Pith. sign in

REVIEW 4 major objections 5 minor 62 references

ExpProof : Operationalizing Explanations for Confidential Models with ZKPs

T0 review · 4 major / 5 minor · reviewed 2026-08-09 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A protocol lets customers verify LIME explanations of confidential models without seeing the weights.

desk verdict First working ZKP for LIME explanations, with real engineering, but the proof certifies a quantized look-alike rather than LIME itself, and the paper never checks how far the two diverge. read the letter →

arxiv 2502.03773 v4 pith:KAM5B5SC submitted 2025-02-06 cs.LG cs.AIcs.CR

Chhavi Yadav , Evan Monroe Laufer , Dan Boneh , Kamalika Chaudhuri This is my paper · ORCID
classification cs.LGcs.AIcs.CR
keywords zero-knowledgeproofsLIMEexplainabilitymodelconfidentialityverifiablecomputationcommitmentschemesadversarialLASSOdualitygap
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Explanations are often demanded in adversarial settings where the model owner has an incentive to manipulate them. This paper argues that a technical guarantee is possible: a customer can check that a LIME explanation was computed from the model that made the prediction, even though the model weights stay secret. The proposed protocol, ExpProof, combines cryptographic commitments, which pin the model and explanation parameters before any query, with a zero-knowledge proof that certifies the prediction and the explanation computation. The paper claims that verification is practical, with proof generation under two minutes and verification in roughly a tenth of a second for small neural networks.

What carries the argument

The load-bearing object is a monolithic zero-knowledge circuit that verifies every step of a quantized LIME computation. Sampling is checked by deriving uniform points from a ZK-friendly hash and proving an inverse-CDF transform; the exponential similarity kernel is checked against a lookup table; model predictions for the sampled points are checked using the proof system's inference-verification circuits; and the LASSO explanation is certified by checking a duality-gap bound against a feasible dual solution supplied as a witness. The design choice that makes the proof small is replacing the optimization with a verifiable optimality certificate. Cryptographic commitments to the model weights and to the prover's sampling randomness are fixed in an offline phase, so the proof binds each explanation to the same model and the same random seed.

What would settle it

Take a set of test inputs, run the committed model, and compute LIME explanations with both the standard LIME library and the ExpProof zero-knowledge circuit using the same model and parameters; if the returned top-K feature sets disagree for a non-negligible fraction of inputs, the fidelity measurements and the explanation-correctness guarantee would not transfer to the real system.

Watch

Extended reading notes

Core claim

The paper's central claim is that correct computation of a LIME explanation for a confidential model can be proven in zero knowledge. Concretely, ExpProof returns the prediction, the explanation, and a proof that the explanation was produced by the committed model using the public LIME configuration, leaking nothing beyond the prediction and explanation. To make this feasible, LIME is re-designed as a circuit-friendly algorithm: uniform sampling replaces Gaussian sampling (via an inverse-CDF lookup table), the exponential kernel becomes a lookup table, and all values are quantized to fixed-point integers. The weighted LASSO step is not solved inside the proof; instead the prover supplies a feasible dual solution and the circuit checks that the duality gap is below a public threshold, certifying near-optimality of the explanation. The paper also introduces BorderLIME, a line-search variant that finds a nearby opposite-class point, and shows empirically on three fairness datasets that the resulting proofs achieve the stated overheads.

Load-bearing premise

The proof certifies a quantized and lookup-table version of LIME, and the paper does not measure how far the resulting explanations are from the explanations that the standard LIME library would produce for the same model and inputs.

Editorial extensions

If this is right

  • A customer receiving a prediction and explanation can independently verify, in a fraction of a second, that both came from the same committed model, without the model owner revealing weights.
  • Explanation parameters such as the sampling neighbourhood, kernel bandwidth, and number of samples become enforceable public configuration, so an owner cannot silently switch explanation algorithms.
  • The proof generation cost is dominated by model inference in the circuit, so future improvements in zero-knowledge inference directly reduce the cost of proven explanations.
  • The duality-gap approach to verifying LASSO suggests that other optimization-based explanation methods can be certified without re-solving them inside the proof.
  • For small neural networks and random forests, end-to-end proof generation is in the minute range, making the protocol usable for individual audit requests rather than batch auditing.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's correctness guarantee attaches to the quantized, lookup-table LIME whose behaviour is never compared with the floating-point LIME library; a direct top-K agreement test would determine whether the fidelity numbers carry over to what is actually proven.
  • The protocol's binding of randomness makes the explanation deterministic given the query, which may change the distribution of explanations in a way that could be detected or gamed; examining the statistical behaviour of ExpProof-generated explanations versus standard LIME is a natural next step.
  • Because verification is cheap and the proof is small, the same machinery could be dropped into a smart contract or a regulator-run portal to create auditable explanation records for fairness disputes.
  • BorderLIME's stability radius is currently found by heuristic search; replacing this with a certified radius would give the protocol an end-to-end guarantee that the border point is truly the closest opposite-label point.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. ExpProof is a system that combines cryptographic commitments and zero-knowledge proofs (ZKPs) to let a model owner prove to a customer that a returned prediction and a LIME explanation were computed from a fixed, committed model, without revealing the model weights. The paper proposes several ZKP-friendly variants of LIME (e.g., uniform vs. Gaussian sampling, exponential vs. no kernel, and a BorderLIME extension), implements them in the ezkl/Halo2 framework, and reports proof-generation time, verification time, and proof size on three tabular datasets for two-layer neural networks and random forests. The central claim is Theorem 5.1: for a committed model f and input x, ExpProof returns f(x), a LIME explanation E(f,x), and a zero-knowledge proof of correct computation, leaking nothing beyond predictions and explanations. The empirical companion claim is feasibility: proof generation up to about 1.5 minutes and verification around 0.12 seconds for the considered models.

