Pith. sign in

REVIEW 3 major objections 5 minor 64 references

Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification

T0 review · 3 major / 5 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper shows that dataset-specific model certificates are breakable, and that sampling fresh audit data after commitment fixes them.

desk verdict The attack on dataset-fixed CMC is convincing and the template is useful, but the zero-knowledge proof has a genuine gap that referees should catch. read the letter →

arxiv 2607.21839 v1 pith:TYYK3347 submitted 2026-07-23 cs.CR cs.LG

Carter Luck , Olive Franzese-McLaughlin , Elisaweta Masserova , Akira Takahashi , Antigoni Polychroniadou , Nicolas Papernot This is my paper · ORCID
classification cs.CRcs.LG
keywords cryptographicmodelcertificationzero-knowledgeproofsdataforgingattacksauditgeneralizationdistributionalsoundnessfairnessauditingdifferentialprivacycommit-sample-prove
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that cryptographic model certification (CMC) schemes that prove a property on a fixed audit dataset do not guarantee the property on fresh data from the same distribution. A provider who knows the audit dataset can forge training data so an honestly trained model passes with, for example, over 99% certified accuracy yet achieves under 30% accuracy on new samples. This can be done for accuracy, fairness, and even differential privacy certification, and standard statistical tests do not reliably detect it. The paper then formalises distribution-level security notions and proves that a commit-sample-prove template — commit to the model, sample a fresh audit dataset, prove the empirical predicate in zero knowledge — is complete, binding, zero-knowledge, and sound up to the empirical predicate's false-positive rate.

What carries the argument

The commit-sample-prove protocol Π_csp: the provider commits to the model, the auditor draws n i.i.d. samples from the target distribution, and the provider proves in zero knowledge that the committed model satisfies an empirical predicate on those samples. The load-bearing object is the trio of predicates (f, F̃, F): an empirical predicate f, the intended distributional property F, and a relaxed distributional predicate F̃; security holds when f's false negative rate (conditioned on F) and false positive rate (conditioned on not F̃) are small. The paper contributes the new notion of F̃-relaxed knowledge soundness, which quantifies the unavoidable gap between checking a finite sample and the

What would settle it

Run the commit-sample-prove protocol exactly as specified, but with the audit dataset drawn from a distribution D' that differs slightly from the deployment distribution D. If the resulting certificates fail to track performance on D (e.g., certified accuracy high, deployed accuracy low), the distributional guarantee is falsified. Alternatively, test whether a provider who knows S_audit before committing can still win under Π_csp; a successful attack would disprove the theorem's core premise.

Watch

Extended reading notes

Core claim

The central discovery is that knowledge soundness of a zero-knowledge proof binds the prover to a model that satisfies an empirical predicate on a specific dataset, not to a model that behaves well on the distribution from which that dataset was drawn. Because machine learning is data-dependent, a provider can engineer training data (e.g., adding ε-perturbed, flipped-label neighbours of each audit point) so that a decision tree trained honestly on that data is perfectly accurate on the audit set but predicts the adversarial label everywhere else. This turns the certification gap into a concrete attack. The paper's positive result is a protocol template that restores soundness: the auditor sa

Load-bearing premise

The positive protocol's guarantee collapses if the auditor cannot sample audit data independently and identically from the deployment distribution D, or if the provider can anticipate the sample before committing; in either case the false-positive/false-negative bounds no longer hold.

Editorial extensions

If this is right

  • Existing CMC schemes that certify on a fixed or publicly known audit dataset should not be treated as distribution-level guarantees; providers can pass them while deploying pathological models.
  • Auditing practice should adopt commit-then-sample: the provider must commit to the model before the auditor draws fresh data from the target distribution.
  • The attack works against accuracy, fairness, and differential privacy certification, with empirical demonstrations on six fairness benchmarks and decision trees, XGBoost, and neural networks.
  • Standard statistical tests, specifically Welch's t-test, cannot reliably distinguish the forged training data from honest draws.
  • Zhang et al.'s accuracy protocol can be plugged into the secure template to obtain distribution-level guarantees; Confidential-DPproof cannot be fixed this way because the training data is provider-chosen.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The results imply that any certification scheme that reuses the same audit dataset across audits, even if it samples from a public benchmark, is vulnerable; continuous fresh sampling or multi-party computation to hide the audit sample would be needed.
  • The template's soundness depends on the auditor being able to sample from the actual deployment distribution; in settings where that distribution shifts after certification, the guarantees degrade — an inference about distribution shift.
  • The false-positive/false-negative tradeoff suggests a practical testable recipe: an auditor can empirically calibrate n and δ for a given model class and target distribution.
  • The attack on differential privacy suggests a broader principle: any certification that relies on the provider choosing the data (proof of training) is inherently vulnerable unless the data's provenance is cryptographically attested.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper identifies a fundamental limitation of cryptographic model certification (CMC) schemes whose guarantees bind only to a fixed audit dataset: a malicious model provider who knows the audit dataset can forge training data so that an honestly trained model passes the audit while behaving pathologically on fresh data from the same distribution. The authors formalize this as an attack game (Definition 3), give concrete data-forging attacks against accuracy, fairness, and differential-privacy certification, and provide empirical evidence on several benchmarks. As a constructive response, they introduce formal security definitions for distributional CMC and a generic commit-sample-prove protocol template Πcsp, proving completeness, binding, zero-knowledge, and relaxed knowledge soundness under false-positive/false-negative rate assumptions on an empirical predicate. They also survey nine prior works and classify six as at least partially vulnerable.

