Computational Attestations of Polynomial Integrity Towards Verifiable Machine-Learning

Caroline El Jazmi; Dustin Ray

REVIEW 4 major objections 6 minor 31 references

Computational Attestations of Polynomial Integrity Towards Verifiable Machine-Learning

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a differentially private linear regression over 50,000 samples can be cryptographically proved correct in under six minutes and verified in 0.17 seconds, making this the fastest known provable-DP training at this…

desk verdict Plausible benchmark, but the paper never proves the DP part: the noise source inside RISC Zero is unspecified, so the attestation as written only covers arithmetic, not privacy. read the letter →

arxiv 2506.11458 v1 pith:3IJRJRKG submitted 2025-06-13 cs.CR

Dustin Ray , Caroline El Jazmi This is my paper

classification cs.CR

keywords DifferentialPrivacyMachine-LearningLinearRegressionZero-KnowledgeCryptographyProbabilisticCheckableProofsZK-STARKComputationalIntegrityLaplaceMechanism

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to show that a machine-learning training run can be cryptographically attested, not just executed. Specifically, it claims to prove the correct training of a differentially private (DP) linear regression over 50,000 samples on a single laptop, with the proof generated in under six minutes and verified in about 0.17 seconds. The authors present this as the fastest known instance of provable DP training at that dataset size, and as a step toward machine-learning-as-a-service where a customer can verify that a private training protocol was followed. The result matters because it turns trust in an untrusted training provider into a checkable certificate.

What carries the argument

The carrying mechanism is a zero-knowledge virtual machine: a software simulation of a small RISC-V computer that is compiled into a circuit, so that running Rust code inside it yields an execution trace that can be turned into a short argument of correct execution. The paper pairs this with the NoisyStats differentially private linear regression, which perturbs the slope and intercept with Laplace noise calibrated to sensitivity. The performance-critical optimizations are fixed-point arithmetic instead of IEEE floating point, and embedding the dataset as contiguous bytes in the prover's binary so that loading 50,000 samples costs about 640 cycles instead of 232 million cycles.

What would settle it

Inspect the prover's code and execution trace to identify the source of randomness for the three Laplace samples. If the attested samples are deterministic, prover-chosen, or drawn from a distribution other than $\mathrm{Lap}(3\Delta/\epsilon)$, then the argument proves only that the arithmetic was done, not that the training is $\epsilon$-differentially private; equivalently, compare the attested noise values across two runs on the same dataset and check whether they match the Laplace distribution.

Watch

Extended reading notes

Core claim

The central claim is that the entire differentially private training process—including the three Laplace noise draws, the regression arithmetic, and the dataset itself—can be committed to a single non-interactive computational-integrity argument. Running the NoisyStats algorithm with ε=2 inside a zero-knowledge virtual machine, the prover produces a STARK-style argument (a transparent, hash-based proof of computational integrity) for all 50,000 samples; the verifier checks it in roughly 0.17 seconds. The paper further claims a poly-logarithmic verifier and a quasi-linear prover, improving on the closest prior work's linear verifier, and reports that the noisy regression converges to almost the same model as ordinary least squares on the same data.

Load-bearing premise

The load-bearing premise is that the cryptographic proof actually pins down the random noise used during training; the paper never says where the random numbers come from or how a verifier would know they were drawn from the correct distribution, so if the prover could choose or bias that noise, the certificate would not by itself establish differential privacy.

Editorial extensions

If this is right

A client of a machine-learning service can verify, in a fraction of a second, that the agreed differentially private regression was actually run over the agreed dataset.
Because the argument is non-interactive and zero-knowledge, the certificate can be circulated and checked by third parties who never had access to the training data.
Verification work grows only poly-logarithmically with dataset size, so the verifier's cost stays small even if training data grows well beyond 50,000 samples.
The batch size ceiling is set by the prover's on-chip memory, but the same batched approach can run in parallel across many GPUs, trading wall-clock time for more hardware.
Using fixed-point rather than floating-point arithmetic is what makes the largest batches affordable, which supports lowering proving time.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

