There is an increasing conflict between business incentives to hide models and data as trade secrets, and the societal need for algorithmic transparency. For example, a rightsholder wishing to know whether their copyrighted works have been used during training must convince the model provider to allow a third party to audit the model and data. Finding a mutually agreeable third party is difficult, and the associated costs often make this approach impractical. In this work, we show that it is possible to simultaneously allow model providers to keep their model weights (but not architecture) and data secret while allowing other parties to trustlessly audit model and data properties. We do this by designing a protocol called ZkAudit in which model providers publish cryptographic commitments of datasets and model weights, alongside a zero-knowledge proof (ZKP) certifying that published commitments are derived from training the model. Model providers can then respond to audit requests by privately computing any function F of the dataset (or model) and releasing the output of F alongside another ZKP certifying the correct execution of F. To enable ZkAudit, we develop new methods of computing ZKPs for SGD on modern neural nets for simple recommender systems and image classification models capable of high accuracies on ImageNet. Empirically, we show it is possible to provide trustless audits of DNNs, including copyright, censorship, and counterfactual audits with little to no loss in accuracy.

翻译：商业动机（将模型和数据作为商业秘密隐藏）与社会对算法透明度的需求之间存在日益加剧的冲突。例如，希望确认其版权作品是否被用于训练的权利人，必须说服模型提供商允许第三方审计模型与数据。然而，寻找双方认可的第三方极为困难，且相关成本往往使此方法不具可行性。本研究证明，可在模型提供商保留模型权重（而非架构）与数据机密性的同时，使其他方能够以无需信任的方式审计模型与数据属性。我们通过设计名为ZkAudit的协议实现此目标：模型提供商发布数据集与模型权重的密码学承诺，同时附上零知识证明（ZKP）以认证所发布的承诺确实源于模型训练过程。随后，模型提供商可通过私下计算数据集（或模型）的任意函数F，并发布F的输出及另一份证明F正确执行的ZKP来响应审计请求。为实现ZkAudit，我们开发了针对现代神经网络（适用于简单推荐系统及能在ImageNet上达到高精度的图像分类模型）随机梯度下降（SGD）的ZKP计算方法。实验表明，该方法可在几乎不损失准确率的前提下，为深度神经网络（DNN）提供版权审计、审查审计及反事实审计等无需信任的审计。