Significance. If the central claim holds, this is a valuable step toward operationalizing explanations in adversarial settings where model owners are incentivized to manipulate explanations and models are confidential. The idea of verifying LASSO optimality inside a ZKP via a duality-gap check rather than solving the optimization inside the circuit is elegant and useful beyond this specific application. The paper also ships publicly available code and reduces the security argument to the knowledge-soundness of Halo2 and the binding/hiding of KZG commitments, which is the right structure. The concrete measurements of proof-generation time, verification time, and proof size are useful for practitioners. However, the current manuscript proves correctness of a fixed-point, lookup-table approximation of LIME, not of the LIME algorithm whose fidelity is measured in the experiments, and one of the circuit subroutines (Algorithm 11) does not match LIME's distance kernel as written. These issues are load-bearing because they affect what predicate the proof actually establishes.

major comments (4)
  1. [§A, Algorithm 11] Algorithm 11 computes 'square distance = x · z_i' and then π_i ← LOOKUP_EXPONENTIAL(−square distance/σ²). LIME's similarity kernel, as defined in Alg. 1 and Alg. 2, is exp(−||x − z_i||²/σ²), not exp(−(x · z_i)/σ²). As written, the circuit proves a different locality kernel, so a proof that passes the ZK LIME checks does not certify that the explanation was produced with LIME's exponential kernel. This discrepancy directly undermines Theorem 5.1's wording. The fix is to implement the squared Euclidean distance, but this must also be reflected in the circuit and measured.
  2. [§6.1 and §6.2, Fidelity Results] The fidelity numbers in Figs. 2, 5, 6, 7, 8, and 10 are computed with the Python LIME library, not with the fixed-point, lookup-table circuit that ExpProof actually proves. The paper never compares the explanations output by the ZK circuit with those output by the LIME library on the same committed model and inputs. Because the circuit uses uniform-then-inverse-CDF sampling (Alg. 13), exponential and inverse-CDF lookup tables of 200k rows, fixed-point LASSO verified by duality gap (Alg. 9), and top-K extraction from quantized weights (Alg. 10), the approximation can change the top-K features. If it does, Theorem 5.1's 'LIME explanation' guarantee holds only for a different explanation algorithm, and the reported fidelity numbers do not transfer. A direct experiment measuring agreement between circuit-output explanations and library-output explanations (e.g., top-K overlap and prediction similarity of the circuit's own explanations) is needed.
  3. [§A.1, R_lime] The formal knowledge-soundness relation R_lime contains checks for the commitment, the inference, the Poseidon hash, the sampling, the kernel, the LASSO primal/dual values and dual gap, but it contains no condition that the output explanation e equals top-K of the LASSO solution ŵ. Algorithm 10 (ZK TOP K) does check e against the sorted ŵ, but that sub-routine is not reflected in the relation. As a result, the stated theorem proves soundness for a relation that does not capture the explanation-correctness property advertised in Thm 5.1. The relation should include a constraint such as e = top-K(ŵ, K) (with the precise definition of top-K used in Alg. 10).
  4. [§A.1, Completeness proof sketch] The completeness argument invokes strong duality of LASSO over the reals to claim existence of a primal-dual pair with zero duality gap, then states that in fixed-point the prover 'can use a larger number of fractional bits until the approximation is precise enough.' This is not a proof: existence over the reals does not guarantee existence within the chosen fixed-point grid at the prover's disposal, and changing the number of fractional bits changes the circuit and the public configuration. The completeness and soundness of the protocol depend on the precise fixed-point encoding and on the public threshold ϵ. The paper needs either a proof that for the fixed-point encoding used in the implementation there is always a witness with dual gap ≤ ϵ, or an explicit approximate-completeness statement quantifying the failure probability, with ϵ chosen accordingly.
minor comments (5)
  1. [§A, Algorithm 8] In Algorithm 8, the loop variable i is reused for both the outer loop over vectors and the inner loop over the vector length, and the update 'x_border ← v_i' inside the inner loop does not clearly correspond to the search described in the text. The logic should be rewritten with distinct loop variables and a clearer description of how the closest opposite-label point is selected.
  2. [§A.2, Note on duality gap] The bound ||w − w*||₂ = O(√(nϵ)/λ_min⁺(X)) is stated without derivation or reference. Since the paper already cites Kim et al. (2007) for the LASSO dual, a derivation or explicit citation for this error bound is needed, along with the precise constants and the role of λ_min⁺(X).
  3. [§5, Theorem 5.1] The informal theorem says 'LIME explanation E(f,x)' without qualifying that the proof concerns the quantized, lookup-table version of LIME implemented in the circuit. Until the fidelity comparison in the major comment above is resolved, the theorem statement should explicitly say which version of LIME is proven, e.g., 'the fixed-point, lookup-table LIME variant implemented in Algorithm 6.'
  4. [§6.1, Setup] The paper says the LIME library is used for experimentation, but it does not cite a specific version or release of the LIME library. Since the paper proposes ZKP-amenable variants that differ from the library's default sampling and kernel by design, specifying the exact library and the overridden parameters would improve reproducibility.
  5. [§6.1, ZKP Overhead Results] The legend of Fig. 3 and the text state 'All configurations use the same number of Halo2 rows, 2^18', but the text in §6 says 'We use default configuration for ezkl, except for 200k rows for all lookup arguments'. It would be clearer to state the total circuit row count and the lookup-table size in one place and to explain why the row count is identical across configurations with different sampling types.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: ExpProof's core theorem reduces to Halo2/KZG guarantees; the quantized-LIME fidelity gap is a modeling mismatch, not a circular derivation.

