Pith. sign in

REVIEW 4 major objections 4 minor 69 references

FairZK: A Scalable System to Prove Machine Learning Fairness in Zero-Knowledge

T0 review · 4 major / 4 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FairZK certifies ML fairness in zero knowledge, scaling to 47M parameters.

desk verdict A genuinely faster ZKP for a disagreement-bound on soft outputs, but the certificate does not establish statistical parity of the classifier's labels—and the paper says so itself in Section 5.1. read the letter →

arxiv 2505.07997 v2 pith:65SZBCO4 submitted 2025-05-12 cs.LG

Tianyu Zhang , Shen Dong , O. Deniz Kose , Yanning Shen , Yupeng Zhang This is my paper · ORCID
classification cs.LG
keywords zero-knowledgeproofsmachinelearningfairnessstatisticalparityboundsspectralnormzkSNARKlogisticregressiondeepneuralnetworks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FairZK tackles a practical deadlock: companies cannot show their machine-learning models are fair without exposing proprietary weights, and auditors cannot trust unshown claims. The paper shows that fairness can be certified by proving an upper bound on statistical parity that depends only on the model parameters and a few aggregate statistics of the input distribution (per-feature means and maximum deviations per sensitive group), not on any concrete dataset. It derives such bounds for logistic regression and fully connected DNNs, builds efficient zero-knowledge proof gadgets for them, and demonstrates a proof for a 47-million-parameter model in 343 seconds. The significance is that a model owner can now publish a commitment to a model and a proof of its fairness while keeping the weights secret.

What carries the argument

The load-bearing object is the recursive fairness bound of Eq. 18: $\|\delta_h^{\ell}\|_2 \le L \|W_{\ell-1}\|_2 \|\delta_h^{\ell-1}\|_2 + 2L \|\Delta_z^{\ell}\|_2$, together with the companion propagation $\Delta_z^{\ell} \le L |W_{\ell-1}| \Delta_z^{\ell-1}$, where $L$ is the Lipschitz constant of the activation (0.25 for sigmoid, 1 for ReLU). This reduces fairness to quantities computable from the model weights and two aggregate statistics of the input—per-feature subgroup mean disparity $\delta_x$ and per-feature max deviation $\Delta_x$—so the zero-knowledge prover never touches a dataset. The other central piece is a spectral-norm proof protocol that verifies the eigenvalue decomposition of a matrix by checking $WW^T = V\Lambda V^T + E$ and $VV^T = I + E'$ with small error terms, making the prover cost quadratic instead of cubic.

What would settle it

Construct or find a model whose FairZK fairness-score bound is below a chosen threshold but whose statistical parity on a held-out test set exceeds that threshold; if the system would certify such a model as fair, the certificate is not sound for the intended fairness property.

Watch

Extended reading notes

Core claim

The paper's central claim is that the statistical parity (and equal opportunity) of a binary classifier can be certified in zero knowledge by verifying a recursive Lipschitz-based bound. For logistic regression with weights $w$, the bound is $|\delta_{\hat{y}}| \le L |\langle w, \delta_x\rangle| + 2L \langle |w|, \Delta_x\rangle$, where $\delta_x$ is the per-feature mean difference between sensitive groups and $\Delta_x$ the maximum per-feature deviation from the group mean. For a DNN, the bound propagates through layers: the disparity of hidden activations is bounded by the spectral norm of the weight matrix times the previous disparity, plus a term controlled by per-layer deviation bounds, which themselves propagate via elementwise absolute values of the weights. The paper proves these bounds in a zkSNARK whose prover time is linear in the model size, using a new protocol that verifies spectral norm in $O(F^2)$ rather than $O(F^3)$, and reports that this is the first system to prove fairness for a 47M-parameter model, at 343 seconds, beating inference-based baselines by 3.1x–1789x.

Load-bearing premise

The certificate is an upper bound on the disparity, not the disparity itself; the paper assumes this bound, once normalized or compared against a threshold, is meaningful enough to certify fairness, even though the reported DNN bounds sit 43x to 1129x above the measured disparity.

