Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

TeleSparse: Practical Privacy-Preserving Verification of Deep Neural Networks

T0 review · 5 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read TeleSparse claims that pruning weights and teleporting activations makes zero-knowledge verification of deep model inference practical, cutting prover memory by about 67 percent and proof time by about 46 percent with roughly 1 percent…

desk verdict A useful zkML post-processing combination that is not yet trustworthy: the teleportation math is underspecified to the point of being trivially minimizable, the privacy model puts weights in public fixed columns, and the headline numbers disagree across sections. read the letter →

arxiv 2504.19274 v2 pith:I5QPGKLQ submitted 2025-04-27 cs.LG cs.AIcs.CR

Mohammad M Maheri , Hamed Haddadi , Alex Davidson This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords zero-knowledgeproofverifiableinferenceneuralnetworksparsificationteleportationHalo2lookuptableoptimizationprivacy-preservingmachinelearningdeepverification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the main obstacles to ZK-SNARK verification of modern neural networks, namely too many circuit constraints and oversized lookup tables for non-linearities, can be attacked by post-processing the model itself rather than only optimizing the proof system. It claims that pruning roughly half the weights and applying a neural-teleportation rescaling that squeezes activation values into a narrow range makes Halo2 proof generation tractable. For ResNet-20 on CIFAR-100, the paper reports prover memory dropping about 67 percent and proving time about 46 percent, with roughly 1 percent accuracy loss, and similar gains across MobileNet and Tiny-ViT. If true, this would make privacy-preserving, verifiable inference viable for existing CNNs and transformers without retraining or revealing model weights.

What carries the argument

The workhorse is the Halo2 PLONKish circuit, in which a matrix-vector multiplication is represented by a fixed column holding weights, advice columns holding inputs and running sums, and copy constraints chaining accumulation across rows; deleting rows whose fixed value is zero removes constraints without touching soundness. On top of that sits neural teleportation, with change-of-basis scalars $\tau^{(i)}_j$ transforming each weight $w^{(i)}_{j,k}$ into $\sqrt{\tau^{(i+1)}_k/\tau^{(i)}_j}\,w^{(i)}_{j,k}$ and each activation $f(x)$ into $\tau f(x/\tau)$. The optimization objective minimized by zero-order coordinate gradient estimation is the per-layer spread of scaled pre-activations, augmented by the reconstruction term $\lambda \lVert f(\boldsymbol{\theta},1) - f(\boldsymbol{\theta},\tau)\rVert^2$ for non-scale-invariant activations; this is what shrinks the lookup tables, while the sparse circuit handles the constraint count.

What would settle it

Take a GELU-based transformer, optimize the teleportation scalars with the reconstruction term removed (lambda = 0), and compare the teleported model's outputs with the original on a held-out set. If the activation range collapses while accuracy drops well beyond the reported one percent, or if with the recommended lambda no scaling keeps both the range small and the output distance small, then the approximate-scale-invariance assumption is doing the work and the reported savings do not transfer. A cheaper check is to measure the per-layer activation spreads before and after teleportation and confirm that the resource reduction in the ablation study is actually driven by lookup-table size rather than by quantization or pruning effects.

Watch

Extended reading notes

Core claim

At its core, the paper argues that model size is not the only factor that makes SNARK verification expensive: the distribution of activation values matters as much as the number of parameters. Two post-processing moves target these costs. First, sparsification (via RD_PRUNE or CAP) zeros out roughly half the weights, and because weights live in fixed columns of the Halo2 circuit, rows corresponding to zero entries can be deleted without changing what the circuit proves (Theorem 4.1). Second, neural teleportation rescales each neuron's input and weight by positive scalars $\tau^{(i)}_j$, chosen to minimize the per-layer spread $\max_j (z^{(i)}_j/\tau^{(i)}_j) - \min_j (z^{(i)}_j/\tau^{(i)}_j)$; for scale-invariant activations this preserves the network function exactly, and for non-scale-invariant activations such as GELU a reconstruction penalty keeps the teleported function close to the original. Together these mechanisms reduce prover memory by about 67 percent and proving time by about 46 percent on ResNet-20/CIFAR-100, with accuracy dropping roughly one percentage point, and the paper reports analogous gains on MobileNetV1 and Tiny-ViT.

Load-bearing premise

The load-bearing premise is that rescaling neuron inputs via teleportation leaves the network's function essentially unchanged even for activations such as GELU that are not perfectly scale-invariant, so that the lookup-table savings do not hide an accuracy cost; the reconstruction penalty is what is supposed to make this true.

