Pith. sign in

REVIEW 4 major objections 5 minor 32 references

\texttt{Range-Arithmetic}: Verifiable Deep Learning Inference on an Untrusted Party

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read By rewriting rounding and ReLU as interval-checked arithmetic, this paper establishes that outsourced DNN inference can be verified with O(log n) communication and O(n^2) verifier work.

desk verdict Genuinely new fusion of sum-check and range proofs for rounding/ReLU, but the protocol as written has blocking dimension mismatches in the polynomial commitment calls. read the letter →

arxiv 2505.17623 v2 pith:ZDVTV2CE submitted 2025-05-23 cs.CR cs.AIcs.ETcs.LGcs.PF

Ali Rahimi , Babak H. Khalaj , Mohammad Ali Maddah-Ali This is my paper · ORCID
classification cs.CRcs.AIcs.ETcs.LGcs.PF
keywords verifiablecomputingsum-checkprotocolrangeprooffixed-pointarithmeticReLUactivationoutsourcedinferenceinteractiveproofsdeeplearningverification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish that the two operations that make deep learning awkward to verify inside a proof system—rounding after fixed-point matrix multiplication, and the ReLU activation—can be checked with plain finite-field arithmetic. The trick is a bounded-decomposition characterization of rounding: a product entry $a$ is correctly rounded to $a'$ exactly when $a \equiv e + 2^s a' \pmod{p}$ with the discarded part $e$ in $[-2^{s-1}, 2^{s-1})$ and the rounded value in $[-2^{t+1}, 2^{t+1})$, and those interval conditions are enforced by an aggregated range proof. Arithmetic equality $C = AB$ is verified by a sum-check protocol, and the same range-proof tool, plus a second sum-check, takes care of ReLU. Because the construction stays inside finite fields, the authors claim it avoids Boolean circuit encodings, high-degree polynomials, and large lookup tables, while giving prover work $O(n^3)$, verifier work $O(n^2)$, and communication $O(\log n)$ for $n \times n$ matrix multiplication with rounding. A reader should care because if this holds, outsourced DNN inference becomes verifiable at a cost close to the cost of running the inference itself.

What carries the argument

The load-bearing object is an exact characterization of fixed-point rounding as two interval constraints on a field decomposition: $a \equiv e + 2^s a' \pmod{p}$ with $e \in [-2^{s-1}, 2^{s-1})$ and $a' \in [-2^{t+1}, 2^{t+1})$. This identity converts a non-arithmetic operation---truncation of low-order bits---into membership of two committed vectors in intervals, which is exactly what an aggregated range proof (Algorithm 6, built from an inner-product argument that gives logarithmic communication) can certify. The arithmetic layer is carried by the sum-check protocol (Algorithm 5) with polynomial commitments, which verifies $\sum_{\ell} \tilde{a}(r_1, \ell) \tilde{b}(\ell, r_2) = \tilde{c}(r_1, r_2)$ at a random point; since the left side is a sum over a product of multilinear extensions, both factors can be evaluated from commitments. ReLU reuses the same range proof for nonnegativity of $Y = |A|$ and a second sum-check for the identity $\tilde{a}^2(x) = \tilde{y}^2(x)$ evaluated at a random point. The composition of these two tools---range proofs for interval membership and sum-check for arithmetic equality---is what carries the whole verifiable-inference argument.

What would settle it

Run the main verification protocol with the range-proof step wired as written in Algorithm 1: Step 11 calls Algorithm 6 with the public vector $C + 2^{s-1}$ while the commitment is to $E + 2^{s-1}$. Then attempt a cheating prover that chooses a wrong $C'$ but satisfies the range check on the public vector; if the verifier accepts, the rounding proof is unsound. A shorter direct check is to compare the input names in Algorithm 1 Step 11 against Algorithm 6's stated interface and see whether the committed value and the ranged vector coincide.

