zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Training
Open accessAbstract
The recent advancements in deep learning have brought about significant changes in various aspects of people’s lives. Meanwhile, these rapid developments have raised concerns about the legitimacy of the training process of deep neural networks. To protect the intellectual properties of AI developers, directly examining the training process by accessing the model parameters and training data is often prohibited for verifiers. In response to this challenge, we present zero-knowledge deep learning (zkDL), an efficient zero-knowledge proof for deep learning training. To address the long-standing challenge of verifiable computations of non-linearities in deep learning training, we introduce zkReLU, a specialized proof for the ReLU activation and its backpropagation. zkReLU turns the disadvantage of non-arithmetic relations into an advantage, leading to the creation of FAC4DNN, our specialized arithmetic circuit design for modelling neural networks. This design aggregates the proofs over different layers and training steps, without being constrained by their sequential order in the training process. With our new CUDA implementation that achieves full compatibility with the tensor structures and the aggregated proof design, zkDL enables the generation of complete and sound proofs in less than a second per batch update for an 8-layer neural network with 10M parameters and a batch size of 64, while provably ensuring the privacy of data and model parameters. To our best knowledge, we are not aware of any existing work on zero-knowledge proof of deep learning training that is scalable to million-size networks.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Proof generation for even moderate-scale training remains orders of magnitude more expensive than inference-level proofs.
“Generating zkSNARK proofs for such heavy procedures is particularly unrealistic, as proof generation for even moderate-scale training remains orders of magnitude more expensive than inference-level proofs [2].”
From Verifiable Unlearning on Edge (2025) · cites this paper as [2]
Cites
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946 · see citing works
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372 · see citing works
(2010) · Cited by 8,261 · see citing works
LLaMA: Open and Efficient Foundation Language Models
Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozière, B., Goyal, N., Hambro, E., Azhar, F., et al. (2023) · arXiv · doi:10.48550/arxiv.2302.13971 · Cited by 4,602 · see citing works
PaLM: Scaling Language Modeling with Pathways
Chowdhery, A., Narang, S., Devlin, J., Bosma, M., Mishra, G., Roberts, A., Barham, P., Chung, H. W., Sutton, C., Gehrmann, S., et al. (2022) · arXiv · doi:10.48550/arxiv.2204.02311 · Cited by 2,590 · see citing works
Fast Probabilistic Algorithms for Verification of Polynomial Identities
Schwartz, J. T. (1980) · Journal of the ACM · doi:10.1145/322217.322225 · Cited by 1,704 · see citing works
On the Size of Pairing-Based Non-interactive Arguments
Groth, J. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-662-49896-5_11 · Cited by 1,271 · see citing works
Probabilistic algorithms for sparse polynomials
Zippel, R. E. (1979) · Lecture notes in computer science · doi:10.1007/3-540-09519-5_73 · Cited by 1,122 · see citing works
Gemini: A Family of Highly Capable Multimodal Models
Gemini Team, Anil, R., Borgeaud, S., Alayrac, J.-B., Yu, J., Soricut, R., Schalkwyk, J., Dai, A. M., Hauth, A., Millican, K., et al. (2023) · arXiv · doi:10.48550/arxiv.2312.11805 · Cited by 990 · see citing works
