heartwood/CITATION.cff at main · zcashsensei/heartwood · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
cff-version: 1.2.0
title: >-
  Heartwood: Publicly Verifiable Proof of Semantic Effort for
  Black-Box LLM Endpoints
message: If you use this work, please cite it.
type: software
authors:
  - given-names: George
    family-names: Tejada
repository-code: https://github.com/zcashsensei/heartwood
url: https://zcashsensei.github.io/heartwood/
license: MIT
version: 0.3.0
date-released: 2026-08-10
keywords:
  - verifiable inference
  - model substitution
  - effort gap
  - anytime-valid inference
  - e-values
  - randomness beacon
  - LLM auditing
  - confidential computing
abstract: >-
  Hollow-LLM (arXiv:2607.28884) established that a cryptographic proof of
  correct inference does not bind the amount of computation actually
  expended -- the "effort gap". Behavioural audits can measure effort, but
  IRIS (arXiv:2607.20860) states that such audits are auditor-centric, with
  no mechanism for independent verification and no use of cryptographic
  commitment or public randomness. Heartwood closes that gap. A challenge
  pool is committed before a public randomness beacon selects which items
  are used, and evidence accumulates as an anytime-valid betting
  supermartingale, so the resulting receipt is recomputable offline by any
  third party. The protocol requires zero cooperation from the provider.
  It targets silent reasoning-effort downgrade -- genuine weights, genuine
  binary, reduced computation per request -- an attack that passes TEE
  attestation, zkML weight commitments, and signed API provenance alike.
  Measured on an endpoint where only serving effort differs, the audit
  detects a full effort skim in 31 queries and a 70 percent dilution in 71
  queries at alpha = 0.01, with no false positive on the honest endpoint.
  On production frontier APIs (Claude Haiku 4.5 and Claude Opus 5 through
  the Anthropic Messages API) the same skim is detected in 4 queries on
  both models, and a 50 percent dilution in 14, with no false positive on
  either honest arm -- the audit becomes cheaper, not harder, as model
  capability rises, because a more capable model fails harder when its
  compute is removed. Against a padded skimmer that pads responses to
  normal length, a length-based style detector performs at chance
  (AUC 0.523) while the capability gap remains large (0.750 versus 0.208).