PoLO: Proof-of-Learning and Proof-of-Ownership at Once with Chained Watermarking

Technical Summary: PoLO (Proof-of-Learning and Proof-of-Ownership at Once)

1. Problem Statement

As machine learning (ML) models become valuable digital assets traded in Enforceable Model Marketplaces (EMMs), two critical verification requirements emerge:

• Proof-of-Learning (PoL): Verifying that the claimed computational effort (training) was actually performed.
• Proof-of-Ownership (PoO): Establishing and verifying the legal ownership of the model via watermarking.

The Gap: Existing research treats PoL and PoO as separate, orthogonal problems. When "stacked" (applying one after the other), the system inherits significant vulnerabilities:

• Security Weaknesses: Current PoL methods rely on gradient-based trajectory tracing, which is susceptible to "synthetic trajectory attacks" (forging plausible training paths).
• High Overhead: Verifying PoL often requires replaying or retraining the model from snapshots, making verification costs scale with model and dataset size.
• Privacy Risks: Many PoL schemes require the verifier to access intermediate training states or the raw training data, risking data leakage.

2. Methodology: The PoLO Framework

The authors propose PoLO, a unified framework that achieves PoL and PoO simultaneously through Chained Watermarking. Instead of verifying a single final watermark or a gradient trajectory, PoLO embeds a sequence of watermarks throughout the training process.

Key Technical Components:

• Fine-Grained Training Shards: The training process is partitioned into $S$ shards. A shard is defined by the successful embedding of a specific watermark, rather than a fixed number of epochs.
• Cryptographic Chaining: To prevent forgery, each watermark $\Lambda_x$ for shard $s_x$ is deterministically derived using a cryptographic hash function $H(\cdot)$ applied to the weights of the preceding shard $W_{x-1}$, a secret nonce $\mu$, and the shard index. This creates a "chain" where modifying one part invalidates all subsequent proofs.
• Two-Stage Embedding: To balance task accuracy and watermark robustness, PoLO uses a regularizer-guided training phase followed by a targeted post-training perturbation ($\delta W$) to finalize the watermark.
• Obfuscation-based Privacy: After each shard, Gaussian noise is applied to non-watermarked weight regions. This protects the model from inference attacks that attempt to reconstruct private training data from the weights.
• Verification Mechanism: The verifier does not need the training data. Instead, they request specific checkpoints ($W_{x-1}, W_x$), reconstruct the expected watermark using the hash chain, and check the detection rate and main-task accuracy.

3. Key Contributions

1. Unified Design: It transforms PoO (watermarking) into the primary primitive for PoL, ensuring that the proof of ownership is the proof of the training trajectory.
2. Economic Security Model: It introduces a "rational adversary" framework. By linking watermarks via hashes, an attacker attempting to forge ownership must either incur a computational cost comparable to honest training (to reconstruct the chain) or suffer degraded model performance that fails verification.
3. Privacy-Preserving Verification: It eliminates the need for dataset sharing during the verification process, addressing a major flaw in gradient-based PoL.

4. Experimental Results

The authors evaluated PoLO using various architectures (ResNet, VGG, BERT) and datasets (CIFAR, TinyImageNet, AG News).

• Accuracy & Efficiency: PoLO achieved 99% watermark detection accuracy. Verification costs were drastically reduced to just 1.5%–10% of traditional methods.
• Unforgeability:
  • Overhaul Fine-tuning Attack (OFA): Attempting to replace the watermark via full-model fine-tuning was found to be economically irrational, costing 1.1x–4x more than honest training. Even under this attack, the original watermark remained detectable (over 64%–98%).
  • Weight Manipulation Attack (WMA): While cheaper, this attack significantly degraded the model's primary task accuracy, causing the forged proof to fail verification.
• Compatibility: The framework is compatible with existing watermarking schemes like RIGA, EDNN, and FedIPR.

5. Significance

PoLO represents a paradigm shift in ML model provenance. By moving away from "log-and-replay" gradient tracking toward "cryptographic weight chaining," it provides a scalable, privacy-preserving, and economically secure method for verifying both the effort and the identity of ML models. This is particularly significant for the burgeoning economy of model marketplaces and outsourced AI services, where trust and attribution are paramount.