用零知识证明验证模型安全公平性，不泄露参数
Certified but Private: Scalable Zero-Knowledge Proofs for Neural Network Guarantees
- 基于线性松弛的轻量级证明算法，支持大规模神经网络
- 290万参数模型5分钟生成证明，10秒内完成验证
- 适合需合规审计但保护模型隐私的工业场景
随着机器学习模型在关键领域的广泛应用，其鲁棒性和公平性需形式化保障。然而，模型参数常为商业机密，无法向审计者或用户披露。为此，我们提出PANDA系统，利用零知识证明（ZKPs）在不暴露私有参数的前提下，证明模型的鲁棒性与公平性。PANDA建立在CROWN框架之上，核心贡献是针对非线性激活层设计了一种新型线性松弛边界证明算法，生成简洁、轻量的证明。系统可对超过290万参数的神经网络在5分钟内生成局部鲁棒性证明，并在10秒内完成验证。相比依赖指数时间算法、难以扩展的以往方法，PANDA在神经元数量上呈多项式规模增长，支持比此前方法大4个数量级的网络，且证明开销显著降低。
原文摘要 · Abstract (English)
With the growing deployment of machine learning models, formal guarantees of the robustness and fairness of these models have become increasingly important in safety-critical and legal-compliance settings. However, model parameters are often commercial secrets that cannot be disclosed to auditors or end users. To this end, we present PANDA, a scalable system that uses zero-knowledge proofs (ZKPs) to prove the robustness and fairness properties of a model without revealing its private parameters. PANDA is built on top of CROWN, an efficient robustness certification framework that is used in many state-of-the-art formal verification tools for neural networks. The core contribution of PANDA is a novel algorithm for proving linear relaxation bounds for non-linear activation layers, yielding simple, lightweight proofs. Remarkably, our system can generate proofs of local robustness for neural networks with more than 2.9M parameters in 5 minutes, and can verify them in 10 seconds. Prior ZKP-based robustness system rely on exponential-time algorithms that cannot scale to nontrivial networks. In contrast, PANDA scales polynomially in the number of neurons in a network, allowing us to support neural networks 4 orders of magnitude larger than previous approaches with significantly reduced prover overhead.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。