Watch

Extended reading notes

Core claim

The central claim is that verifiable fixed-point DNN inference reduces to a bounded-decomposition identity plus two standard proof tools. For a fixed-point number with $s$ fractional bits, the paper shows that knowing a field element $a'$ and an error $e$ such that $a \equiv e + 2^s a' \pmod{p}$, with $-2^{s-1} \le e < 2^{s-1}$ and $-2^{t+1} \le a' < 2^{t+1}$, is equivalent to knowing that $a' = R(a)$, the fixed-point rounding of $a$. Matrix multiplication $C = AB$ is checked by a sum-check over the multilinear extensions of $A$, $B$, and $C$ at a random point, relying on the standard random-point polynomial identity lemma to make a single point check certify the whole product; the interval conditions on every entry of $E = C - 2^s C'$ and on $C'$ itself are then checked in aggregate by a range proof. ReLU is handled by committing to $Y = |A|$, proving all entries of $Y$ are nonnegative with the same range proof, and using a second sum-check to prove $a_i^2 = y_i^2$ entrywise, so that $B = (A+Y)/2$ must equal $\mathrm{ReLU}(A)$. The paper claims these pieces compose layer by layer without preprocessing and give $O(n^3)$ prover cost, $O(n^2)$ verifier cost, and $O(\log n)$ communication for $n \times n$ rounded matrix multiplication, with ReLU support that prior sum-check-based methods lack.

Load-bearing premise

The soundness of the whole protocol rests on the range-proof step being applied to the same vector that the commitment argues about; if the rounding step passes one vector to the range proof while committing to another, the interval check no longer constrains the actual rounding error.

Editorial extensions

If this is right

  • Fixed-point matrix multiplication followed by rounding can be verified without Boolean circuits or large lookup tables, with communication $O(\log n)$ and verifier work $O(n^2)$.
  • The same machinery verifies ReLU layers, so a multilayer network can be checked layer by layer, each layer's commitment feeding into the next.
  • The prover's cost stays a constant multiple of the cost of one matrix multiplication, so producing a proof is comparable in expense to running the inference once.
  • The protocol is compatible with finite-field-based proof systems and needs no preprocessing or R1CS-style sparse circuit encodings, per the paper.
  • In the reported MNIST case study with four fully connected layers and fixed-point arithmetic, the prover spends roughly 230 ms and the verifier roughly 154 ms, while communication grows only logarithmically with matrix size.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the soundness claims hold, the same bounded-decomposition trick should generalize to other piecewise-linear activations such as leaky ReLU or clipped ReLU by adding extra interval constraints, though the paper does not develop these cases.
  • The claimed costs assume the range-proof sub-protocol is instantiated on the value that the commitment actually binds; the paper never reconciles the mismatch between the vector named in Algorithm 1 Step 11 and the committed error vector, so a working implementation must settle that before the performance numbers are meaningful.
  • The protocol as presented is interactive, and converting it to a non-interactive proof would require care with how the sum-check challenges and range-proof challenges are generated; the paper only describes the interactive form.
  • Because verification costs per layer are $O(n^2)$, total verification cost for a deep network roughly follows the sum of the layer dimensions rather than the depth-weighted computation count, which is good news for deep but narrow networks.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Range-Arithmetic, a framework for verifiable deep-learning inference in which an untrusted prover convinces a verifier of the correctness of fixed-point matrix multiplication with rounding and of ReLU activations. The core idea is to verify arithmetic layers with a sum-check protocol over matrix products and to verify the non-arithmetic rounding and ReLU steps with aggregated range proofs, thereby avoiding Boolean encodings, high-degree polynomials, and large lookup tables. The paper claims O(n^3) prover work, O(n^2) verifier work, and O(log n) communication for n x n matrix multiplication with rounding, while also supporting ReLU. Experimental results on matrix multiplication and an MNIST case study are reported. The paper includes a standalone theorem (Theorem 3.1) characterizing fixed-point rounding by a congruence and two range conditions, with an appendix proof.

