Proof-of-Learning: Definition and Practice
Proof-of-Learning: Definitions and Practice
Translation in progress — untranslated text is omitted.
The researchers propose a "proof-of-learning" mechanism to prove that publicly released model parameters were indeed produced by the corresponding training computation. The method constructs proofs using secret information accumulated during training due to the randomness of stochastic gradient descent; the paper's analysis shows that an adversary attempting to illegally forge a proof must expend at least as much computation as gradient descent itself. The paper applies the mechanism to model ownership disputes and to distributed training involving untrusted participants—the former protecting the intellectual property of public models, the latter preventing Byzantine nodes that return incorrect updates from disrupting training availability. The researchers state that experiments verify the mechanism is robust to variance introduced by hardware accelerators and software stacks.
- Training ML models is costly, but existing mechanisms cannot prove that a given set of weights was indeed produced by that training process: after a model is stolen it is difficult to assert ownership, and in distributed training it is also impossible to confirm whether the updates returned by untrusted workers are correct.
- Proposes proof-of-learning: the prover saves the weights of periodic checkpoints during training, the batch indices and the data signatures, encrypts them with the verifier's public key and signs and publishes them; the verifier uses the KS test to verify initialization, and replays the Q segments with the largest update magnitude in each epoch, judging whether they match by a threshold δ. Security is based on the analysis that gradient descent is difficult to invert.
- The experiments use ResNet-20/CIFAR-10 and ResNet-50/CIFAR-100: at k=1 the reproduction error is close to 0, and at k=E·S the l1 error is 0.974/0.903; after a few training steps the KS test can identify non-random initialization; the authors state that the two forgery strategies, inverse gradient and targeted retraining, both cost no less than training or cannot pass verification.
- Limitations noted by the authors: verification requires disclosing training data to the verifier; checkpoint storage overhead is large; verification success rate decays multiplicatively with PoL chain length. Experiments cover only ResNet-20/50, LeNet5 and one logistic regression model, with datasets CIFAR-10/100, MNIST and Iris.