Editorial extensions

If this is right

  • A model owner can publish a commitment to the weights plus one zero-knowledge proof that the fairness-score bound holds, and the same commitment can later be used to verify individual predictions against the same model.
  • The fairness statement holds for any input distribution consistent with the published aggregate statistics, not just for one benchmark dataset.
  • Prover time scales linearly in model size, so the same techniques should handle much larger networks and, with the aggregate-statistics proof, large datasets.
  • The bound is shown to decrease monotonically with measured disparity across models trained with increasing fairness interventions, suggesting it can be used as a ranking signal when comparing models of the same architecture.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the proof certifies only an upper bound, a model that is genuinely unfair by measured disparity could still pass if the bound is loose; a practical deployment would need a threshold calibrated to the bound's average gap, not to the disparity itself.
  • The same bound structure should extend to convolutional networks, transformers, and graph networks whenever per-layer Lipschitz constants and aggregated feature statistics can be stated; the paper's spectral-norm gadget already covers the main cost.
  • The aggregate statistics can themselves be computed inside a separate zero-knowledge proof from private data, which would let the system certify fairness from a hidden dataset and would allow privacy-enhancing transforms (e.g., differential privacy) on the statistics.
  • The current protocol reveals the model architecture (layer dimensions, depth, activation types); padding with dummy neurons could hide it, at the cost of a larger proof, an explicit trade-off the paper sketches.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. FairZK proposes a zero-knowledge proof system intended to certify that a logistic regression or feedforward DNN satisfies a group-fairness bound, without revealing model parameters. The key idea is to replace ZK proofs of many ML inferences with a ZK proof of an analytic bound on the disparity between two sensitive subgroups, where the bound depends only on the model weights and on aggregated statistics (per-feature mean differences and per-feature deviation bounds). The paper derives layer-by-layer bounds for soft-output disparity (Section 3), develops optimized zkSNARK gadgets including a spectral-norm protocol with O(F^2) prover time (Section 4.2.2), and reports an implementation with large speedups over naive inference-based baselines and OATH, including a 47-million-parameter DNN in 343 seconds (Section 5).

Significance. If the central claim were correct, the paper would be a strong systems contribution: it would be the first ZK system to certify a group-fairness property at scale, with a reproducible open-source implementation and careful engineering of lookup arguments and a spectral-norm protocol that is asymptotically faster than generic R1CS approaches. The fairness-bound derivations in Section 3 are internally coherent as bounds on a soft-output disparity measure, and the comparison against Gnark gives concrete evidence for the efficiency of the spectral-norm gadget. However, the advertised fairness property is statistical parity on predicted labels, and the certificate actually proves an upper bound on mean sigmoid output. That semantic gap, together with the observation that all reported bounds exceed 1 while probability disparities are in [0,1], means the instantiated system does not certify the fairness notion stated in Equation (1). The work is therefore best assessed as a solid ZKP-engineering contribution attached to an unsupported fairness claim.