Significance. If the proposed protocol were correct and complete, it would be a useful contribution to verifiable ML: replacing Boolean-circuit encodings of rounding and ReLU with arithmetic range proofs is a natural and potentially practical idea. The rounding theorem itself is cleanly stated and proven, and the sum-check reduction for matrix products is standard. The manuscript, however, does not contain a formal completeness or soundness proof for the full composed protocol, and several concrete composition errors mean the protocol, as written, cannot be instantiated. The central algorithmic claim therefore currently rests on an incorrect or underspecified description rather than on a verified construction. With Major revisions that fix the generator dimensions, the range-proof interfaces, and the bit-length parameters, the underlying approach could be salvageable.

major comments (4)
  1. [Section 3.1.3, Algorithm 1 Step 6; Algorithm 5 Steps 13-14; Section 2.3] The matrix-multiplication sum-check cannot be instantiated with the generator vectors supplied. Algorithm 1 Step 6 invokes Algorithm 5 with g[:m] and h[:m], but Algorithm 5's final steps call Algorithm 3 to evaluate f^(1) = ã(r1, ·) and f^(2) = b̃(·, r2) from the commitments PA and PB, which are commitments to the full multilinear extensions of A and B with nm and mk coefficients. Algorithm 3 requires g, h ∈ G^{2^v} where 2^v is the coefficient count of the polynomial being evaluated (Section 2.3), so evaluating ã(r1, ·) requires generator vectors of length nm and evaluating b̃(·, r2) requires length mk. With g[:m] of length m, the inner-product argument in Algorithm 2 is undefined for the longer Lagrange basis vectors, and the protocol aborts before any rounding or ReLU step. This is a load-bearing error: the claimed O(log n) communication and O(n^2) verifier work for the arithmetic layer are not established by the described algorithms.
  2. [Section 3.1.3, Algorithm 1 Steps 11-12] The range-proof calls pass a public vector that does not match the commitment. In Step 11, the commitment argument is PC / P_{C'}^{2^s} × g^{2^{s-1}}, which binds to E + 2^{s-1} where E = C - 2^s C', but the stated vector is C + 2^{s-1}; thus the range proof would not prove the intended bound -2^{s-1} ≤ e_i < 2^{s-1}. In Step 12, the commitment binds to C' + 2^{t+1} (via PC' × g^{2^{t+1}}), but the stated vector is C + 2^{t+1}; even after correcting this typo to C' + 2^{t+1}, the bit-length is wrong: the condition -2^{t+1} ≤ c'_i < 2^{t+1} is equivalent to 0 ≤ c'_i + 2^{t+1} < 2^{t+2}, so the range proof needs bit-length t+2, not t+1. These inconsistencies mean the rounding verification as written does not actually verify the stated bounds.
  3. [Section 3.2, Algorithm 8 Step 3; Section 2.5] The ReLU range proof is not instantiable as described. Algorithm 8 Step 3 calls Algorithm 6 with generators g, h ∈ G^{nk} and the vector Y, but Algorithm 6 requires a bit-length parameter n such that each claimed element v_j is in [0, 2^n - 1]. No bit-length is specified, and the statement 'all elements of Y are positive' is undefined for arbitrary finite-field elements; a range proof can only certify bounds on integer representatives. Since the fixed-point format (s, t) is not given as an input to Algorithm 8, the prover and verifier cannot agree on the range that must be proven. This gap affects the soundness of the ReLU verification.
  4. [Section 2.5 and Algorithm 6] The aggregated range proof is internally inconsistent and under-specified. The interface states P = g^{v_{[:m]}} with g ∈ G^{mn}, but Step 8 runs the inner-product argument on (g[:m], h[:m], u, P × P', q(z), v, z^m), which requires P to be a commitment to v using the first m generators, while Step 12 uses the full g and h'. Furthermore, the construction omits blinding factors that are essential in the Bulletproofs protocol it cites, and the notation g^{v_{[:m]}} is ambiguous when g has mn entries and v has m entries. Because the composed scheme's soundness depends on this sub-protocol, the paper must provide a precise and correct instantiation of the range proof, not merely cite Bulletproofs.
minor comments (5)
  1. [Algorithm 1 Step 12] The vector in the input tuple should read C' + 2^{t+1}, not C + 2^{t+1}, for the commitment to match.
  2. [Algorithm 5 Step 7] The check 'gi-1(ri-1)' references an undefined object; it should presumably be f_{i-1}(r_{i-1}) = f_i(0) + f_i(1), and the notation should be made consistent with Algorithm 4.
  3. [Section 3.2, Equations (5)-(6)] The arguments of the identity-matrix MLE ilde I are written as (x, s) in Equation (5) and (s, x) in Equation (6); the ordering should be fixed and consistently defined, especially since Algorithm 7 Step 15 evaluates ilde I(s_1, ..., s_v, r_1, ..., r_v).
  4. [Figure 2] The axis labels in Figure 2 contain garbled Unicode fragments (e.g., '/uni00000019/uni0000000f/uni0000001b'), which must be repaired for the figure to be legible.
  5. [Section 4] The experimental section reports times but does not report proof sizes, and it does not compare against the analytic complexity table in Table 1; stating that 'communication overhead grows logarithmically' in Figure 4 would be more convincing if the proof-size values were given.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the derivation is self-contained and builds on external Bulletproofs and sum-check primitives; no fitted parameter, self-citation chain, or definitional equivalence is load-bearing.

