Proofs of Ownership for Machine Learning Models

2026-06-29

AI Summary

This work formally introduces the problem of proving ownership of machine learning models, focusing on verifying model provenance even after theft and minor modifications. In the black-box setting, it formulates a three-party game-theoretic framework involving an owner, an adversary, and a judge, and proposes a cryptographic perturbation mechanism grounded in standard cryptographic assumptions, analyzed through the lens of self-correction theory. The central contribution establishes a fundamental boundary between provable ownership and the self-correctability of concept classes: under standard cryptographic assumptions, reliable ownership verification is achievable if and only if the target concept class is not self-correctable. This characterization extends naturally to a range of practical deployment scenarios.

Abstract

With the increasing adoption of Machine Learning, protecting model ownership has become an essential challenge. We initiate a formal study of Proof of Ownership for machine learning models: under what conditions can one prove that a stolen model originated from a particular creator? We model proofs of ownership as a game among three parties: a model owner, a thief, and a judge. The owner transforms the original model into a slightly perturbed model together with a proof of ownership. The thief then obtains the transformed model and attempts to minimally modify it so that it remains useful but escapes detection as owned by the model owner. Finally, the judge receives a model and a proof of ownership, and must decide whether the given model is a modified version of some model created by the model owner, or else the given model was developed independently. Our main result is a dichotomy for classifiers in the black-box setting: Under standard cryptographic assumptions, ownership of models for some concept class can be proven in the above sense {\em if and only if} the concept class is not self-correctable, in a sense close to that of Blum, Luby and Rubinfeld, STOC'90. The result is constructive and extends, with some variations, to a number of related settings.

Problem

• Proof of Ownership
• Machine Learning Models
• Model Theft
• Ownership Verification
• Black-box Setting

Innovation

• Proof of Ownership
• Machine Learning Model Protection
• Self-correctability
• Black-box Setting
• Cryptographic Assumptions