不泄露数据或模型的去信任审计
Trustless Audits without Revealing Data or Models
AI总结：
针对模型与数据保密和算法审计之间的冲突，本文提出 ZkAudit 协议，用密码学承诺与零知识证明在不泄露权重和数据的情况下验证训练及审计函数执行。
摘要：
将模型和数据作为商业秘密隐藏的商业激励，与社会对算法透明度的需求之间正出现日益严重的冲突。例如，希望了解其受版权保护作品是否在训练期间被使用的权利人，必须说服模型提供商允许第三方审计模型和数据。找到双方都认可的第三方十分困难，而相关成本往往使这种方式不切实际。在本研究中，我们表明可以同时让模型提供商将其模型权重（但不包括架构）和数据保密，并允许其他方去信任地审计模型与数据属性。为此，我们设计了一种名为 ZkAudit 的协议：模型提供商发布数据集和模型权重的密码学承诺，并附上零知识证明（ZKP），证明所发布的承诺源自模型训练。随后，对于审计请求，模型提供商可以私下计算数据集（或模型）的任意函数 F，并发布 F 的输出以及另一个 ZKP，用以证明 F 被正确执行。为实现 ZkAudit，我们开发了在现代神经网络上为 SGD 计算 ZKP 的新方法，适用于简单推荐系统以及能够在 ImageNet 上取得高准确率的图像分类模型。实验表明，可以为 DNN 提供去信任审计，包括版权、审查和反事实审计，且准确率几乎没有或完全没有损失。
英文摘要：
There is an increasing conflict between business incentives to hide models and data as trade secrets, and the societal need for algorithmic transparency. For example, a rightsholder wishing to know whether their copyrighted works have been used during training must convince the model provider to allow a third party to audit the model and data. Finding a mutually agreeable third party is difficult, and the associated costs often make this approach impractical. In this work, we show that it is possible to simultaneously allow model providers to keep their model weights (but not architecture) and data secret while allowing other parties to trustlessly audit model and data properties. We do this by designing a protocol called ZkAudit in which model providers publish cryptographic commitments of datasets and model weights, alongside a zero-knowledge proof (ZKP) certifying that published commitments are derived from training the model. Model providers can then respond to audit requests by privately computing any function F of the dataset (or model) and releasing the output of F alongside another ZKP certifying the correct execution of F. To enable ZkAudit, we develop new methods of computing ZKPs for SGD on modern neural nets for simple recommender systems and image classification models capable of high accuracies on ImageNet. Empirically, we show it is possible to provide trustless audits of DNNs, including copyright, censorship, and counterfactual audits with little to no loss in accuracy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
