Verifiable Data Provenance in Machine Learning Training

Abstract

Machine learning models trained on sensitive financial records may incorporate private data without the data owner’s knowledge or consent. A bank that suspects a fintech company has trained a model on stolen customer records faces a structural dilemma: to prove misappropriation, the bank must disclose the dataset, which may itself constitute a privacy violation under Article 5 of the General Data Protection Regulation (GDPR). Existing verification techniques do not fully resolve this issue. Membership inference attacks provide probabilistic rather than deterministic evidence, dataset watermarks require proactive embedding and can be removed, and zero-knowledge proofs of training verify training correctness but do not determine whether the training data overlaps with private records.

This thesis proposes a three-party cryptographic protocol that simultaneously certifies training correctness and characterizes the intersection between the trainer’s dataset and the data owner’s private dataset, without revealing raw features or labels to the auditor. Before training, the bank posts a cryptographic commitment to its authorized records on a public ledger. The trainer posts a commitment to the training dataset and submits a proof after training. The auditor verifies two properties using only the proof and the public commitments.

For training correctness, a sumcheck protocol with multilinear KZG oracles is used, adapted from deep neural networks to linear and logistic regression, to verify that each gradient descent step was computed correctly over the committed data. For data authorization, each training sample is checked against the bank’s authorized dataset using the zero-knowledge sets construction of Silvio Micali, Michael Rabin, and Joe Kilian. These two components integrate without requiring an additional circuit. The per-sample commitment used as a lookup key is already a public element of the training commitment, allowing the auditor to derive it locally.

The zero-knowledge property of the combined protocol is formally established through simulator-based composition, providing a reusable proof structure for combining verifiable computation schemes with cryptographic set-membership proofs. Additionally, a soundness issue in the linear regression verifier was identified and corrected by enforcing error-label consistency, reducing the residual error probability to a negligible level relative to field size.

The protocol was benchmarked on the UCI Default of Credit Card Clients dataset using batch sizes up to 256 and up to 23 features. Proof size grows logarithmically with batch size and linearly with feature count, reaching approximately 80 KB per gradient step at the maximum configuration. Prover time scales linearly with dataset size and feature count, reaching approximately 3 seconds per step. The zero-knowledge membership check adds a constant 20 KB and 4.5 ms per sample, independent of dataset size. Verifier time grows linearly only with feature count, reaching approximately 500 ms per step. The computational burden therefore remains primarily with the trainer rather than the auditor.

A remaining open problem is the Consistent Data Commitment (CDC) assumption, which states that the column-wise multilinear KZG commitments and row-wise univariate KZG commitments bind identical underlying data. The current protocol does not cryptographically enforce this consistency. Developing a cross-commitment scheme to close this gap remains the highest-priority direction for future work.