{"id":"7a4fedec-ff65-4ff0-9290-1c69ed8ef3f5","arxiv_id":"2505.07997","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"FairZK derives parameter-only fairness bounds and new zero-knowledge gadgets, and demonstrates practical proofs of model fairness for much larger models than prior work.","lead":"FairZK proves an upper-bound fairness score of a hidden logistic regression or deep neural network model inside a zero-knowledge proof, using only the model weights and aggregate statistics, not the full dataset. It reports prover speedups of 3.1x to 1789x over prior approaches and scales to a 47 million parameter model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"FairZK's certificate is vacuous for statistical parity as instantiated: reported bounds all exceed 1 (DNN: 9.95–2021.59) while ΔSP∈[0,1], and the proved soft-output disparity is not the thresholded ΔSP of Eq. 1.","rationale":"Good-faith reading: the paper's novel contribution is a ZK-friendly upper bound and efficient proof gadgets; the protocol itself may be sound and the scaling result is impressive. The load-bearing issue is not in the ZKP but in the statement being proved. Lemmas 1 through 6 give an upper bound on a soft-output disparity, and Theorems 1 and 2 prove that bound. For that bound to be a fairness certificate, two things must hold: (a) the soft disparity must coincide with or dominate the ΔSP of Eq. 1, and (b) the bound must be below a meaningful threshold. Neither holds in the paper as written. The paper's own Section 5.1 and Appendix D.4 concede the gap. The reader's weakest assumption identified the same issue, so I agree with the conditional verdict. I do not see grounds for outright rejection: the bounds and ZKP protocols are independently useful, and a revised version that either proves a hard-label bound or explicitly reframes the certificate as an uncalibrated proxy, with threshold guidance and normalized reporting, would address the concern. The concrete test above would settle whether any instantiation currently produces a non-vacuous certificate.","tokens_in":28207,"tokens_out":9119,"duration_ms":98546,"concrete_test":"Use the released code and the Adult test split: for each Table 2 model, compute the proved bound δ_hat, the soft-output disparity mean_{s0}(σ(z)) − mean_{s1}(σ(z)), and the hard-label statistical parity P(σ(z)>0.5|s=0) − P(σ(z)>0.5|s=1). Then apply fairness thresholds ε ∈ {0.01, 0.05, 0.1, 0.2} and check how many models have δ_hat ≤ ε and whether δ_hat ever bounds the hard-label ΔSP. If no certified model passes, or if δ_hat > 1 whenever hard-label ΔSP ≤ 1, the certificate is vacuous and the claim must be reframed.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that the value proved in zero knowledge is a bound on the fairness metric of Eq. 1. But Eq. 1 is defined on predicted labels ŷ, whereas FairZK proves a bound on δ_hat = mean(σ(z)|s=0) − mean(σ(z)|s=1) and asserts, in Section 3.1, that \"|δ_hat| = ΔSP\" citing [31]. For a sigmoid output, mean σ(z) is not P(σ(z)>τ) for a thresholded label, so this identification is unproven and generally false; a bound on soft-output means does not bound positive-rate disparity without additional monotonicity or threshold arguments that are absent. Even granting the soft-output reading, the bound values in Table 2 are 1.17–11.74 for LR and 9.95–2021.59 for DNN, while any probability difference lies in [0,1]. Proving ΔSP ≤ 54.79, as for Adult W3, is vacuously true and cannot certify fairness at any meaningful threshold ε<1. The paper itself acknowledges this: Section 5.1 says the bound values are larger than 1, calls loose bounds an open problem, and proposes normalization or reference scores; the appended S&P meta-review in Appendix D.4 says it is unclear what the values mean. No calibration, threshold, or hard-label reduction is supplied, so the certificate as instantiated does not establish the advertised fairness property.