Editorial extensions

If this is right

  • If the claims hold, proving a Tiny-ViT on ImageNet no longer requires over 10 TB of prover memory; TeleSparse reports about 357 GB across 24 split proofs, roughly 45 percent below the baseline, making verifiable inference feasible on reachable hardware.
  • Because both steps are post-processing on a pre-trained model, existing deployed networks can be converted to ZK-friendly form without retraining or architectural changes, and the conversion overhead is reported as under 2 percent of proof memory for teleportation.
  • The two mechanisms are complementary: sparsification mainly attacks constraint count, teleportation mainly attacks lookup-table cost, so the best gains come from applying both together, with teleportation contributing little on models dominated by linear constraints such as MobileNet.
  • The approach composes with existing ZK-friendly arithmetization: it inherits Halo2's soundness and zero-knowledge properties and leaves open the option of parallel or recursive proof composition across split circuits.
  • The sparsity ratio leaks through the verification key size; the paper's proposed mitigation is dummy constraints, which would trade proof overhead for hiding the ratio, an explicit design knob for privacy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same range-minimization objective could be applied during training as a ZK-friendly regularizer rather than only as post-processing; this would likely yield even smaller lookup tables than teleporting a fixed model, though the paper does not test it.
  • Teleportation's benefit is concentrated in lookup-heavy layers, so a layer-wise cost model that allocates sparsity and teleportation effort according to constraint cost versus lookup cost could outperform the uniform 50 percent sparsity used in the experiments.
  • The teleportation objective resembles rotation-based outlier suppression used in quantization; combining change-of-basis rescaling with such rotations or with per-layer fixed-point scales might reduce lookup range further, at the cost of extra circuit gates.
  • A cleaner privacy statement would require a quantified mechanism for hiding the sparsity ratio; the paper's dummy-constraint idea points toward a differential-privacy-style noise trade-off but leaves the actual mechanism unspecified.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes TeleSparse, a post-processing pipeline for deep neural networks intended to make ZK-SNARK inference verification practical. It combines unstructured sparsification (RD_PRUNE, CAP) to reduce circuit constraints with a neural-teleportation-inspired scaling of network parameters aimed at shrinking activation ranges and hence lookup tables. Using Halo2 via the EZKL toolkit, the authors report memory and prover-time reductions on MobileNetV1/CIFAR-10, ResNet-20/CIFAR-100, and Tiny-ViT/ImageNet, with accuracy losses around 1%, and they present a privacy analysis that explicitly assumes leakage of the layer-wise sparsity ratio.

Significance. If the reported results hold, TeleSparse would be a useful and largely orthogonal post-processing layer for the ZK-ML stack: it is model-agnostic, complementary to arithmetization-specific optimizations, and supported by a public code release. The experimental coverage across convolutional, mobile, and transformer architectures is a strength, as is the candid discussion of sparsity-ratio leakage. However, the teleportation objective is degenerate as written and the simulator argument in the privacy proof has a gap, so the significance currently hinges on unverified assumptions rather than on the mechanisms actually demonstrated.

major comments (5)
  1. [Section 5, Eqs. (14)-(15); Algorithm 2] The objective in Eq. (15) is unbounded in a way that makes the reported teleportation gains (Table 4, Figure 6) not attributable to a principled optimization. For a fixed layer i, setting tau_j = c for all j makes the term (max_j z_j/tau_j - min_j z_j/tau_j) equal to (max_j z_j - min_j z_j)/c, which tends to 0 as c tends to infinity; the infimum is 0 and is not attained. Algorithm 2 only enforces tau_j >= epsilon and imposes no upper bound or normalization. For scale-invariant activations such as ReLU, the teleported network function is identical for every tau, so the reconstruction penalty in Eq. (20) does not constrain tau and the optimizer can inflate the scaling factors arbitrarily. The paper never reports the learned tau values, the learning rate eta, the perturbation size mu, the maximum iterations, or the stopping criterion, so the 38.9% memory reduction attributed to teleportation in Table 4 cannot be reproduced or distinguished from a trivial scaling artifact. This directly undermines the central G2 claim. Please add a normalization constraint (e.g., geometric mean of tau_j fixed to 1 per layer), report the resulting tau statistics, and re-run the ablation with accuracy figures for teleportation alone.
  2. [Abstract, Section 1, Section 8] The headline numbers are internally inconsistent. The abstract states reductions of 67% in prover memory and 46% in proof generation time; Section 1 states 67% in proof generation time and 46% in prover memory; the conclusion states 67% memory and 54% time. Table 1 reports 66.8%/45.6% for ResNet-20 and 59.2%/54.0% for MobileNetV1, so the '67%/46%' and '54%' figures refer to different models. Since these are the paper's central quantitative claims, please state explicitly which model and dataset each headline figure corresponds to and correct the swapped values in Section 1 and the conclusion.
  3. [Section 5.2 and Section 6.4] The extension to non-scale-invariant activations such as GELU is asserted but not validated. Eq. (20) introduces a reconstruction penalty with hyperparameter lambda, but the paper does not report lambda, eta, mu, max iterations, or any teleportation-only accuracy result. Table 3 reports accuracy only for the dense and combined sparse+teleported models, so the approximately 1% accuracy trade-off cannot be attributed between sparsification and teleportation. Given that teleportation alone produces large resource reductions in Table 4, a missing accuracy column for that configuration makes it impossible to assess whether the resource savings come at an unstated accuracy cost. Please provide hyperparameter values and an accuracy ablation for teleportation alone, including for the GELU-based ViT.
  4. [Section 7.2 and Appendix H] The proof of Theorem 7.1 has a simulation gap. The simulator is said to 'generate model weights V_t_sparse that produce y given X' using only the sparsity ratio and access to the ideal functionality. In a standard NIZK, the zero-knowledge simulator can produce a proof only for statements in the language; it cannot produce a valid proof for a false statement (that would break soundness). If the simulator picks its own V, there is no guarantee that f(X; V) equals the public output y provided by the ideal functionality, so the simulated proof would be for a statement that is not necessarily true. The proof should instead leverage the hiding property of the polynomial commitment to replace the committed weights and use the NIZK simulator on a true statement, or explicitly model a stronger simulation soundness property. As written, the privacy guarantee is not established.
  5. [Tables 2 and 4] The Tiny-ViT numbers in Tables 2 and 4 are inconsistent as presented. Table 2 reports EZKL memory 650 GB and proving time 1087 s, while Table 4 lists 'No Post-Processing' for Tiny-ViT as 1002.2 GB and 541 s, with a note that the metrics correspond only to MLP parts. The caption of Table 4 should state this scope, and the baseline and reduction percentages should be recomputed consistently; as presented, a reader cannot reconcile a 20.05% time reduction in Table 2 with a 52.7% time reduction in Table 4 for what appear to be the same model.
minor comments (6)
  1. [Abstract] The abstract contains a grammar error: 'TeleSparse, a ZK-friendly post-processing mechanisms' should be 'a ... mechanism'.
  2. [Section 1] The sentence 'TeleSparse achieves about 67% reduction in proof generation time and a 46% reduction in prover memory usage' reverses the abstract's numbers; this should be corrected.
  3. [Notation table and Section 5] The notation table defines g^(i)_j as pre-activation and z^(i)_j as activation output, but Eq. (13) uses z^(i)_j as the input to the activation function; please unify the notation.
  4. [Algorithm 1 and Eq. (8)] The pruning objective in Algorithm 1 is written as an L2 reconstruction over layers, but Eq. (8) defines the CAP importance score; the relation between these two formulations should be clarified.
  5. [Figure 6] The figure caption refers to 'Mean Activation Loss' and 'Standard Deviation of Activation Loss'; these terms are not defined and appear to mean the mean and standard deviation of the activation range. Please use consistent terminology.
  6. [Section 6.1] The paper should specify the exact EZKL version and configuration (e.g., Halo2 parameters, KZG or IPA commitment settings), as these materially affect the reported resource figures.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: TeleSparse's efficiency results are independent measurements against EZKL baselines, and the teleportation range reduction is simply the optimized objective rather than a predicted quantity.

