{"id":"6a4d11a8-8229-4740-9cf8-47d454f7ab40","arxiv_id":"2506.11458","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"A differentially private linear regression over 50,000 samples is proven inside the RISC Zero ZKVM in under six minutes and verified in 0.17 seconds.","lead":"The authors show a zero-knowledge proof system that attests to the correct training of a differentially private linear regression on 50,000 samples, taking under six minutes to prove and 0.17 seconds to verify. The result is a step toward letting customers verify that an outsourced machine learning provider applied the promised privacy protections.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central DP claim is unsupported because the paper never specifies where Laplace noise comes from inside the RISC Zero guest; with a prover-controlled randomness source, a proof can be valid while the noise is chosen adversarially.","rationale":"The reader's weakest assumption identified the same load-bearing gap: the argument does not constrain the Laplace noise to be sampled from the correct distribution. My read of the manuscript confirms that Sections 4 and 5 describe the ZKVM and the DP regression without ever specifying the randomness mechanism inside the guest. Since RISC Zero's execution model is deterministic and the prover controls host-side inputs, the proof can be valid without the noise being private or correctly distributed. This is a correctness risk rather than a performance issue; the claimed proving and verification times may be real, but they prove the wrong statement if the distributional guarantee is absent. I found no reason to soften the reader's rejection. If the repository shows a verifiable, public-coin or hardware-derived randomness source that is part of the proven computation, this concern would be resolved, but the manuscript itself does not describe one.","tokens_in":13785,"tokens_out":4452,"duration_ms":46805,"concrete_test":"In the linked GitHub repository, locate the guest code path that produces L1, L2, and L3 in Algorithm 1. If these values are read from host-provided private inputs, run the unmodified guest binary with all three noise values fixed to zero and observe whether the RISC Zero verifier accepts the resulting proof; if it does, the proof does not certify a distributional property and the DP claim fails. As a complementary check, search the guest for `env::read`, `rand`, or a deterministic seed to confirm the entropy source is prover-controlled.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that the CI statement attests to correct DP training. Algorithm 1 samples L1, L2, L3 from Laplace distributions, and the (epsilon,0)-DP guarantee holds only if these draws follow Lap(0, 3*Delta/epsilon). Section 4 selects the RISC Zero ZKVM but never states how these samples are obtained in the guest. RISC Zero guest execution is deterministic, so any random-looking value must be supplied by the host or derived from a seed that the prover controls. A malicious prover can therefore choose L1=L2=L3=0, execute the same arithmetic, and produce a proof that the verifier accepts; the proof attests only to that arithmetic over chosen values, not to the required distribution. Section 5.1 mentions f32 and fixed-point arithmetic but is silent on the sampler or entropy source. Consequently the attestation does not establish differential privacy, and the 'fastest known provable-DP' comparison inherits the gap.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a zero-knowledge computational-integrity attestation for differentially private linear regression. It uses the RISC Zero ZKVM to prove execution of the NoisyStats (epsilon,0)-DP algorithm on the Kaggle Healthcare dataset (50,000 samples), reporting a total proving time of about 6 minutes and a verification time of 0.17 seconds. The paper also discusses batching and distributed proving, and compares its asymptotics to confidential-DP. The central claim is that this is the fastest known provable-DP training result for a dataset of this size.","tokens_in":13988,"tokens_out":3624,"duration_ms":37684,"significance":"If the claims were fully substantiated, the work would provide a useful practical benchmark for ZKVM-based verifiable machine learning, and it responsibly names the use of fixed-point arithmetic and GPU acceleration as engineering choices. The authors also make their code publicly available, which is a concrete contribution. However, the paper's headline claims are not backed by the presented protocol description: the randomness source for the Laplace noise is unspecified, the fixed-point discretization is not analyzed, and the batched aggregation does not match the stated DP algorithm. These gaps are load-bearing, so the significance of the reported numbers is currently unclear.","major_comments":[{"comment":"The paper never specifies how the Laplace samples L1, L2, L3 in Algorithm 1 are generated inside the RISC Zero guest, nor how the proof constrains their distribution. RISC Zero guest execution is deterministic, so any random-looking values must be supplied by the host or derived from a prover-controlled seed. A malicious prover can set L1=L2=L3=0, execute the same arithmetic, and produce a valid CI statement. The proof therefore attests only to the arithmetic over chosen noise values, not to the required Lap(0, 3*Delta/epsilon) distribution. Consequently the claimed (epsilon,0)-DP guarantee