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"FairZK proposes a zero-knowledge proof system intended to certify that a logistic regression or feedforward DNN satisfies a group-fairness bound, without revealing model parameters. The key idea is to replace ZK proofs of many ML inferences with a ZK proof of an analytic bound on the disparity between two sensitive subgroups, where the bound depends only on the model weights and on aggregated statistics (per-feature mean differences and per-feature deviation bounds). The paper derives layer-by-layer bounds for soft-output disparity (Section 3), develops optimized zkSNARK gadgets including a spectral-norm protocol with O(F^2) prover time (Section 4.2.2), and reports an implementation with large speedups over naive inference-based baselines and OATH, including a 47-million-parameter DNN in 343 seconds (Section 5).","tokens_in":28491,"tokens_out":4746,"duration_ms":50785,"significance":"If the central claim were correct, the paper would be a strong systems contribution: it would be the first ZK system to certify a group-fairness property at scale, with a reproducible open-source implementation and careful engineering of lookup arguments and a spectral-norm protocol that is asymptotically faster than generic R1CS approaches. The fairness-bound derivations in Section 3 are internally coherent as bounds on a soft-output disparity measure, and the comparison against Gnark gives concrete evidence for the efficiency of the spectral-norm gadget. However, the advertised fairness property is statistical parity on predicted labels, and the certificate actually proves an upper bound on mean sigmoid output. That semantic gap, together with the observation that all reported bounds exceed 1 while probability disparities are in [0,1], means the instantiated system does not certify the fairness notion stated in Equation (1). The work is therefore best assessed as a solid ZKP-engineering contribution attached to an unsupported fairness claim.","major_comments":[{"comment":"The paper conflates the soft-output mean with the positive-rate probability. Equation (1) defines statistical parity as |P(ŷ=1|s=0) − P(ŷ=1|s=1)|, where ŷ is the predicted label. Lemma 1, however, proves a bound on |mean(σ(z)|s=0) − mean(σ(z)|s=1)|, and Section 3.1 asserts that this quantity equals Δ_SP, citing [31]. For a sigmoid output with a thresholded label, mean(σ(z)) is not equal to P(σ(z)>τ) for any fixed τ, and no monotonicity or threshold-calibration argument is supplied. The proved statement is therefore a bound on soft-output disparity, not on the statistical parity defined in Equation (1).","section":"Section 3.1, Lemma 1, Equation (1)"},{"comment":"The certificate is vacuous for any meaningful fairness threshold. Every reported bound in Table 2 exceeds 1 (logistic regression: 1.17–11.74; DNN: 9.95–2021.59), while Δ_SP ∈ [0,1]. Proving that Δ_SP ≤ 54.79, for example, is a tautology at any threshold ε<1 and cannot certify statistical parity. The paper acknowledges this in Section 5.1, where it calls the loose bounds an open problem and proposes normalization or reference scores; however, those proposals are not formalized, and the appendix meta-review (Appendix D.4) explicitly says it is unclear what the values mean. As instantiated, the protocol does not prove ML fairness in the sense advertised.","section":"Section 5.1, Table 2"},{"comment":"The formal relation Rfair states FairEval(W, Δx, δx) = δ̂y, where δ̂y is the upper bound from Section 3, not the measured disparity of Equation (1). Even if the bound were smaller than 1, the relation would only certify an upper bound on soft-output disparity. Because no reduction from soft-output disparity to thresholded positive-rate disparity is given, the zkSNARK's soundness is not in question, but its interpretation as a fairness proof is. This is a load-bearing mismatch between the proved statement and the paper's central claim.","section":"Section 4.1, relation Rfair"},{"comment":"The performance comparisons, while interesting, compare the cost of proving a vacuous bound against the cost of proving sampled ML inferences. Since the baselines prove statements about actual predictions on data samples, while FairZK proves a model-dependent upper bound with no demonstrated relation to Δ_SP, the 3.1×–1789× speedup does not translate into a speedup for the same fairness property. The scaling result for the 47-million-parameter model is an engineering achievement, but it does not establish that fairness certification scales.","section":"Section 5.2, Tables 3 and 4"}],"minor_comments":[{"comment":"The notation is inconsistent: the paper first defines the logistic-regression output as ŷ = σ(⟨w,x⟩), a real number in (0,1), but Equation (1) uses P(ŷ=1), which requires a binary label. The authors should define the thresholding rule for ŷ or explicitly state