major comments (4)
  1. [Section 3.1, Lemma 1, Equation (1)] The paper conflates the soft-output mean with the positive-rate probability. Equation (1) defines statistical parity as |P(ŷ=1|s=0) − P(ŷ=1|s=1)|, where ŷ is the predicted label. Lemma 1, however, proves a bound on |mean(σ(z)|s=0) − mean(σ(z)|s=1)|, and Section 3.1 asserts that this quantity equals Δ_SP, citing [31]. For a sigmoid output with a thresholded label, mean(σ(z)) is not equal to P(σ(z)>τ) for any fixed τ, and no monotonicity or threshold-calibration argument is supplied. The proved statement is therefore a bound on soft-output disparity, not on the statistical parity defined in Equation (1).
  2. [Section 5.1, Table 2] The certificate is vacuous for any meaningful fairness threshold. Every reported bound in Table 2 exceeds 1 (logistic regression: 1.17–11.74; DNN: 9.95–2021.59), while Δ_SP ∈ [0,1]. Proving that Δ_SP ≤ 54.79, for example, is a tautology at any threshold ε<1 and cannot certify statistical parity. The paper acknowledges this in Section 5.1, where it calls the loose bounds an open problem and proposes normalization or reference scores; however, those proposals are not formalized, and the appendix meta-review (Appendix D.4) explicitly says it is unclear what the values mean. As instantiated, the protocol does not prove ML fairness in the sense advertised.
  3. [Section 4.1, relation Rfair] The formal relation Rfair states FairEval(W, Δx, δx) = δ̂y, where δ̂y is the upper bound from Section 3, not the measured disparity of Equation (1). Even if the bound were smaller than 1, the relation would only certify an upper bound on soft-output disparity. Because no reduction from soft-output disparity to thresholded positive-rate disparity is given, the zkSNARK's soundness is not in question, but its interpretation as a fairness proof is. This is a load-bearing mismatch between the proved statement and the paper's central claim.
  4. [Section 5.2, Tables 3 and 4] The performance comparisons, while interesting, compare the cost of proving a vacuous bound against the cost of proving sampled ML inferences. Since the baselines prove statements about actual predictions on data samples, while FairZK proves a model-dependent upper bound with no demonstrated relation to Δ_SP, the 3.1×–1789× speedup does not translate into a speedup for the same fairness property. The scaling result for the 47-million-parameter model is an engineering achievement, but it does not establish that fairness certification scales.
minor comments (4)
  1. [Section 2.1] The notation is inconsistent: the paper first defines the logistic-regression output as ŷ = σ(⟨w,x⟩), a real number in (0,1), but Equation (1) uses P(ŷ=1), which requires a binary label. The authors should define the thresholding rule for ŷ or explicitly state that they are proposing a new soft-output fairness metric.
  2. [Figure 4, Step 5] The initial bound is written as Δ1_z = |W1|·Δx, but based on the layer indexing used in Section 2.1 the first weight matrix is W0; the formula should be Δ1_z = |W0|·Δx. Please correct the indexing or clarify the convention.
  3. [Section 5.1] The phrase 'Our δ̂y' in Table 2 is misleading: the column reports the computed upper bound, not a measured disparity. A more precise label such as 'our upper bound' would make the vacuity of the certificates easier for the reader to assess.
  4. [Section 4.2.1] There is a typo in 'Multiplications are performed with truncations in Section Section 4.2.1'; the repeated word 'Section' should be removed.

Circularity Check

1 steps flagged · score 4.0 of 10

The bound derivation is self-contained, but the semantic step identifying δ_hat with statistical parity ΔSP is imported from the authors' own prior work (FairGAT [31]) and is load-bearing for the advertised fairness guarantee.

  1. self citation load bearing [Section 3.1, after Definition 4]
    "At the output layer of the DNN, δˆy = δm h , which is a single value as the DNN is a binary classification. As shown in [31], |δˆy| = ∆SP is exactly the statistical parity of the model."

    The paper's advertised guarantee is that the ZKP proves statistical parity as defined in Eq. 1, a difference of positive rates P(ŷ=1|s). The proved quantity δ_hat is a difference of mean sigmoid outputs. These are not the same object, and the only support for their equality is a citation to [31], whose authors (Kose and Shen) overlap with the present paper. The ZK relation R_fair and the protocols in Figures 3-4 actually prove the upper bound of Eq. 14/18, not the equality to ΔSP. Thus the step converting the proved bound into a statement about the fairness metric of Eq. 1 is carried by an unverified self-citation.

full rationale

The mathematical derivation of the fairness bounds is not circular: Lemmas 1-3 and 4-6 derive Eqs. 14 and 18 from Lipschitz continuity, Cauchy-Schwarz, and spectral-norm inequalities, with W, Δx, and δx as explicit inputs and no fitted parameter relabeled as a prediction. The ZKP gadgets, especially the spectral-norm protocol, are benchmarked externally against Gnark and against the OATH and naive-inference baselines, so the performance claims are independently grounded. The only load-bearing circularity found is the identification of δ_hat with the statistical parity ΔSP of Eq. 1, which is imported from [31], a paper by two of the present authors, rather than derived in this manuscript. Since Table 2 shows the fairness scores are not probability differences and Section 5.1 concedes the bounds are loose, this self-citation is not merely a routine reference; it is what turns a proved upper bound into the advertised fairness certificate. The technical content remains substantial, so the score is moderate rather than high.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central derivation uses standard linear algebra and cryptographic primitives. The main additional load-bearing choices are public aggregate statistics, the sigmoid-output-as-label equivalence, and the uncalibrated upper-bound certificate.

