arXiv:2504.19274cs.LGcs.AI2025-04中稿 · the Privacy Enhanc…被引 9

让深度模型推理可验证又不泄露隐私,还能提速近半。

TeleSparse: Practical Privacy-Preserving Verification of Deep Neural Networks

  • 用稀疏化和神经遥感技术减少验证电路约束
  • 证明内存降67%,生成时间减46%,准确率损失仅1%
  • 适合需要可信推理的AI安全场景

深度学习推理完整性验证对确保模型正确应用至关重要,但传统方法需访问模型权重和敏感训练数据。零知识简洁非交互式证明(ZK-SNARKs)本可解决此问题,但应用于现代神经网络如Transformer和大视觉模型时带来巨大计算开销。本文提出TeleSparse,一种面向ZK-SNARK的后处理机制,解决两大核心挑战:(1) 通过模型稀疏化减少电路约束,降低内存与证明生成成本;(2) 通过神经遥感优化激活函数范围,缩小查表规模。在相同模型上,TeleSparse使证明器内存使用减少67%,证明生成时间缩短46%,准确率下降约1%。我们基于Halo2实现该框架,在Vision Transformer、ResNet、MobileNet等架构及ImageNet、CIFAR-10、CIFAR-100数据集上验证有效性。该工作为可验证深度学习的高效设计开辟新方向。

原文摘要 · Abstract (English)

Verification of the integrity of deep learning inference is crucial for understanding whether a model is being applied correctly. However, such verification typically requires access to model weights and (potentially sensitive or private) training data. So-called Zero-knowledge Succinct Non-Interactive Arguments of Knowledge (ZK-SNARKs) would appear to provide the capability to verify model inference without access to such sensitive data. However, applying ZK-SNARKs to modern neural networks, such as transformers and large vision models, introduces significant computational overhead. We present TeleSparse, a ZK-friendly post-processing mechanisms to produce practical solutions to this problem. TeleSparse tackles two fundamental challenges inherent in applying ZK-SNARKs to modern neural networks: (1) Reducing circuit constraints: Over-parameterized models result in numerous constraints for ZK-SNARK verification, driving up memory and proof generation costs. We address this by applying sparsification to neural network models, enhancing proof efficiency without compromising accuracy or security. (2) Minimizing the size of lookup tables required for non-linear functions, by optimizing activation ranges through neural teleportation, a novel adaptation for narrowing activation functions' range. TeleSparse reduces prover memory usage by 67% and proof generation time by 46% on the same model, with an accuracy trade-off of approximately 1%. We implement our framework using the Halo2 proving system and demonstrate its effectiveness across multiple architectures (Vision-transformer, ResNet, MobileNet) and datasets (ImageNet,CIFAR-10,CIFAR-100). This work opens new directions for ZK-friendly model design, moving toward scalable, resource-efficient verifiable deep learning.

ZK证明模型验证隐私保护稀疏化

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。