🤖 AI Summary
This work addresses the tension between verification efficacy and privacy in AI validation, where verifiers require sufficient evidence to confirm legitimate claims yet conventional approaches often inadvertently disclose sensitive information about models, workloads, or hardware. To resolve this, the paper introduces a Minimal Information Disclosure (MID) framework that, for the first time, employs conditional mutual information to rigorously quantify incidental privacy leakage in verification evidence. The framework ensures verification validity while strictly bounding information exposure, is broadly applicable across diverse verification objectives and deployment constraints, and seamlessly integrates with zero-knowledge proofs (ZKPs). By co-designing evidence channels, sampling strategies, and release transformations, the authors instantiate the framework using Groth16 zk-SNARKs to enable linear projection authentication. Experiments across four physical measurements and six verification tasks demonstrate perfect verification with zero leakage in three tasks, while the remaining tasks precisely delineate the privacy–utility trade-off frontier.
📝 Abstract
AI verification crosses a trust boundary: a verifier must learn enough to establish an authorized claim, yet the same evidence can reveal sensitive details about the model, workload, or hardware. We introduce minimal information disclosure (MID), which designs and quantifies the information content of verifier-facing evidence itself. MID measures collateral leakage with conditional mutual information: what the release reveals about the protected property after the authorized result is known. MID is general by design: it can accommodate different verification goals, protected properties, evidence sources, and deployment constraints. To demonstrate MID's practicality, we evaluate it on four physical measurements and six verification tasks spanning execution type, hardware identity, compute scale, and model identity. These experiments use three mechanism-design variables--the evidence channel, collection policy, and release transformation--but MID is not limited to these choices and can accommodate other deployable mechanisms. Across these tasks, MID produces three releases with perfect held-out verification and zero measured collateral leakage, while the remaining tasks yield explicit privacy--utility frontiers. MID also supports ZKP-certified releases: we demonstrate our proposed linear-projection mechanism using a Groth16 zk-SNARK.