free parameters (2)
  • quantization precision q (qI integer bits, qD decimal bits)
    Chosen by the implementer to balance field size, lookup table size 2^q, and numerical error; the paper states q < log p - 1 but does not fix or justify a concrete value.
  • error tolerance for spectral norm lookup (Terr)
    The spectral norm protocol allows perturbation matrices E, E' and scalar e to be small, but no quantitative bound is given to ensure quantized eigenvectors are close enough to the real ones.
assumptions (5)
  • standard math A = W * W^T is symmetric positive semi-definite with an orthonormal eigenbasis over the reals.
    Used in Lemma 5 and Appendix B.2 to connect the proved eigenpair equations to the true spectral norm.
  • domain assumption Aggregated statistics Delta_x and delta_x are public, correct, and representative of the population over which fairness is claimed.
    Section 3.1 treats them as public inputs, from Census data or a separate ZKP; if they are wrong or from a different distribution, the bound does not certify fairness for the actual deployment data.
  • domain assumption Mean sigmoid output disparity can stand in for statistical parity P(yhat=1|s).
    Lemma 1 and the DNN bound use sigma(z) as the predicted outcome, while Eq. 1 defines prediction probability for binary labels; no thresholding step is modeled.
  • ad hoc to paper The layer-by-layer upper bound, after unspecified normalization or reference scoring, is a meaningful fairness certificate.
    Section 5.1 introduces normalization or reference scores only as ideas; no calibration procedure is defined, so the relationship between delta_hat and an acceptance decision is not established.
  • standard math Underlying zkSNARK building blocks, sumcheck, GKR, polynomial commitments, and LogUp lookup, are secure and correctly implemented.
    Theorems 1 to 3 rely on these standard primitives; no machine-checked implementation is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FairZK: A Scalable System to Prove Machine Learning Fairness in Zero-Knowledge." pith.science (2026). https://pith.science/paper/65SZBCO4

@misc{pith2026250507997,
  author       = {Pith},
  title        = {Pith review of: FairZK: A Scalable System to Prove Machine Learning Fairness in Zero-Knowledge},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/65SZBCO4}},
  note         = {Machine review of arXiv:2505.07997}
}
read the original abstract

With the rise of machine learning techniques, ensuring the fairness of decisions made by machine learning algorithms has become of great importance in critical applications. However, measuring fairness often requires full access to the model parameters, which compromises the confidentiality of the models. In this paper, we propose a solution using zero-knowledge proofs, which allows the model owner to convince the public that a machine learning model is fair while preserving the secrecy of the model. To circumvent the efficiency barrier of naively proving machine learning inferences in zero-knowledge, our key innovation is a new approach to measure fairness only with model parameters and some aggregated information of the input, but not on any specific dataset. To achieve this goal, we derive new bounds for the fairness of logistic regression and deep neural network models that are tighter and better reflecting the fairness compared to prior work. Moreover, we develop efficient zero-knowledge proof protocols for common computations involved in measuring fairness, including the spectral norm of matrices, maximum, absolute value, and fixed-point arithmetic. We have fully implemented our system, FairZK, that proves machine learning fairness in zero-knowledge. Experimental results show that FairZK is significantly faster than the naive approach and an existing scheme that use zero-knowledge inferences as a subroutine. The prover time is improved by 3.1x--1789x depending on the size of the model and the dataset. FairZK can scale to a large model with 47 million parameters for the first time, and generates a proof for its fairness in 343 seconds. This is estimated to be 4 orders of magnitude faster than existing schemes, which only scale to small models with hundreds to thousands of parameters.

Figures

Figures reproduced from arXiv: 2505.07997 by the authors.

Figure 1
Figure 1. Design of our ZKP of ML fairness. under this definition, the prover could use a ZKP protocol to prove that the predictions of the ML model on a public dataset over two sensitive subgroups do not differ by much. However, this would require multiple invocations of ZKPs for the inferences of the model, which is not practical yet for large models and is an active research topic on its own. Moreover, even if the proof ca… view at source ↗
Figure 2
Figure 2. Protocol for proving the spectral norm of a matrix [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. zkSNARK for proving the fairness of a logistic [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: Prover time of spectral norm in FAIRZK and a generic zkSNARK. Param Prover time Proof size Verifier time 808K 3.48s 412MB 0.49s 25M 51.32s 648MB 2.97s 47M 342.74s 1175MB 15.77s TABLE 6: Performance of FAIRZK on large DNN models. spectral norm in [PITH_FULL_IMAGE:figur…
Figure 6
Figure 6. Figure 6: zkSNARK for computing δx, ∆x of a dataset [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

