PoTS: Proof-of-Training-Steps for Backdoor Detection in Large Language Models

As Large Language Models (LLMs) gain traction across critical domains, ensuring secure and trustworthy training processes has become a major concern. Backdoor attacks, among various threats—where malicious actors inject hidden triggers into training data—are particularly insidious and difficult to detect. Existing post-training verification solutions like Proof-of-Learning are impractical for LLMs due to their requirement for full retraining, lack robustness against stealthy manipulations, and inability to provide early detection during training—a property that would significantly reduce computational costs. To address these limitations, we introduce Proof-of-Training Steps, a verification protocol that enables an independent auditor (Alice) to confirm that an LLM developer (Bob) has followed the declared training recipe, including data batches, architecture, and hyperparameters. By analyzing the sensitivity of the LLMs’ language modeling head (LM-Head) to input perturbations, our method can expose subtle backdoor injections or deviations in training. Even with backdoor triggers in up to 10% of the training data, our protocol significantly reduces the attacker’s ability to achieve a high attack success rate (ASR). Our method enables early detection of the attack (at the step the attack is injected), with verification step being 3× faster than a training step. Our results highlight the protocol’s potential to enhance the accountability and security of LLM development, especially against insider threats.