Significance. If the results hold, the paper makes an important and timely contribution: it shows that dataset-specific certification — even when cryptographically sound for that dataset — can be meaningless for deployment, and it offers a concrete template for achieving distributional guarantees. The attack theorems, the Hoeffding-based instantiations for accuracy and demographic parity, the empirical evaluation, and the public code release are genuine strengths. The case study systematizes prior work and gives practitioners actionable guidance. However, the proof of the template's zero-knowledge property contains a gap that currently undermines the claimed privacy guarantee of the central constructive result. This gap is likely fixable, but it must be addressed before the paper can be accepted.

major comments (3)
  1. [§F.2, Theorem 3 (Zero Knowledge)] The zero-knowledge simulator commits to the all-zero model and runs the underlying ZKP simulator on statement x=(com_dummy, S_audit). The ZKP simulator is only guaranteed to produce correct transcripts for true statements (x,w)∈R, as stated in §B.3. For a dummy commitment, the statement is typically false (f(0,S_audit)=1 is not guaranteed), so the invocation is outside the ZKP simulator's guarantee. The sentence 'the output of S is indistinguishable from the view of Audit during the interaction ⟨P(h),V⟩((com,S_audit)) for any valid witness h' misapplies the guarantee to a statement with no valid witness. To fix, the simulator needs an efficiently computable model h*(S_audit) with f(h*,S_audit)=1 (true for the accuracy and demographic-parity instantiations), or an equivocal commitment, or a weaker formal privacy notion.
  2. [§C, proof of Theorem 1] The proof handles the case |r_i−x_i|>ε and invokes the 'between-point' lemma requiring strict inequalities. But the theorem's conclusion is T(x)=1 only if ||x−r||_∞<ε; the boundary case ||x−r||_∞=ε is not addressed. When the norm is exactly ε, no strict inequality exists and the constructed point r±ε b_i may coincide with x on one coordinate, so the leaf-containment argument does not apply. For continuous distributions this is a measure-zero event, so the empirical claim is unaffected, but the stated probability-one theorem needs a measure-zero caveat or a slightly strengthened proof.
  3. [§5.2 / Theorem 3 (assumptions)] The soundness and completeness of Πcsp depend on the auditor sampling S_audit i.i.d. from the exact deployment distribution D and on the prover not learning S_audit before committing. While §8 acknowledges this as a practical limitation, the theorem statement itself should make the dependency explicit (e.g., as a precondition 'if S_audit is sampled i.i.d. from D and kept hidden until after commitment'). Otherwise, the formal result can be over-read as applying to any audit dataset, which is precisely the gap the paper warns against.
minor comments (5)
  1. [§1] The abstract states 'over 99% accuracy on an audit dataset, but less than 30% accuracy on fresh samples'; the corresponding empirical results appear in §7 and Figure 3. A pointer to the specific experiment would help the reader verify the claim.
  2. [§3.1] The notation ⟨P(w),V⟩(x) is used for both an interaction and its output bit; on first use it is defined, but later in §3.3 the same notation is reused with different arity. Clarify the output convention (e.g., b←⟨·,·⟩).
  3. [Table 1] The symbol '▲(pd)' is explained only in the caption. It would be clearer to include the explanation in the main text where the table is introduced, since the distinction between 'conditional' and 'supported' is central to the case-study conclusions.
  4. [§F.1] The zero-knowledge definition in F.1 says 'for any h such that F(h,S_train)=1', but Πcsp is defined for predicates F that depend only on h. Either unify the notation (e.g., write F(h)) or state that S_train is optional in the definition.
  5. [Appendix D] Lemma 2 and the proof of Corollary 2 are dense and the notation 'Sk_audit' is not defined before Theorem 2. Define it explicitly (presumably k concatenated copies of S_audit).