for the attested computation does not follow, and the abstract's 'provable-DP' claim is unsupported.","section":"Algorithm 1, Section 4, Section 5.1"},{"comment":"The paper states that fixed-point arithmetic is used instead of IEEE floating point, without any analysis of how this affects the differential-privacy guarantee. The NoisyStats mechanism is proven private for continuous Laplace noise; replacing it with a discrete, scaled fixed-point approximation changes the output distribution and can destroy the (epsilon,0)-DP guarantee unless the discretization and clamping are explicitly accounted for. No such analysis is provided, so the privacy budget of epsilon=2 is not established for the actual executed computation.","section":"Section 5.1"},{"comment":"The GPU protocol does not run Algorithm 1 on the full 50,000-sample dataset. Instead, the dataset is split into batches of 1400 samples, each batch is proven separately, and the resulting models are combined by averaging slopes and intercepts. This is a different mechanism from the single-run NoisyStats regression described in Algorithm 1. The paper gives no composition analysis showing that the batched-and-averaged procedure satisfies any stated DP guarantee, nor that the 6-minute proving time and 0.17-second verification time correspond to the claimed 'entire computation' on 50,000 samples.","section":"Section 5.1, Section 5.4"},{"comment":"The verification time of 0.17 seconds is measured on a single GPU-Float batch divided into 10 mini-batches, as stated in the Figure 3 caption. The text in Section 5.1 uses this figure to claim that the verifier is convinced of the authenticity of the CI statement for the entire 50,000-sample task in 0.17 seconds. If verification is per batch, the total verification time for the full dataset would scale with the number of batches, contradicting the stated claim. The measurement does not support the abstract's 'verifying the entire computation in 0.17 seconds' assertion.","section":"Figure 3, Section 5.1"}],"minor_comments":[{"comment":"The Delta values in Table 1 do not match the differences between the OLS and DP-OLS columns: for slope standard error, 0.01636 - 0.01634 = 0.00002, not 0.000018; for intercept standard error, the two values are identical, yet the table reports '< 0.00001'.","section":"Table 1"},{"comment":"The notation 'y = (y1...xn)^T' should be 'y = (y1...yn)^T'; the subscript is inconsistent.","section":"Section 3.4"},{"comment":"The formal definitions of completeness and soundness contain typographical gaps, e.g., 'For every instance-witness pair ( , )' with missing variables, and the probability expression is malformed.","section":"Section 2.1"},{"comment":"Several references are informal sources (a Medium article [10], Wikipedia [11], a Substack post [23], and a Google Sheets document [24]). These are not appropriate as primary citations for cryptographic definitions and should be replaced with peer-reviewed or archival sources.","section":"References"},{"comment":"The comparison to the Ethereum network's hash rate as an estimate of available GPU units is not technically meaningful for this setting and appears to be an unsupported extrapolation; it should be removed or substantiated with relevant data.","section":"Section 5.4"},{"comment":"The conclusion states that 'the verifier has learned the exact same machine-learning model,' which is misleading: the verifier checks a proof of a computation; it does not 'learn' a model in the machine-learning sense.","section":"Section 7"}],"recommendation":"reject","confidential_remarks":"The paper's core contribution is a benchmark, but the benchmark currently measures a process whose privacy guarantee is not established. The missing randomness specification is not a minor presentation issue; it changes the protocol and the meaning of the reported numbers. I would not consider a revision within the current scope sufficient unless the authors redesign the protocol to prove correct Laplace sampling, analyze the fixed-point discretization, and either prove composition for the batched aggregation or change the claimed statement to match what is actually verified."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Hey [Name],\n\nYou should know about this one if you track verifiable ML. The authors build a RISC Zero guest that runs the NoisyStats DP linear regression on 50k samples and report a six-minute prove and 0.17-second verify. That benchmark, if it holds up, is the kind of concrete data point the field lacks. But the central privacy claim does not hold up as written: they never say where the Laplace noise comes from inside the ZKVM. RISC Zero guests are deterministic, so the host must supply randomness; if the prover controls that seed, a valid proof attests only to the arithmetic, not to the sample being Lap(...). That is a load-bearing gap, and it is exactly the gap the stress-test flags. It is not a subtle nit—Algorithm 1 samples L1, L2, L3, and Section 4 picks RISC Zero, but no sampler or entropy source is described anywhere.\n\nWhat is genuinely new is small but real: applying a general-purpose ZKVM to a specific DP algorithm, plus two engineering tricks worth stealing (byte embedding to cut data-loading cycles from 232M to 640, fixed-point batching to fit 1400 samples per batch). The paper is clearly written and the authors are transparent about the GPU VRAM batching and about the fact that runtimes across different datasets are not directly comparable.