공개키, ZKML 기반 머신러닝 모델 소유권 증명 및 온체인 검증 방법

초록

Deep learning models are increasingly seen as key intellectual assets, but establishing and verifying ownership can be tricky since a model has numerical parameter sets. Current methods like watermarking, backdoors, and fingerprinting can leave traces in a model, yet they often depend on secret triggers and proprietary methods that don’t strongly link to the owner’s identity or when they first claimed it. If a dispute arises, public verification might mean sharing model parameters or trigger inputs, which raises issues around privacy and trade secrets. In this paper proposes an on-chain ownership proof method for deep learning models that combines public-key digital signatures, white-box watermarking, zero- knowledge machine learning (ZKML), and blockchain-based timestamping. This method combines public-key signatures, white-box watermarking, zkVM-based ZKML, and blockchain timestamping. In this scheme a 128-bit string will be embedded into the model through a DeepSigns watermark and use zkVM to handle the watermark extraction process. This proves that the extraction was done correctly without exposing the internal parameters. The verifier checks a signed public certificate that links the program identifier and public outputs, all anchored on Ethereum's Sepolia. We tried out this workflow on an MNIST MLP with RISC Zero, looking at the overall latency and gas costs tied to on-chain verification. On top of that, we ran some bit-level tampering tests on key elements like signatures, certificate fields, program IDs, and proof bytes to make sure they acted as we expected when they were rejected. Rather than proposing a new watermarking or zero-knowledge algorithm, this work focuses on implementing an integrated public-key, watermarking, ZKML, and blockchain architecture in a realistic environment and analyzing its behavior and on-chain costs; broader robustness evaluations over diverse datasets, models, and attack scenarios are left as future work.

키워드