PoLO: Proof-of-Learning and Proof-of-Ownership at Once with Chained Watermarking

2025-05-18

AI Summary

In model outsourcing scenarios, simultaneously ensuring proof-of-learning (PoL) and proof-of-ownership (PoO) remains challenging; existing approaches address them separately, resulting in weak forgery resistance, high privacy risks, and substantial verification overhead. Method: We propose the first unified blockchain-inspired watermarking framework that jointly achieves PoL and PoO. It partitions the training process into sequential segments, embedding lightweight, hash-chained watermarks—each dependent on the hash of the preceding segment—to construct an immutable training provenance chain. This ensures verifiable training effort and unambiguous, exclusive ownership binding. Results: Experiments demonstrate 99% ownership verification accuracy, verification overhead reduced to only 1.5–10% of conventional schemes, 1.1–4× higher forging cost, and >90% detection rate under original-proof attacks.

Technology Category

• Machine Learning: Privacy
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Natural Language Processing: Language Grounding & Multi-modal NLP

Application Category

• Security and Privacy: Data transparency and provenance
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Machine learning models are increasingly shared and outsourced, raising requirements of verifying training effort (Proof-of-Learning, PoL) to ensure claimed performance and establishing ownership (Proof-of-Ownership, PoO) for transactions. When models are trained by untrusted parties, PoL and PoO must be enforced together to enable protection, attribution, and compensation. However, existing studies typically address them separately, which not only weakens protection against forgery and privacy breaches but also leads to high verification overhead. We propose PoLO, a unified framework that simultaneously achieves PoL and PoO using chained watermarks. PoLO splits the training process into fine-grained training shards and embeds a dedicated watermark in each shard. Each watermark is generated using the hash of the preceding shard, certifying the training process of the preceding shard. The chained structure makes it computationally difficult to forge any individual part of the whole training process. The complete set of watermarks serves as the PoL, while the final watermark provides the PoO. PoLO offers more efficient and privacy-preserving verification compared to the vanilla PoL solutions that rely on gradient-based trajectory tracing and inadvertently expose training data during verification, while maintaining the same level of ownership assurance of watermark-based PoO schemes. Our evaluation shows that PoLO achieves 99% watermark detection accuracy for ownership verification, while preserving data privacy and cutting verification costs to just 1.5-10% of traditional methods. Forging PoLO demands 1.1-4x more resources than honest proof generation, with the original proof retaining over 90% detection accuracy even after attacks.

Problem

• Ensures model training effort and ownership verification simultaneously
• Prevents forgery and privacy breaches in shared ML models
• Reduces verification overhead compared to traditional methods

Innovation

• Chained watermarks for simultaneous PoL and PoO
• Fine-grained training shards with embedded watermarks
• Efficient privacy-preserving verification with low cost