Research: Freivalds verification for llama.cpp backends

[michaelneale]

What

Experiment measuring whether Freivalds' algebraic check can verify that remote mesh peers are running the correct model weights. This is a backend-agnostic alternative to CommitLLM's vLLM-specific kernel instrumentation.

How it works

1. Run a forward pass through a GGUF model
2. Capture activation tensors at matmul boundaries via llama.cpp's cb_eval callback
3. Read the weight tensors from the model
4. Perform the Freivalds check on CPU: verify v·y ≈ (v·W)·x where v is a secret random vector

If the peer used different weights, the check fails with high probability. The secret vector v is never shared, so the peer can't pre-compute a fake that passes.

Results (CPU inference, Apple M4 Max)

Model	Quant	Max Residual	Avg Residual
Qwen2.5-0.5B	Q4_K_M	6.4%	1.6%
SmolLM2-135M	Q8_0	2.9%	1.2%
Qwen3-8B	Q4_K_M	23.5%*	4.6%

*Last-layer outlier — other layers are <7%

Model substitution (running a wrong model) produces ~100% residual → clear separation for detecting basic cheating.

Key findings

• ✅ Quantization format barely matters (Q4_K_M ≈ Q8_0 residuals)
• ✅ Check is fast (~2ms for v·W pre-computation per matrix)
• ✅ Uses existing llama.cpp eval callback — no kernel patches needed
• ⚠️ Last layer of larger models shows outlier residuals — needs investigation
• ❓ GPU residuals (Metal/CUDA) not yet measured — key open question

What's next

1. Measure GPU residuals (Metal offload, CUDA)
2. Investigate last-layer outlier on larger models
3. Test with multiple random vectors for tighter confidence
4. If viable: design commit-then-reveal protocol for mesh-llm

See research/freivalds/README.md for full writeup and protocol design.