PrivaDE: Privacy-preserving Data Evaluation for Blockchain-based Data Marketplaces

1. Problem Statement

In decentralized machine learning ecosystems and blockchain-based data marketplaces, there is a critical need to evaluate the utility of a dataset before purchase to ensure it improves a model's performance. However, a fundamental conflict exists:

• Model Owners (MO) are unwilling to reveal their proprietary model parameters ($\theta$) before payment.
• Data Owners (DO) are unwilling to reveal their raw data features ($x$) and labels ($y$) before payment.
• Trust Issues: Existing solutions often rely on semi-honest assumptions (where parties follow the protocol but try to learn extra info) or Trusted Third Parties (TTPs), which are unsuitable for trustless, decentralized environments.

The core challenge is to design a protocol that computes a data-utility score ($\phi$) quantifying how much a candidate dataset improves a model, while maintaining malicious security (protecting against parties who arbitrarily deviate from the protocol) and ensuring privacy for both model weights and raw data.

2. Methodology: The PrivaDE Protocol

PrivaDE is a two-party, maliciously secure protocol that integrates cryptographic primitives (MPC, ZKPs, Commitments) with machine learning optimization techniques. The workflow consists of four main stages:

A. Core Components & Optimizations

To make secure inference practical, PrivaDE employs three key optimization techniques:

1. Model Distillation: The model owner trains a smaller "student" model to approximate the original "teacher" model. This reduces the computational overhead of secure inference while retaining sufficient accuracy for evaluation.
2. Split Model Inference ($M = C \circ B \circ A$): The model is partitioned into three blocks:
   • Block A: Initial layers. Evaluated via Secure Multi-Party Computation (MPC). The MO provides weights, the DO provides inputs. Only the output activations are revealed.
   • Block B: Intermediate layers. Evaluated locally by the Data Owner using weights sent in the clear.
   • Block C: Final layers. Evaluated locally by the Model Owner using activations from Block B.
   • Security Mechanism: A "secret mixer" (invertible linear layer) is inserted between A and B to prevent the DO from reconstructing the full model or reusing embeddings.
3. Representative Subset Selection: Instead of evaluating the entire dataset ($D_B$), the DO selects a small, representative subset ($D_R$). This is verified using a Challenge Protocol (CP) where the MO randomly challenges the DO to prove, via Zero-Knowledge Proofs (ZKPs), that the subset is representative of the full dataset within a defined distance threshold.

B. The Scoring Function

The protocol computes a score $\phi$ based on three criteria derived from Active Learning heuristics:

• Loss ($l$): The prediction error on the representative subset (indicates potential training value).
• Uncertainty ($u$): The entropy of the model's predictions (indicates informativeness).
• Diversity ($d$): The spread of data points in feature space (indicates redundancy reduction).
  The final score is a weighted aggregation: $\phi = f(l, u, d)$.

C. Cryptographic Primitives

• MPC (SPDZ2k): Used for the secure evaluation of Block A and the final scoring calculation. It ensures malicious security (detecting deviations).
• Zero-Knowledge Proofs (NIZKPoK): Used to verify the correctness of the local computations (Blocks B and C) without revealing the intermediate activations or weights.
• Cut-and-Choose ZKP (CnCZK): A lightweight verification method where only a random subset of layers and data points are audited, significantly reducing computational cost while maintaining high cheating-detection probability.

D. Blockchain Integration

PrivaDE is designed to be integrated with smart contracts on an EVM-compatible chain:

• Commitments: Inputs (model weights, data) are committed on-chain to create an immutable audit trail.
• Fairness Enforcement: Smart contracts hold escrow deposits. If a party aborts the protocol or fails to provide proofs, their deposit is slashed, ensuring fair execution.
• Atomic Transactions: Payment is released only upon the successful verification of the score and the data delivery.

3. Key Contributions

1. First Maliciously Secure Data Evaluation: PrivaDE is the first work to propose a secure data evaluation scheme in the malicious setting (without a Trusted Third Party) specifically for data marketplaces.
2. Efficient Secure Inference: The authors introduce a novel combination of model distillation, three-way model splitting, and cut-and-choose ZKPs to reduce the overhead of secure inference, making it feasible for models with millions of parameters.
3. Model-Agnostic Scoring: A novel scoring function that correlates with downstream training performance, operating on a representative subset to minimize leakage and computation.
4. Formal Security Proofs: The protocol is proven secure in the simulation-based paradigm against malicious adversaries.
5. Blockchain Proof-of-Concept: A demonstration of how PrivaDE integrates with smart contracts to enforce fairness and automate payments.

4. Experimental Results

The authors evaluated PrivaDE on real-world datasets (MNIST, CIFAR-10, CIFAR-100) using models ranging from LeNet to VGG-8.

• Performance:
  • Online Runtime: Achieved runtimes as low as 45 seconds for MNIST (LeNet) and under 15 minutes total for larger models (VGG-8 on CIFAR-100).
  • Scalability: The online runtime is largely independent of the total dataset size ($n$) because only the representative subset ($k$) is processed. It scales linearly with the subset size and verification depth.
  • Optimization Impact: The use of model splitting and cut-and-choose verification reduced communication and computation overhead significantly compared to full ZKP or full MPC approaches.
• Scoring Robustness:
  • The proposed scoring method (combining loss, uncertainty, and diversity) consistently outperformed random sampling and entropy-based sampling in improving model accuracy.
  • It performed comparably to Core-Set sampling but with the added benefit of privacy preservation.
  • Scores generated by distilled (student) models showed high correlation (Spearman > 0.84) with those from the original teacher models, validating the use of distillation for efficiency.
• Leakage Analysis: Empirical tests showed that the model splitting strategy effectively prevents the reconstruction of the original model or input data (SSIM < 0.3 for image reconstruction), satisfying the defined privacy thresholds.

5. Significance

PrivaDE addresses a critical bottleneck in the commercialization of decentralized AI. By enabling privacy-preserving, trustless data valuation, it allows:

• Fair Compensation: Data owners can be paid based on the actual, verified utility of their data without revealing the data itself.
• Incentivized Data Sharing: Model owners can safely evaluate potential data sources without fear of IP theft.
• Decentralized Ecosystems: It provides the cryptographic foundation for automated, blockchain-based data marketplaces where smart contracts can enforce fair trade without human intermediaries.

The work bridges the gap between theoretical secure computation and practical machine learning applications, demonstrating that high-security data evaluation is achievable with reasonable computational costs.