Proof-of-Learning (SecurePoL), animated
🔬 Anyone can download a model and claim they trained it — the final weights are just a tensor of numbers, copyable in milliseconds. The proof is in the journey: a real training run leaves a checkpoint trajectory that took a full run to generate and is expensive to forge. This animation builds the idea from the ground up — why the path beats the point, how a verifier spot-checks it cheaply, the prover/adversary cost asymmetry, and how the author's SecurePoL seals the remaining crack with a watermark.
legitimate / trajectory checkpoint · δ-ball adversary / spoof watermark
🧠 What did you just learn?
The journey is harder to fake than the destination. A model's final weights are trivially copyable, so ownership can't rest on them. But the path the optimizer took — the sequence of checkpoints W₀…W_T with the exact data batches and hyperparameters that drove each step — took a full training run to produce. Proof-of-Learning records that transcript: P(f) = (W, I, H, A) — checkpoints, batch indices, batch signatures, and auxiliary info.
Verification is cheap because it spot-checks. Re-running the whole training would cost as much as training. Instead the verifier exploits a structural fact: honest gradient steps are small, so a forger taking shortcuts must hide a few oversized jumps. It sorts updates by magnitude, replays only the top-Q segments per epoch, and checks each recomputed checkpoint lands within a slack ball δ (which absorbs floating-point, hardware, and optimizer nondeterminism). A spoofed jump can't fit inside δ.
Security is a cost asymmetry — a goal, not a theorem. Honest proving costs one training run; forging means inverting SGD against randomly sampled checkpoints. Because the entropy of the process grows roughly linearly in the number of steps T, the space of consistent paths grows exponentially. The relation E[C_A] ≥ E[C_T] is a design property (Jia et al., 2021) — and later work (Zhang et al. 2022; Fang et al. 2023) showed plain PoL can be spoofed, which is exactly the gap the author's work closes.
SecurePoL seals it with a watermark. Verification becomes a logical AND: a checkpoint must be trajectory-consistent (d₂ ≤ δ) and carry the secret feature watermark (W(f) = σ). A fabricated transcript can mimic the loss curve, but it can't carry a mark it never trained to embed — so spoofing collapses back to doing the real training.
Scientific Context: The genuine loss trajectory descends in expectation (SGD is non-monotone) with heavy-tailed step sizes — a high-entropy fingerprint of compute expended. The trajectory-plus-watermark construction is detailed in the author's "SecurePoL" (IEEE Access 2025) and Ph.D. Dissertation.
📐 The math, precisely
Rendered on load. If equations appear as raw text, your browser blocked the math font CDN.