full rationale

The two load-bearing mechanisms are not derived from their own conclusions. Sparsification soundness (Theorem 4.1) is reduced to Halo2's commitment binding and copy-constraint soundness, which are external to this paper, and pruning itself uses the external RD_PRUNE and CAP methods. Teleportation uses change-of-basis equations from prior external work [2, 85]; Eq. (14)-(15) define the activation-range objective, and Figure 6 reports that same objective after optimization, which is a sanity check rather than a prediction. The headline resource figures in Tables 1, 2, and 4 are measured on Halo2/EZKL proof generation and are not analytically forced by the teleportation objective, and the accuracy figures in Table 3 are also measured. No fitted parameter is renamed as a prediction. The unbounded-tau concern is a genuine optimization/correctness risk, but even a trivial minimum would not make the measured memory and time reductions circular. The only overlapping-author citation, [25], appears in an application list and is not load-bearing. The swapped 67%/46% figures between the abstract and introduction are an internal inconsistency, not a circular step.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

The paper contributes a combination of existing tools rather than a new cryptographic primitive or physical entity. Its central resource claims rest on user-chosen settings (sparsity ratio, quantization scale, teleportation lambda and hyperparameters), plus the correctness of Halo2/EZKL and the approximate validity of neural teleportation for non-homogeneous activations.

free parameters (5)
  • sparsity ratio R = 50% for headline results
    All main benchmarks use R=50%; Figure 4 varies it and shows the accuracy/memory/time trade-offs. It is a design choice, not derived from theory.
  • teleportation regularization lambda (Eq. 20) = not reported
    Balances activation-range minimization against preserving the network function for GELU; directly influences the reported accuracy trade-off.
  • fixed-point quantization scale = 2^12
    Chosen to balance accuracy and proof memory; a larger scale increases accuracy and memory usage during proof generation.
  • teleportation hyperparameters (eta, mu, max iterations) = not reported
    Coordinate gradient estimation depends on these; convergence and the final tau values depend on them.
  • pruning calibration data D_calib = 1024 samples, as cited from the pruning methods
    Calibration set size affects pruned accuracy; it is not independently varied in the paper.
assumptions (6)
  • domain assumption Halo2 and EZKL correctly implement PLONKish arithmetization, lookup arguments, and hiding commitments
    The soundness and zero-knowledge properties are inherited from these systems (Section 4.1, Appendix A).
  • domain assumption Neural teleportation symmetry in the sense of [2] holds for the architectures tested
    The transformation in Eqs. (9)-(10) is taken from prior work; the paper does not re-derive it.
  • ad hoc to paper GELU can be treated as approximately scale-invariant, with reconstruction error controlled by lambda
    Introduced to extend teleportation to non-homogeneous activations (Section 5.2, Eq. 20).
  • domain assumption Fixed-point quantization at scale 2^12 preserves accuracy within about 1%
    The ZK circuit only computes quantized values; accuracy relative to full precision is measured but not otherwise guaranteed.
  • ad hoc to paper Sparsity ratio leakage is acceptable for the privacy proof
    Theorem 7.1's simulator needs the sparsity ratio R_l; the paper acknowledges this leakage and only sketches mitigations (Section 7.3).
  • standard math Standard cryptographic assumptions such as binding and hiding of polynomial commitments
    Used in the Appendix E soundness proof and the Appendix H privacy proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TeleSparse: Practical Privacy-Preserving Verification of Deep Neural Networks." pith.science (2026). https://pith.science/paper/I5QPGKLQ

