VILLE

Verified Inference Leak Locator using E-values

Team REIGN · Chittimilla Saitarun · SaiNithin Pokala

A hacked AI inference server can leak its model weights by hiding bits in normal-looking word choices. VILLE replays each prompt on a trusted machine, looks at where the words differ, and adds up the evidence over many responses. It raises an alert while it keeps the chance of any false alarm below 1 percent. The detector comes from recent research. Team REIGN adds a drop-in monitor, automatic recalibration, an automatic response that blocks the data an attacker needs, and one security dashboard.

Project

• GitHub repositoryCode, README, paper summary, idea flow and our additions
• Ideation deck (.pptx)The submission slides

Research references

• Anytime-valid detection of LLM weight exfiltrationOrtega-Fernandez, Kowalczyk, Warr (2026). NeurIPS 2026 Workshop E-Values. The main paper VILLE builds on.
• Verifying LLM inference to detect model weight exfiltrationRinberg et al. (2025). The threat model and the per-token baseline.
• DiFR: Inference verification despite nondeterminismKarvonen et al. (2025). Benign replay mismatches from GPU noise.

Tools and data

• NVIDIA garakLLM vulnerability scanner for prompt-side testing
• NVIDIA NeMo GuardrailsProgrammable guardrails for LLM applications
• NVIDIA Safety for Agentic AINVIDIA reference recipe for AI safety
• LMSYS-Chat-1MPrompt dataset used in the paper