Pinocchio: Nearly Practical Verifiable Computation
Parno, B., Howell, J., Gentry, C., & Raykova, M. (2013) · 2013 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2013.47 · Cited by 864 · see citing works
Algebraic methods for interactive proof systems
Lund, C., Fortnow, L., Karloff, H. J., & Nisan, N. (1992) · Journal of the ACM · doi:10.1145/146585.146605 · Cited by 715 · see citing works
Goldwasser, S., Kalai, Y. T., & Rothblum, G. N. (2008) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/1374376.1374396 · Cited by 484 · see citing works
Zero-knowledge from secure multiparty computation
Ishai, Y., Eyal Kushilevitz, Z., Ostrovsky, R., & Sahai, A. (2007) · ACM Symposium on Theory of Computing (STOC) · doi:10.1145/1250790.1250794 · Cited by 425 · see citing works
Doubly-Efficient zkSNARKs Without Trusted Setup
Wahby, R. S., Tzialla, I., Shelat, A., Thaler, J., & Walfish, M. (2018) · 2018 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2018.00060 · Cited by 276 · see citing works
Practical verified computation with streaming interactive proofs
Cormode, G., Mitzenmacher, M., & Thaler, J. (2012) · Conference on Innovations in Theoretical Computer Science · doi:10.1145/2090236.2090245 · Cited by 201 · see citing works
Libra: Succinct Zero-Knowledge Proofs with Optimal Prover Computation
Xie, T., Zhang, J., Zhang, Y., Papamanthou, C., & Song, D. (2019) · Lecture notes in computer science · doi:10.1007/978-3-030-26954-8_24 · Cited by 199 · see citing works
Time-Optimal Interactive Proofs for Circuit Evaluation
Thaler, J. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-40084-1_5 · Cited by 190 · see citing works
PLONK: Permutations over Lagrange-bases for Oecumenical Noninteractive arguments of Knowledge.Preprint
Gabizon, A., Williamson, Z. J., & Ciobotaru, O. (2019) · IACR Cryptology ePrint Archive · Cited by 187 · see citing works
zkCNN: Zero Knowledge Proofs for Convolutional Neural Network Predictions and Accuracy
Liu, T., Xie, X., & Zhang, Y. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3485379 · Cited by 173 · see citing works
Certified Data Removal from Machine Learning Models
Guo, C., Goldstein, T., Hannun, A., & van der Maaten, L. (2019) · arXiv · doi:10.48550/arxiv.1911.03030 · Cited by 160 · see citing works
SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted CloudPreprint
Ghodsi, Z., Gu, T., & Garg, S. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1706.10268 · Cited by 119 · see citing works
VeriFi: Towards Verifiable Federated Unlearning
Gao, X., Ma, X., Wang, J., Sun, Y., Li, B., Ji, S., Cheng, P., & Chen, J. (2024) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2024.3382321 · Cited by 111 · see citing works
VeriML: Enabling Integrity Assurances and Fair Payments for Machine Learning as a Service
Zhao, L., Wang, Q., Wang, C., Li, Q. L., Shen, C. Q., & Feng, B. (2021) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2021.3068195 · Cited by 105 · see citing works
Proof-of-Learning: Definitions and Practice
Jia, H., Yaghini, M., Choquette-Choo, C. A., Dullerud, N., Thudi, A., Chandrasekaran, V., & Papernot, N. (2021) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp40001.2021.00106 · Cited by 89 · see citing works
Orion: Zero Knowledge Proof with Linear Prover Time
Xie, T., Zhang, Y., & Song, D. X. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-15985-5_11 · Cited by 88 · see citing works
pvCNN: Privacy-Preserving and Verifiable Convolutional Neural Network Testing
Weng, J., Weng, J., Tang, G., Yang, A., Li, M., & Liu, J.-N. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3262932 · Cited by 57 · see citing works
