Research map / Architectures and efficiency / RNNs and normalization
Trustless Audits without Revealing Data or Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ZkAudit, a protocol where model providers commit to data and weights and prove via ZK-SNARKs that training (SGD) was done correctly, enabling trustless private audits of DNNs.
Problem
Auditing ML models and training data for properties (copyright, censorship, counterfactual behavior) without revealing trade-secret weights or data, and without trusting a third party; existing ZK methods do not cover backward pass/training of modern DNNs.
Approach
Extend ZK-SNARK proving (halo2, AIR-based, int8 inference prior work) to full SGD training with rounded division, variable fixed-point precision, and a high-precision softmax, then let providers commit to data/weights and prove any audit function F trustlessly.
Key results
- Fixed-point ZkAudit-T training is within 0.5-0.7% of fp32 test accuracy on dermnet, flowers-102, and cars (e.g., flowers-102 79.7% vs 80.4%).
- Rounded division improves ImageNet top-5 accuracy by 9.6-11.3% over integer division for MobileNet configurations.
- A counterfactual audit on MovieLens costs $8,456, and a copyright/demographic audit on flowers-102 costs $108, versus ~$13M for a financial audit of S&P 500 firm.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use fixed-point ZkAudit-T training instead of fp32 training | MobileNet v2 · dermnet, flowers-102, and cars test sets | accuracy: 38.5% vs 39.0%; 79.7% vs 80.4%; 49.8% vs 50.4% | No clear effect |
| Add rounded division instead of integer division (ablation) | MobileNet models · ImageNet | top-5 accuracy: 59.1% -> 70.4%; 75.7% -> 86.3%; 79.2% -> 88.8% | Helped |
| Remove the optimized softmax (ablation) | ZkAudit-T classification training · Image classification | training feasibility | Hurt |
| Increase the fixed-point scale factor (ablation) | ZkAudit-T image-classification SGD · Single-image MobileNet v2 (1.0, 224) | proving time: 47.5 s -> 87.8 s -> 167.0 s -> 328.3 s | Hurt |
| Increase the fixed-point scale factor (ablation) | ZkAudit-T recommender SGD · MovieLens recommender, single example | proving time: 3.16 s -> 5.54 s -> 10.49 s -> 23.79 s | Hurt |
| Reduce training precision from scale factor 2^15 toward 1 (ablation) | ZkAudit-T image-classification training · Image classification datasets | accuracy | Hurt |
| Reduce training precision from scale factor 2^13 to 2^10 (ablation) | ZkAudit-T recommender training · MovieLens | MSE | Hurt |
Surprising findings
- Integer (floor) division used by prior int8 ZK inference work considerably hurts training-relevant accuracy, dropping ImageNet top-5 accuracy by up to 11.3%.
Limitations
- Does not protect against data poisoning attacks.
- Reveals the model architecture, only weights are hidden.
- Proving costs remain high; folding optimization not implemented.
Experimental setup
Datasets: dermnet flowers-102 cars MovieLens ImageNet CIFAR-10 MNIST
Benchmarks: dermnet flowers-102 cars MovieLens ImageNet
Metrics: test accuracy top-5 accuracy mean squared error proving time verification time dollar cost of proving
Baselines: Zen vCNN pvCNN zkCNN integer division variant
Builds on: halo2 zkCNN DLRM
Closest papers by meaning
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.84)
- FairProof : Confidential and Certifiable Fairness for Neural Networks (ICML 2024 · similarity 0.83)
- ExpProof : Operationalizing Explanations for Confidential Models with ZKPs (ICML 2025 · similarity 0.83)
- Nearly Tight Black-Box Auditing of Differentially Private Machine Learning (NeurIPS 2024 · similarity 0.83)
- Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning (ICLR 2025 · similarity 0.83)
- Auditing Privacy Mechanisms via Label Inference Attacks (NeurIPS 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.