OVIG: Optimistic Verification of AI Training Integrity via Gradient Signals

2026-06-18

AI Summary

This work addresses the challenge of integrity verification in outsourced AI post-training, where floating-point discrepancies across heterogeneous accelerators obscure the distinction between benign numerical drift and malicious tampering. To tackle this, the authors propose OVIG, an optimistic verification framework that, for the first time, leverages gradient signals to establish empirically derived tolerance bounds accommodating execution-induced drift. OVIG aligns training steps into intervals and retains only endpoint checkpoints for efficient auditing. It further introduces an optimistic sampling mechanism that drastically reduces storage and communication overhead. Experiments demonstrate that OVIG achieves 0% success rate against diverse attacks across language, vision, and diffusion models. On Qwen3, increasing the step interval to 2,000 reduces off-chain storage and transmission costs by 1,996×, with only a 1.143× increase in total system overhead.

Abstract

The rapid growth of AI has increased the demand for domain-specific post-training, while the cost and specialization of accelerator infrastructure push many model owners to outsource this process. Outsourced training lowers operational barriers, but creates a training-integrity gap: the owner receives a checkpoint, logs, and aggregate metrics without direct evidence that the declared training trajectory was faithfully executed. An untrusted provider may have incentives to deviate from that trajectory, either to save computation or to introduce targeted security risks. Auditing such deviations is difficult because floating-point execution on heterogeneous accelerators introduces benign numerical drift, making it hard to distinguish honest replay differences from integrity violations. Existing verification methods either observe training at too coarse a granularity or impose costs and deployment constraints that are impractical at scale. We present OVIG, an optimistic verification framework that audits outsourced post-training using an empirical boundary on gradient differences calibrated from honest heterogeneous replays. OVIG checks opened intervals against this boundary and combines optimistic sampling with a stride parameter $s$, which partitions training into stride-aligned intervals and retains only interval-endpoint evidence. Across shortcut training attacks and targeted manipulation attacks, OVIG maintains $0\%$ ASR on language, vision, and diffusion workloads. On Qwen3, increasing the stride from $s=1$ to $s=2000$ reduces off-chain storage and evidence transmission by $1996\times$ while preserving $0\%$ ASR; at this setting, OVIG incurs only $1.143\times$ total system overhead relative to training without verification. These results show that OVIG provides a practical integrity layer for outsourced AI post-training under heterogeneous execution.

Problem

• training integrity
• outsourced training
• gradient signals
• heterogeneous execution
• numerical drift

Innovation

• optimistic verification
• gradient signals
• training integrity
• outsourced AI training
• heterogeneous execution