@misc{pith2026250419274,
  author       = {Pith},
  title        = {Pith review of: TeleSparse: Practical Privacy-Preserving Verification of Deep Neural Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I5QPGKLQ}},
  note         = {Machine review of arXiv:2504.19274}
}
read the original abstract

Verification of the integrity of deep learning inference is crucial for understanding whether a model is being applied correctly. However, such verification typically requires access to model weights and (potentially sensitive or private) training data. So-called Zero-knowledge Succinct Non-Interactive Arguments of Knowledge (ZK-SNARKs) would appear to provide the capability to verify model inference without access to such sensitive data. However, applying ZK-SNARKs to modern neural networks, such as transformers and large vision models, introduces significant computational overhead. We present TeleSparse, a ZK-friendly post-processing mechanisms to produce practical solutions to this problem. TeleSparse tackles two fundamental challenges inherent in applying ZK-SNARKs to modern neural networks: (1) Reducing circuit constraints: Over-parameterized models result in numerous constraints for ZK-SNARK verification, driving up memory and proof generation costs. We address this by applying sparsification to neural network models, enhancing proof efficiency without compromising accuracy or security. (2) Minimizing the size of lookup tables required for non-linear functions, by optimizing activation ranges through neural teleportation, a novel adaptation for narrowing activation functions' range. TeleSparse reduces prover memory usage by 67% and proof generation time by 46% on the same model, with an accuracy trade-off of approximately 1%. We implement our framework using the Halo2 proving system and demonstrate its effectiveness across multiple architectures (Vision-transformer, ResNet, MobileNet) and datasets (ImageNet,CIFAR-10,CIFAR-100). This work opens new directions for ZK-friendly model design, moving toward scalable, resource-efficient verifiable deep learning.

Figures

Figures reproduced from arXiv: 2504.19274 by the authors.

Figure 1
Figure 1. System diagram of ZK-SNARK DNN inference. [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. System overview: the neural network weight is fed [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. (A) represent a Halo2 circuit without removing [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Effect of sparsity ratio on memory usage, proving [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: Transformer architecture contains two parts of [PITH_FULL_IMAGE:figures/full_fig_p017_5.png]
Figure 6
Figure 6. Figure 6: Activation range distribution of 300 CIFAR100 sam [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. KBF: Knowledge Boundary as Fingerprint for Language Model and Black-Box API Auditing

    cs.CR 2026-05 unverdicted novelty 7.0 of 10

    KBF uses stable numerical recall near the knowledge boundary to fingerprint and audit black-box LLM APIs, successfully detecting all tested substitutions and some real-world inconsistencies across production endpoints.

Reference graph

Works this paper leans on

91 extracted references · 46 canonical work pages · cited by 1 Pith paper

  1. [1]

    Marco Armenta and Pierre-Marc Jodoin. 2021. The representation theory of neural networks. Mathematics 9, 24 (2021), 3216

    2021

  2. [2]

    Marco Armenta, Thierry Judge, Nathan Painchaud, Youssef Skandarani, Carl Lemaire, Gabriel Gibeau Sanchez, Philippe Spino, and Pierre-Marc Jodoin. 2023. Neural teleportation. Mathematics 11, 2 (2023), 480

    2023

  3. [3]

    Saleh Ashkboos, Amirkeivan Mohtashami, Maximilian L Croci, Bo Li, Martin Jaggi, Dan Alistarh, Torsten Hoefler, and James Hensman. 2024. Quarot: Outlier- free 4-bit inference in rotated llms. arXiv preprint arXiv:2404.00456 (2024)

    arXiv 2024

  4. [4]

    Vijay Badrinarayanan, Bamdev Mishra, and Roberto Cipolla. 2015. Symmetry- invariant optimization in deep networks. arXiv preprint arXiv:1511.01754 (2015)

    arXiv 2015

  5. [5]

    Guangji Bai, Yijiang Li, Chen Ling, Kibaek Kim, and Liang Zhao. 2024. Gradient- Free Adaptive Global Pruning for Pre-trained Language Models. arXiv preprint arXiv:2402.17946 (2024)

    arXiv 2024

  6. [6]

    David Balbás, Dario Fiore, Maria Isabel González Vasco, Damien Robissout, and Claudio Soriente. 2023. Modular Sumcheck Proofs with Applications to Machine Learning and Image Processing. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . 1437–1451

    2023

  7. [7]

    Eli Ben-Sasson, Alessandro Chiesa, Eran Tromer, and Madars Virza. 2014. Suc- cinct{Non-Interactive} zero knowledge for a von neumann architecture. In23rd USENIX Security Symposium (USENIX Security 14) . 781–796

    2014

  8. [8]