Doubly Efficient Interactive Proofs for General Arithmetic Circuits with Linear Prover Time
Zhang, J., Liu, T., Wang, W., Zhang, Y., Song, D., Xie, X., & Zhang, Y. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484767 · Cited by 54 · see citing works
Experimenting with Zero-Knowledge Proofs of Training
Garg, S., Goel, A., Jha, S., Mahloujifar, S., Mahmoody, M., Policharla, G.-V., & Wang, M. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623202 · Cited by 43 · see citing works
Mystique: Efficient Conversions for Zero-Knowledge Proofs with Applications to Machine Learning.Preprint
Weng, C., Yang, K., Xie, X., Katz, J. I., & Wang, X. (2021) · IACR Cryptology ePrint Archive · Cited by 41 · see citing works
Towards Probabilistic Verification of Machine Unlearning
Sommer, D. M., Song, L., Wagh, S., & Mittal, P. (2020) · arXiv · doi:10.48550/arxiv.2003.04247 · Cited by 38 · see citing works
Proof of Unlearning: Definitions and Instantiation
Weng, J., Yao, S., Du, Y., Huang, J., Weng, J., & Wang, C. (2024) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2024.3358993 · Cited by 30 · see citing works
“Adversarial Examples” for Proof-of-Learning
Zhang, R., Liu, J., Ding, Y., Wang, Z., Wu, Q., & Ren, K. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833596 · Cited by 24 · see citing works
Succinct Non-Interactive Arguments via Linear Interactive Proofs
Bitansky, N., Chiesa, A., Ishai, Y., Ostrovsky, R., & Paneth, O. (2022) · Journal of Cryptology · doi:10.1007/s00145-022-09424-4 · Cited by 24 · see citing works
On Polynomial Approximations for Privacy-Preserving and Verifiable ReLU NetworksPreprint
Ali, R. E., So, J., & Avestimehr, A. S. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.05530 · Cited by 24 · see citing works
ezDPS: An Efficient and Zero-Knowledge Machine Learning Inference Pipeline
Wang, H., & Hoang, T. (2023) · Proceedings on Privacy Enhancing Technologies · doi:10.56553/popets-2023-0061 · Cited by 21 · see citing works
Proof-of-Learning is Currently More Broken Than You Think
Fang, C., Jia, H., Thudi, A., Yaghini, M., Choquette-Choo, C. A., Dullerud, N., Chandrasekaran, V., & Papernot, N. (2023) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp57164.2023.00052 · Cited by 20 · see citing works
Scaling up Trustless DNN Inference with Zero-Knowledge ProofsPreprint
Kang, D. D., Hashimoto, T., Stoica, I. G., & Sun, Y. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2210.08674 · Cited by 19 · see citing works
vCNN: Verifiable Convolutional Neural Network.Preprint
Lee, S., Ko, H., Kim, J., & Oh, H. (2020) · IACR Cryptology ePrint Archive · Cited by 18 · see citing works
Halo Infinite: Recursive zk-SNARKs from any Additive Polynomial Commitment Scheme.Preprint
Boneh, D., Drake, J., Fisch, B., & Gabizon, A. (2020) · IACR Cryptology ePrint Archive · Cited by 12 · see citing works
ZEN: Efficient Zero-Knowledge Proofs for Neural Networks.Preprint
Feng, B., Qin, L., Zhen-fei, Z., Ding, Y., & Chu, S. (2021) · IACR Cryptology ePrint Archive · Cited by 6 · see citing works
Flagged first, then by citations
2 of the 42 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
Enhancing Privacy and Integrity in Computing Services Provisioning Using Blockchain and Zk-SNARKs
Ballesteros-Rodríguez, A., Sánchez‐Alonso, S., & Sicilia, M. (2024) · IEEE Access · doi:10.1109/access.2024.3447785 · Cited by 16 · see citing works
TruVRF: Toward Triple-Granularity Verification on Machine Unlearning
Zhou, C., Gao, Y., Fu, A., Chen, K., Zhang, Z., Xue, M., Dai, Z., Ji, S., & Zhang, Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3565991 · Cited by 7 · see citing works
