Verifiable Fine-Tuning for LLMs: Zero-Knowledge Training Proofs Bound to Data Provenance and Policy

TL;DR

This work addresses the trust gap in how large language models are trained and fine-tuned by introducing Verifiable Fine-Tuning (VFT), a protocol that produces succinct zero-knowledge proofs tying the final model to a public initialization, a declared training program, and a committed dataset. The method combines dataset commitments, a verifiable sampler, PEFT-restricted update circuits with proof-friendly approximations, recursive proof aggregation, and provenance binding with optional hardware attestations to enable end-to-end verification in centralized and federated settings. Empirical results show that VFT preserves instruction-following, calibration, and safety metrics within tight proof budgets, while delivering manageable prover times, proof sizes, and low privacy leakage under private sampling. The work demonstrates practical feasibility today for real PEFT pipelines, offering a robust framework for compliance, auditing, and trusted deployment of regulated and decentralized AI systems.

Abstract

Large language models are often adapted through parameter efficient fine tuning, but current release practices provide weak assurances about what data were used and how updates were computed. We present Verifiable Fine Tuning, a protocol and system that produces succinct zero knowledge proofs that a released model was obtained from a public initialization under a declared training program and an auditable dataset commitment. The approach combines five elements. First, commitments that bind data sources, preprocessing, licenses, and per epoch quota counters to a manifest. Second, a verifiable sampler that supports public replayable and private index hiding batch selection. Third, update circuits restricted to parameter efficient fine tuning that enforce AdamW style optimizer semantics and proof friendly approximations with explicit error budgets. Fourth, recursive aggregation that folds per step proofs into per epoch and end to end certificates with millisecond verification. Fifth, provenance binding and optional trusted execution property cards that attest code identity and constants. On English and bilingual instruction mixtures, the method maintains utility within tight budgets while achieving practical proof performance. Policy quotas are enforced with zero violations, and private sampling windows show no measurable index leakage. Federated experiments demonstrate that the system composes with probabilistic audits and bandwidth constraints. These results indicate that end to end verifiable fine tuning is feasible today for real parameter efficient pipelines, closing a critical trust gap for regulated and decentralized deployments.

Figures (10)

• Figure 1: System overview of Verifiable Fine-Tuning (VFT). The trainer commits to the dataset and manifest, samples batches (public/private), proves each update, and recursively aggregates step proofs before verification.
• Figure 2: Validation perplexity curves vs. training steps for baseline PEFT and VFT (proved) runs.
• Figure 3: Precision--Recall curves on the safety/refusal subset, comparing baseline and VFT.
• Figure 4: Per-step prover time composition: witness generation, polynomial/FFT evaluation, MSM/FRI, and overhead.
• Figure 5: Epoch-level recursive aggregation time vs. number of parallel provers (GPUs).