    Nir Bitansky, Ran Canetti, Alessandro Chiesa, and Eran Tromer. 2012. From extractable collision resistance to succinct non-interactive arguments of knowl- edge, and back again. In Innovations in Theoretical Computer Science 2012, Cam- bridge, MA, USA, January 8-10, 2012 , Shafi Goldwasser (Ed.). ACM, 326–349. https://doi.org/10.1145/2090236.2090263

    arXiv 2012

Show all 91 references
  1. [9]

    Yelysei Bondarenko, Markus Nagel, and Tijmen Blankevoort. 2023. Quantizable transformers: Removing outliers by helping attention heads do nothing.Advances in Neural Information Processing Systems 36 (2023), 75067–75096

    2023

  2. [10]

    Sean Bowe, Jack Grigg, and Daira Hopwood. 2019. Recursive proof composition without a trusted setup. Cryptology ePrint Archive (2019)

    2019

  3. [11]

    Benedikt Bünz, Ben Fisch, and Alan Szepieniec. 2020. Transparent SNARKs from DARK compilers. In Advances in Cryptology–EUROCRYPT 2020: 39th An- nual International Conference on the Theory and Applications of Cryptographic Techniques, Zagreb, Croatia, May 10–14, 2020, Proceedin...

    2020

  4. [12]

    Aochuan Chen, Yimeng Zhang, Jinghan Jia, James Diffenderfer, Jiancheng Liu, Konstantinos Parasyris, Yihua Zhang, Zheng Zhang, Bhavya Kailkhura, and Sijia Liu. 2023. Deepzero: Scaling up zeroth-order optimization for deep model training. arXiv preprint arXiv:2310.02025 (2023)

    2023 arXiv

  5. [13]

    Ana-Maria Cretu, Daniel Jones, Yves-Alexandre de Montjoye, and Shruti Tople

  6. [14]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Im- agenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition . Ieee, 248–255

    2009

  7. [15]

    Jacob Dexe, Ulrik Franke, and Alexander Rad. 2021. Transparency and insur- ance professionals: a study of Swedish insurance practice attitudes and future development. The Geneva Papers on Risk and Insurance. Issues and Practice 46, 4 (2021), 547

    2021

  8. [16]

    Yifu Ding, Haotong Qin, Qinghua Yan, Zhenhua Chai, Junjie Liu, Xiaolin Wei, and Xianglong Liu. 2022. Towards accurate post-training quantization for vi- sion transformer. In Proceedings of the 30th ACM international conference on multimedia. 5380–5388

    2022

  9. [17]

    Xin Dong, Shangyu Chen, and Sinno Pan. 2017. Learning to prune deep neural networks via layer-wise optimal brain surgeon. Advances in neural information processing systems 30 (2017)

    2017

  10. [18]

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xi- aohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv prepri...

    2020 arXiv

  11. [19]

    Simon S Du, Wei Hu, and Jason D Lee. 2018. Algorithmic regularization in learning deep homogeneous models: Layers are automatically balanced.Advances in neural information processing systems 31 (2018)

    2018

  12. [20]

    Yongkai Fan, Kaile Ma, Linlin Zhang, Xia Lei, Guangquan Xu, and Gang Tan

  13. [21]

    Yongkai Fan, Binyuan Xu, Linlin Zhang, Jinbao Song, Albert Zomaya, and Kuan- Ching Li. 2023. Validating the integrity of convolutional neural network predic- tions based on zero-knowledge proof. Information Sciences 625 (2023), 125–140

    2023

  14. [22]

    IEEE Transactions on Dependable and Secure Computing (2024)

    ValidCNN: A large-scale CNN predictive integrity verification scheme based on zk-SNARK. IEEE Transactions on Dependable and Secure Computing (2024)

    2024

  15. [23]

    Boyuan Feng, Lianke Qin, Zhenfei Zhang, Yufei Ding, and Shumo Chu. 2021. Zen: An optimizing compiler for verifiable, zero-knowledge neural network inferences. Cryptology ePrint Archive (2021)

    2021

  16. [24]

    Gongfan Fang, Xinyin Ma, Mingli Song, Michael Bi Mi, and Xinchao Wang

  17. [25]

    Olive Franzese, Ali Shahin Shamsabadi, and Hamed Haddadi. 2024. OATH: Efficient and Flexible Zero-Knowledge Proofs of End-to-End ML Fairness. arXiv preprint arXiv:2410.02777 (2024)

    2024

  18. [26]

    Ariel Gabizon, Zachary J Williamson, and Oana Ciobotaru. 2019. Plonk: Per- mutations over lagrange-bases for oecumenical noninteractive arguments of knowledge. Cryptology ePrint Archive (2019)

    2019

  19. [27]

    Jonathan Frankle and Michael Carbin. 2018. The lottery ticket hypothesis: Finding sparse, trainable neural networks. arXiv preprint arXiv:1803.03635 (2018)

    2018 arXiv

  20. [28]

    Zahra Ghodsi, Tianyu Gu, and Siddharth Garg. 2017. Safetynets: Verifiable execution of deep neural networks on an untrusted cloud. Advances in Neural Information Processing Systems 30 (2017)

    2017

  21. [29]

    Grzegorz Głuch and Rüdiger Urbanke. 2021. Noether: The more things change, the more stay the same. arXiv preprint arXiv:2104.05508 (2021)

    2021 arXiv

  22. [30]