full rationale

No circular step is present. The paper's derivation chain rests on standard external primitives: matrix-multiplication verification is reduced to the sum-check protocol and polynomial commitments (Algorithms 4, 5, and 3), whose soundness is inherited from Bulletproofs [5] and the sum-check literature [23]. The rounding theorem (Theorem 3.1 and Appendix B) is a standalone arithmetic uniqueness proof: it assumes only congruence modulo p plus interval bounds and proves by a magnitude argument that the claimed rounded value and residual are unique, without assuming the conclusion. The ReLU verification uses an aggregated range proof for non-negativity and the algebraic identity a^2 = y^2 combined with sum-check to prove Y = |A|; this is independent of the claimed output. There are no fitted parameters renamed as predictions, no author-imported uniqueness theorems, and no self-citations that carry the argument. The experimental comparison targets an external state-of-the-art method [7] rather than the paper's own claims. The central result therefore does not reduce to its inputs by construction. Potential interface mismatches between Algorithm 1 and Algorithm 6 are correctness or soundness concerns, not circularity, and are outside the scope of this pass.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The protocol relies on standard cryptographic assumptions for Bulletproofs (discrete log in an appropriate group) and the Schwartz-Zippel lemma for polynomial equality. It postulates that fixed-point rounding can be checked by two range proofs, which is proven in Theorem 3.1. No new hardness assumptions or invented entities are introduced beyond the framework's name.

assumptions (4)
  • standard math Schwartz-Zippel lemma (Lemma 2.1): distinct multilinear polynomials disagree on most points.
    Used throughout to reduce polynomial equality to random-point checking (Sections 3.1.1, 3.2).
  • domain assumption Fixed-point representation maps real numbers to field elements via a = 2^s a', and rounding is defined by R(x) with floor semantics.
    Section 2.1 defines this model; correctness of Theorem 3.1 depends on this representation and the bound that p has at least s+t+3 bits.
  • domain assumption Bulletproofs inner-product and range proof are computationally sound for a computationally bounded prover under the discrete logarithm assumption.
    The protocol inherits this from [5]; Algorithms 2, 3, and 6 rely on it.
  • domain assumption The prover's matrix multiplication C=AB and rounding are performed over integers that do not wrap around modulo p.
    The paper assumes p is large enough to avoid overflow in Section 2.1 and in the statement of Theorem 3.1.