In our reading, the result is specific to a two-variable linear regression; extending the same guarantee to deep networks would require proving gradient and backpropagation computations, which this paper leaves open.
The paper does not state where the randomness for the Laplace samples comes from or how the verifier knows the samples were drawn from the right distribution, so a cautious reader should treat the certificate as proving arithmetic correctness before inferring differential privacy.
The multi-machine aggregation step averages per-node slopes and intercepts, which is not generally the same as the pooled regression over all 50,000 rows; the distributed scheme would certify that combined model, not necessarily the single-machine model.
A natural testable extension is to prove a seeded pseudorandom generator inside the virtual machine so that each Laplace draw is verifiably distributed; that would close the gap between arithmetic attestation and a full differential-privacy certificate.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Hey [Name],

You should know about this one if you track verifiable ML. The authors build a RISC Zero guest that runs the NoisyStats DP linear regression on 50k samples and report a six-minute prove and 0.17-second verify. That benchmark, if it holds up, is the kind of concrete data point the field lacks. But the central privacy claim does not hold up as written: they never say where the Laplace noise comes from inside the ZKVM. RISC Zero guests are deterministic, so the host must supply randomness; if the prover controls that seed, a valid proof attests only to the arithmetic, not to the sample being Lap(...). That is a load-bearing gap, and it is exactly the gap the stress-test flags. It is not a subtle nit—Algorithm 1 samples L1, L2, L3, and Section 4 picks RISC Zero, but no sampler or entropy source is described anywhere.

What is genuinely new is small but real: applying a general-purpose ZKVM to a specific DP algorithm, plus two engineering tricks worth stealing (byte embedding to cut data-loading cycles from 232M to 640, fixed-point batching to fit 1400 samples per batch). The paper is clearly written and the authors are transparent about the GPU VRAM batching and about the fact that runtimes across different datasets are not directly comparable.

The soft spots beyond the randomness issue: the 0.17s verifier claim appears to come from a single batch divided into mini-batches, not from the full 50k dataset—the text is ambiguous and the figure does not resolve it. Table 1 has small arithmetic errors in the deltas. The 'fastest known' comparison rests on one non-comparable baseline, which the authors themselves admit. None of these are fatal if the randomness gap is fixed; they are the usual revision work.

My take: send it to peer review, but the reviewers must push on the noise sampling. As submitted, the central attestation is not established. The GitHub repo may or may not resolve it; the paper needs to make the provenance of entropy an explicit part of the protocol.

Worth discussing at reading group for exactly this reason—it is a clean example of why deterministic proofs and DP randomness do not compose automatically. I would not cite it in its current form.

Best, [You]

Referee Report

4 major / 6 minor

Summary. The paper proposes a zero-knowledge computational-integrity attestation for differentially private linear regression. It uses the RISC Zero ZKVM to prove execution of the NoisyStats (epsilon,0)-DP algorithm on the Kaggle Healthcare dataset (50,000 samples), reporting a total proving time of about 6 minutes and a verification time of 0.17 seconds. The paper also discusses batching and distributed proving, and compares its asymptotics to confidential-DP. The central claim is that this is the fastest known provable-DP training result for a dataset of this size.

Significance. If the claims were fully substantiated, the work would provide a useful practical benchmark for ZKVM-based verifiable machine learning, and it responsibly names the use of fixed-point arithmetic and GPU acceleration as engineering choices. The authors also make their code publicly available, which is a concrete contribution. However, the paper's headline claims are not backed by the presented protocol description: the randomness source for the Laplace noise is unspecified, the fixed-point discretization is not analyzed, and the batched aggregation does not match the stated DP algorithm. These gaps are load-bearing, so the significance of the reported numbers is currently unclear.

major comments (4)