full rationale

The paper's claimed derivation chain is not circular. The central guarantee (Thm 5.1, formalized via R_lime in App. A.1) is a reduction to Halo2 knowledge-soundness and KZG commitment binding/hiding: the proof sketch states that knowledge-soundness 'follows directly from the knowledge-soundness of the underlying proof system Halo2' and that zero-knowledge follows from the Halo2 simulator. No fitted constant defines R_lime: the duality-gap threshold ϵ is a public verifier-set parameter, and the paper derives the bound ||w - w*||_2 = O(sqrt(nϵ)/λ_min^+(X)) rather than assuming the target explanation. The fidelity and overhead results are external empirical measurements on Adult, Credit, and German Credit, not predictions generated by fitting the protocol's constants. There are self-citations, notably (Yadav et al., 2024a) for an optional offline stability-radius proof in BorderLIME, but that citation is not load-bearing for the standard LIME protocol, and the experiments approximate δ heuristically from a fixed grid. The legitimate concern that the ZK circuit proves a fixed-point, lookup-table approximation of LIME rather than reference LIME is a fidelity and predicate-mismatch gap: for instance, Algorithm 11 computes 'square distance = x·z_i' instead of ||x - z_i||^2, and the formal relation R_lime omits an explicit top-K condition. These issues weaken the match between the theorem's informal wording and the implemented circuit, but they do not make the derivation equivalent to its inputs by construction. The circuit relation is presented as a ZKP-amenable approximation of LIME, not as a definition of LIME, so no circular step is exhibited.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The protocol has no fitted constants inside its proof system; the free numeric choices are experimental configuration and the BorderLIME stability radius. The core axioms are standard cryptographic assumptions (Halo2 knowledge-soundness, KZG commitment binding and hiding) and LASSO strong duality. The most fragile non-cryptographic premise is that fixed-point arithmetic and lookup tables faithfully represent the LIME functions they replace.

