一句话：提出 WAVE，用 GPU 性能计数器观测 LLM 推理，推断模型架构参数并用 SMT 一致性检查实现隐私保护的运行时监管。
LLM 推理服务需要在不暴露权重与代码的前提下获得运行时可见性，以确认实际执行与声明模型一致。WAVE 利用硬件约束不变量（访存、指令混合、Tensor Core 利用率）由模型线性代数结构诱导这一洞见，采集轻量级 GPU 性能计数器（PMC）轨迹，并采用两阶段流水线：先推断参数规模、层深、隐藏维度、批大小等架构属性，再用基于 SMT 的一致性检查器判断执行是否符合配置算力与声称模型的约束。在 LLaMA、GPT、Qwen 及 Ada Lovelace、Hopper、Blackwell 等 GPU 上评估，关键参数平均恢复误差为 6.8%，并能识别真实扰动下的伪装执行。
Large Language Models (LLMs) inference increasingly require mechanisms that provide runtime visibility into what is actually executing, without exposing model weights or code. We present WAVE, a hardware-grounded monitoring framework that leverages GPU performance counters (PMCs) to observe LLM inference. WAVE is built on the insight that legitimate executions of a given model must satisfy hardware-constrained invariants, such as memory accesses, instruction mix, and tensor-core utilization, induced by the model's linear-algebraic structure. WAVE collects lightweight PMC traces and applies a two-stage pipeline: (1) inferring architectural properties (e.g., parameter count, layer depth, hidden dimension, batch size) from the observed traces; and (2) using an SMT-based consistency checker to assess whether the execution aligns with the provisioned compute and the claimed model's constraints. We evaluate WAVE on common open-source LLM architectures, such as LLaMA, GPT, and Qwen, across multiple GPU architectures, including NVIDIA Ada Lovelace, Hopper, and Blackwell. Results show that WAVE recovers key model parameters with an average error of 6.8% and identifies disguised executions under realistic perturbations. By grounding oversight in hardware invariants, WAVE provides a practical avenue for continuous, privacy-preserving runtime monitoring of LLM services.
@inproceedings{XuGLZC026,
title = {<scp>Wave</scp>
: Leveraging Architecture Observation for Privacy-Preserving Model Oversight},
author = {Haoxuan Xu and Chen Gong and Beijie Liu and Haizhong Zheng and Beidi Chen and Mengyuan Li},
booktitle = {ASPLOS},
year = {2026},
doi = {10.1145/3779212.3790247}
}