[Algorithm 1, Section 4, Section 5.1] The paper never specifies how the Laplace samples L1, L2, L3 in Algorithm 1 are generated inside the RISC Zero guest, nor how the proof constrains their distribution. RISC Zero guest execution is deterministic, so any random-looking values must be supplied by the host or derived from a prover-controlled seed. A malicious prover can set L1=L2=L3=0, execute the same arithmetic, and produce a valid CI statement. The proof therefore attests only to the arithmetic over chosen noise values, not to the required Lap(0, 3*Delta/epsilon) distribution. Consequently the claimed (epsilon,0)-DP guarantee for the attested computation does not follow, and the abstract's 'provable-DP' claim is unsupported.
[Section 5.1] The paper states that fixed-point arithmetic is used instead of IEEE floating point, without any analysis of how this affects the differential-privacy guarantee. The NoisyStats mechanism is proven private for continuous Laplace noise; replacing it with a discrete, scaled fixed-point approximation changes the output distribution and can destroy the (epsilon,0)-DP guarantee unless the discretization and clamping are explicitly accounted for. No such analysis is provided, so the privacy budget of epsilon=2 is not established for the actual executed computation.
[Section 5.1, Section 5.4] The GPU protocol does not run Algorithm 1 on the full 50,000-sample dataset. Instead, the dataset is split into batches of 1400 samples, each batch is proven separately, and the resulting models are combined by averaging slopes and intercepts. This is a different mechanism from the single-run NoisyStats regression described in Algorithm 1. The paper gives no composition analysis showing that the batched-and-averaged procedure satisfies any stated DP guarantee, nor that the 6-minute proving time and 0.17-second verification time correspond to the claimed 'entire computation' on 50,000 samples.
[Figure 3, Section 5.1] The verification time of 0.17 seconds is measured on a single GPU-Float batch divided into 10 mini-batches, as stated in the Figure 3 caption. The text in Section 5.1 uses this figure to claim that the verifier is convinced of the authenticity of the CI statement for the entire 50,000-sample task in 0.17 seconds. If verification is per batch, the total verification time for the full dataset would scale with the number of batches, contradicting the stated claim. The measurement does not support the abstract's 'verifying the entire computation in 0.17 seconds' assertion.

minor comments (6)

[Table 1] The Delta values in Table 1 do not match the differences between the OLS and DP-OLS columns: for slope standard error, 0.01636 - 0.01634 = 0.00002, not 0.000018; for intercept standard error, the two values are identical, yet the table reports '< 0.00001'.
[Section 3.4] The notation 'y = (y1...xn)^T' should be 'y = (y1...yn)^T'; the subscript is inconsistent.
[Section 2.1] The formal definitions of completeness and soundness contain typographical gaps, e.g., 'For every instance-witness pair ( , )' with missing variables, and the probability expression is malformed.
[References] Several references are informal sources (a Medium article [10], Wikipedia [11], a Substack post [23], and a Google Sheets document [24]). These are not appropriate as primary citations for cryptographic definitions and should be replaced with peer-reviewed or archival sources.
[Section 5.4] The comparison to the Ethereum network's hash rate as an estimate of available GPU units is not technically meaningful for this setting and appears to be an unsupported extrapolation; it should be removed or substantiated with relevant data.
[Section 7] The conclusion states that 'the verifier has learned the exact same machine-learning model,' which is misleading: the verifier checks a proof of a computation; it does not 'learn' a model in the machine-learning sense.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper reports empirical benchmarks of an external algorithm (NoisyStats) run inside an external ZKVM (RISC Zero), with no fitted input renamed as a prediction and no load-bearing self-citation.

full rationale

The paper's central claim is an empirical benchmark: it instantiates the standard NoisyStats DP linear regression (Algorithm 1, citing Alabi et al. [5]) inside the RISC Zero ZKVM [21], and reports measured prover and verifier runtimes on the Kaggle Healthcare dataset. No parameter is fitted to the reported outcome and then renamed as a prediction; the measured proving and verification times are observations of an external system, not consequences of the paper's own definitions or equations. The only self-reference is the GitHub repository [30] containing the code, and it is used as a pointer to artifacts, not as evidence for a mathematical claim. The skeptical concern, that the paper does not specify how the Laplace samples L1, L2, L3 are drawn inside the deterministic ZKVM guest and therefore the proof may attest only to arithmetic over prover-chosen noise, is a correctness or soundness gap in the DP claim, not a circularity: a certificate generated by an honest prover would not be equivalent by construction to its inputs. The protocol composes external results (NoisyStats and RISC Zero) whose stated assumptions do not include the paper's measured benchmark. Accordingly there is no circular step and the circularity score is 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The construction relies on the soundness of RISC Zero and the STARK argument system, on the DP guarantee of NoisyStats, and on unanalyzed engineering choices (fixed-point arithmetic, unsafe data embedding) that are introduced by this paper. The free parameters are the privacy budget, batch size, and unstated fixed-point precision.