    Trevor Gale, Erich Elsen, and Sara Hooker. 2019. The state of sparsity in deep neural networks. arXiv preprint arXiv:1902.09574 (2019)

    2019 arXiv

  23. [31]

    Meng Hao, Hanxiao Chen, Hongwei Li, Chenkai Weng, Yuan Zhang, Haomiao Yang, and Tianwei Zhang. 2024. Scalable Zero-knowledge Proofs for Non-linear Functions in Machine Learning. In 33rd USENIX Security Symposium (USENIX Security 24). 3819–3836

    2024

  24. [32]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition . 770–778

    2016

  25. [33]

    Jens Groth. 2016. On the size of pairing-based non-interactive arguments. In Advances in Cryptology–EUROCRYPT 2016: 35th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Vienna, Austria, May 8-12, 2016, Proceedings, Part II 35 . Sprin...

    2016

  26. [34]

    Andrew G Howard. 2017. Mobilenets: Efficient convolutional neural networks for mobile vision applications. arXiv preprint arXiv:1704.04861 (2017)

    2017 arXiv

  27. [35]

    Siddhant Jayakumar, Razvan Pascanu, Jack Rae, Simon Osindero, and Erich Elsen

  28. [36]

    Dan Hendrycks and Kevin Gimpel. 2016. Gaussian error linear units (gelus). arXiv preprint arXiv:1606.08415 (2016)

    2016 arXiv

  29. [37]

    Aniket Kate, Gregory M Zaverucha, and Ian Goldberg. 2010. Constant-size commitments to polynomials and their applications. In Advances in Cryptology- ASIACRYPT 2010: 16th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, ...

    2010

  30. [38]

    Joe Kilian. 1992. A note on efficient zero-knowledge proofs and arguments. In Proceedings of the twenty-fourth annual ACM symposium on Theory of computing . 723–732

    1992

  31. [39]

    Sehoon Kim, Coleman Hooper, Amir Gholami, Zhen Dong, Xiuyu Li, Sheng Shen, Michael W Mahoney, and Kurt Keutzer. 2023. Squeezellm: Dense-and-sparse quantization. arXiv preprint arXiv:2306.07629 (2023)

    2023 arXiv

  32. [40]

    Daniel Kang, Tatsunori Hashimoto, Ion Stoica, and Yi Sun. 2022. Scaling up Trust- less DNN Inference with Zero-Knowledge Proofs.arXiv preprint arXiv:2210.08674 (2022)

    2022 arXiv

  33. [41]

    2014.{TRUESET}: Faster {Verifiable} Set Computations

    Ahmed E Kosba, Dimitrios Papadopoulos, Charalampos Papamanthou, Mah- moud F Sayed, Elaine Shi, and Nikos Triandopoulos. 2014.{TRUESET}: Faster {Verifiable} Set Computations. In 23rd USENIX Security Symposium (USENIX Security 14). 765–780

    2014

  34. [42]

    Alex Krizhevsky, Geoffrey Hinton, et al. 2009. Learning multiple layers of features from tiny images. (2009)

    2009

  35. [43]

    Nishant Kumar, Mayank Rathee, Nishanth Chandran, Divya Gupta, Aseem Ras- togi, and Rahul Sharma. 2020. Cryptflow: Secure tensorflow inference. In 2020 IEEE Symposium on Security and Privacy (SP) . IEEE, 336–353. 14 TeleSparse: Practical Privacy-Preserving Verification of Deep ...

    2020

  36. [44]

    Brian Knott, Shobha Venkataraman, Awni Hannun, Shubho Sengupta, Mark Ibrahim, and Laurens van der Maaten. 2021. Crypten: Secure multi-party com- putation meets machine learning. Advances in Neural Information Processing Systems 34 (2021), 4961–4973

    2021

  37. [45]

    Eldar Kurtić, Elias Frantar, and Dan Alistarh. 2024. ZipLM: Inference-Aware Structured Pruning of Language Models. Advances in Neural Information Pro- cessing Systems 36 (2024)

    2024

  38. [46]

    Denis Kuznedelev, Eldar Kurtić, Elias Frantar, and Dan Alistarh. 2024. CAP: Correlation-Aware Pruning for Highly-Accurate Sparse Vision Models.Advances in Neural Information Processing Systems 36 (2024)

    2024

  39. [47]

    Woosuk Kwon, Sehoon Kim, Michael W Mahoney, Joseph Hassoun, Kurt Keutzer, and Amir Gholami. 2022. A fast post-training pruning framework for transform- ers. Advances in Neural Information Processing Systems 35 (2022), 24101–24116

    2022

  40. [48]

    Daniel Kunin, Javier Sagastuy-Brena, Surya Ganguli, Daniel LK Yamins, and Hidenori Tanaka. 2020. Neural mechanics: Symmetry and broken conservation laws in deep learning dynamics. arXiv preprint arXiv:2012.04728 (2020)

    2020 arXiv

  41. [49]

    Eunsang Lee, Joon-Woo Lee, Junghyun Lee, Young-Sik Kim, Yongjune Kim, Jong-Seon No, and Woosuk Choi. 2022. Low-complexity deep convolutional neural networks on fully homomorphic encryption using multiplexed parallel convolutions. In International Conference on Machine Learning...