69 extracted references · 57 canonical work pages

  1. [31]

    O. D. Kose and Y . Shen. Fairgat: Fairness-aware graph attention networks. ACM Transactions on Knowledge Discovery from Data , 18(7):1–20, 2024

    work page 2024

  2. [1]

    https://github.com/Consensys/gnark

    Gnark. https://github.com/Consensys/gnark

    work page

  3. [2]

    https://www.census.gov/library/ publications/2022/demo/p60-276.html, 2022

    Income in the united states: 2021. https://www.census.gov/library/ publications/2022/demo/p60-276.html, 2022

    work page 2021

  4. [3]

    Abbaszadeh, C

    K. Abbaszadeh, C. Pappas, J. Katz, and D. Papadopoulos. Zero- knowledge proofs of training for deep neural networks. Cryptology ePrint Archive, 2024

    work page 2024

  5. [4]

    J. A. Adebayo et al. FairML: ToolBox for diagnosing bias in pre- dictive modeling. PhD thesis, Massachusetts Institute of Technology, 2016

    work page 2016

  6. [5]

    Angwin, J

    J. Angwin, J. Larson, S. Mattu, and L. Kirchner. Machine bias: There’s software used across the country to predict fu- ture criminals. and it’s biased against blacks. 2016. URL https://www. propublica. org/article/machine-bias-risk-assessments- in-criminal-sentencing, 2019

    work page 2016

  7. [6]

    Angwin, J

    J. Angwin, J. Larson, S. Mattu, and L. Kirchner. Machine bias. In Ethics of data and analytics , pages 254–264. Auerbach Publications, 2022

    work page 2022

  8. [7]

    arkworks zksnark ecosystem

    arkworks contributors. arkworks zksnark ecosystem. https:// arkworks.rs, 2022

    work page 2022

Show all 69 references
  1. [8]

    Becker and R

    B. Becker and R. Kohavi. Adult. uci machine learning repository (1996). DOI: https://doi. org/10.24432/C5XW20, Accessed , 15

    1996 doi

  2. [9]

    R. K. Bellamy, K. Dey, M. Hind, S. C. Hoffman, S. Houde, K. Kan- nan, P. Lohia, J. Martino, S. Mehta, A. Mojsilovi ´c, et al. Ai fairness 360: An extensible toolkit for detecting and mitigating algorithmic bias. IBM Journal of Research and Development , 63(4/5):4–1, 2019

    2019

  3. [10]

    R. Berk, H. Heidari, S. Jabbari, M. Kearns, and A. Roth. Fairness in criminal justice risk assessments: The state of the art. Sociological Methods & Research , 50(1):3–44, 2021

    2021

  4. [11]

    Beutel, J

    A. Beutel, J. Chen, Z. Zhao, and E. H. Chi. Data decisions and the- oretical implications when adversarially learning fair representations. arXiv preprint arXiv:1707.00075 , June 2017

    2017 arXiv

  5. [12]

    B.-J. Chen, S. Waiwitlikhit, I. Stoica, and D. Kang. Zkml: An optimizing system for ml inference in zero-knowledge proofs. In Proceedings of the Nineteenth European Conference on Computer Systems, pages 560–574, 2024

    2024

  6. [13]

    Z. Chen, J. M. Zhang, M. Hort, M. Harman, and F. Sarro. Fair- ness testing: A comprehensive survey and analysis of trends. ACM Transactions on Software Engineering and Methodology, 33(5):1–59, 2024

    2024

  7. [14]

    Chiesa, M

    A. Chiesa, M. A. Forbes, and N. Spooner. A Zero Knowledge Sumcheck and its Applications. CoRR, abs/1704.02086, 2017

    2017 arXiv

  8. [15]

    Chouldechova

    A. Chouldechova. Fair prediction with disparate impact: A study of bias in recidivism prediction instruments. Big data , 5(2):153–163, 2017

    2017

  9. [16]