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack results and the Πcsp soundness proof are self-contained; the only flagged issue is a non-circular ZK proof gap, plus minor self-citations in the case study.

full rationale

The paper's central derivations are not circular. The data-forging attacks (Algorithm 1 and Theorem 1) prove a property of decision trees trained on adversarially constructed data; this is a self-contained construction, not a fitted parameter renamed as a prediction. The empirical evaluations demonstrate the attack on standard benchmarks rather than 'predicting' a quantity from the same fitted data. The positive result (Theorem 3) derives completeness, binding, and F~-relaxed knowledge soundness from standard commitment/ZKP properties plus Hoeffding bounds connecting the empirical predicate f to the distributional predicates F and F~. Those false-positive/false-negative rate bounds are concentration inequalities, not data-fitted inputs. Self-citations appear in the case-study table (e.g., [21], [41], [42], co-authored by current authors), but they are the objects of analysis rather than evidence supporting the security theorem, so they are not load-bearing. One genuine proof gap exists, but it is not circularity: the zero-knowledge simulator in §F.2 commits to a dummy model and runs the ZKP simulator on (com,S_audit); when f(0,S_audit)≠1, the statement is false and standard ZK simulators are not guaranteed to produce accepting transcripts. This is a correctness flaw in the privacy proof, not a reduction of the theorem to its own assumptions, and it does not affect the attacks or the soundness template. The paper also honestly states limitations, e.g., in §6.2 that its template does not apply to DP-training predicates, which further supports a non-circular assessment.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

No new technical entities are postulated. The load on outside assumptions is mainly procedural: fresh same-distribution sampling and keeping audit data hidden until commitment. The cryptographic primitives are standard.

free parameters (3)
  • delta (accuracy/fairness slack) = e.g., 0.02 or 0.01 in examples
    Introduced by the protocol designer to bridge empirical and distributional error via Hoeffding bounds; the soundness guarantee is t+2delta. It is a design parameter, not fitted to data.
  • n (audit sample size) = 10,000-40,000 in examples
    Chosen to drive false-positive/negative rates below 0.001; scales ZKP cost.
  • epsilon (perturbation radius in attacks) = 1.0 for XGBoost experiments; varies otherwise
    The attacker chooses epsilon so that the epsilon-neighborhood of audit points has small probability mass under D; Theorem 1's conclusion depends on this choice.
assumptions (6)
  • domain assumption The auditor can sample audit data i.i.d. from the deployment distribution D.
    Central to Theorem 3; without same-distribution fresh sampling, the soundness guarantee does not transfer to deployment.
  • domain assumption The audit dataset is kept secret from the prover until after commitment.
    Required for Pi_csp Step 2; if the provider can see S_audit before committing, the attack of Section 4 re-emerges.
  • standard math Underlying commitment and ZK proof systems satisfy standard binding, hiding, completeness, and knowledge soundness.
    Assumed in Theorem 3 and throughout the construction.
  • domain assumption CART decision trees use axis-aligned thresholds and are trained to homogeneous leaves.
    Needed for Theorem 1; not applicable to other model classes without modification.
  • standard math Hoeffding's inequality applies to i.i.d. audit samples.
    Used in Lemmas 3 and 4 to bound false-positive and false-negative rates.
  • domain assumption DP-SGD's sensitivity analysis treats each row independently; duplicating a user's rows is not prevented by the audit.
    Basis of Algorithm 3 and the DP attack; matches Wilson et al.'s bounded-user-contribution critique.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification." pith.science (2026). https://pith.science/paper/TYYK3347

@misc{pith2026260721839,
  author       = {Pith},
  title        = {Pith review of: Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TYYK3347}},
  note         = {Machine review of arXiv:2607.21839}
}
read the original abstract

Privacy-preserving machine learning auditing protocols allow auditors to assess models for properties such as accuracy or fairness, without revealing their internals or training data. This makes them especially attractive for auditing models deployed in sensitive domains such as healthcare or finance. For these protocols to be meaningful in real-world audit settings, though, their guarantees must reflect how the model will behave once deployed, rather than merely certifying its behavior during an audit. Existing security definitions often miss this mark: most certify model behavior only on a fixed audit dataset, without ensuring that the same guarantees generalize to other datasets drawn from the same distribution. As we show, this gap allows a model provider to attack many cryptographic model certification (CMC) schemes built on secure zero knowledge proofs (ZKP) by carefully engineering training data, resulting in models that exhibit benign behavior during an audit, but pathological behavior in practice. For example, we empirically demonstrate that an attacker can certify that a model achieves over 99% accuracy on an audit dataset, but less than 30% accuracy on fresh samples from the same distribution. To address this gap, we formalize rigorous cryptographic security notions tailored to CMC frameworks, introduce a generic protocol template, and prove that it satisfies these requirements. Our results thus offer both cautionary evidence about existing approaches and constructive guidance for designing secure, privacy-preserving ML auditing protocols.

