---
title: "A2-DIDM Lets AI Creators Prove Model Ownership on Blockchain Without Exposing Data"
subtitle: "A blockchain and zero-knowledge scheme lets model owners prove a neural network is theirs without ever revealing training data or weights."
url: "https://alphasignal.ai/news/a2-didm-lets-ai-creators-prove-model-ownership-on-blockchain-without-exposing"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-04-14T00:00:00.000Z"
updated: "2026-08-23T23:50:22.078Z"
type: "Paper"
topics:
  - "Security"
  - "Development"
subtopics:
  - "Red Teaming"
  - "Code Generation"
upvotes: 4500
source_url: "https://arxiv.org/abs/2405.04108"
comments: 0
truncated: true
---

# A2-DIDM Lets AI Creators Prove Model Ownership on Blockchain Without Exposing Data

> A blockchain and zero-knowledge scheme lets model owners prove a neural network is theirs without ever revealing training data or weights.

Selling or licensing a neural network resembles selling a painting that anyone with a camera can perfectly copy. Once weights leak, competitors can retrain, distill, or claim ownership, and the original creator has almost no way to prove they did the work. A new paper called [A2-DIDM](https://arxiv.org/abs/2405.04108) proposes a cryptographic auditing scheme that lets a model owner prove authorship of a DNN on a blockchain without exposing the training dataset, the intermediate checkpoints, or even the verification logic itself.

The core problem the authors target is that DNN model trading can trigger unauthorized replication and misuse, and verifying integrity and ownership is one of the critical obstacles to trustworthy transactions. Existing defenses each have a soft spot. Watermarking degrades performance and can be scrubbed by model stealing attacks. Fingerprints can be forged. Proof-of-Learning style schemes replay the training history but are vulnerable to adversarial checkpoint construction and expose sensitive data.

## Training history as identity

A2-DIDM treats a model's **ordered sequence of weight checkpoints** as its identity. Each incremental update between adjacent checkpoints becomes an Identity Record (IR), and the sequence of IRs forms a unique fingerprint of how the final model was actually optimized. The scheme configures weight checkpoints with zero-knowledge proofs and incorporates predicates that capture incremental state changes, ensuring the uniqueness of the checkpoint sequence.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [A2-DIDM: Privacy-preserving Accumulator-enabled Auditing for Distributed Identity of DNN Model](https://arxiv.org/abs/2405.04108)
- [A2-DIDM HTML paper](https://arxiv.org/html/2405.04108)
- [A2-DIDM GitHub repository](https://github.com/xtx123456/A2-DIDM.git)
- [veri-zexe library](https://github.com/EspressoSystems/veri-zexe)
- [bellman-bignat library](https://github.com/alex-ozdemir/bellman-bignat)