Proof-of-Learning (SecurePoL), animated

The journey is harder to fake than the destination. A model's final weights are trivially copyable, so ownership can't rest on them. But the path the optimizer took, the sequence of checkpoints W₀…W_T with the exact data batches and hyperparameters that drove each step, took a full training run to produce. Proof-of-Learning records that transcript: P(f) = (W, I, H, A): checkpoints, batch indices, batch signatures, and auxiliary info.

Spot-checks have limits. The original verifier replays the largest updates and compares reconstructed checkpoints within a tolerance δ. Subsequent attacks exploit what this partial verification leaves unchecked; a plausible loss curve alone establishes nothing.

Cost asymmetry is a design goal. A useful proof should be cheaper to verify than to create, and no cheaper to forge than honest training.

SecurePoL adds an ownership signal. Its verifier requires both a consistent trajectory and a watermark. The dissertation evaluates feature-based, parameter-perturbation, and auxiliary-head variants against specified attacks. This raises the cost of the tested attacks; it does not establish universal unforgeability.

What the paper measured. On CIFAR-10 with ResNet-20, the joint condition raises the cost of the two spoofing routes that break plain PoL, blindfold Top-Q and infinitesimal-update, while leaving the model useful: baseline accuracy moves by 0.00, 0.03 and 0.58 percentage points across the three strategies. Ownership verification is not free, but the price is small and stated: runtime overhead between 0.6% and 17.3%, and proof logs under 12 MB.