free parameters (4)
  • stability_radius_delta (BorderLIME) = per dataset, chosen from grid {0.01, 0.03, 0.05, 0.07, 0.1, 0.15} as the smallest value with an opposite-class point…
    Hand-tuned on the evaluation inputs in Sec 6.2; it drives the BorderLIME fidelity and overhead results, but is not part of the standard LIME protocol.
  • duality_gap_threshold_epsilon = 0.001 in experiments
    Set by the authors in Sec 6.1; the optimality bound of the certified explanation depends on it. Appendix A.2 notes it should ideally be set by the verifier, but in the experiments it is a chosen constant.
  • LIME variant hyperparameters = n=300, K=5, sigma=sqrt(#features)*0.75, sampling width/std=0.2
    Taken from the LIME library defaults in Sec 6.1; they define which explanation problem the proof certifies, so they are load-bearing for the feasibility and fidelity numbers.
  • fixed-point quantization scale = 4 decimal places for NN weights; unspecified bit widths for circuit values
    Quantization is required for ZKP compatibility and causes about a 1% test accuracy drop (Sec 6); the proof certifies the quantized model, not the original floating-point model.
assumptions (5)
  • domain assumption Halo2 is knowledge-sound, complete, and zero-knowledge for the circuits built by ezkl.
    Invoked in Appendix A.1 proof sketches; the formal theorem inherits Halo2's security properties.
  • domain assumption KZG polynomial commitments are hiding and binding.
    Used in Sec 5 commitment phase to bind model weights and randomness; security rests on algebraic group or discrete-log type assumptions.
  • domain assumption Poseidon behaves as a keyed pseudorandom function so the sample stream r_p + r_v is unpredictable to both prover and verifier.
    Used in Sec 5 under Verifying Sampling to generate the LIME neighborhood; this hash-based randomness model is not explicitly formalized in the security proof.
  • standard math Strong duality of LASSO and the closed-form dual feasible construction of Kim et al. 2007.
    Used in Appendix A.2 and the completeness proof to justify that a dual-feasible witness with gap at most epsilon exists for real-valued LASSO.
  • ad hoc to paper Fixed-point arithmetic and lookup tables exactly compute the intended real-valued functions up to the chosen precision.
    The circuit replaces exponentials and Gaussian inverse CDFs with lookup tables and quantizes all values; the paper does not verify the induced error against reference LIME. This is the weakest implicit assumption.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ExpProof : Operationalizing Explanations for Confidential Models with ZKPs." pith.science (2026). https://pith.science/paper/KAM5B5SC

@misc{pith2026250203773,
  author       = {Pith},
  title        = {Pith review of: ExpProof : Operationalizing Explanations for Confidential Models with ZKPs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KAM5B5SC}},
  note         = {Machine review of arXiv:2502.03773}
}
read the original abstract

In principle, explanations are intended as a way to increase trust in machine learning models and are often obligated by regulations. However, many circumstances where these are demanded are adversarial in nature, meaning the involved parties have misaligned interests and are incentivized to manipulate explanations for their purpose. As a result, explainability methods fail to be operational in such settings despite the demand \cite{bordt2022post}. In this paper, we take a step towards operationalizing explanations in adversarial scenarios with Zero-Knowledge Proofs (ZKPs), a cryptographic primitive. Specifically we explore ZKP-amenable versions of the popular explainability algorithm LIME and evaluate their performance on Neural Networks and Random Forests. Our code is publicly available at https://github.com/emlaufer/ExpProof.

Figures

Figures reproduced from arXiv: 2502.03773 by the authors.

Figure 1
Figure 1. Pictorial Representation of ExpProof. and are incentivized to manipulate explanations to meet their ends. For instance, a bank which denies loan to an applicant based on an ML model’s prediction has an incen￾tive to return an incontestable explanation to the applicant rather than reveal the true workings of the model since the explanation can be used by the applicant to prove discrimi￾nation in the court of law (Bor… view at source ↗
Figure 2
Figure 2. Results for NNs. G/U: gaussian or uniform sampling, E/N: using or not using the exponential kernel. Left: Fidelity of different variants of Standard LIME, Mid: Fidelity of different variants of BorderLIME , Right: Fidelity of Standard vs. BorderLIME. Adult Credit German 0.00 0.25 0.50 0.75 1.00 1.25 1.50 1.75 2.00 Proof Generation Time (mins) G + E G + N U + E U + N Adult Credit German 0 2 4 6 8 10 12 14 16 Proof Si… view at source ↗
Figure 3
Figure 3. Results for NNs. G/U: gaussian or uniform sampling, E/N: using or not using the exponential kernel. Left: Proof Generation Time (in mins), Mid: Proof Size (in KBs), Right: Verification times (in secs) for different variants of Standard LIME. All configurations use the same number of Halo2 rows, 2 18, and lookup tables of size 200k. 6.3. Ablation Study We conduct an ablation study to investigate the computa￾tional bo… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Proof-Generation (mins) and Verification Time (secs) with increasing #HiddenLayers and #Units/HiddenLayer. #Layers Sampling+ExpKernel LASSO Inferences 2 23.54 59.62 42.15 10 24.11 60.34 108.23 20 24.50 60.70 179.00 40 25.59 62.30 319.48 [PITH_FULL_IMAGE:figures/full_f…
Figure 5
Figure 5. Figure 5: Results for NNs for n = 300 neighboring points and uniform sampling in the evaluation. Left: Fidelity of different variants of Standard LIME, Mid: Fidelity of different variants of BorderLIME, Right: Fidelity of Standard vs. BorderLIME. Next we increase the neighborhoo…
Figure 6
Figure 6. Figure 6: Results for NNs for n = 5000 neighboring points and gaussian sampling in the evaluation. Left: Fidelity of different variants of Standard LIME, Mid: Fidelity of different variants of BorderLIME , Right: Fidelity of Standard vs. BorderLIME. 20 [PITH_FULL_IMAGE:figures/…
Figure 7
Figure 7. Figure 7: Results for RFs for n = 300 neighboring points and gaussian sampling in the evaluation. Left: Fidelity of different variants of Standard LIME, Mid: Fidelity of different variants of BorderLIME , Right: Fidelity of Standard vs. BorderLIME. Adult German Credit 0.0 0.2 0.…
Figure 8
Figure 8. Figure 8: Results for RFs for n = 300 neighboring points and uniform sampling in the evaluation. Left: Fidelity of different variants of Standard LIME, Mid: Fidelity of different variants of BorderLIME , Right: Fidelity of Standard vs. BorderLIME. Next we show the ZKP overheads …
Figure 9
Figure 9. Figure 9: Results for RFs for n = 300 neighboring points. Left: Proof Generation Time (in mins), Mid: Proof Size (in KBs), Right: Verification times (in secs) for different variants of Standard LIME. All configurations use the same number of Halo2 rows, 2 18, and lookup tables o…
Figure 10
Figure 10. Figure 10: Results for RFs for neighboring points n = 5000 and gaussian sampling in the evaluation. Left: Fidelity of different variants of Standard LIME, Mid: Fidelity of different variants of BorderLIME , Right: Fidelity of Standard vs. BorderLIME. 22 [PITH_FULL_IMAGE:figures…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