free parameters (3)

epsilon (privacy budget) = 2
Privacy parameter for the NoisyStats (epsilon, 0)-DP mechanism. Chosen by the authors; the central result is demonstrated for this value only.
batch size = 1400 samples
Empirically selected as optimal batch size for GPU proving on the RTX 4070 Laptop GPU; affects prover runtime measurements and the number of proofs the verifier must check.
fixed-point scaling factor = not specified
The paper uses fixed-point arithmetic for Laplace noise and regression but never states the precision or scaling, which affects both the DP guarantees and the proven computation's fidelity.

assumptions (4)

domain assumption The RISC Zero ZKVM and the underlying STARK argument system are sound and complete as claimed in [21] and [4].
Section 4 selects RISC Zero and relies on its soundness for the integrity statements; the paper does not prove or re-verify the argument system.
domain assumption NoisyStats achieves (epsilon, 0)-DP for simple linear regression when noise is drawn from the continuous Laplace distribution, as claimed in [19].
Section 3.5 adopts Algorithm 1 from [19] and does not re-derive its privacy guarantee.
ad hoc to paper The use of fixed-point arithmetic preserves the DP guarantee of the continuous Laplace mechanism.
The paper switches from f32 to fixed-point to improve proving throughput (Section 5.1) but provides no analysis of the resulting privacy loss from discretization.
ad hoc to paper Embedding the dataset into the prover's binary via unsafe Rust pointer casts does not break the privacy or security model.
Section 5.2 assumes the verifier can safely construct the binary and that the prover cannot exploit the unsafe cast; the threat model with respect to the prover seeing raw data is not analyzed.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Computational Attestations of Polynomial Integrity Towards Verifiable Machine-Learning." pith.science (2026). https://pith.science/paper/3IJRJRKG

@misc{pith2026250611458,
  author       = {Pith},
  title        = {Pith review of: Computational Attestations of Polynomial Integrity Towards Verifiable Machine-Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3IJRJRKG}},
  note         = {Machine review of arXiv:2506.11458}
}

read the original abstract

Machine-learning systems continue to advance at a rapid pace, demonstrating remarkable utility in various fields and disciplines. As these systems continue to grow in size and complexity, a nascent industry is emerging which aims to bring machine-learning-as-a-service (MLaaS) to market. Outsourcing the operation and training of these systems to powerful hardware carries numerous advantages, but challenges arise when privacy and the correctness of work carried out must be ensured. Recent advancements in the field of zero-knowledge cryptography have led to a means of generating arguments of integrity for any computation, which in turn can be efficiently verified by any party, in any place, at any time. In this work we prove the correct training of a differentially-private (DP) linear regression over a dataset of 50,000 samples on a single machine in less than 6 minutes, verifying the entire computation in 0.17 seconds. To our knowledge, this result represents the fastest known instance in the literature of provable-DP over a dataset of this size. We believe this result constitutes a key stepping-stone towards end-to-end private MLaaS.

Figures

Figures reproduced from arXiv: 2506.11458 by the authors.