that they are proposing a new soft-output fairness metric.","section":"Section 2.1"},{"comment":"The initial bound is written as Δ1_z = |W1|·Δx, but based on the layer indexing used in Section 2.1 the first weight matrix is W0; the formula should be Δ1_z = |W0|·Δx. Please correct the indexing or clarify the convention.","section":"Figure 4, Step 5"},{"comment":"The phrase 'Our δ̂y' in Table 2 is misleading: the column reports the computed upper bound, not a measured disparity. A more precise label such as 'our upper bound' would make the vacuity of the certificates easier for the reader to assess.","section":"Section 5.1"},{"comment":"There is a typo in 'Multiplications are performed with truncations in Section Section 4.2.1'; the repeated word 'Section' should be removed.","section":"Section 4.2.1"}],"recommendation":"reject","confidential_remarks":"The ZKP engineering is competent and the spectral-norm protocol is a genuine technical contribution, but the fairness claim that motivates the entire system is not established. The soft-output-to-thresholded-label gap is a fundamental semantic issue, and the numerical bounds reported in Table 2 make the certificate vacuous for statistical parity. These problems cannot be repaired by a local revision: a different fairness metric or a new bounding technique would be needed. If the authors reframe the work as a ZK proof of a specific soft-output disparity score with a clear definition and meaningful thresholds, a resubmission could be viable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nFairZK is worth a serious look, but not for the reason its title suggests. What the system actually proves is an upper bound on the difference of mean sigmoid scores between two sensitive groups; what the title advertises is proof of ML fairness under statistical parity. Those are different things, and the paper's own Section 5.1 concedes that the bound values are larger than 1 while ΔSP lies in [0,1], so the certificate is vacuous at any meaningful threshold. The appended S&P meta-review (D.4) says the same. The stress-test note holds up on reading.\n\nNow the real contributions. The layerwise bound on Δz (Lemma 6) that removes the intermediate-value dependence, and the √F factor removal in Lemma 4, are genuine improvements over [31]. The spectral-norm protocol in Figure 2 is the most interesting piece: it avoids computing eigenvalues inside the circuit, instead verifying V·V^T ≈ I and A = VΛV^T + E with small-error lookups, and pushes prover cost from O(F^3) to O(F^2). Appendix B.2's error analysis is sound. The implementation is complete, the baselines use the same backend, and scaling to a 47M-parameter model in 343s is a real result. Credit where due.\n\nThe soft spots, in order. First, the identification |δ_ŷ| = ΔSP in Section 3.1 is asserted with a citation to [31], not derived. For a sigmoid output, the mean of the score is not the probability of a thresholded label, so the proof does not bound the statistical parity of the classifier's decisions. One could rescue this with a monotone transformation or hard-label reduction, but none is given. Second, even granting the soft-output reading, no threshold or normalization turns the bound into a fairness verdict; Table 2's DNN bounds are two to three orders of magnitude above any plausible ε. The paper explicitly leaves this as an open problem, which is honest but means the central claim needs rewriting: this is a system for proving a parameter-dependent disparity bound in zero knowledge, not for certifying fairness.\n\nThe citation pattern is fine—self-citing [31] is disclosed, and the improvement over it is explicit and direct.\n\nVerdict: the cryptography is coherent, the improvements are real, and the authors have been unusually candid about the meaning problem. I would send it to peer review, and I would push the authors to either supply a hard-label reduction or rebrand the claim. It is a clear yes for reading group.","headline":"A genuinely faster ZKP for a disagreement-bound on soft outputs, but the certificate does not establish statistical parity of the classifier's labels—and the paper says so itself in Section 5.1.","tokens_in":29072,"tokens_out":3127,"would_cite":true,"duration_ms":34035,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"FairZK certifies ML fairness in zero knowledge, scaling to 47M parameters.","keywords":["zero-knowledge