\n\nThe soft spots beyond the randomness issue: the 0.17s verifier claim appears to come from a single batch divided into mini-batches, not from the full 50k dataset—the text is ambiguous and the figure does not resolve it. Table 1 has small arithmetic errors in the deltas. The 'fastest known' comparison rests on one non-comparable baseline, which the authors themselves admit. None of these are fatal if the randomness gap is fixed; they are the usual revision work.\n\nMy take: send it to peer review, but the reviewers must push on the noise sampling. As submitted, the central attestation is not established. The GitHub repo may or may not resolve it; the paper needs to make the provenance of entropy an explicit part of the protocol.\n\nWorth discussing at reading group for exactly this reason—it is a clean example of why deterministic proofs and DP randomness do not compose automatically. I would not cite it in its current form.\n\nBest,\n[You]","headline":"Plausible benchmark, but the paper never proves the DP part: the noise source inside RISC Zero is unspecified, so the attestation as written only covers arithmetic, not privacy.","tokens_in":14463,"tokens_out":3193,"would_cite":false,"duration_ms":31278,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a differentially private linear regression over 50,000 samples can be cryptographically proved correct in under six minutes and verified in 0.17 seconds, making this the fastest known provable-DP training at this…","keywords":["Differential Privacy","Machine-Learning","Linear Regression","Zero-Knowledge Cryptography","Probabilistic Checkable Proofs","ZK-STARK","Computational Integrity","Laplace Mechanism"],"falsifier":"Inspect the prover's code and execution trace to identify the source of randomness for the three Laplace samples. If the attested samples are deterministic, prover-chosen, or drawn from a distribution other than $\\mathrm{Lap}(3\\Delta/\\epsilon)$, then the argument proves only that the arithmetic was done, not that the training is $\\epsilon$-differentially private; equivalently, compare the attested noise values across two runs on the same dataset and check whether they match the Laplace distribution.","tokens_in":13565,"feed_emoji":"🔐","tokens_out":9032,"duration_ms":83706,"temperature":0.7,"pith_summary":"This paper aims to show that a machine-learning training run can be cryptographically attested, not just executed. Specifically, it claims to prove the correct training of a differentially private (DP) linear regression over 50,000 samples on a single laptop, with the proof generated in under six minutes and verified in about 0.17 seconds. The authors present this as the fastest known instance of provable DP training at that dataset size, and as a step toward machine-learning-as-a-service where a customer can verify that a private training protocol was followed. The result matters because it turns trust in an untrusted training provider into a checkable certificate.","feed_headline":"A six-minute proof certifies private training on 50,000 samples","feed_subtitle":"A zero-knowledge proof verifies a differentially private linear regression in 0.17 seconds.","key_machinery":"The carrying mechanism is a zero-knowledge virtual machine: a software simulation of a small RISC-V computer that is compiled into a circuit, so that running Rust code inside it yields an execution trace that can be turned into a short argument of correct execution. The paper pairs this with the NoisyStats differentially private linear regression, which perturbs the slope and intercept with Laplace noise calibrated to sensitivity. The performance-critical optimizations are fixed-point arithmetic instead of IEEE floating point, and embedding the dataset as contiguous bytes in the prover's binary so that loading 50,000 samples costs about 640 cycles instead of 232 million cycles.","core_discovery":"The central claim is that the entire differentially private training process—including the three Laplace noise draws, the regression arithmetic, and the dataset itself—can be committed to a single non-interactive computational-integrity argument. Running the NoisyStats algorithm with ε=2 inside a zero-knowledge virtual machine, the prover produces a STARK-style argument (a transparent, hash-based proof of computational integrity) for all 50,000 samples; the verifier checks it in roughly 0.17 seconds. The paper further claims a poly-logarithmic verifier and a quasi-linear prover, improving on the closest prior work's linear verifier, and reports that the noisy regression converges to almost the same model as ordinary least squares on the same data.","pith_inferences":["In our reading, the result is specific to a two-variable linear regression; extending the same guarantee to deep networks would require proving gradient and backpropagation computations, which this paper leaves open.","The paper does not state where the randomness for the Laplace samples comes from or how the verifier knows the samples were drawn from the right distribution, so a cautious reader should treat the certificate as proving arithmetic correctness before inferring differential privacy.","The multi-machine aggregation step averages per-node slopes and intercepts, which is not generally the same as the pooled regression over all 50,000 rows; the distributed scheme would certify that combined