**Figure 2.** Runtime vs. dataset size over different data types. We measure the performance of floating-point vs. fixedpoint decimals on both the GPU and the CPU hardware. 140 420 700 980 1.2k 1.4k 9.5 10.0 10.5 11.0 11.5 Dataset Size Time (Milliseconds) Verifier Runtime [PITH_FULL_IMAGE:figures/full_fig_p013_2.png] view at source ↗

**Figure 3.** Verifier runtime over a single GPU-Float batch divided into 10 mini [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗

**Figure 4.** Optimized Data-Handling Path in the RISC-Zero ZKVM [PITH_FULL_IMAGE:figures/full_fig_p015_4.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

31 extracted references · 24 canonical work pages

[1]

Available online: https://www2.deloitte

Deloitte: Generative Artificial Intelligence. Available online: https://www2.deloitte. com/us/en/pages/consulting/articles/generative-artificial-intelligence.html [Ac- cessed 20-09-2023]

work page 2023
[2]

Avail- able online: https://eccc.weizmann.ac.il/report/2020/058/ [Accessed 20-09-2023]

Goldwasser, S., Rothblum, G., Shafer, J., Yehudayoff, A.: ECCC - TR20-058. Avail- able online: https://eccc.weizmann.ac.il/report/2020/058/ [Accessed 20-09-2023]

work page 2020
[3]

Cryptology ePrint Archive, Paper 2016/116, 2016

Ben-Sasson, E., Chiesa, A., Spooner, N.: Interactive Oracle Proofs. Cryptology ePrint Archive, Paper 2016/116, 2016. https://eprint.iacr.org/2016/116

work page 2016
[4]

Cryptology ePrint Archive, Paper 2018/046, 2018

Ben-Sasson, E., Bentov, I., Horesh, Y., Riabzev, M.: Scalable, transparent, and post-quantum secure computational integrity. Cryptology ePrint Archive, Paper 2018/046, 2018. https://eprint.iacr.org/2018/046

work page 2018
[5]

arXiv preprint arXiv:2007.05157, 2020

Alabi, D., McMillan, A., Sarathy, J., Smith, A., Vadhan, S.: Differentially Private Simple Linear Regression. arXiv preprint arXiv:2007.05157, 2020. https://arxiv.org/ abs/2007.05157

arXiv 2007
[6]

arXiv preprint arXiv:2009.03106, 2020

Lee, J., Kifer, D.: Scaling up Differentially Private Deep Learning with Fast Per- Example Gradient Clipping. arXiv preprint arXiv:2009.03106, 2020. https://arxiv. org/abs/2009.03106

arXiv 2009
[7]

B., Mironov, I., Talwar, K., Zhang, L.: Deep Learning with Differential Privacy

Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., Zhang, L.: Deep Learning with Differential Privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308–318. Association for Computing Machinery, New York, NY, USA, 2016. https://doi.org/ 10.1145/2976749.2978318

arXiv 2016
[8]

Google AI Blog, 2022, Feb

Applying differential privacy to large scale image classification. Google AI Blog, 2022, Feb. https://ai.googleblog.com/2022/02/ applying-differential-privacy-to-large.html

work page 2022

Show all 31 references

[9]

Founda- tions and Trends® in Theoretical Computer Science, vol

Dwork, C., Roth, A.: The algorithmic foundations of Differential Privacy. Founda- tions and Trends® in Theoretical Computer Science, vol. 9, no. 3-4, pp. 211–407
[10]

Medium, Becoming Human: Artificial Intelligence Magazine, 2020, Oct

Fathima, S.: Differential Privacy-noise adding mechanisms. Medium, Becoming Human: Artificial Intelligence Magazine, 2020, Oct. https://becominghuman.ai/ differential-privacy-noise-adding-mechanisms-ede242dcbb2e

2020
[11]

Wikipedia, Wikimedia Foundation, 2022, May

Laplace distribution. Wikipedia, Wikimedia Foundation, 2022, May. https://en. wikipedia.org/wiki/Laplace distribution

2022
[12]

arXiv preprint arXiv:1501.06095, 2015

Steinke, T., Ullman, J.: Between Pure and Approximate Differential Privacy. arXiv preprint arXiv:1501.06095, 2015. https://arxiv.org/abs/1501.06095

2015 arXiv
[13]

In: Theory of Cryptography, Third Theory of Cryptography Conference, TCC 2006, Lecture Notes in Computer Science, vol

Dwork, C., McSherry, F., Nissim, K., Smith, A.: Calibrating Noise to Sensitivity in Private Data Analysis. In: Theory of Cryptography, Third Theory of Cryptography Conference, TCC 2006, Lecture Notes in Computer Science, vol. 3876, pp. 265-284. Springer, 2006. https://iacr.org...