Figures

Figures reproduced from arXiv: 2607.21839 by the authors.

Figure 1
Figure 1. Simplified protocol flow for (insecure) ZK-based ML certification. Left: The model provider, after observing the audit dataset, commits to a model and engages with the auditor in a zero-knowledge proof of accuracy (ZKProofOfAcc). If the audit succeeds, the auditor certifies the committed model. Right: For each new inference query, the model provider interacts with the client in a zero-knowledge proof of inference (Z… view at source ↗
Figure 2
Figure 2. Protocol flow during a data forging attack. The model provider, i.e., the attacker, after observing the audit dataset, commits to a model engineered using the knowledge (indicated by red arrow) of this dataset. Then, it engages with the auditor, i.e., the defender, in a zero-knowledge proof of accuracy (ZKProofOfAcc). If the audit succeeds, the auditor certifies the committed corrupted model. for some predicate f , … view at source ↗
Figure 3
Figure 3. Accuracy of models trained on datasets constructed to minimize real-world accuracy while maintaining high accuracy [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Fairness of models trained on datasets constructed to maintain demographic parity on audit data while producing unfair [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Accuracy of models trained on datasets constructed [PITH_FULL_IMAGE:figures/full_fig_p030_5.png]
Figure 6
Figure 6. Figure 6: Accuracy and denial rates of models trained on [PITH_FULL_IMAGE:figures/full_fig_p030_6.png]
Figure 8
Figure 8. Figure 8: Performance of 226M-parameter neural networks [PITH_FULL_IMAGE:figures/full_fig_p030_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

64 extracted references · 6 canonical work pages

  1. [1]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016

    2016

  2. [2]

    Zero-knowledge proofs of training for deep neural networks

    Kasra Abbaszadeh, Christodoulos Pappas, Jonathan Katz, and Dimitrios Papadopoulos. Zero-knowledge proofs of training for deep neural networks. InPro- ceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 4316– 4330, 2024

    2024

  3. [3]

    Machine bias.ProPublica, May 2016

    Julia Angwin, Jeff Larson, Surya Mattu, and Lauren Kirchner. Machine bias.ProPublica, May 2016. Re- trieved January 15, 2022

    2016

  4. [4]

    Thomas Attema, Michael Klooß, Russell W. F. Lai, and Pavlo Yatsyna. Adaptive special soundness: Im- proved knowledge extraction by adaptive useful chal- lenge sampling. Cryptology ePrint Archive, Paper 2024/2038, 2024. URL: https://eprint.iacr.org/ 2024/2038

    2024

  5. [5]

    Velox: Scalable fair asynchronous MPC from lightweight cryp- tography

    Akhil Bandarupalli, Xiaoyu Ji, Aniket Kate, Chen-Da Liu-Zhang, Daniel Pöllmann, and Yifan Song. Velox: Scalable fair asynchronous MPC from lightweight cryp- tography. In Chun-Ying Huang, Jyh-Cheng Chen, Shiuh- Pyng Shieh, David Lie, and Véronique Cortier, editors, Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security, CCS 2...

    arXiv 2025

  6. [6]

    Joseph, and J

    Marco Barreno, Blaine Nelson, Anthony D. Joseph, and J. D. Tygar. The security of machine learning.Mach. Learn., 81(2):121–148, 2010

    2010

  7. [7]

    Barry Becker and Ronny Kohavi. Adult. UCI Machine Learning Repository, 1996

    1996

  8. [8]

    Completeness theorems for non-cryptographic fault- tolerant distributed computation (extended abstract)

    Michael Ben-Or, Shafi Goldwasser, and Avi Wigderson. Completeness theorems for non-cryptographic fault- tolerant distributed computation (extended abstract). In Janos Simon, editor,Proceedings of the 20th Annual ACM Symposium on Theory of Computing, May 2-4, 1988, Chicago, Illinois, USA, pages 1–10. ACM, 1988. doi:10.1145/62212.62213

    arXiv 1988

Show all 64 references
  1. [9]

    P2NIA: privacy-preserving non-iterative auditing.CoRR, abs/2504.00874, 2025

    Jade Garcia Bourrée, Hadrien Lautraite, Sébastien Gambs, Gilles Trédan, Erwan Le Merrer, and Benoît Rottembourg. P2NIA: privacy-preserving non-iterative auditing.CoRR, abs/2504.00874, 2025. URL: https://doi.org/10.48550/arXiv.2504.00874, arXiv:2504.00874, doi:10.48550/ARXIV.25...