    2022

  42. [50]

    Seunghwa Lee, Hankyung Ko, Jihye Kim, and Hyunok Oh. 2024. vcnn: Verifi- able convolutional neural network based on zk-snarks. IEEE Transactions on Dependable and Secure Computing (2024)

    2024

  43. [51]

    Klas Leino and Matt Fredrikson. 2020. Stolen memories: Leveraging model memorization for calibrated{White-Box} membership inference. In29th USENIX security symposium (USENIX Security 20) . 1605–1622

    2020

  44. [52]

    Mike Lasby, Anna Golubeva, Utku Evci, Mihai Nica, and Yani Ioannou. 2023. Dy- namic Sparse Training with Structured Sparsity. arXiv preprint arXiv:2305.02299 (2023)

    2023 arXiv

  45. [53]

    Ji Lin, Ligeng Zhu, Wei-Ming Chen, Wei-Chen Wang, and Song Han. 2023. Tiny machine learning: progress and futures [feature]. IEEE Circuits and Systems Magazine 23, 3 (2023), 8–34

    2023

  46. [54]

    Shiwei Liu, Lu Yin, Decebal Constantin Mocanu, and Mykola Pechenizkiy. 2021. Do we actually need dense over-parameterization? in-time over-parameterization in sparse training. In International Conference on Machine Learning . PMLR, 6989– 7000

    2021

  47. [55]

    Tianyi Liu, Xiang Xie, and Yupeng Zhang. 2021. ZkCNN: Zero knowledge proofs for convolutional neural network predictions and accuracy. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2968–2985

    2021

  48. [56]

    Xiling Li, Chenkai Weng, Yongxin Xu, Xiao Wang, and Jennie Rogers. 2023. Zksql: Verifiable and efficient query evaluation with zero-knowledge proofs. Proceedings of the VLDB Endowment 16, 8 (2023)

    2023

  49. [57]

    Qian Lou and Lei Jiang. 2021. HEMET: a homomorphic-encryption-friendly privacy-preserving mobile neural network architecture. In International confer- ence on machine learning . PMLR, 7102–7110

    2021

  50. [58]

    Tao Lu, Haoyu Wang, Wenjie Qu, Zonghui Wang, Jinye He, Tianyang Tao, Wenzhi Chen, and Jiaheng Zhang. 2024. An Efficient and Extensible Zero-knowledge Proof Framework for Neural Networks. Cryptology ePrint Archive (2024)

    2024

  51. [59]

    Xinyin Ma, Gongfan Fang, and Xinchao Wang. 2023. Llm-pruner: On the struc- tural pruning of large language models.Advances in neural information processing systems 36 (2023), 21702–21720

    2023

  52. [60]

    Yijiang Liu, Huanrui Yang, Zhen Dong, Kurt Keutzer, Li Du, and Shanghang Zhang. 2023. Noisyquant: Noisy bias-enhanced post-training activation quan- tization for vision transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 20321–20330

    2023

  53. [61]

    Silvio Micali. 2000. Computationally sound proofs. SIAM J. Comput. 30, 4 (2000), 1253–1298

    2000

  54. [62]

    Sharan Narang, Erich Elsen, Gregory Diamos, and Shubho Sengupta. 2017. Ex- ploring sparsity in recurrent neural networks. arXiv preprint arXiv:1704.05119 (2017)

    2017 arXiv

  55. [63]

    Alec Radford. 2018. Improving language understanding by generative pre- training. (2018)

    2018

  56. [64]

    Nahema Marchal, Rachel Xu, Rasmi Elasmar, Iason Gabriel, Beth Goldberg, and William Isaac. 2024. Generative AI Misuse: A Taxonomy of Tactics and Insights from Real-World Data. arXiv preprint arXiv:2406.13843 (2024)

    2024 arXiv

  57. [65]

    Tobin South, Alexander Camuto, Shrey Jain, Shayla Nguyen, Robert Mahari, Christian Paquin, Jason Morton, and Alex’Sandy’ Pentland. 2024. Verifiable evaluations of machine learning models using zkSNARKs. arXiv preprint arXiv:2402.02675 (2024)

    2024 arXiv

  58. [66]

    Wenting Zheng Srinivasan, PMRL Akshayaram, and Popa Raluca Ada. 2019. DELPHI: A cryptographic inference service for neural networks. In Proc. 29th USENIX Secur. Symp. 2505–2522

    2019

  59. [67]

    Haochen Sun, Jason Li, and Hongyang Zhang. 2024. zkLLM: Zero Knowledge Proofs for Large Language Models. arXiv preprint arXiv:2404.16109 (2024)

    2024 arXiv

  60. [68]

    Md Aamir Raihan and Tor Aamodt. 2020. Sparse weight activation training. Advances in Neural Information Processing Systems 33 (2020), 15625–15638

    2020

  61. [69]

    Mingjie Sun, Zhuang Liu, Anna Bair, and J Zico Kolter. 2023. A simple and effec- tive pruning approach for large language models. arXiv preprint arXiv:2306.11695 (2023)

    2023 arXiv

  62. [70]

    Yi-Lin Sung, Varun Nair, and Colin A Raffel. 2021. Training neural networks with fixed sparse masks. Advances in Neural Information Processing Systems 34 (2021), 24193–24205

    2021

  63. [71]

