Are You Getting What You Pay For? Auditing Model Substitution in LLM
  APIs
The proliferation of Large Language Models (LLMs) accessed via black-box APIs
introduces a significant trust challenge: users pay for services based on
advertised model capabilities (e.g., size, performance), but providers may
covertly substitute the specified model with a cheaper, lower-quality
alternative to reduce operational costs. This lack of transparency undermines
fairness, erodes trust, and complicates reliable benchmarking. Detecting such
substitutions is difficult due to the black-box nature, typically limiting
interaction to input-output queries. This paper formalizes the problem of model
substitution detection in LLM APIs. We systematically evaluate existing
verification techniques, including output-based statistical tests, benchmark
evaluations, and log probability analysis, under various realistic attack
scenarios like model quantization, randomized substitution, and benchmark
evasion. Our findings reveal the limitations of methods relying solely on text
outputs, especially against subtle or adaptive attacks. While log probability
analysis offers stronger guarantees when available, its accessibility is often
limited. We conclude by discussing the potential of hardware-based solutions
like Trusted Execution Environments (TEEs) as a pathway towards provable model
integrity, highlighting the trade-offs between security, performance, and
provider adoption. Code is available at
https://github.com/sunblaze-ucb/llm-api-audit
67f4a59bf51362f606eb84e8
Will Cai
claimed_verified
2025-04-09T16:22:39.251Z
671f7193315a5b40773b36c3
/avatars/e097da0032341958c57237e4006587ab.svg
Will Cai
user
wicai24
67f4a59bf51362f606eb84e9
Tianneng Shi
67f4a59bf51362f606eb84ea
Xuandong Zhao
admin_assigned
2025-04-08T10:36:45.588Z
6275a465597c70eb8949fce5
https://cdn-avatars.huggingface.co/v1/production/uploads/6275a465597c70eb8949fce5/ph4UogqMurMB0hSXZC38w.png
Xuandong Zhao
user
Xuandong
67f4a59bf51362f606eb84eb
Dawn Song
admin_assigned
2025-04-08T10:36:39.333Z
6513179af60393414afd4140
https://cdn-avatars.huggingface.co/v1/production/uploads/noauth/GAf-FulRRNF-X_Svew1Xj.jpeg
Xiaowei Song
user
dawnsong
Are You Getting What You Pay For? Auditing Model Substitution in LLM
  APIs
The proliferation of Large Language Models (LLMs) accessed via black-box APIs
introduces a significant trust challenge: users pay for services based on
advertised model capabilities (e.g., size, performance), but providers may
covertly substitute the specified model with a cheaper, lower-quality
alternative to reduce operational costs. This lack of transparency undermines
fairness, erodes trust, and complicates reliable benchmarking. Detecting such
substitutions is difficult due to the black-box nature, typically limiting
interaction to input-output queries. This paper formalizes the problem of model
substitution detection in LLM APIs. We systematically evaluate existing
verification techniques, including output-based statistical tests, benchmark
evaluations, and log probability analysis, under various realistic attack
scenarios like model quantization, randomized substitution, and benchmark
evasion. Our findings reveal the limitations of methods relying solely on text
outputs, especially against subtle or adaptive attacks. While log probability
analysis offers stronger guarantees when available, its accessibility is often
limited. We conclude by discussing the potential of hardware-based solutions
like Trusted Execution Environments (TEEs) as a pathway towards provable model
integrity, highlighting the trade-offs between security, performance, and
provider adoption. Code is available at
https://github.com/sunblaze-ucb/llm-api-audit
The paper evaluates existing techniques for detecting model substitutions in LLM APIs, highlighting the limitations of output-based methods and the potential of hardware-based solutions.
Large Language Models (LLMs) black-box APIs model substitution detection verification techniques output-based statistical tests benchmark evaluations log probability analysis model quantization randomized substitution benchmark evasion Trusted Execution Environments (TEEs)