Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference

2026-07-30

AI Summary

Current zero-knowledge (ZK) verification for large language models (LLMs) ensures only that outputs conform to a declared architecture, without guaranteeing that the service provider actually performed computation at the claimed scale—creating a “computational effort gap.” This work formally characterizes this vulnerability and introduces Hollow-LLM, a novel attack that embeds algebraically degenerate “ghost weights” into an LLM while preserving its public structure and parameter count. These ghost weights drastically reduce actual computational cost yet still produce valid ZK proofs. Constructed from standard Transformer components, the proposed ghost weight family is compatible with existing ZK circuits. Experiments demonstrate that Hollow-LLM significantly lowers service costs without degrading output quality and entirely evades current verification mechanisms, exposing a fundamental security flaw: correctness proofs in ZK-based LLM inference do not imply genuine computation.

Abstract

As large language models (LLMs) grow in scale and are predominantly served from remote platforms, verifying faithful inference execution becomes critical (i.e., ensuring that a provider actually executes the advertised model and computational workload rather than a tampered or downsized variant). Zero-knowledge (ZK) LLM inference offers an appealing approach. It promises public verifiability and delivers per-instance guarantees of equational correctness by proving that an output is consistent with executing a public architecture under committed, private weights. Though, we show that it does not bind the effort expended to produce the output. In this paper, we formalize this overlooked effort gap and introduce the Hollow-LLM Attack, in which a dishonest provider retains the declared architecture and parameter count but embeds ghost weights whose algebraic structure collapses effective computation. These witnesses satisfy the verification circuit and yield valid proofs, even though the dishonest model owner, who serves as the prover, performs computation commensurate with a much smaller model than the declared public architecture. This creates a profitable equilibrium in which providers deliver provably correct outputs at small-model cost while overclaiming model size. Accordingly, we characterize concrete families of ghost weights that compose with standard transformer blocks and show that such hollow deployments substantially reduce serving cost with zero quality loss under the same verification circuit. These findings underscore that proof of correct inference is not proof of large-model execution and necessitate additional protections to bind correctness to verifiable computational work.

Problem

• zero-knowledge verification
• large language models
• computational effort
• model inference
• verifiable execution

Innovation

• Hollow-LLM Attack
• zero-knowledge verification
• ghost weights
• computational effort gap
• LLM inference