    A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems (2017)

    2017

  64. [72]

    Zico Kolter, and Zhuang Liu

    Mingjie Sun, Xinlei Chen, J. Zico Kolter, and Zhuang Liu. 2024. Massive Activa- tions in Large Language Models. arXiv preprint arXiv:2402.17762 (2024)

    2024 arXiv

  65. [73]

    Xiuling Wang and Wendy Hui Wang. 2024. GCL-Leak: Link Membership In- ference Attacks against Graph Contrastive Learning. Proceedings on Privacy Enhancing Technologies (2024)

    2024

  66. [74]

    Chenkai Weng, Kang Yang, Xiang Xie, Jonathan Katz, and Xiao Wang. 2021. Mystique: Efficient conversions for{Zero-Knowledge} proofs with applications to machine learning. In 30th USENIX Security Symposium (USENIX Security 21) . 501–518

    2021

  67. [75]

    Jiasi Weng, Jian Weng, Gui Tang, Anjia Yang, Ming Li, and Jia-Nan Liu. 2023. pvcnn: Privacy-preserving and verifiable convolutional neural network testing. IEEE Transactions on Information Forensics and Security 18 (2023), 2218–2233

    2023

  68. [76]

    Chaoqi Wang, Roger Grosse, Sanja Fidler, and Guodong Zhang. 2019. Eigendam- age: Structured pruning in the kronecker-factored eigenbasis. In International conference on machine learning . PMLR, 6566–6575

    2019

  69. [77]

    Kaixin Xu, Zhe Wang, Xue Geng, Min Wu, Xiaoli Li, and Weisi Lin. 2023. Efficient joint optimization of layer-adaptive weight pruning in deep neural networks. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 17447– 17457

    2023

  70. [78]

    Songkai Xue, Mikhail Yurochkin, and Yuekai Sun. 2020. Auditing ml models for individual bias and unfairness. InInternational Conference on Artificial Intelligence and Statistics. PMLR, 4552–4562

    2020

  71. [79]

    Lu Yu and Wei Xiang. 2023. X-pruner: explainable pruning for vision transform- ers. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 24355–24363

    2023

  72. [80]

    Frank F Xu, Uri Alon, Graham Neubig, and Vincent Josua Hellendoorn. 2022. A systematic evaluation of large language models of code. In Proceedings of the 6th ACM SIGPLAN International Symposium on Machine Programming . 1–10

    2022

  73. [81]

    Syed Ali Raza Zaidi, Ali M Hayajneh, Maryam Hafeez, and Qasim Zeeshan Ahmed. 2022. Unlocking edge intelligence through tiny machine learning (TinyML). IEEE Access 10 (2022), 100867–100877

    2022

  74. [82]

    Zcash. 2022. The Halo2 Book. https://zcash.github.io/halo2/

    2022

  75. [83]

    Wenxuan Zeng, Meng Li, Wenjie Xiong, Tong Tong, Wen-jie Lu, Jin Tan, Run- sheng Wang, and Ru Huang. 2023. Mpcvit: Searching for accurate and efficient mpc-friendly vision transformer with heterogeneous attention. In Proceedings of the IEEE/CVF International Conference on Compu...

    2023

  76. [84]

    Shixing Yu, Zhewei Yao, Amir Gholami, Zhen Dong, Sehoon Kim, Michael W Mahoney, and Kurt Keutzer. 2022. Hessian-aware pruning and optimal neural implant. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 3880–3891

    2022

  77. [85]

    Bo Zhao, Nima Dehmamy, Robin Walters, and Rose Yu. 2022. Symmetry telepor- tation for accelerated optimization. Advances in neural information processing systems 35 (2022), 16679–16690

    2022

  78. [86]

    Michael Zhu and Suyog Gupta. 2017. To prune, or not to prune: exploring the efficacy of pruning for model compression. arXiv preprint arXiv:1710.01878 (2017)

    2017 arXiv

  79. [87]

    ZKonduit. 2023. EZKL: Efficient Zero-Knowledge Proving Toolkit. https://github. com/zkonduit/ezkl Accessed: 2024-11-06. A ZK PROPERTIES OF HALO2 IN THE PROPOSED SYSTEM TeleSparse, based on the Halo2 protocol, inherits its security prop- erties including: • Succinctness: Since ...

    2023

  80. [88]

    Yuxin Zhang, Yiting Luo, Mingbao Lin, Yunshan Zhong, Jingjing Xie, Fei Chao, and Rongrong Ji. 2023. Bi-directional masks for efficient n: M sparse training. In International Conference on Machine Learning . PMLR, 41488–41497

    2023

  81. [2020]

    Advances in Neural Information Processing Systems 33 (2020), 20744–20754

    Top-kast: Top-k always sparse training. Advances in Neural Information Processing Systems 33 (2020), 20744–20754

    2020

  82. [2023]

    In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Depgraph: Towards any structural pruning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 16091–16101

  83. [2024]

    Proceedings on Privacy Enhancing Technologies 2024, 3 (July 2024), 407–430

    Investigating the Effect of Misalignment on Membership Privacy in the White-box Setting. Proceedings on Privacy Enhancing Technologies 2024, 3 (July 2024), 407–430. https://doi.org/10.56553/popets-2024-0085

    2024 doi

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.