A Framework for Cryptographic Verifiability of End-to-End AI Pipelines
Balan, K., Learney, R. M., & Wood, T. (2025) · ACM International Workshop on Security and Privacy Analytics (IWSPA) · doi:10.1145/3716815.3729011 · Cited by 9 · see citing works
Hybrid and adaptive framework for secure and scalable authentication in healthcare IoT
Iqbal, R., Afzaal, M., & Rathee, G. (2025) · Array · doi:10.1016/j.array.2025.100527 · Cited by 4 · see citing works
Federated Learning with Assured Privacy and Reputation-Driven Incentives for Internet of Vehicles
Chai, J., Chen, M., Zhang, W., Wang, X., & Song, J. (2026) · Sensors · doi:10.3390/s26051720 · Cited by 4 · see citing works
Ural, Ö., & Yoshigoe, K. (2024) · IEEE Access · doi:10.1109/access.2024.3489776 · Cited by 4 · see citing works
Laminator: Verifiable ML Property Cards using Hardware-assisted Attestations
Duddu, V., Järvinen, O., Gunn, L. J., & Asokan, N. (2024) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3714393.3726492 · Cited by 4 · see citing works
ZkVML: Zero-Knowledge Verifiable Machine Learning
Aziz, M. B., Naushad, A. S., Siddiqui, M. U., & Shamsi, J. A. (2025) · Communications in computer and information science · doi:10.1007/978-3-031-89813-6_14 · Cited by 3 · see citing works
Founding Zero-Knowledge Proof of Training on Optimum Vicinity
Tan, G., Gascón, A., Meiklejohn, S., Raykova, M., Wang, X. S., & Luo, N. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3744862 · Cited by 3 · see citing works
zkVFL: Verifiable Federated Learning for Free-Rider Attacks via Efficient Zero-Knowledge Proofs
Liu, J., Sun, L., Kang, T., Wu, D., Song, Y., Xie, Y., & Guo, L. (2025) · IEEE Internet of Things Journal · doi:10.1109/jiot.2025.3638886 · Cited by 3 · see citing works
FairZK: A Scalable System to Prove Machine Learning Fairness in Zero-Knowledge
Zhang, T., Dong, S., Kose, O. D., Shen, Y., & Zhang, Y. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00205 · Cited by 2 · see citing works
Zhao, S., Sun, K., Zhao, C., Jiang, B., Chen, Z., & Xu, Q. (2025) · Chinese Journal of Electronics · doi:10.23919/cje.2025.00.038 · Cited by 2 · see citing works
Liu, C., Zhou, H., Yang, L., Wu, Z. Y., Dai, P., Li, Y., Wu, S., & Yang, F. (2024) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2024.3524364 · Cited by 2 · see citing works
Face Protection Based on Optimizing Latent Code Space With Multiple Loss Function Constraints
Zhang, J., Yang, D., Li, R., & Li, Z. (2025) · IEEE Signal Processing Letters · doi:10.1109/lsp.2025.3622533 · Cited by 1 · see citing works
ScaleCirc: Scaling the Analysis over Circom Circuits
Jiang, J., Qin, H., & Luo, X. (2025) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase63991.2025.00124 · Cited by 1 · see citing works
Anonymity and Privacy-Enhancing Mechanisms for AI-Based e-Health Systems
Tsantikidou, K., Sklavos, N., & Symeonidis, I. (2026) · Signals and communication technology · doi:10.1007/978-3-032-03554-7_12 · Cited by 1 · see citing works
Game-Theoretic Defense Against Encrypted Data Poisoning in Federated Learning for Social Networks
Sun, Z., Gao, W., Yin, P., Li, W., Zhang, M., Chen, Y., & Shu, J. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-7027-0_6 · Cited by 1 · see citing works
Maheri, M. M., Davidson, A., & Haddadi, H. (2025) · arXiv · doi:10.48550/arxiv.2506.20037
“Generating zkSNARK proofs for such heavy procedures is particularly unrealistic, as proof generation for even moderate-scale training remains orders of magnitude more expensive than inference-level proofs [2].”
