There is an increasing conflict between business incentives to hide models
and data as trade secrets, and the societal need for algorithmic transparency.
For example, a rightsholder wishing to know whether their copyrighted works
have been used during training must convince the model provider to allow a
third party to audit the model and data. Finding a mutually agreeable third
party is difficult, and the associated costs often make this approach
impractical.
In this work, we show that it is possible to simultaneously allow model
providers to keep their model weights (but not architecture) and data secret
while allowing other parties to trustlessly audit model and data properties. We
do this by designing a protocol called ZkAudit in which model providers publish
cryptographic commitments of datasets and model weights, alongside a
zero-knowledge proof (ZKP) certifying that published commitments are derived
from training the model. Model providers can then respond to audit requests by
privately computing any function F of the dataset (or model) and releasing the
output of F alongside another ZKP certifying the correct execution of F. To
enable ZkAudit, we develop new methods of computing ZKPs for SGD on modern
neural nets for simple recommender systems and image classification models
capable of high accuracies on ImageNet. Empirically, we show it is possible to
provide trustless audits of DNNs, including copyright, censorship, and
counterfactual audits with little to no loss in accuracy.

本研究提出了一种名为 ZkAudit 的协议，旨在解决商业激励与算法透明的冲突，允许模型提供者保护模型权重和数据的机密性，同时允许其他方信任地审计模型和数据的属性。通过使用零知识证明，我们证明了可以提供对深度神经网络的可信审计，包括版权审计、审查审计和反事实审计，而几乎不会降低准确性。