    2025 doi arXiv

  2. [10]

    Multilinear schwartz- zippel mod N and lattice-based succinct arguments

    Benedikt Bünz and Ben Fisch. Multilinear schwartz- zippel mod N and lattice-based succinct arguments. In Guy N. Rothblum and Hoeteck Wee, editors,Theory of Cryptography - 21st International Conference, TCC 2023, Taipei, Taiwan, November 29 - December 2, 2023, Proceedings, Part...

    2023 doi

  3. [11]

    Building classifiers with independency constraints

    Toon Calders, Faisal Kamiran, and Mykola Pechenizkiy. Building classifiers with independency constraints. In Yücel Saygin, Jeffrey Xu Yu, Hillol Kargupta, Wei Wang, Sanjay Ranka, Philip S. Yu, and Xindong Wu, ed- itors,ICDM Workshops 2009, IEEE International Con- ference on Da...

    2009 doi

  4. [12]

    {HOLMES}: Efficient distribution testing for secure collaborative learning

    Ian Chang, Katerina Sotiraki, Weikeng Chen, Murat Kantarcioglu, and Raluca Popa. {HOLMES}: Efficient distribution testing for secure collaborative learning. In 32nd USENIX Security Symposium (USENIX Security 23), pages 4823–4840, 2023

    2023

  5. [13]

    Multiparty unconditionally secure protocols (abstract)

    David Chaum, Claude Crépeau, and Ivan Damgård. Multiparty unconditionally secure protocols (abstract). In Carl Pomerance, editor,Advances in Cryptology - CRYPTO ’87, A Conference on the Theory and Applica- tions of Cryptographic Techniques, Santa Barbara, Cal- ifornia, USA, Au...

    1987 doi

  6. [14]

    Xgboost: A scal- able tree boosting system

    Tianqi Chen and Carlos Guestrin. Xgboost: A scal- able tree boosting system. In Balaji Krishnapuram, Mohak Shah, Alexander J. Smola, Charu C. Aggarwal, Dou Shen, and Rajeev Rastogi, editors,Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and ...

    2016

  7. [16]

    Scalable and un- conditionally secure multiparty computation

    Ivan Damgård and Jesper Buus Nielsen. Scalable and un- conditionally secure multiparty computation. In Alfred Menezes, editor,Advances in Cryptology - CRYPTO 2007, 27th Annual International Cryptology Confer- ence, Santa Barbara, CA, USA, August 19-23, 2007, Proceedings, volum...

    2007 doi

  8. [17]

    Retiring adult: New datasets for fair machine learning.Advances in Neural Information Processing Systems, 34, 2021

    Frances Ding, Moritz Hardt, John Miller, and Ludwig Schmidt. Retiring adult: New datasets for fair machine learning.Advances in Neural Information Processing Systems, 34, 2021

    2021

  9. [18]

    Attesting distributional properties of training data for machine learning

    Vasisht Duddu, Anudeep Das, Nora Khayata, Hossein Yalame, Thomas Schneider, and N Asokan. Attesting distributional properties of training data for machine learning. InEuropean Symposium on Research in Com- puter Security, pages 3–23. Springer, 2024

    2024

  10. [19]

    The algorithmic foundations of differential privacy.Foundations and trends® in theoretical computer science, 9(3–4):211– 407, 2014

    Cynthia Dwork, Aaron Roth, et al. The algorithmic foundations of differential privacy.Foundations and trends® in theoretical computer science, 9(3–4):211– 407, 2014

    2014

  11. [20]

    Towards scalable YOSO MPC via packed secret-sharing

    Daniel Escudero, Elisaweta Masserova, and Antigoni Polychroniadou. Towards scalable YOSO MPC via packed secret-sharing. In Goichiro Hanaoka and Bo-Yin Yang, editors,Advances in Cryptology - ASIACRYPT 2025 - 31st International Conference on the Theory and Application of Cryptol...

    2025 doi

  12. [21]

    Oath: Efficient and flexible zero-knowledge proofs of end-to-end ml fairness.arXiv preprint arXiv:2410.02777, 2024

    Olive Franzese, Ali Shahin Shamsabadi, and Hamed Haddadi. Oath: Efficient and flexible zero-knowledge proofs of end-to-end ml fairness.arXiv preprint arXiv:2410.02777, 2024

    2024

  13. [22]

    Experimenting with zero- knowledge proofs of training

    Sanjam Garg, Aarushi Goel, Somesh Jha, Saeed Mahlou- jifar, Mohammad Mahmoody, Guru-Vamsi Policharla, and Mingyuan Wang. Experimenting with zero- knowledge proofs of training. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Com- munications Security, pages 1880...

    2023

  14. [23]

    The exact round complex- ity of secure computation

    Sanjam Garg, Pratyay Mukherjee, Omkant Pandey, and Antigoni Polychroniadou. The exact round complex- ity of secure computation. In Marc Fischlin and Jean- Sébastien Coron, editors,Advances in Cryptology - EU- ROCRYPT 2016 - 35th Annual International Confer- ence on the Theory ...