62 extracted references · 45 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    https://github.com/lyronctk/zator/tree/main, 2023

    Zator: Verified inference of a 512-layer neural network using recursive snarks. https://github.com/lyronctk/zator/tree/main, 2023

    work page 2023

  3. [3]

    Zero-knowledge proofs of training for deep neural networks

    Abbaszadeh, K., Pappas, C., Katz, J., and Papadopoulos, D. Zero-knowledge proofs of training for deep neural networks. Cryptology ePrint Archive, 2024

    work page 2024

  4. [4]

    Fairwashing: the risk of rationalization

    A \" vodji, U., Arai, H., Fortineau, O., Gambs, S., Hara, S., and Tapp, A. Fairwashing: the risk of rationalization. In International Conference on Machine Learning, pp.\ 161--170. PMLR, 2019

    work page 2019

  5. [5]

    Keeping up with the language models: Robustness-bias interplay in nli data and models

    Baldini, I., Yadav, C., Das, P., and Varshney, K. Keeping up with the language models: Robustness-bias interplay in nli data and models. In The 61st Annual Meeting Of The Association For Computational Linguistics, 2023

    work page 2023

  6. [6]

    and Kohavi, R

    Becker, B. and Kohavi, R. Adult . UCI Machine Learning Repository, 1996. DOI : https://doi.org/10.24432/C5XW20

    doi:10.24432/c5xw20 1996

  7. [7]

    and von Luxburg, U

    Bhattacharjee, R. and von Luxburg, U. Auditing local explanations is hard. In Globerson, A., Mackey, L., Belgrave, D., Fan, A., Paquet, U., Tomczak, J., and Zhang, C. (eds.), Advances in Neural Information Processing Systems, volume 37, pp.\ 18593--18632. Curran Associates, Inc., 2024

    work page 2024

  8. [8]

    Coin flipping by telephone a protocol for solving impossible problems

    Blum, M. Coin flipping by telephone a protocol for solving impossible problems. ACM SIGACT News, 15 0 (1): 0 23--27, 1983

    work page 1983

Show all 62 references
  1. [9]

    Post-hoc explanations fail to achieve their purpose in adversarial contexts

    Bordt, S., Finck, M., Raidl, E., and von Luxburg, U. Post-hoc explanations fail to achieve their purpose in adversarial contexts. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pp.\ 891--905, 2022

    2022

  2. [10]

    Zkml: An optimizing system for ml inference in zero-knowledge proofs

    Chen, B.-J., Waiwitlikhit, S., Stoica, I., and Kang, D. Zkml: An optimizing system for ml inference in zero-knowledge proofs. In Proceedings of the Nineteenth European Conference on Computer Systems, pp.\ 560--574, 2024

    2024

  3. [11]

    Framework for evaluating faithfulness of local explanations

    Dasgupta, S., Frost, N., and Moshkovitz, M. Framework for evaluating faithfulness of local explanations. In International Conference on Machine Learning, pp.\ 4794--4815. PMLR, 2022

    2022

  4. [12]

    Validating the integrity of convolutional neural network predictions based on zero-knowledge proof

    Fan, Y., Xu, B., Zhang, L., Song, J., Zomaya, A., and Li, K.-C. Validating the integrity of convolutional neural network predictions based on zero-knowledge proof. Information Sciences, 625: 0 125--140, 2023

    2023

  5. [13]

    Zen: Efficient zero-knowledge proofs for neural networks

    Feng, B., Qin, L., Zhang, Z., Ding, Y., and Chu, S. Zen: Efficient zero-knowledge proofs for neural networks. IACR Cryptol. ePrint Arch., 2021: 0 87, 2021. URL https://api.semanticscholar.org/CorpusID:231731893