proofs","machine learning fairness","statistical parity","fairness bounds","spectral norm","zkSNARK","logistic regression","deep neural networks"],"falsifier":"Construct or find a model whose FairZK fairness-score bound is below a chosen threshold but whose statistical parity on a held-out test set exceeds that threshold; if the system would certify such a model as fair, the certificate is not sound for the intended fairness property.","tokens_in":27962,"feed_emoji":"⚖️","tokens_out":7043,"duration_ms":59899,"temperature":0.7,"pith_summary":"FairZK tackles a practical deadlock: companies cannot show their machine-learning models are fair without exposing proprietary weights, and auditors cannot trust unshown claims. The paper shows that fairness can be certified by proving an upper bound on statistical parity that depends only on the model parameters and a few aggregate statistics of the input distribution (per-feature means and maximum deviations per sensitive group), not on any concrete dataset. It derives such bounds for logistic regression and fully connected DNNs, builds efficient zero-knowledge proof gadgets for them, and demonstrates a proof for a 47-million-parameter model in 343 seconds. The significance is that a model owner can now publish a commitment to a model and a proof of its fairness while keeping the weights secret.","feed_headline":"Zero-knowledge fairness proof scales to 47M parameters","feed_subtitle":"New bounds let model owners certify fairness from aggregate statistics without revealing weights.","key_machinery":"The load-bearing object is the recursive fairness bound of Eq. 18: $\\|\\delta_h^{\\ell}\\|_2 \\le L \\|W_{\\ell-1}\\|_2 \\|\\delta_h^{\\ell-1}\\|_2 + 2L \\|\\Delta_z^{\\ell}\\|_2$, together with the companion propagation $\\Delta_z^{\\ell} \\le L |W_{\\ell-1}| \\Delta_z^{\\ell-1}$, where $L$ is the Lipschitz constant of the activation (0.25 for sigmoid, 1 for ReLU). This reduces fairness to quantities computable from the model weights and two aggregate statistics of the input—per-feature subgroup mean disparity $\\delta_x$ and per-feature max deviation $\\Delta_x$—so the zero-knowledge prover never touches a dataset. The other central piece is a spectral-norm proof protocol that verifies the eigenvalue decomposition of a matrix by checking $WW^T = V\\Lambda V^T + E$ and $VV^T = I + E'$ with small error terms, making the prover cost quadratic instead of cubic.","core_discovery":"The paper's central claim is that the statistical parity (and equal opportunity) of a binary classifier can be certified in zero knowledge by verifying a recursive Lipschitz-based bound. For logistic regression with weights $w$, the bound is $|\\delta_{\\hat{y}}| \\le L |\\langle w, \\delta_x\\rangle| + 2L \\langle |w|, \\Delta_x\\rangle$, where $\\delta_x$ is the per-feature mean difference between sensitive groups and $\\Delta_x$ the maximum per-feature deviation from the group mean. For a DNN, the bound propagates through layers: the disparity of hidden activations is bounded by the spectral norm of the weight matrix times the previous disparity, plus a term controlled by per-layer deviation bounds, which themselves propagate via elementwise absolute values of the weights. The paper proves these bounds in a zkSNARK whose prover time is linear in the model size, using a new protocol that verifies spectral norm in $O(F^2)$ rather than $O(F^3)$, and reports that this is the first system to prove fairness for a 47M-parameter model, at 343 seconds, beating inference-based baselines by 3.1x–1789x.","pith_inferences":["Because the proof certifies only an upper bound, a model that is genuinely unfair by measured disparity could still pass if the bound is loose; a practical deployment would need a threshold calibrated to the bound's average gap, not to the disparity itself.","The same bound structure should extend to convolutional networks, transformers, and graph networks whenever per-layer Lipschitz constants and aggregated feature statistics can be stated; the paper's spectral-norm gadget already covers the main cost.","The aggregate statistics can themselves be computed inside a separate zero-knowledge proof from private data, which would let the system certify fairness from a hidden dataset and would allow privacy-enhancing transforms (e.g., differential privacy) on the statistics.","The current protocol reveals the model architecture (layer dimensions, depth, activation types); padding with dummy neurons could hide it, at the cost of a larger proof, an explicit trade-off the paper sketches."],"forward_implications":["A model owner can publish a commitment to the weights plus one zero-knowledge proof that the fairness-score bound holds, and the same commitment can later be used to verify individual predictions against the same model.","The fairness statement holds for any input distribution consistent with the published aggregate statistics, not just for one benchmark dataset.","Prover time scales linearly in model size, so the same techniques should handle much larger networks and, with the aggregate-statistics proof, large datasets.","The bound is shown to decrease monotonically with measured disparity across models trained with increasing fairness interventions, suggesting it can be used as a ranking signal when comparing models of the same architecture."],"supporting_citations":[{"why":"Supplies the original GNN-based fairness bound that this paper adapts and tightens; serves as the baseline for the new bounds.","marker":"[31]"},{"why":"The prior system proving fairness through zero-knowledge inferences; the main efficiency baseline, estimated at 115 days for a 42.5M-parameter model.","marker":"[21]"},{"why":"Provides the polynomial commitment scheme used in the implementation, which determines proof size and verifier time.","marker":"[25]"},{"why":"Gives the linear-time sumcheck prover algorithms that make the overall prover time linear in model size.","marker":"[53]"},{"why":"Provides the lookup argument that implements range checks, absolute value, and maximum gadgets.","marker":"[27]"},{"why":"Defines the GKR interactive-proof framework on which the circuit-level zkSNARK is built.","marker":"[24]"}],"fun_headline_variants":["FairZK certifies ML fairness in zero-knowledge at 47M scale","Scalable zk proof verifies ML fairness without revealing model","Zero-knowledge fairness proof: 47M parameters in 343s","New bounds enable zk fairness proof for large ML models","FairZK: prover time linear in model size, scales to 47M"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The certificate is an upper bound on the disparity, not the disparity itself; the paper assumes this bound, once normalized or compared against a threshold, is meaningful enough to certify fairness, even though the reported DNN bounds sit 43x to 1129x above the measured disparity.","fun_headline_variants_meta":{"raw":{"variants":["FairZK certifies ML fairness in zero-knowledge at 47M scale","Scalable zk proof verifies ML fairness without revealing model","Zero-knowledge fairness proof: 47M parameters in 343s","New bounds enable zk fairness proof for large ML models","FairZK: prover time linear in model size, scales to 47M"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000343,"raw_usage":{"total_tokens":1962,"prompt_tokens":1095,"completion_tokens":867,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":711,"completion_tokens_details":{"reasoning_tokens":773}},"tokens_in":711,"tokens_out":867,"duration_ms":6036,"temperature":1.0,"reasoning_tokens":773,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:06:24.424407+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Construct or find a model whose FairZK fairness-score bound is below a chosen threshold but whose statistical parity on a held-out test set exceeds that threshold; if the system would certify such a model as fair, the certificate is not sound for the intended fairness property.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the original GNN-based fairness bound that this paper adapts and tightens; serves as the baseline for the new bounds."},{"cited_title":"Golovnev, J","cited_arxiv_id":null,"evidence_quote":"Provides the polynomial commitment scheme used in the implementation, which determines proof size and verifier time."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Gives the linear-time sumcheck prover algorithms that make the overall prover time linear in model size."},{"cited_title":"Hab ¨ock","cited_arxiv_id":null,"evidence_quote":"Provides the lookup argument that implements range checks, absolute value, and maximum gadgets."},{"cited_title":"Goldwasser, Y","cited_arxiv_id":null,"evidence_quote":"Defines the GKR interactive-proof framework on which the circuit-level zkSNARK is built."}],"review_version":1}