    2016 doi

  15. [24]

    YOSO: you only speak once - secure MPC with stateless ephemeral roles

    Craig Gentry, Shai Halevi, Hugo Krawczyk, Bernardo Magri, Jesper Buus Nielsen, Tal Rabin, and Sophia Yak- oubov. YOSO: you only speak once - secure MPC with stateless ephemeral roles. In Tal Malkin and Chris Peikert, editors,Advances in Cryptology - CRYPTO 2021 - 41st Annual I...

    2021 doi

  16. [25]

    How to play any mental game or A completeness theorem for protocols with honest majority

    Oded Goldreich, Silvio Micali, and Avi Wigderson. How to play any mental game or A completeness theorem for protocols with honest majority. In Alfred V . Aho, editor,Proceedings of the 19th Annual ACM Sympo- sium on Theory of Computing, 1987, New York, New York, USA, pages 218...

    1987

  17. [26]

    The knowledge complexity of interactive proof- systems (extended abstract)

    Shafi Goldwasser, Silvio Micali, and Charles Rack- off. The knowledge complexity of interactive proof- systems (extended abstract). In Robert Sedgewick, editor,Proceedings of the 17th Annual ACM Sympo- sium on Theory of Computing, May 6-8, 1985, Provi- dence, Rhode Island, USA...

    1985

  18. [27]

    Blockchains enable non-interactive MPC

    Vipul Goyal, Elisaweta Masserova, Bryan Parno, and Yifan Song. Blockchains enable non-interactive MPC. In Kobbi Nissim and Brent Waters, editors,Theory of Cryptography - 19th International Conference, TCC 2021, Raleigh, NC, USA, November 8-11, 2021, Pro- ceedings, Part II, vol...

    2021 doi

  19. [28]

    How one of apple’s key privacy safeguards falls short.Wired

    Andy Greenberg. How one of apple’s key privacy safeguards falls short.Wired. URL: https://www.wired.com/story/ apple-differential-privacy-shortcomings/

  20. [29]

    The emerging science of machine learn- ing benchmarks.Manuscript

    Moritz Hardt. The emerging science of machine learn- ing benchmarks.Manuscript. https://mlbenchmarks. org, 2025

    2025

  21. [30]

    Statlog (German Credit Data)

    Hans Hofmann. Statlog (German Credit Data). UCI Machine Learning Repository, 1994. DOI: https://doi.org/10.24432/C5NC77

    1994 doi

  22. [31]

    Membership in- ference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    Hongsheng Hu, Zoran Salcic, Lichao Sun, Gillian Dob- bie, Philip S Yu, and Xuyun Zhang. Membership in- ference attacks on machine learning: A survey.ACM Computing Surveys (CSUR), 54(11s):1–37, 2022

    2022

  23. [32]

    Found- ing cryptography on oblivious transfer - efficiently

    Yuval Ishai, Manoj Prabhakaran, and Amit Sahai. Found- ing cryptography on oblivious transfer - efficiently. In David A. Wagner, editor,Advances in Cryptology - CRYPTO 2008, 28th Annual International Cryptol- ogy Conference, Santa Barbara, CA, USA, August 17- 21, 2008. Proceed...

    2008 doi

  24. [33]

    Scaling up trustless DNN inference with zero- knowledge proofs.CoRR, abs/2210.08674, 2022

    Daniel Kang, Tatsunori Hashimoto, Ion Stoica, and Yi Sun. Scaling up trustless DNN inference with zero- knowledge proofs.CoRR, abs/2210.08674, 2022. URL: https://doi.org/10.48550/arXiv.2210.08674, arXiv:2210.08674, doi:10.48550/ARXIV.2210. 08674

    2022 doi arXiv

  25. [34]

    Billion-gate secure computation with malicious adversaries

    Benjamin Kreuter, Abhi Shelat, and Chih-Hao Shen. Billion-gate secure computation with malicious adversaries. In Tadayoshi Kohno, editor,Proceedings of the 21th USENIX Security Symposium, Belle- vue, WA, USA, August 8-10, 2012, pages 285–300. USENIX Association, 2012. URL: htt...

    2012

  26. [35]

    zkcnn: Zero knowledge proofs for convolutional neural network pre- dictions and accuracy

    Tianyi Liu, Xiang Xie, and Yupeng Zhang. zkcnn: Zero knowledge proofs for convolutional neural network pre- dictions and accuracy. In Yongdae Kim, Jong Kim, Giovanni Vigna, and Elaine Shi, editors,CCS ’21: 2021 ACM SIGSAC Conference on Computer and Commu- nications Security, V...