how reviews work

0 comments
Cite this review

Pith. "Pith review of \texttt{Range-Arithmetic}: Verifiable Deep Learning Inference on an Untrusted Party." pith.science (2026). https://pith.science/paper/ZDVTV2CE

@misc{pith2026250517623,
  author       = {Pith},
  title        = {Pith review of: \textttRange-Arithmetic: Verifiable Deep Learning Inference on an Untrusted Party},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZDVTV2CE}},
  note         = {Machine review of arXiv:2505.17623}
}
read the original abstract

Verifiable computing (VC) has gained prominence in decentralized machine learning systems, where resource-intensive tasks like deep neural network (DNN) inference are offloaded to external participants due to blockchain limitations. This creates a need to verify the correctness of outsourced computations without re-execution. We propose \texttt{Range-Arithmetic}, a novel framework for efficient and verifiable DNN inference that transforms non-arithmetic operations, such as rounding after fixed-point matrix multiplication and ReLU, into arithmetic steps verifiable using sum-check protocols and concatenated range proofs. Our approach avoids the complexity of Boolean encoding, high-degree polynomials, and large lookup tables while remaining compatible with finite-field-based proof systems. Experimental results show that our method not only matches the performance of existing approaches, but also reduces the computational cost of verifying the results, the computational effort required from the untrusted party performing the DNN inference, and the communication overhead between the two sides.

Figures

Figures reproduced from arXiv: 2505.17623 by the authors.

Figure 1
Figure 1. A schematic overview of general interactive [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Comparison of prover and verifier runtimes, as well as communication costs, for verifiable [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Runtime of the arithmetic and non￾arithmetic parts for the verifier and the prover in the matrix multiplication. 2 6 2 8 2 10 2 12 2 14 2 16 2 18 The size of the multiplied matrices (number of rows × number of columns) 10 3 10 2 10 1 10 0 10 1 10 2 Runtime (s) Verifier runtime Prover runtime 0 1 2 3 4 5 Communication Cost (KB) Sum-check part Range-Proof part [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (1 more)
Figure 5
Figure 5. Figure 5: Lines 1 and 2 depict the fixed-point numbers [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 29 canonical work pages

  1. [1]

    Accountable magic: Ai alignment and governance, 2025

    Accountable Magic. Accountable magic: Ai alignment and governance, 2025. URL https: //www.accountablemagic.com/

    work page 2025

  2. [2]

    The sum-check protocol over fields of small characteristic

    Suyash Bagad, Yuval Domb, and Justin Thaler. The sum-check protocol over fields of small characteristic. Cryptology ePrint Archive, 2024

    work page 2024

  3. [3]

    Deep learning, volume 1

    Yoshua Bengio, Ian Goodfellow, Aaron Courville, et al. Deep learning, volume 1. MIT press Cambridge, MA, USA, 2017

    work page 2017

  4. [4]

    Sumcheck arguments and their applications

    Jonathan Bootle, Alessandro Chiesa, and Katerina Sotiraki. Sumcheck arguments and their applications. In Advances in Cryptology–CRYPTO 2021: 41st Annual International Cryptology Conference, CRYPTO 2021, Virtual Event, August 16–20, 2021, Proceedings, Part I 41, pages 742–773. Springer, 2021

    work page 2021

  5. [5]

    Bulletproofs: Short proofs for confidential transactions and more

    Benedikt Bünz, Jonathan Bootle, Dan Boneh, Andrew Poelstra, Pieter Wuille, and Greg Maxwell. Bulletproofs: Short proofs for confidential transactions and more. In 2018 IEEE symposium on security and privacy (SP), pages 315–334. IEEE, 2018

    work page 2018

  6. [6]

    Interactive proofs for rounding arithmetic

    Shuo Chen, Jung Hee Cheon, Dongwoo Kim, and Daejun Park. Interactive proofs for rounding arithmetic. IEEE Access, 10:122706–122725, 2022

    work page 2022

  7. [7]

