Proof-of-Learning (SecurePoL), animated

The journey is harder to fake than the destination. A model's final weights are trivially copyable, so ownership can't rest on them. But the path the optimizer took, the sequence of checkpoints W₀…W_T with the exact data batches and hyperparameters that drove each step, took a full training run to produce. Proof-of-Learning records that transcript: P(f) = (W, I, H, A): checkpoints, batch indices, batch signatures, and auxiliary info.

Verification is cheap because it spot-checks. Re-running the whole training would cost as much as training. Instead the verifier exploits a structural fact: honest gradient steps are small, so a forger taking shortcuts must hide a few oversized jumps. It sorts updates by magnitude, replays only the top-Q segments per epoch, and checks each recomputed checkpoint lands within a slack ball δ (which absorbs floating-point, hardware, and optimizer nondeterminism). A spoofed jump can't fit inside δ.

Security is a cost asymmetry, a goal, not a theorem. Honest proving costs one training run; forging means inverting SGD against randomly sampled checkpoints. Because the entropy of the process grows roughly linearly in the number of steps T, the space of consistent paths grows exponentially. The relation E[C_A] ≥ E[C_T] is a design property (Jia et al., 2021), and later work (Zhang et al. 2022; Fang et al. 2023) showed plain PoL can be spoofed, which is exactly the gap the author's work closes.

SecurePoL seals it with a watermark. Verification becomes a logical AND: a checkpoint must be trajectory-consistent (d₂ ≤ δ) and carry the secret watermark (W(f) = σ). A fabricated transcript can mimic the loss curve, but it can't carry a mark it never trained to embed, so spoofing collapses back to doing the real training. The paper couples the immutable PoL log with three watermarking strategies rather than one: feature-based triggers, sparse parameter perturbations, and a non-intrusive auxiliary head.

What the paper measured. On CIFAR-10 with ResNet-20, the joint condition raises the cost of the two spoofing routes that break plain PoL, blindfold Top-Q and infinitesimal-update, while leaving the model useful: baseline accuracy moves by 0.00, 0.03 and 0.58 percentage points across the three strategies. Ownership verification is not free, but the price is small and stated: runtime overhead between 0.6% and 17.3%, and proof logs under 12 MB.

Scientific Context: The genuine loss trajectory descends in expectation (SGD is non-monotone) with heavy-tailed step sizes, a high-entropy fingerprint of compute expended. The trajectory-plus-watermark construction is detailed in the author's "SecurePoL" (IEEE Access 2025) and Ph.D. Dissertation.