    2021

  27. [36]

    Model cards for model reporting

    Margaret Mitchell, Simone Wu, Andrew Zaldivar, Parker Barnes, Lucy Vasserman, Ben Hutchinson, Elena Spitzer, Inioluwa Deborah Raji, and Timnit Gebru. Model cards for model reporting. InProceedings of the conference on fairness, accountability, and transparency, pages 220– 229, 2019

    2019

  28. [37]

    PhD thesis, ETH Zurich, 10 2022

    Ngoc Khanh Nguyen.Lattice-Based Zero- Knowledge Proofs Under a Few Dozen Kilo- bytes. PhD thesis, ETH Zurich, 10 2022. https://www.research-collection.ethz.ch/ handle/20.500.11850/574844

    2022

  29. [38]

    Sparrow: Space-efficient zksnark for data-parallel cir- cuits and applications to zero-knowledge decision trees

    Christodoulos Pappas and Dimitrios Papadopoulos. Sparrow: Space-efficient zksnark for data-parallel cir- cuits and applications to zero-knowledge decision trees. InProceedings of the 2024 on ACM SIGSAC Confer- ence on Computer and Communications Security, pages 3110–3124, 2024

    2024

  30. [39]

    Communities and Crime

    Michael Redmond. Communities and Crime. UCI Machine Learning Repository, 2009

    2009

  31. [40]

    Aequitas: A bias and fairness audit toolkit

    Pedro Saleiro, Benedict Kuester, Loren Hinkson, Jesse London, Abby Stevens, Ari Anisfeld, Kit T Rodolfa, and Rayid Ghani. Aequitas: A bias and fairness audit toolkit. arXiv preprint arXiv:1811.05577, 2018

    2018 arXiv

  32. [41]

    Confidential-dpproof: Confidential proof of differentially private training

    Ali Shahin Shamsabadi, Gefei Tan, Tudor Ioan Cebere, Aurélien Bellet, Hamed Haddadi, Nicolas Papernot, Xiao Wang, and Adrian Weller. Confidential-dpproof: Confidential proof of differentially private training. In International Conference on Learning Representations (ICLR), 2024

    2024

  33. [42]

    Confidential- profitt: confidential proof of fair training of trees

    Ali Shahin Shamsabadi, Sierra Calanda Wyllie, Nicholas Franzese, Natalie Dullerud, Sébastien Gambs, Nicolas Papernot, Xiao Wang, and Adrian Weller. Confidential- profitt: confidential proof of fair training of trees. InThe Eleventh International Conference on Learning Repre- s...

    2022

  34. [43]

    Stochastic gradient descent with differentially private updates

    Shuang Song, Kamalika Chaudhuri, and Anand D Sar- wate. Stochastic gradient descent with differentially private updates. In2013 IEEE global conference on sig- nal and information processing, pages 245–248. IEEE, 2013

    2013

  35. [44]

    Certi- fied defenses for data poisoning attacks

    Jacob Steinhardt, Pang Wei Koh, and Percy Liang. Certi- fied defenses for data poisoning attacks. InNIPS, pages 3517–3529, 2017

    2017

  36. [45]

    Zkdl: Efficient zero-knowledge proofs of deep learning training.IEEE Transactions on Information Forensics and Security, 2024

    Haochen Sun, Tonghe Bai, Jason Li, and Hongyang Zhang. Zkdl: Efficient zero-knowledge proofs of deep learning training.IEEE Transactions on Information Forensics and Security, 2024

    2024

  37. [46]

    Distill-and-compare: Auditing black-box models using transparent model distillation

    Sarah Tan, Rich Caruana, Giles Hooker, and Yin Lou. Distill-and-compare: Auditing black-box models using transparent model distillation. InAIES, pages 303–310. ACM, 2018

    2018

  38. [47]

    Fairtest: Discovering unwar- ranted associations in data-driven applications

    Florian Tramer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, Jean-Pierre Hubaux, Mathias Humbert, Ari Juels, and Huang Lin. Fairtest: Discovering unwar- ranted associations in data-driven applications. In2017 IEEE European Symposium on Security and Privacy (EuroS&P), pages...

