note that this is even true for an honest server. Roughly, FHE computations often require certain bounds on the (encrypted) messages for things like tuning polynomial approximation domains etc. If your messages are out of distribution for the tuned polynomial approximations you'll get back garbage as as result.
reply100% not an expert but my understanding was that part of what you are proving by signing the computation is that the computation itself was performed specifically as agreed to. I may be mixing this up with zero knowledge proofs.
replyIf this were the case it would be necessary to send the entire model weights in response to every request which would be a bit inconvenient.
replyHmm, could one instead of sending the model weights, send like, a merkle tree root for them, not exactly specifying the model, but at least demonstrating that the same model is used each time?
reply