    2021

  6. [14]

    Experimenting with zero-knowledge proofs of training

    Garg, S., Goel, A., Jha, S., Mahloujifar, S., Mahmoody, M., Policharla, G.-V., and Wang, M. Experimenting with zero-knowledge proofs of training. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 1880--1894, 2023

    2023

  7. [15]

    and Luxburg, U

    Garreau, D. and Luxburg, U. Explaining the explainer: A first theoretical analysis of lime. In International conference on artificial intelligence and statistics, pp.\ 1287--1296. PMLR, 2020

    2020

  8. [16]

    and von Luxburg, U

    Garreau, D. and von Luxburg, U. Looking deeper into tabular lime. arXiv preprint arXiv:2008.11092, 2020

    2008 arXiv

  9. [17]

    Proofs that yield nothing but their validity or all languages in np have zero-knowledge proof systems

    Goldreich, O., Micali, S., and Wigderson, A. Proofs that yield nothing but their validity or all languages in np have zero-knowledge proof systems. J. ACM, 38 0 (3): 0 690–728, jul 1991. ISSN 0004-5411. doi:10.1145/116825.116852. URL https://doi.org/10.1145/116825.116852

    1991

  10. [18]

    The knowledge complexity of interactive proof-systems

    Goldwasser, S., Micali, S., and Rackoff, C. The knowledge complexity of interactive proof-systems. In Proceedings of the Seventeenth Annual ACM Symposium on Theory of Computing, STOC '85, pp.\ 291–304, New York, NY, USA, 1985. Association for Computing Machinery. ISBN 08979115...

    1985

  11. [19]

    Poseidon: A new hash function for Zero-Knowledge proof systems

    Grassi, L., Khovratovich, D., Rechberger, C., Roy, A., and Schofnegger, M. Poseidon: A new hash function for Zero-Knowledge proof systems. In 30th USENIX Security Symposium (USENIX Security 21), pp.\ 519--535. USENIX Association, August 2021. ISBN 978-1-939133-24-3. URL https:...

    2021

  12. [20]

    Statlog (German Credit Data)

    Hofmann, H. Statlog (German Credit Data) . UCI Machine Learning Repository, 1994. DOI : https://doi.org/10.24432/C5NC77

    1994 doi

  13. [21]

    zkmlaas: a verifiable scheme for machine learning as a service

    Huang, C., Wang, J., Chen, H., Si, S., Huang, Z., and Xiao, J. zkmlaas: a verifiable scheme for machine learning as a service. In GLOBECOM 2022-2022 IEEE Global Communications Conference, pp.\ 5475--5480. IEEE, 2022

    2022

  14. [22]

    Jordan, M., Lewis, J., and Dimakis, A. G. Provable certificates for adversarial examples: Fitting a ball in the union of polytopes. Advances in neural information processing systems, 32, 2019

    2019

  15. [23]

    Scaling up trustless dnn inference with zero-knowledge proofs, 2022

    Kang, D., Hashimoto, T., Stoica, I., and Sun, Y. Scaling up trustless dnn inference with zero-knowledge proofs, 2022

    2022

  16. [24]

    A survey of algorithmic recourse: Contrastive explanations and consequential recommendations

    Karimi, A.-H., Barthe, G., Sch\" o lkopf, B., and Valera, I. A survey of algorithmic recourse: Contrastive explanations and consequential recommendations. ACM Comput. Surv., 55 0 (5), December 2022. ISSN 0360-0300. doi:10.1145/3527848. URL https://doi.org/10.1145/3527848

    2022 doi

  17. [25]

    a stner, L., Langer, M., Lazar, V., Schom \

    K \"a stner, L., Langer, M., Lazar, V., Schom \"a cker, A., Speith, T., and Sterz, S. On the relation of trust and explainability: Why to engineer for trustworthiness. In 2021 IEEE 29th International Requirements Engineering Conference Workshops (REW), pp.\ 169--175. IEEE, 2021

    2021

  18. [26]

    M., and Goldberg, I

    Kate, A., Zaverucha, G. M., and Goldberg, I. Constant-size commitments to polynomials and their applications. In Advances in Cryptology-ASIACRYPT 2010: 16th International Conference on the Theory and Application of Cryptology and Information Security, Singapore, December 5-9, ...

    2010

  19. [27]

    An interior-point method for large-scale _1 -regularized least squares

    Kim, S.-J., Koh, K., Lustig, M., Boyd, S., and Gorinevsky, D. An interior-point method for large-scale _1 -regularized least squares. IEEE Journal of Selected Topics in Signal Processing, 1 0 (4): 0 606--617, 2007. doi:10.1109/JSTSP.2007.910971

    2007

  20. [28]

    ezkl: Efficient zero-knowledge machine learning

    Konduit. ezkl: Efficient zero-knowledge machine learning. https://github.com/zkonduit/ezkl, 2024. Accessed: 2025-01-21

    2024

  21. [29]

    What do we want from explainable artificial intelligence (xai)?--a stakeholder perspective on xai and a conceptual model guiding interdisciplinary xai research

    Langer, M., Oster, D., Speith, T., Hermanns, H., K \"a stner, L., Schmidt, E., Sesing, A., and Baum, K. What do we want from explainable artificial intelligence (xai)?--a stakeholder perspective on xai and a conceptual model guiding interdisciplinary xai research. Artificial I...