model, not necessarily the single-machine model.","A natural testable extension is to prove a seeded pseudorandom generator inside the virtual machine so that each Laplace draw is verifiably distributed; that would close the gap between arithmetic attestation and a full differential-privacy certificate."],"forward_implications":["A client of a machine-learning service can verify, in a fraction of a second, that the agreed differentially private regression was actually run over the agreed dataset.","Because the argument is non-interactive and zero-knowledge, the certificate can be circulated and checked by third parties who never had access to the training data.","Verification work grows only poly-logarithmically with dataset size, so the verifier's cost stays small even if training data grows well beyond 50,000 samples.","The batch size ceiling is set by the prover's on-chip memory, but the same batched approach can run in parallel across many GPUs, trading wall-clock time for more hardware.","Using fixed-point rather than floating-point arithmetic is what makes the largest batches affordable, which supports lowering proving time."],"supporting_citations":[{"why":"Supplies the NoisyStats differentially private linear regression algorithm (Algorithm 1) whose execution is being proved.","marker":"[5]"},{"why":"Supplies the scalable, transparent, post-quantum-secure computational-integrity construction that the argument system is based on.","marker":"[4]"},{"why":"Provides the interactive-oracle-proof model and the completeness, soundness, and succinctness definitions used to specify the protocol.","marker":"[3]"},{"why":"Supplies the zero-knowledge virtual machine that turns the Rust implementation of the training into a provable execution trace.","marker":"[21]"},{"why":"Gives the closest prior provable-DP result, the baseline the speed and verifier-complexity claims are compared against.","marker":"[26]"},{"why":"Underlies the comparison baseline and implies the linear verifier complexity that this work claims to improve to poly-logarithmic.","marker":"[28]"}],"fun_headline_variants":["Zero-knowledge proof verifies private ML training in 0.17s","STARK-based proof checks DP regression on 50k samples","Fastest provable-DP: 50k samples, 6-min proof, 0.17s verify","Integrity proof for private training: poly-log verifier","Proof of correct DP training on 50k samples in minutes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the cryptographic proof actually pins down the random noise used during training; the paper never says where the random numbers come from or how a verifier would know they were drawn from the correct distribution, so if the prover could choose or bias that noise, the certificate would not by itself establish differential privacy.","fun_headline_variants_meta":{"raw":{"variants":["Zero-knowledge proof verifies private ML training in 0.17s","STARK-based proof checks DP regression on 50k samples","Fastest provable-DP: 50k samples, 6-min proof, 0.17s verify","Integrity proof for private training: poly-log verifier","Proof of correct DP training on 50k samples in minutes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000232,"raw_usage":{"total_tokens":1457,"prompt_tokens":883,"completion_tokens":574,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":499,"completion_tokens_details":{"reasoning_tokens":489}},"tokens_in":499,"tokens_out":574,"duration_ms":5594,"temperature":1.0,"reasoning_tokens":489,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T04:05:14.803010+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Inspect the prover's code and execution trace to identify the source of randomness for the three Laplace samples. If the attested samples are deterministic, prover-chosen, or drawn from a distribution other than $\\mathrm{Lap}(3\\Delta/\\epsilon)$, then the argument proves only that the arithmetic was done, not that the training is $\\epsilon$-differentially private; equivalently, compare the attested noise values across two runs on the same dataset and check whether they match the Laplace distribution.","supporting_citations":[{"cited_title":"Cryptology ePrint Archive, Paper 2018/046, 2018","cited_arxiv_id":null,"evidence_quote":"Supplies the scalable, transparent, post-quantum-secure computational-integrity construction that the argument system is based on."},{"cited_title":"Cryptology ePrint Archive, Paper 2016/116, 2016","cited_arxiv_id":null,"evidence_quote":"Provides the interactive-oracle-proof model and the completeness, soundness, and succinctness definitions used to specify the protocol."},{"cited_title":"Available online: https://www.risczero.com/about [Accessed 20- 09-2023]","cited_arxiv_id":null,"evidence_quote":"Supplies the zero-knowledge virtual machine that turns the Rust implementation of the training into a provable execution trace."},{"cited_title":"Available online: https://openreview.net/ pdf?id=PQY2v6VtGe, 2024","cited_arxiv_id":null,"evidence_quote":"Gives the closest prior provable-DP result, the baseline the speed and verifier-complexity claims are compared against."},{"cited_title":"et al: Wolverine: Fast, Scalable, and Communication-Efficient Zero- Knowledge Proofs for Boolean and Arithmetic Circuits","cited_arxiv_id":null,"evidence_quote":"Underlies the comparison baseline and implies the linear verifier complexity that this work claims to improve to poly-logarithmic."}],"review_version":1}