    More optimizations to sum-check proving

    Quang Dao and Justin Thaler. More optimizations to sum-check proving. Cryptology ePrint Archive, 2024

    work page 2024

  8. [8]

    The mnist database of handwritten digit images for machine learning research

    Li Deng. The mnist database of handwritten digit images for machine learning research. IEEE Signal Processing Magazine, 29(6):141–142, 2012

    2012

Show all 32 references
  1. [9]

    EZKL: Zero-knowledge machine learning, 2025

    EZKL. EZKL: Zero-knowledge machine learning, 2025. URL https://ezkl.xyz/

    2025

  2. [10]

    Succinct zero knowledge for floating point computations

    Sanjam Garg, Abhishek Jain, Zhengzhong Jin, and Yinuo Zhang. Succinct zero knowledge for floating point computations. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 1203–1216, 2022

    2022

  3. [11]

    Experimenting with zero-knowledge proofs of training

    Sanjam Garg, Aarushi Goel, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Guru- Vamsi Policharla, and Mingyuan Wang. Experimenting with zero-knowledge proofs of training. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 1880–1894, 2023

    2023

  4. [12]

    Safetynets: Verifiable execution of deep neural networks on an untrusted cloud

    Zahra Ghodsi, Tianyu Gu, and Siddharth Garg. Safetynets: Verifiable execution of deep neural networks on an untrusted cloud. Advances in Neural Information Processing Systems, 30, 2017

    2017

  5. [13]

    Efficient sum-check protocol for convolution

    Chanyang Ju, Hyeonbum Lee, Heewon Chung, Jae Hong Seo, and Sungwook Kim. Efficient sum-check protocol for convolution. IEEE Access, 9:164047–164059, 2021

    2021

  6. [14]

    Snargs and ppad hardness from the decisional diffie-hellman assumption

    Yael Tauman Kalai, Alex Lombardi, and Vinod Vaikuntanathan. Snargs and ppad hardness from the decisional diffie-hellman assumption. In Advances in Cryptology–EUROCRYPT 2023: 42nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Lyon, ...

    2023

  7. [15]

    Sparsity-aware protocol for zk-friendly ml models: Shedding lights on practical zkml

    Alan Li, Qingkai Liang, and Mo Dong. Sparsity-aware protocol for zk-friendly ml models: Shedding lights on practical zkml. Cryptology ePrint Archive, 2024

    2024

  8. [16]

    Artemis: Efficient commit-and-prove snarks for zkml

    Hidde Lycklama, Alexander Viand, Nikolay Avramov, Nicolas Küchler, and Anwar Hithnawi. Artemis: Efficient commit-and-prove snarks for zkml. arXiv preprint arXiv:2409.12055, 2024

    2024 arXiv

  9. [17]

    Noya: Ai-powered infrastructure for zero-knowledge proofs, 2025

    Noya. Noya: Ai-powered infrastructure for zero-knowledge proofs, 2025. URL https: //noya.ai/

    2025

  10. [18]

    Pinocchio: Nearly practical verifiable computation

    Bryan Parno, Jon Howell, Craig Gentry, and Mariana Raykova. Pinocchio: Nearly practical verifiable computation. Communications of the ACM, 59(2):103–112, 2016

    2016

  11. [19]

    A survey of zero-knowledge proof based verifiable machine learning

    Zhizhi Peng, Taotao Wang, Chonghe Zhao, Guofu Liao, Zibin Lin, Yifeng Liu, Bin Cao, Long Shi, Qing Yang, and Shengli Zhang. A survey of zero-knowledge proof based verifiable machine learning. arXiv preprint arXiv:2502.18535, 2025. 11

    2025 arXiv

  12. [20]

    Polygon zkEVM: Ethereum scaling with zero-knowledge proofs, 2025

    Polygon. Polygon zkEVM: Ethereum scaling with zero-knowledge proofs, 2025. URL https: //polygon.technology/polygon-zkevm