    2017

  39. [48]

    ezdps: An ef- ficient and zero-knowledge machine learning in- ference pipeline.Proc

    Haodi Wang and Thang Hoang. ezdps: An ef- ficient and zero-knowledge machine learning in- ference pipeline.Proc. Priv. Enhancing Tech- nol., 2023(2):430–448, 2023. URL: https://doi. org/10.56553/popets-2023-0061, doi:10.56553/ POPETS-2023-0061

    2023 doi

  40. [49]

    The generalization of ‘stu- dent’s’problem when several different population var- lances are involved.Biometrika, 34(1-2):28–35, 1947

    Bernard L Welch. The generalization of ‘stu- dent’s’problem when several different population var- lances are involved.Biometrika, 34(1-2):28–35, 1947

    1947

  41. [50]

    Differentially private sql with bounded user contribution.Proceedings on Privacy Enhancing Technologies, 2020

    Royce J Wilson, Celia Yuxin Zhang, William Lam, Damien Desfontaines, Daniel Simmons-Marengo, and Bryant Gipson. Differentially private sql with bounded user contribution.Proceedings on Privacy Enhancing Technologies, 2020

    2020

  42. [51]

    Fairproof: Confidential and certifiable fairness for neural networks.arXiv preprint arXiv:2402.12572, 2024

    Chhavi Yadav, Amrita Roy Chowdhury, Dan Boneh, and Kamalika Chaudhuri. Fairproof: Confidential and certifiable fairness for neural networks.arXiv preprint arXiv:2402.12572, 2024

    2024 arXiv

  43. [52]

    Protocols for secure computa- tions (extended abstract)

    Andrew Chi-Chih Yao. Protocols for secure computa- tions (extended abstract). In23rd Annual Symposium on Foundations of Computer Science, Chicago, Illinois, USA, 3-5 November 1982, pages 160–164. IEEE Com- puter Society, 1982.doi:10.1109/SFCS.1982.38

    1982 doi

  44. [53]

    How to generate and exchange secrets (extended abstract)

    Andrew Chi-Chih Yao. How to generate and exchange secrets (extended abstract). In27th Annual Symposium on Foundations of Computer Science, Toronto, Canada, 27-29 October 1986, pages 162–167. IEEE Computer Society, 1986.doi:10.1109/SFCS.1986.25

    1986 doi

  45. [54]

    The comparisons of data mining techniques for the predictive accu- racy of probability of default of credit card clients

    I-Cheng Yeh and Che hui Lien. The comparisons of data mining techniques for the predictive accu- racy of probability of default of credit card clients. Expert Systems with Applications, 36(2, Part 1):2473– 2480, 2009. URL: https://www.sciencedirect. com/science/article/pii/S09...

    2009 doi

  46. [55]

    How benchmark prediction from fewer data misses the mark.arXiv preprint arXiv:2506.07673, 2025

    Guanhua Zhang, Florian E Dorner, and Moritz Hardt. How benchmark prediction from fewer data misses the mark.arXiv preprint arXiv:2506.07673, 2025

    2025 arXiv

  47. [56]

    Zero knowledge proofs for decision tree predictions and accuracy

    Jiaheng Zhang, Zhiyong Fang, Yupeng Zhang, and Dawn Song. Zero knowledge proofs for decision tree predictions and accuracy. InCCS, pages 2039–2053. ACM, 2020

  48. [57]

    With respect to a private datasetchosen by the model provider, the committed model satisfies certain fairness guarantees

    Tianyu Zhang, Shen Dong, Oyku Deniz Kose, Yanning Shen, and Yupeng Zhang. Fairzk: A scalable system to prove machine learning fairness in zero-knowledge. In Marina Blanton, William Enck, and Cristina Nita- Rotaru, editors,IEEE Symposium on Security and Pri- vacy, SP 2025, San ...

    2025

  49. [58]

    RunProve ∗ to getcom

  50. [59]

    SampleS∼D n,r E ←R E, andr P ←R P

  51. [60]

    Run EP (x;r E ) to extract the witness (h,ρ)

    Let P0 be the algorithm that outputs x= (com,S) as a statement and P= (P0,P 1), where P1’s randomness is fixed to rP . Run EP (x;r E ) to extract the witness (h,ρ)

  52. [61]

    Iff(h,S)̸=1 orcom̸=Commit(h;ρ), abort

  53. [62]

    12We require this to realize negligible distinguishing advantage as in the standard zero-knowledge definition

    Repeat the following process: (a) SampleS ′ ∼D n andr ′ E ←R E. 12We require this to realize negligible distinguishing advantage as in the standard zero-knowledge definition. If pfnr is small but not negligible, one could relax the zero-knowledge property for CMC to allow for ...

  54. [63]

    Generate a dummy commitment com←Commit(0;ρ) using a uniformly random stringρ∈ {0,1}ℓρ

  55. [64]

    RunS((com,S audit))to get a simulatedview ′ forZKP

  56. [65]

    Since Commit is hiding, the dummy commitment is indistin- guishable from a real commitment

    Outputview= (com,S audit,view ′). Since Commit is hiding, the dummy commitment is indistin- guishable from a real commitment. Moreover, the output of S is indistinguishable from the view of Audit during the interac- tion ⟨P(h),V⟩((com,S audit)) for any valid witness h. Since a...

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.