Research map / Adversarial robustness and security / Attacks on text and graphs
ExpProof : Operationalizing Explanations for Confidential Models with ZKPs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ExpProof, a protocol combining cryptographic commitments and zero-knowledge proofs (via ezkl/Halo2) to let a confidential model owner prove that a LIME explanation was computed correctly with a committed model, and studies ZKP-amenable LIME variants on neural networks and random forests.
Problem
Explanations are meant to build trust but are easily manipulated in adversarial settings where models are confidential, allowing model swapping, parameter tuning, and algorithm corruption; customers cannot verify explanations without access to the model.
Approach
Commit to model weights and explanation parameters, then use ZKPs to prove that the prediction and LIME explanation were computed correctly with the committed model, making LIME ZKP-amenable via uniform/Gaussian sampling with Poseidon-verified randomness, an exponential-kernel lookup table, and LASSO optimality certified by a duality gap instead of solving the optimization in-circuit; also introdu
Key results
- Maximum proof generation time of about 1.5 minutes, verification about 0.12 seconds, and proof size about 13KB for neural networks with standard LIME.
- Fidelity differences among standard LIME variants are small; gaussian sampling is slightly better than uniform on the Credit dataset.
- BorderLIME has larger ZKP overhead than standard LIME (4.85 vs 1.17 min proof generation for NNs), and inference proofs dominate cost as hidden layers grow.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BorderLIME instead of standard LIME (ablation) | LIME explanations in the ZKP system · Neural Networks | Proof generation time: 1.17 $\pm$ $10^{-2}$ -> 4.85 $\pm$ $10^{-2}$ mins | Hurt |
| Use BorderLIME instead of standard LIME (ablation) | LIME explanations in the ZKP system · Neural Networks | Explanation fidelity | No clear effect |
| Use Gaussian rather than uniform sampling (ablation) | Standard LIME · Credit dataset | Prediction similarity | Helped |
| Use Gaussian rather than uniform sampling (ablation) | Standard LIME in the ZKP system · Neural Networks | ZKP overhead | Hurt |
| Add the exponential kernel rather than use no kernel (ablation) | Standard LIME in the ZKP system · Neural Networks | ZKP overhead | Hurt |
| Increase neighborhood size from 300 to 5000 samples (ablation) | LIME · Neural Networks | Prediction similarity: 300 to 5000 | Helped |
| Increase neighborhood size from 300 to 5000 samples (ablation) | LIME · Random Forests | Prediction similarity: 300 to 5000 | Helped |
| Add the BorderLIME search for an opposite-label point (ablation) | Standard LIME · Random Forests, 300 neighboring points | Proof generation time: $2.02\pm10^{-2}$ -> $8.46\pm10^{-1}$ mins | Hurt |
| Increase the number of hidden layers (ablation) | ZK_LIME · Credit dataset | Inference proof-generation time: 42.15 -> 108.23 -> 179.00 -> 319.48 seconds | Hurt |
Surprising findings
- Gaussian sampling and exponential kernel increase ZKP overhead, and the paper finds little fidelity difference between LIME variants, so the cheapest variant (gaussian sampling, no kernel) is recommended.
Limitations
- Does not prevent model corruption or manipulated training that yields innocuous explanations with biased predictions.
- Proof generation takes minutes and inference proof cost grows polynomially with depth; models evaluated are small (2-layer, 16 units).
- Stability radius for BorderLIME is approximated heuristically rather than computed with guarantees.
Experimental setup
Datasets: Adult Credit German Credit
Benchmarks: Adult Credit German Credit
Metrics: prediction similarity (fidelity) proof generation time verification time proof size
Baselines: Standard LIME (G+N, G+E, U+N, U+E variants) BorderLIME
Builds on: LIME Halo2 ezkl Poseidon KZG commitments
Closest papers by meaning
- From Counterfactuals to Trees: Competitive Analysis of Model Extraction Attacks (NeurIPS 2025 · similarity 0.83)
- Trustless Audits without Revealing Data or Models (ICML 2024 · similarity 0.83)
- FairProof : Confidential and Certifiable Fairness for Neural Networks (ICML 2024 · similarity 0.82)
- Promoting Counterfactual Robustness through Diversity (AAAI 2024 · similarity 0.82)
- F-Fidelity: A Robust Framework for Faithfulness Evaluation of Explainable AI (ICLR 2025 · similarity 0.82)
- X-Hacking: The Threat of Misguided AutoML (ICML 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.