    2025

  13. [21]

    Provably: Trustless ai verification, 2025

    Provably AI. Provably: Trustless ai verification, 2025. URL https://provably.ai/

    2025

  14. [22]

    Fast probabilistic algorithms for verification of polynomial identities.Journal of the ACM (JACM), 27(4):701–717, 1980

    Jacob T Schwartz. Fast probabilistic algorithms for verification of polynomial identities.Journal of the ACM (JACM), 27(4):701–717, 1980

    1980

  15. [23]

    Proofs, arguments, and zero-knowledge

    Justin Thaler et al. Proofs, arguments, and zero-knowledge. Foundations and Trends® in Privacy and Security, 4(2–4):117–660, 2022

    2022

  16. [24]

    Mystique: Efficient conversions for {Zero-Knowledge} proofs with applications to machine learning

    Chenkai Weng, Kang Yang, Xiang Xie, Jonathan Katz, and Xiao Wang. Mystique: Efficient conversions for {Zero-Knowledge} proofs with applications to machine learning. In 30th USENIX Security Symposium (USENIX Security 21), pages 501–518, 2021

    2021

  17. [25]

    pvcnn: Privacy- preserving and verifiable convolutional neural network testing

    Jiasi Weng, Jian Weng, Gui Tang, Anjia Yang, Ming Li, and Jia-Nan Liu. pvcnn: Privacy- preserving and verifiable convolutional neural network testing. IEEE Transactions on Informa- tion Forensics and Security, 18:2218–2233, 2023

    2023

  18. [26]

    Validating the integrity for deep learning models based on zero-knowledge proof and blockchain

    Qianyi Zhan, Yuanyuan Liu, Zhenping Xie, and Yuan Liu. Validating the integrity for deep learning models based on zero-knowledge proof and blockchain. In Blockchain and Web3 Technology Innovation and Application Exchange Conference, pages 387–399. Springer, 2024

    2024

  19. [27]

    Probabilistic algorithms for sparse polynomials

    Richard Zippel. Probabilistic algorithms for sparse polynomials. In International symposium on symbolic and algebraic manipulation, pages 216–226. Springer, 1979

    1979

  20. [28]

    zkAGI: Zero-knowledge artificial general intelligence, 2025

    zkAGI. zkAGI: Zero-knowledge artificial general intelligence, 2025. URL https://www. zkagi.ai/

    2025

  21. [29]

    ZKML: Zero-knowledge machine learning systems, 2025

    ZKML Systems. ZKML: Zero-knowledge machine learning systems, 2025. URL https: //www.zkml.systems/. 12 Appendix A. Details of Algorithms Algorithm 2 Verification of Inner-product Require: The algorithm inputs are: g, h ∈ Gn, u, P∈ G, c ∈ F, a, b ∈ Fn. Require: Verifier has g, h...

    2025

  22. [30]

    From these inequalities, we deduce that −2t+s+2 + 1≤ (e2 − e1) + 2s × (a′ 2 − a′

    ≤ 2t+s+2 − 2s. From these inequalities, we deduce that −2t+s+2 + 1≤ (e2 − e1) + 2s × (a′ 2 − a′

  23. [31]

    Since p has at least s + t + 3bits, we can conclude that 2s+t+2 ≤ p

    ≤ 2t+s+2 − 1. Since p has at least s + t + 3bits, we can conclude that 2s+t+2 ≤ p. Thus, since p divides (e2 − e1) + 2s × (a′ 2 − a′ 1), and this expression is smaller in magnitude than p, the only possible solution is (e2 − e1) + 2s × (a′ 2 − a′

  24. [32]

    Given the bounds on e1 and e2 as well as the multiple of 2s, it follows that e1 = e2, and consequently, a′ 1 = a′ 2

    = 0. Given the bounds on e1 and e2 as well as the multiple of 2s, it follows that e1 = e2, and consequently, a′ 1 = a′ 2. 17

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.