{"slug": "hollow-llm-attack-ghost-weights-that-fool-zero-knowledge-llm-verification", "title": "Hollow-LLM Attack: Ghost Weights That Fool Zero-Knowledge LLM Verification", "summary": "A new paper on arXiv (submitted 30 Jul 2026) introduces the Hollow-LLM Attack, showing that zero-knowledge (ZK) verification of large language model (LLM) inference can be fooled by dishonest providers who embed 'ghost weights' that collapse effective computation while still satisfying the verification circuit. The attack allows providers to deliver provably correct outputs at small-model cost while overclaiming model size, with zero quality loss under the same verification circuit, highlighting that proof of correct inference is not proof of large-model execution.", "body_md": "# Computer Science > Cryptography and Security\n\n[Submitted on 30 Jul 2026]\n\n# Title:Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference\n\n[View PDF](/pdf/2607.28884)\n\n[HTML (experimental)](https://arxiv.org/html/2607.28884v1)\n\nAbstract:As large language models (LLMs) grow in scale and are predominantly served from remote platforms, verifying faithful inference execution becomes critical (i.e., ensuring that a provider actually executes the advertised model and computational workload rather than a tampered or downsized variant). Zero-knowledge (ZK) LLM inference offers an appealing approach. It promises public verifiability and delivers per-instance guarantees of equational correctness by proving that an output is consistent with executing a public architecture under committed, private weights. Though, we show that it does not bind the effort expended to produce the output. In this paper, we formalize this overlooked effort gap and introduce the Hollow-LLM Attack, in which a dishonest provider retains the declared architecture and parameter count but embeds ghost weights whose algebraic structure collapses effective computation. These witnesses satisfy the verification circuit and yield valid proofs, even though the dishonest model owner, who serves as the prover, performs computation commensurate with a much smaller model than the declared public architecture. This creates a profitable equilibrium in which providers deliver provably correct outputs at small-model cost while overclaiming model size. Accordingly, we characterize concrete families of ghost weights that compose with standard transformer blocks and show that such hollow deployments substantially reduce serving cost with zero quality loss under the same verification circuit. These findings underscore that proof of correct inference is not proof of large-model execution and necessitate additional protections to bind correctness to verifiable computational work.\n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer\n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers\n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps\n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations\n\n*(*[What are Smart Citations?](https://www.scite.ai/))# Code, Data and Media Associated with this Article\n\nalphaXiv\n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers\n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub\n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub\n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face\n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast\n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower\n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender\n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [ Learn more about arXivLabs](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/hollow-llm-attack-ghost-weights-that-fool-zero-knowledge-llm-verification", "canonical_source": "https://arxiv.org/abs/2607.28884", "published_at": "2026-08-04 02:07:06+00:00", "updated_at": "2026-08-04 02:22:25.860044+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-safety", "ai-research"], "entities": ["arXiv"], "alternates": {"html": "https://wpnews.pro/news/hollow-llm-attack-ghost-weights-that-fool-zero-knowledge-llm-verification", "markdown": "https://wpnews.pro/news/hollow-llm-attack-ghost-weights-that-fool-zero-knowledge-llm-verification.md", "text": "https://wpnews.pro/news/hollow-llm-attack-ghost-weights-that-fool-zero-knowledge-llm-verification.txt", "jsonld": "https://wpnews.pro/news/hollow-llm-attack-ghost-weights-that-fool-zero-knowledge-llm-verification.jsonld"}}