2006
[14]

In: Springer Tracts in Electrical and Electronics Engineer- ing

Das, S., Mishra, S.: Advances in Differential Privacy and Differentially Private Machine Learning. In: Springer Tracts in Electrical and Electronics Engineer- ing. Springer Nature Singapore, pp. 147–188, 2024. http://dx.doi.org/10.1007/ 978-981-97-0407-1 7

2024
[15]

arXiv preprint arXiv:1311.3158, 2018

Bun, M., Ullman, J., Vadhan, S.: Fingerprinting Codes and the Price of Approxi- mate Differential Privacy. arXiv preprint arXiv:1311.3158, 2018. https://arxiv.org/ abs/1311.3158

2018 arXiv
[16]

E.: Learning with Differential Privacy: Stability, Learnability and the Sufficiency and Necessity of ERM Principle

Wang, Y.-X., Lei, J., Fienberg, S. E.: Learning with Differential Privacy: Stability, Learnability and the Sufficiency and Necessity of ERM Principle. arXiv preprint arXiv:1502.06309, 2016. https://arxiv.org/abs/1502.06309

2016 arXiv
[17]

In: 2017 IEEE 30th Computer Security Foundations Symposium (CSF), IEEE, 2017, Aug

Mironov, I.: R´ enyi Differential Privacy. In: 2017 IEEE 30th Computer Security Foundations Symposium (CSF), IEEE, 2017, Aug. http://dx.doi.org/10.1109/CSF. 2017.11

2017 doi
[18]

arXiv preprint arXiv:1507.02482, 2017

Sheffet, O.: Differentially Private Ordinary Least Squares. arXiv preprint arXiv:1507.02482, 2017. https://arxiv.org/abs/1507.02482

2017 arXiv
[19]

arXiv preprint arXiv:2208.07353, 2023

Amin, K., Joseph, M., Ribero, M., Vassilvitskii, S.: Easy Differentially Private Linear Regression. arXiv preprint arXiv:2208.07353, 2023. https://arxiv.org/abs/ 2208.07353

2023 arXiv
[20]

TensorFlow

Implement differential privacy with tensorflow privacy: responsible AI toolkit. TensorFlow. Available online: https://www.tensorflow.org/responsible ai/privacy/ tutorials/classification privacy
[21]

Available online: https://www.risczero.com/about [Accessed 20- 09-2023]

RiscZero: About. Available online: https://www.risczero.com/about [Accessed 20- 09-2023]

2023
[22]

Available online: https://www.kaggle.com/ datasets/prasad22/healthcare-dataset, 2022

Prasad, S.: Healthcare Dataset. Available online: https://www.kaggle.com/ datasets/prasad22/healthcare-dataset, 2022. [Accessed 12-06-2024]

2022
[23]

Available online: https://l2ivresearch.substack.com/p/ tech-deep-dive-verifying-fhe-in-risc, 2024

Chen, W., Research Partner, L2IV (@weikengchen): Tech Deep Dive: Verifying FHE in RISC Zero, Part I. Available online: https://l2ivresearch.substack.com/p/ tech-deep-dive-verifying-fhe-in-risc, 2024. [Accessed 18-04-2024]

2024
[24]

Available on- line: https://docs.google.com/spreadsheets/d/138M4R1- zS-OLBsl2VJeN anfTSCRCFc6EguYUVG-yA/edit#gid=1339763553 [Accessed 20-09-2023]

Mining Model Spreadsheet: Mining Model Spreadsheet. Available on- line: https://docs.google.com/spreadsheets/d/138M4R1- zS-OLBsl2VJeN anfTSCRCFc6EguYUVG-yA/edit#gid=1339763553 [Accessed 20-09-2023]

2023
[25]

Available online: https://www.notebookcheck

NotebookCheck: NotebookCheck. Available online: https://www.notebookcheck. net/NVIDIA-GeForce-RTX-4070-Laptop-GPU-Benchmarks-and-Specs.675690.0. html, 2024. [Accessed 18-04-2024]

