ZK-AdapterMark: Privacy-Preserving Provenance Evidence for LoRA Adapters

Low-rank adaptation (LoRA) fine-tunes a large model with a low-rank update over frozen weights. The update travels as a separate adapter file that is easy to copy, alter, and re-upload; so, a hub may have to decide whether a disputed file derives from a registered adapter. Since an altered copy no longer matches the original byte for byte, the usual tool is a fingerprint, secret measurements of the weights that survive moderate edits. Verifying a fingerprint currently requires disclosing either the measurements, which a copier can then evade, or the possibly confidential weights. ZK-AdapterMark is, to our knowledge, the first to verify a LoRA fingerprint in zero knowledge: a hub confirms that a disputed file passes a registered fingerprint without learning the secret or the weights. The proof is practical because our fingerprint is expressed over the two low-rank factors, making the complete proof circuit up to 44 times smaller than rebuilding the update. The acceptance threshold fixes a relative-entropy bound on the probability of accepting an unrelated adapter, which gives it an information-theoretic footing. Across ten model families, the fingerprint survives moderate quantization, noise, and rank reduction, and no pair among 904 independently trained adapters is accepted.