    2021

  22. [30]

    Comparison-based inverse classification for interpretability in machine learning

    Laugel, T., Lesot, M.-J., Marsala, C., Renard, X., and Detyniecki, M. Comparison-based inverse classification for interpretability in machine learning. In Medina, J., Ojeda-Aciego, M., Verdegay, J. L., Pelta, D. A., Cabrera, I. P., Bouchon-Meunier, B., and Yager, R. R. (eds.),...

    2018

  23. [31]

    Defining locality for surrogates in post-hoc interpretablity

    Laugel, T., Renard, X., Lesot, M.-J., Marsala, C., and Detyniecki, M. Defining locality for surrogates in post-hoc interpretablity. arXiv preprint arXiv:1806.07498, 2018 b

    2018 arXiv

  24. [32]

    Explainable ai as evidence of fair decisions

    Leben, D. Explainable ai as evidence of fair decisions. Frontiers in Psychology, 14: 0 1069426, 2023

    2023

  25. [33]

    vcnn: Verifiable convolutional neural network

    Lee, S., Ko, H., Kim, J., and Oh, H. vcnn: Verifiable convolutional neural network. IACR Cryptol. ePrint Arch., 2020: 0 584, 2020. URL https://api.semanticscholar.org/CorpusID:218895602

    2020

  26. [34]

    Liao, Q. V. and Varshney, K. R. Human-centered explainable ai (xai): From algorithms to user experiences. arXiv preprint arXiv:2110.10790, 2021

    2021 arXiv

  27. [35]

    zkcnn: Zero knowledge proofs for convolutional neural network predictions and accuracy

    Liu, T., Xie, X., and Zhang, Y. zkcnn: Zero knowledge proofs for convolutional neural network predictions and accuracy. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021. URL https://api.semanticscholar.org/CorpusID:235349006

    2021

  28. [36]

    RoFL: Robustness of Secure Federated Learning

    Lycklama, H., Burkhalter, L., Viand, A., Kuchler, N., and Hithnawi, A. RoFL: Robustness of Secure Federated Learning . In 2023 IEEE Symposium on Security and Privacy (SP), pp.\ 453--476, Los Alamitos, CA, USA, May 2023. IEEE Computer Society. doi:10.1109/SP46215.2023.10179400....

    2023

  29. [37]

    Pytorch: An imperative style, high-performance deep learning library

    Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga, L., et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019

    2019

  30. [38]

    Scikit-learn: Machine learning in python

    Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., et al. Scikit-learn: Machine learning in python. the Journal of machine Learning research, 12: 0 2825--2830, 2011

    2011

  31. [39]

    why should i trust you?

    Ribeiro, M. T., Singh, S., and Guestrin, C. " why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, pp.\ 1135--1144, 2016

    2016

  32. [40]

    Fairness, integrity, and privacy in a scalable blockchain-based federated learning system

    R \"u ckel, T., Sedlmeir, J., and Hofmann, P. Fairness, integrity, and privacy in a scalable blockchain-based federated learning system. Computer Networks, 202: 0 108621, 2022

    2022

  33. [41]

    Washing the unwashable: On the (im) possibility of fairwashing detection

    Shahin Shamsabadi, A., Yaghini, M., Dullerud, N., Wyllie, S., A \" vodji, U., Alaagib, A., Gambs, S., and Papernot, N. Washing the unwashable: On the (im) possibility of fairwashing detection. Advances in Neural Information Processing Systems, 35: 0 14170--14182, 2022

    2022

  34. [42]

    S., Wyllie, S

    Shamsabadi, A. S., Wyllie, S. C., Franzese, N., Dullerud, N., Gambs, S., Papernot, N., Wang, X., and Weller, A. Confidential proof of fair training of trees. ICLR, 2023

    2023

  35. [43]

    Zero knowledge proofs towards verifiable decentralized ai pipelines

    Singh, N., Dayama, P., and Pandit, V. Zero knowledge proofs towards verifiable decentralized ai pipelines. In International Conference on Financial Cryptography and Data Security, pp.\ 248--275. Springer, 2022

    2022

  36. [44]

    Fooling lime and shap: Adversarial attacks on post hoc explanation methods

    Slack, D., Hilgard, S., Jia, E., Singh, S., and Lakkaraju, H. Fooling lime and shap: Adversarial attacks on post hoc explanation methods. In Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, pp.\ 180--186, 2020