    D. Dua, C. Graff, et al. Uci machine learning repository, 2017. URL http://archive. ics. uci. edu/ml

    2017

  10. [17]

    Dwork, M

    C. Dwork, M. Hardt, T. Pitassi, O. Reingold, and R. Zemel. Fairness through awareness. In Proc. Innovations in Theoretical Computer Science (ITCS), pages 214–226, January 2012

    2012

  11. [18]

    Dwork, M

    C. Dwork, M. Hardt, T. Pitassi, O. Reingold, and R. Zemel. Fair- ness through awareness. In Proceedings of the 3rd innovations in theoretical computer science conference , pages 214–226, 2012

    2012

  12. [19]

    B. Feng, L. Qin, Z. Zhang, Y . Ding, and S. Chu. Zen: An optimizing compiler for verifiable, zero-knowledge neural network inferences. Cryptology ePrint Archive , 2021

    2021

  13. [20]

    Fiat and A

    A. Fiat and A. Shamir. How to prove yourself: Practical solutions to identification and signature problems. In Advances in Cryptology — CRYPTO’ 86, 1987

    1987

  14. [21]

    Franzese, A

    O. Franzese, A. S. Shamsabadi, and H. Haddadi. Oath: Efficient and flexible zero-knowledge proofs of end-to-end ml fairness. arXiv preprint arXiv:2410.02777, 2024

    2024

  15. [22]

    Fuster, P

    A. Fuster, P. Goldsmith-Pinkham, T. Ramadorai, and A. Walther. Pre- dictably unequal? the effects of machine learning on credit markets. The Journal of Finance , 77(1):5–47, 2022

    2022

  16. [23]

    S. Garg, A. Goel, S. Jha, S. Mahloujifar, M. Mahmoody, G.-V . Policharla, and M. Wang. Experimenting with zero-knowledge proofs of training. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pages 1880–1894, 2023

    2023

  17. [24]

    Goldwasser, Y

    S. Goldwasser, Y . T. Kalai, and G. N. Rothblum. Delegating Com- putation: Interactive Proofs for Muggles. J. ACM, 62(4):27:1–27:64, Sept. 2015

    2015

  18. [25]

    Golovnev, J

    A. Golovnev, J. Lee, S. Setty, J. Thaler, and R. S. Wahby. Brakedown: Linear-time and field-agnostic snarks for r1cs. In Annual Interna- tional Cryptology Conference , pages 193–226. Springer, 2023

    2023

  19. [26]

    Grgic-Hlaca, M

    N. Grgic-Hlaca, M. B. Zafar, K. P. Gummadi, and A. Weller. The case for process fairness in learning: Feature selection for fair decision making. In NIPS symposium on machine learning and the law , volume 1, page 2. Barcelona, Spain, 2016

    2016

  20. [27]

    Hab ¨ock

    U. Hab ¨ock. Multivariate lookups based on logarithmic derivatives. Cryptology ePrint Archive , 2022

    2022

  21. [28]

    Hardt, E

    M. Hardt, E. Price, and N. Srebro. Equality of opportunity in supervised learning. Advances in neural information processing systems, 29, 2016

    2016

  22. [29]

    D. Kang, T. Hashimoto, I. Stoica, and Y . Sun. Scaling up trust- less dnn inference with zero-knowledge proofs. arXiv preprint arXiv:2210.08674, 2022

    2022 arXiv

  23. [30]

    O. D. Kose and Y . Shen. Fair node representation learning via adaptive data augmentation. arXiv preprint arXiv:2201.08549 , 2022

    2022 arXiv

  24. [32]

    M. J. Kusner, J. Loftus, C. Russell, and R. Silva. Counterfactual fairness. Advances in neural information processing systems , 30, 2017

    2017

  25. [33]

    J. P. Lalor, A. Abbasi, K. Oketch, Y . Yang, and N. Forsgren. Should fairness be a metric or a model? A model-based framework for assessing bias in machine learning pipelines. ACM Transactions on Information Systems, 42(4):1–41, 2024

    2024

  26. [34]

    S. Lee, H. Ko, J. Kim, and H. Oh. vcnn: Verifiable convolutional neu- ral network based on zk-snarks. IEEE Transactions on Dependable and Secure Computing , 2024

