A2-DIDM Lets AI Creators Prove Model Ownership on Blockchain Without Exposing Data
A blockchain and zero-knowledge scheme lets model owners prove a neural network is theirs without ever revealing training data or weights.
PRO- A2-DIDM audits DNN ownership on-chain using zkSNARKs without revealing training data, weights, or predicate logic.
- Three predicates verify checkpoint continuity, initialization distribution, and monotonicity to detect forged training histories.
- An accumulator defers expensive pairing operations to a single on-chain check, keeping verification cost constant.
- Full predicate set achieves 1.000 TPR and 0.000 FPR against reverse construction, checkpoint forgery, and distillation attacks.
- Poseidon-128 hashing gives an 80% prover speedup over Pedersen, with under 1% accuracy loss versus baseline training.
- Code and experiments available at github.com/xtx123456/A2-DIDM; paper at arXiv:2405.04108.
Selling or licensing a neural network resembles selling a painting that anyone with a camera can perfectly copy. Once weights leak, competitors can retrain, distill, or claim ownership, and the original creator has almost no way to prove they did the work. A new paper called A2-DIDM proposes a cryptographic auditing scheme that lets a model owner prove authorship of a DNN on a blockchain without exposing the training dataset, the intermediate checkpoints, or even the verification logic itself.
The core problem the authors target is that DNN model trading can trigger unauthorized replication and misuse, and verifying integrity and ownership is one of the critical obstacles to trustworthy transactions. Existing defenses each have a soft spot. Watermarking degrades performance and can be scrubbed by model stealing attacks. Fingerprints can be forged. Proof-of-Learning style schemes replay the training history but are vulnerable to adversarial checkpoint construction and expose sensitive data.
Training history as identity
A2-DIDM treats a model's ordered sequence of weight checkpoints as its identity. Each incremental update between adjacent checkpoints becomes an Identity Record (IR), and the sequence of IRs forms a unique fingerprint of how the final model was actually optimized. The scheme configures weight checkpoints with zero-knowledge proofs and incorporates predicates that capture incremental state changes, ensuring the uniqueness of the checkpoint sequence.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