    2020

  37. [45]

    Counterfactual explanations can be manipulated

    Slack, D., Hilgard, A., Lakkaraju, H., and Singh, S. Counterfactual explanations can be manipulated. Advances in neural information processing systems, 34: 0 62--75, 2021

    2021

  38. [46]

    Smuha, N. A. The eu approach to ethics guidelines for trustworthy artificial intelligence. Computer Law Review International, 20 0 (4): 0 97--106, 2019

    2019

  39. [47]

    and Zhang, H

    Sun, H. and Zhang, H. zkdl: Efficient zero-knowledge proofs of deep learning training, 2023

    2023

  40. [48]

    zkllm: Zero knowledge proofs for large language models

    Sun, H., Li, J., and Zhang, H. zkllm: Zero knowledge proofs for large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp.\ 4405--4419, 2024

    2024

  41. [49]

    Verifiable fairness: Privacy-preserving computation of fairness for machine learning systems

    Toreini, E., Mehrnezhad, M., and van Moorsel, A. Verifiable fairness: Privacy-preserving computation of fairness for machine learning systems. 2023. URL https://api.semanticscholar.org/CorpusID:261696588

    2023

  42. [50]

    Von Eschenbach, W. J. Transparency and the black box problem: Why we do not trust ai. Philosophy & Technology, 34 0 (4): 0 1607--1622, 2021

    2021

  43. [51]

    Counterfactual explanations without opening the black box: Automated decisions and the gdpr

    Wachter, S., Mittelstadt, B., and Russell, C. Counterfactual explanations without opening the black box: Automated decisions and the gdpr. Harv. JL & Tech., 31: 0 841, 2017

    2017

  44. [52]

    Trustless audits without revealing data or models

    Waiwitlikhit, S., Stoica, I., Sun, Y., Hashimoto, T., and Kang, D. Trustless audits without revealing data or models. In Proceedings of the 41st International Conference on Machine Learning, ICML'24. JMLR.org, 2024

    2024

  45. [53]

    Pvcnn: Privacy-preserving and verifiable convolutional neural network testing

    Weng, J., Weng, J., Tang, G., Yang, A., Li, M., and Liu, J.-N. Pvcnn: Privacy-preserving and verifiable convolutional neural network testing. Trans. Info. For. Sec., 18: 0 2218–2233, mar 2023. ISSN 1556-6013. doi:10.1109/TIFS.2023.3262932. URL https://doi.org/10.1109/TIFS.2023.3262932

    2023

  46. [54]

    Right to explanation, 2025

    Wikipedia contributors . Right to explanation, 2025. URL https://en.wikipedia.org/wiki/Right_to_explanation. Accessed: 2025-01-14

    2025

  47. [55]

    R., Boneh, D., and Chaudhuri, K

    Yadav, C., Chowdhury, A. R., Boneh, D., and Chaudhuri, K. Fairproof: Confidential and certifiable fairness for neural networks. In International Conference on Machine Learning, pp.\ 55682--55705. PMLR, 2024 a

    2024

  48. [56]

    Xaudit: A learning-theoretic look at auditing with explanations

    Yadav, C., Moshkovitz, M., and Chaudhuri, K. Xaudit: A learning-theoretic look at auditing with explanations. Transactions on Machine Learning Research, 2024 b

    2024

  49. [57]

    Influence-based attributions can be manipulated

    Yadav, C., Wu, R., and Chaudhuri, K. Influence-based attributions can be manipulated. arXiv preprint arXiv:2409.05208, 2024 c

    2024 arXiv

  50. [58]

    and Zhang, C

    Yan, T. and Zhang, C. Active fairness auditing. In International Conference on Machine Learning, pp.\ 24929--24962. PMLR, 2022

    2022

  51. [59]

    default of credit card clients

    Yeh, I.-C. default of credit card clients . UCI Machine Learning Repository, 2016. DOI : https://doi.org/10.24432/C55S3H

    2016 doi

  52. [60]

    Halo2: A Plonkish zk-SNARK implemented in Rust , 2023

    Zcash Foundation . Halo2: A Plonkish zk-SNARK implemented in Rust , 2023. URL https://github.com/zcash/halo2. Accessed: 2025-01-27

    2023

  53. [61]

    Zero knowledge proofs for decision tree predictions and accuracy

    Zhang, J., Fang, Z., Zhang, Y., and Song, D. Zero knowledge proofs for decision tree predictions and accuracy. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS '20, pp.\ 2039–2053, New York, NY, USA, 2020 a . Association for Computi...

    2020

  54. [62]

    Zero knowledge proofs for decision tree predictions and accuracy

    Zhang, J., Fang, Z., Zhang, Y., and Song, D. Zero knowledge proofs for decision tree predictions and accuracy. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 2039--2053, 2020 b

    2020

Pith tools

Reviewed August 9, 2026 · model on record in the stance chip above.