    2024

  27. [35]

    T. Liu, X. Xie, and Y . Zhang. Zkcnn: Zero knowledge proofs for convolutional neural network predictions and accuracy. In Pro- ceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 2968–2985, 2021

    2021

  28. [36]

    C. Lund, L. Fortnow, H. Karloff, and N. Nisan. Algebraic methods for interactive proof systems. Journal of the ACM (JACM) , 39(4):859– 868, 1992

    1992

  29. [37]

    Mehrabi, F

    N. Mehrabi, F. Morstatter, N. Saxena, K. Lerman, and A. Galstyan. A survey on bias and fairness in machine learning. ACM Computing Surveys (CSUR), 54(6):1–35, 2021

    2021

  30. [38]

    Paszke, S

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems , 32, 2019

    2019

  31. [39]

    Pessach and E

    D. Pessach and E. Shmueli. A review on fairness in machine learning. ACM Computing Surveys (CSUR) , 55(3):1–44, 2022

    2022

  32. [40]

    Plonkish

    plonkish contributors. Plonkish. https://github.com/han0110/plonkish

  33. [41]

    Saleiro, B

    P. Saleiro, B. Kuester, L. Hinkson, J. London, A. Stevens, A. Anisfeld, K. T. Rodolfa, and R. Ghani. Aequitas: A bias and fairness audit toolkit. arXiv preprint arXiv:1811.05577 , 2018

    2018 arXiv

  34. [42]

    S. Setty. Spartan: Efficient and general-purpose zksnarks without trusted setup. In Advances in Cryptology – CRYPTO 2020 , pages 704–737, 2020

    2020

  35. [43]

    A. S. Shamsabadi, G. Tan, T. I. Cebere, A. Bellet, H. Haddadi, N. Pa- pernot, X. Wang, and A. Weller. Confidential-dpproof: Confidential proof of differentially private training. In International Conference on Learning Representations (ICLR) , 2024

    2024

  36. [44]

    A. S. Shamsabadi, S. C. Wyllie, N. Franzese, N. Dullerud, S. Gambs, N. Papernot, X. Wang, and A. Weller. Confidential-profitt: confiden- tial proof of fair training of trees. In The Eleventh International Conference on Learning Representations , 2022

    2022

  37. [45]

    R. R. Stoll. Linear algebra and matrix theory . Courier Corporation, 2013

    2013

  38. [46]

    H. Sun, T. Bai, J. Li, and H. Zhang. Zkdl: Efficient zero-knowledge proofs of deep learning training. Cryptology ePrint Archive , 2023

    2023

  39. [47]

    H. Sun, J. Li, and H. Zhang. zkllm: Zero knowledge proofs for large language models. arXiv preprint arXiv:2404.16109 , 2024

    2024 arXiv

  40. [48]

    J. Thaler. Time-Optimal Interactive Proofs for Circuit Evaluation. In Advances in Cryptology – CRYPTO 2013 , 2013

    2013

  41. [49]

    Tramer, V

    F. Tramer, V . Atlidakis, R. Geambasu, D. Hsu, J.-P. Hubaux, M. Hum- bert, A. Juels, and H. Lin. Fairtest: Discovering unwarranted associa- tions in data-driven applications. In 2017 IEEE European Symposium on Security and Privacy (EuroS&P) , pages 401–416. IEEE, 2017

    2017

  42. [50]

    R. S. Wahby, I. Tzialla, A. Shelat, J. Thaler, and M. Walfish. Doubly- efficient zkSNARKs without trusted setup. In 2018 IEEE Symposium on Security and Privacy (SP) , pages 926–943, 2018

    2018

  43. [51]

    C. Weng, K. Yang, X. Xie, J. Katz, and X. Wang. Mystique: Efficient conversions for{Zero-Knowledge} proofs with applications to machine learning. In 30th USENIX Security Symposium (USENIX Security 21), pages 501–518, 2021

    2021

  44. [52]

    J. Weng, J. Weng, G. Tang, A. Yang, M. Li, and J.-N. Liu. pvcnn: Privacy-preserving and verifiable convolutional neural network test- ing. IEEE Transactions on Information Forensics and Security , 18:2218–2233, 2023

    2023

  45. [53]

