LLM weight theft: detecting a compromised inference server that hides bits in token selection

A compromised server can exfiltrate a model’s weights by encoding them within plausible responses. A statistical method accumulates clues across requests whilst minimising the risk of false positives.

How do I know if an inference server is getting the weights out of the model it runs? The scenario studied in an arXiv article of October 8, 2026 is discreet: a compromise server slides bits of the model into its token choices, with only answers that remain perfectly plausible for the user. Replaying the same query on a trusted server may reveal the gap, but the normal numerical non-determinism of calculations also produces divergences: a patient attacker can shelter behind this noise.

Accumulate low indices

The authors propose an "e-process" at the request level: he learns what differences on healthy traffic look like and then adds up the responses after response. Under the assumption of calibration transfer, it guarantees a controlled probability of false alarm regardless of the duration of the surveillance. The method is evaluated on four models facing two attacks, including a more stealthy variant that hides its bits only when two tokens are almost equal.

The study thus figures the compromise between the flow of the exfiltration channel and the risk of detection. Faced with an alarm that would trigger on each suspicious token, the sequential approach takes advantage of signals that are too weak to be conclusive in isolation.