arXiv cs.LG论文
认证但私有：神经网络保证的可扩展零知识证明
本文提出PANDA系统，利用零知识证明在不泄露模型参数的情况下验证神经网络的鲁棒性和公平性。该系统基于CROWN框架，通过新颖的算法证明非线性激活层的线性松弛界，生成轻量级证明。实验表明，PANDA能在5分钟内为超过290万参数的神经网络生成局部鲁棒性证明，并在10秒内完成验证，支持的网络规模比先前方法大四个数量级，且证明开销显著降低。
这篇是正式发表的长论文，站内提供中文解读，全文请到原文阅读 PDF。
Abstract:With the growing deployment of machine learning models, formal guarantees of the robustness and fairness of these models have become increasingly important in safety-critical and legal-compliance settings. However, model parameters are often commercial secrets that cannot be disclosed to auditors or end users. To this end, we present PANDA, a scalable system that uses zero-knowledge proofs (ZKPs) to prove the robustness and fairness properties of a model without revealing its private parameters. PANDA is built on top of CROWN, an efficient robustness certification framework that is used in many state-of-the-art formal verification tools for neural networks. The core contribution of PANDA is a novel algorithm for proving linear relaxation bounds for non-linear activation layers, yielding simple, lightweight proofs. Remarkably, our system can generate proofs of local robustness for neural networks with more than 2.9M parameters in 5 minutes, and can verify them in 10 seconds. Prior ZKP-based robustness system rely on exponential-time algorithms that cannot scale to nontrivial networks. In contrast, PANDA scales polynomially in the number of neurons in a network, allowing us to support neural networks 4 orders of magnitude larger than previous approaches with significantly reduced prover overhead.