    T. Xie, J. Zhang, Y . Zhang, C. Papamanthou, and D. Song. Libra: Succinct zero-knowledge proofs with optimal prover computation. In Advances in Cryptology – CRYPTO , 2019

    2019

  46. [54]

    T. Xie, J. Zhang, Y . Zhang, C. Papamanthou, and D. Song. Libra: Succinct zero-knowledge proofs with optimal prover computation. In Advances in Cryptology – CRYPTO 2019 , pages 733–764, 2019

    2019

  47. [55]

    T. Xie, Y . Zhang, and D. Song. Orion: Zero knowledge proof with linear prover time. In Annual International Cryptology Conference , pages 299–328. Springer, 2022

    2022

  48. [56]

    Yadav, A

    C. Yadav, A. R. Chowdhury, D. Boneh, and K. Chaudhuri. Fairproof: Confidential and certifiable fairness for neural networks. arXiv preprint arXiv:2402.12572, 2024

    2024 arXiv

  49. [57]

    J. N. Yan, Z. Gu, H. Lin, and J. M. Rzeszotarski. Silva: Interactively assessing machine learning fairness using causality. In Proc. confer- ence on human factors in computing systems , pages 1–13, 2020

    2020

  50. [58]

    Zhang, Z

    J. Zhang, Z. Fang, Y . Zhang, and D. Song. Zero knowledge proofs for decision tree predictions and accuracy. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 2039–2053, 2020

    2020

  51. [59]

    Zhang, T

    J. Zhang, T. Liu, W. Wang, Y . Zhang, D. Song, X. Xie, and Y . Zhang. Doubly efficient interactive proofs for general arithmetic circuits with linear prover time. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , pages 159– 177, 2021

    2021

  52. [60]

    Zhang, W

    J. Zhang, W. Wang, Y . Zhang, and Y . Zhang. Doubly efficient interactive proofs for general arithmetic circuits with linear prover time. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security , 2021

    2021

  53. [61]

    Zhang, T

    J. Zhang, T. Xie, Y . Zhang, and D. X. Song. Transparent polynomial delegation and its applications to zero knowledge proof. 2020 IEEE Symposium on Security and Privacy (SP) , pages 859–876, 2020

    2020

  54. [62]

    Zhang, J

    P. Zhang, J. Wang, J. Sun, G. Dong, X. Wang, X. Wang, J. S. Dong, and T. Dai. White-box fairness testing through adversarial sampling. In Proceedings of the ACM/IEEE 42nd international conference on software engineering, pages 949–960, 2020

    2020

  55. [63]

    Zhang, D

    Y . Zhang, D. Genkin, J. Katz, D. Papadopoulos, and C. Papamanthou. A zero-knowledge version of vsql. IACR Cryptol. ePrint Arch. , 2017:1146, 2017

    2017

  56. [64]

    Zheng, Z

    H. Zheng, Z. Chen, T. Du, X. Zhang, Y . Cheng, S. Ji, J. Wang, Y . Yu, and J. Chen. Neuronfair: Interpretable white-box fairness testing through biased neuron identification. In Proceedings of the 44th International Conference on Software Engineering, pages 1519– 1531, 2022. A...

    2022

  57. [65]

    P y∈{0,1}log n ˜eq(rx,y)(˜h0(y)(γ + ˜A(y))− 1) = 0

  58. [66]

    P y∈{0,1}log N ˜eq(r′ x,y)(˜h1(y)(γ + ˜T (y))− ˜m(y) = 0

  59. [67]

    Finally, the prover opens these polynomial commitments at the random points checked in the last step of the sumcheck protocols

    P x∈{0,1}log n ˜h0(x)−P x∈{0,1}log N ˜h1(x) = 0. Finally, the prover opens these polynomial commitments at the random points checked in the last step of the sumcheck protocols. The verifier verifies the sumcheck protocol as well as the proofs of the PCS. This protocol is direc...

    2025

  60. [68]

    The proposed system adopts a novel approach for prov- ing ML model fairness and significantly outperforms prior work

  61. [69]

    The inferred bounds may be of independent interest and may inspire future research for tighter results. D.4. Noteworthy Concerns While the proposed scheme achieves better bounds (in absolute values) than prior works for provable fairness, it is not clear exactly what these val...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.