2024
[26]

Available online: https://openreview.net/ pdf?id=PQY2v6VtGe, 2024

Shamsabadi1 et al: Confidential-DPproof: CONFIDENTIAL PROOF OF DIF- FERENTIALLY PRIV ATE TRAINING. Available online: https://openreview.net/ pdf?id=PQY2v6VtGe, 2024. [Accessed 18-04-2024]

2024
[27]

Available online: https://github.com/emp-toolkit/ emp-zk, 2023

Weikeng et al: emptoolkit. Available online: https://github.com/emp-toolkit/ emp-zk, 2023. [Accessed 18-04-2024]

2023
[28]

et al: Wolverine: Fast, Scalable, and Communication-Efficient Zero- Knowledge Proofs for Boolean and Arithmetic Circuits

Weng, C. et al: Wolverine: Fast, Scalable, and Communication-Efficient Zero- Knowledge Proofs for Boolean and Arithmetic Circuits. Available online: https: //eprint.iacr.org/2020/925.pdf, 2020. [Accessed 18-04-2024]

2020
[29]

GitHub, 2024

Zama: Concrete ml. GitHub, 2024. https://github.com/zama-ai/concrete-ml [Ac- cessed 20-09-2023]

2024
[30]

GitHub repository, GitHub, 2024

Ray, D.: capy2vML: Provably-secure differentially-private machine learning train- ing. GitHub repository, GitHub, 2024. https://github.com/drcapybara/capy2vML

2024
[2013]

https://doi.org/10.1561/0400000042

doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

Available online: https://www2.deloitte

Deloitte: Generative Artificial Intelligence. Available online: https://www2.deloitte. com/us/en/pages/consulting/articles/generative-artificial-intelligence.html [Ac- cessed 20-09-2023]

work page 2023

[2] [2]

Avail- able online: https://eccc.weizmann.ac.il/report/2020/058/ [Accessed 20-09-2023]

Goldwasser, S., Rothblum, G., Shafer, J., Yehudayoff, A.: ECCC - TR20-058. Avail- able online: https://eccc.weizmann.ac.il/report/2020/058/ [Accessed 20-09-2023]

work page 2020

[3] [3]

Cryptology ePrint Archive, Paper 2016/116, 2016

Ben-Sasson, E., Chiesa, A., Spooner, N.: Interactive Oracle Proofs. Cryptology ePrint Archive, Paper 2016/116, 2016. https://eprint.iacr.org/2016/116

work page 2016

[4] [4]

Cryptology ePrint Archive, Paper 2018/046, 2018

Ben-Sasson, E., Bentov, I., Horesh, Y., Riabzev, M.: Scalable, transparent, and post-quantum secure computational integrity. Cryptology ePrint Archive, Paper 2018/046, 2018. https://eprint.iacr.org/2018/046

work page 2018

[5] [5]

arXiv preprint arXiv:2007.05157, 2020

Alabi, D., McMillan, A., Sarathy, J., Smith, A., Vadhan, S.: Differentially Private Simple Linear Regression. arXiv preprint arXiv:2007.05157, 2020. https://arxiv.org/ abs/2007.05157

arXiv 2007

[6] [6]

arXiv preprint arXiv:2009.03106, 2020

Lee, J., Kifer, D.: Scaling up Differentially Private Deep Learning with Fast Per- Example Gradient Clipping. arXiv preprint arXiv:2009.03106, 2020. https://arxiv. org/abs/2009.03106

arXiv 2009

[7] [7]

B., Mironov, I., Talwar, K., Zhang, L.: Deep Learning with Differential Privacy

Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., Zhang, L.: Deep Learning with Differential Privacy. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 308–318. Association for Computing Machinery, New York, NY, USA, 2016. https://doi.org/ 10.1145/2976749.2978318

arXiv 2016

[8] [8]

Google AI Blog, 2022, Feb

Applying differential privacy to large scale image classification. Google AI Blog, 2022, Feb. https://ai.googleblog.com/2022/02/ applying-differential-privacy-to-large.html

work page 2022