SoK: The Role of Zero-Knowledge Proofs in Building Confidential and Trustworthy AI
Nourmohammadi, R., & Zhang, K. (2025) · International Conference on Blockchain Computing and Applications (BCCA) · doi:10.1109/bcca66705.2025.11229769
Trustworthy distributed mirror learning for secure and private multi-agent coordination
Wei, S., Jia, J., Feng, X., & Yu, H. (2025) · Engineering Applications of Artificial Intelligence · doi:10.1016/j.engappai.2025.112812
Zero-Knowledge Enhanced Adaptation Learning (ZEAL): A Framework for Verifiable Model Adaptation
Panchal, D., Mehta, H., Shetty, P., Kanani, P., Sankhe, D., & Kumar, R. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-04312-2_31
Blockchain-enabled AI Collaboration
Zhang, J., Zhang, Y., Zhang, T., Gao, J., & Chen, Z. (2025) · IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) · doi:10.1109/cyberscitech68397.2025.00108
Zero-Knowledge Quantized Weighted Majority Algorithm
Quan, L., Jiang, X., & Düdder, B. (2025) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom66490.2025.00024
ZkGCN: Zero-Knowledge Based Verifiable Inference for Graph Convolutional Networks
Ding, H., Wu, L., Luo, Y., & Jiang, H. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-8408-6_20
Matrix Commitment-Based Ownership Verification for Distributed Machine Learning
Xie, T., Gai, K., Yu, J., Zhu, L., & Wu, Q. (2026) · IEEE Transactions on Pattern Analysis and Machine Intelligence · doi:10.1109/tpami.2026.3687640
Sum-Check Protocol for Approximate Computations
Bitan, D., DeStefano, Z., Goldwasser, S., Ishai, Y., Kalai, Y. T., & Thaler, J. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-25336-1_8
Yang, Y., Chen, Z., Yang, J., & Li, J. (2026) · International Conference on Computer Supported Cooperative Work in Design (CSCWD) · doi:10.1109/cscwd68734.2026.11581738
Self-citationZero-Knowledge Proof Mechanisms for Trustless Federated Learning on Blockchain
Santosh Kumar, B., Sangeetha, N., Shinzeer, C. K., Ramya, R., G.Uma, & Saravanan, M. (2025) · International Conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud) (I-SMAC) · doi:10.1109/i-smac65734.2025.11597672
SUMMER: Recursive Zero-Knowledge Proofs for Scalable RNN Training
Li, Y., & Fan, X. (2026) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp68448.2026.00018
S, S. P. Y. V., Mohammed, A. B., Kishor Kumar Reddy, C., Madana Mohana, R., & Venkata, R. M. B. (2026) · Computers & Electrical Engineering · doi:10.1016/j.compeleceng.2026.111471
An AI Smart Contract System with Incentivized Off-Chain Training and On-Chain Model Evaluation
Yoshida, Y., & Omote, K. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-36766-2_3
Alhwikem, F., Khan, A. R., & Jaskani, F. H. (2026) · Symmetry · doi:10.3390/sym18091565
Ma, Z., Yu, Z., Xing, W., Chen, Y., & Han, M. (2026) · ACM Turing Celebration Conference - China (ACM TURC) · doi:10.1145/3833142.3833188
Spot-Checking is All You Need: Decoupled Zero-Knowledge Verification for Federated LearningPreprint
Yang, Y., Ge, C., Lv, Y., Li, L., Sui, Z., Qiu, Q., Zhou, H., & Yin, L. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7602431
- Authors
- Sun, H., Bai, T., Li, J., & Zhang, H.
- Affiliations
- University of Waterloo (CA)
- David R. Cheriton School of Computer Science, Faculty of Mathematics, University of Waterloo, Waterloo, ON, Canada
- Venue
- IEEE Transactions on Information Forensics and Security
- Published
- 2025
- Volume
- 20
- Pages
- 914-927
- ISSN
- 1556-6013 (ISSN-L)
- 1556-6021
- OpenAlex
- W4405633082
- Cited by
- 33
- References
- 42
- Citations by year
- 2026: 14 · 2025: 15 · 2024: 4
- FWCI
- 4.87
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Transactions on Information Forensics and Security (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- Natural Sciences and Engineering ResearchCouncil of Canada (NSERC) Discovery (RGPIN-2022-03215, DGECR-2022-00357)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Information Systems › Blockchain Technology Applications and Security
- Keywords
- zero-knowledge proofs, arithmetic circuits, privacy-preserving training, intellectual property protection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
