# Proof-of-Learning: Definitions and Practice

**Authors:** Hengrui Jia, Mohammad Yaghini, Christopher A. Choquette-Choo, Natalie Dullerud, Anvith Thudi, Varun Chandrasekaran, Nicolas Papernot  
**arXiv:** [2103.05633](https://arxiv.org/abs/2103.05633)  
**Date:** 2021-03-09  
**Summary page:** https://www.summarizepaper.com/en/paper/2103.05633v1/

## Key points

- The paper addresses the problem of proving the legitimacy of machine learning (ML) models' final parameters after the optimization process
- Currently, there is no mechanism to verify that these parameters were obtained through the optimization procedure, posing security risks
- The authors propose a concept called "proof-of-learning" in ML to tackle this issue
- Stochastic gradient descent (SGD) accumulates secret information due to its stochastic nature, leading to a natural construction for a proof-of-learning mechanism
- Proof-of-learning demonstrates sufficient computational effort expended to obtain accurate model parameters
- Benefits of introducing proof-of-learning include simplifying ownership resolution and preventing denial-of-service attacks during distributed training
- Concrete instantiations of the proof-of-learning mechanism are provided for model ownership resolution and distributed training scenarios
- Empirical evaluations confirm the effectiveness and resilience of the proposed mechanism to hardware and software variations.

## Summary

The paper addresses the problem of proving the legitimacy of machine learning (ML) models' final parameters after the expensive iterative optimization process. Currently, there is no mechanism to verify that these parameters were indeed obtained through the optimization procedure, which poses security risks in ML applications. To tackle this issue, the authors propose a concept called "proof-of-learning" in ML. Inspired by research on proof-of-work and verified computations, the authors observe how stochastic gradient descent (SGD), a widely used training algorithm, accumulates secret information due to its stochastic nature. This observation leads to the development of a natural construction for a proof-of-learning mechanism. This mechanism demonstrates that a party has expended sufficient computational effort to obtain accurate model parameters. The paper highlights that an adversary attempting to illegitimately create a proof-of-learning would need to perform at least as much work as required for gradient descent itself. By introducing this proof-of-learning concept, several benefits are achieved. Firstly, it simplifies ownership resolution when multiple parties contest ownership of a specific model. Secondly, it facilitates distributed training across untrusted workers by preventing Byzantine workers from mounting denial-of-service attacks through incorrect model updates. The authors provide concrete instantiations of the proof-of-learning mechanism in scenarios such as model ownership resolution and distributed training. In terms of model ownership resolution, this mechanism ensures the protection of intellectual property for publicly released models. In distributed training, it preserves the availability and integrity of the training procedure. To validate their approach, empirical evaluations are conducted considering hardware variations (ML accelerators) and software stacks. The results demonstrate that the proposed proof-of-learning mechanism remains robust despite these variances. In summary, this paper introduces and explores the concept of proof-of-learning in ML as a solution to prove the legitimacy of optimized model parameters. The proposed mechanism offers security benefits by simplifying ownership resolution and protecting against malicious actors during distributed training processes. Empirical evaluations confirm its effectiveness and resilience to hardware and software variations.