is consistent with the declared circuit and those committed weights. The weights remain hidden, while anyone can check the proof.

Hollow-LLM identifies a gap between that mathematical statement and the computational effort a customer may associate with a large model. The owner can choose weights whose algebraic structure embeds a smaller model inside a larger declared architecture. The resulting proof is valid: the outer model really does produce the same response. Its apparent size, however, does not establish how much work was needed to obtain that response (§3).

How a model becomes hollow

Hollow-LLM uses structured weights chosen before commitment. A small inner model serves responses while the provider constructs a witness and proof for the larger declared circuit. The verifier accepts a valid proof for the same output, without measuring actual serving effort.
Figure 1. Hollow-LLM separates the inexpensive serving path from proving the larger committed circuit. This schematic summarizes §§3–5 of the paper; it does not imply cheaper proof generation. View full-size figure.

The construction starts with an ordinary inner model. Before making a commitment, the provider creates an expanded outer model with carefully structured “ghost weights.” Online serving executes the inner model. When a transcript is audited, the provider constructs a witness for the larger outer circuit and generates a proof using the existing verification procedure. The commitment remains unchanged throughout.

Depth and width hollowing

The two constructions preserve the inner model’s function in different ways. Depth expansion adds residual blocks that act as identities; width expansion repeats compatible hidden-state computations and combines them at the decoder.

Depth hollowing adds attention and FFN branches with zero output, while residual paths preserve x. Width hollowing replicates hidden state h into [h,h]; an untied decoder [D/2,D/2] recovers the same logits Dh. The weights, normalization, positional encoding, and arithmetic must be compatible.
Figure 2. The depth construction adds exact residual identities (§4.2). The width panel shows two replicas with an untied decoder (§4.3); preserving logits requires the paper’s coordinated parameter construction and numerical conditions. View full-size figure.
  • Expand depth with identity blocks. Additional transformer blocks have attention and feed-forward branches that contribute zero. Their residual paths therefore implement x → x, preserving the active inner model’s result. The extra layers exist in the declared architecture without adding useful computation to the serving path (§4.2).
  • Expand width with replicated coordinates. Hidden states and compatible weight structures are replicated across coordinate blocks. Normalization, attention, and the decoder must be arranged so that the wider model preserves the inner model’s logits. This requires controlled replication and output selection or rescaling; simply making a model wider would change its behavior (§4.3).
  • Preserve the proof contract. The verifier, circuit, statement format, and public parameters remain fixed for the declared architecture. The construction supplies a valid witness rather than forging a proof or changing committed weights after serving (§3.2).

What the experiments show

The evaluation uses the zkGPT proving procedure with a compact, six-layer Transformer of hidden dimension 512. Experiments use 64-token prompts and greedy decoding on an Intel Core Ultra 7 265F workstation running Ubuntu 24.04. Depth and width expansions are evaluated separately and together, including serving, proof generation, and verification (§5 and Table 2).

Measured times from Hollow-LLM Table 2, normalized separately for each phase to the inner six-layer, 512-dimensional model. Inner, Hollow A+B, and honest larger model ratios are 1, 1, 2.4 for prefill; 1, 1, 3.1 for decode; and 1, 4.81, 4.74 for proof generation. Hollow A+B and the larger reference both declare twelve layers and dimension 1024.
Figure 3. Reported timing ratios from Table 2. Each phase is normalized to its own inner-model baseline; ratios across panels do not represent absolute time. The evaluation uses 64-token prompts, greedy decoding, and the zkGPT proving procedure on the CPU testbed described above. View full-size figure.
  • A larger declaration at the same serving cost. Combining both expansions declares 12 layers and hidden dimension 1024, while prefill and decode time remain at 1× the inner-model baseline. An honestly executed larger reference with that shape takes 2.4× the baseline prefill time and 3.1× the decode time.
  • Proving still pays for the larger circuit. The combined construction requires 4.81× baseline prover time, close to the larger reference’s 4.74×. Its proof size is 88.3 KB versus 45.6 KB for the inner baseline. These results demonstrate a serving/proving asymmetry, not universally cheaper proofs.
  • Behavior is preserved relative to the inner model. Outputs and measured perplexity remain unchanged under the evaluated expansions. This does not claim that a small model acquires the quality of an independently trained larger model.

Threat model and boundaries

The attacker is a model owner who can choose the private weights before committing to them. Hollow-LLM does not provide a way to substitute a different model under an already fixed commitment to independently authenticated genuine weights. Public-weight and reference-bound deployments are outside the paper’s threat model. Even with authenticated weights, an ordinary inference proof is not a measurement of actual FLOPs or energy expenditure (§3.1).

The constructions respect the verifier’s numerical semantics. They are analyzed for pre-normalization transformer blocks; positional encodings also matter. Learned positional tables and appropriately replicated rotary encodings support the described variants. A fixed, dimension-dependent sinusoidal encoding can block the width-replication construction, while leaving the depth construction available (§4.4).

The paper establishes a boundary of commitment-relative inference guarantees, rather than a failure of zero-knowledge soundness. Its experiments demonstrate the construction on a compact model; they do not establish deployment-wide economic gains or that arbitrary size overclaims evade behavioral scrutiny. Serving cost, proof cost, audit frequency, and model provenance must be considered separately (§6).

Paper and related work

Read the full paper, the IEEE publication, or the arXiv version.

Related: ARGUS uses a CPU confidential VM to check LLM execution on an untrusted GPU. Explore the lab’s broader research on verifiable AI.

Abstract

As large language models (LLMs) grow in scale and are predominantly served from remote platforms, verifying faithful inference execution becomes critical (i.e., ensuring that a provider actually executes the advertised model and computational workload rather than a tampered or downsized variant). Zero-knowledge (ZK) LLM inference offers an appealing approach. It promises public verifiability and delivers per-instance guarantees of equational correctness by proving that an output is consistent with executing a public architecture under committed, private weights. Though, we show that it does not bind the effort expended to produce the output.

In this paper, we formalize this overlooked effort gap and introduce the Hollow-LLM Attack, in which a dishonest provider retains the declared architecture and parameter count but embeds ghost weights whose algebraic structure collapses effective computation. These witnesses satisfy the verification circuit and yield valid proofs, even though the dishonest model owner, who serves as the prover, performs computation commensurate with a much smaller model than the declared public architecture. This creates a profitable equilibrium in which providers deliver provably correct outputs at small-model cost while overclaiming model size. Accordingly, we characterize concrete families of ghost weights that compose with standard transformer blocks and show that such hollow deployments substantially reduce serving cost with zero quality loss under the same verification circuit. These findings underscore that proof of correct inference is not proof of large-model execution and necessitate additional protections to bind correctness to verifiable computational work.

Based on the linked paper. Read the full paper for the design, threat model, and evaluation. Lab members and advisees are shown in bold.

FlashProve and Hollow-LLM

Amazing work by the FlashProve team on zero-knowledge proofs for LLM inference! We especially appreciate the open implementation and thoughtful discussion of its guarantees and limitations. We’re also glad to see our Hollow-LLM work cited and discussed in their paper: “Nothing in FlashProve prevents the Hollow-LLM attack.” FlashProve, §9, p. 50

A valid proof binds a result to committed weights, but does not certify how much computation those weights require. A provider who chooses the private weights can commit to a model with a large declared architecture that computes like a smaller one. This does not break ZK soundness or permit a different model to pass verification under an already authenticated commitment. Limitation 8.7