Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

TeleSparse: Practical Privacy-Preserving Verification of Deep Neural Networks

Mohammad M Maheri, Hamed Haddadi, Alex Davidson

TL;DR

TeleSparse tackles the high cost of verifiable deep learning via ZK-SNARKs by post-processing pre-trained models to be ZK-friendly. It combines two core ideas: sparsification to reduce circuit constraints and neural teleportation to shrink activation lookup-table ranges, implemented on Halo2. Across Vision Transformers, ResNet, and MobileNet, TeleSparse achieves up to 67% prover-memory reduction and 46% faster proof generation with around 1% accuracy loss, demonstrated on ImageNet, CIFAR-10, and CIFAR-100. This work enables scalable, privacy-preserving verifiable inference for large DL models and opens a path toward ZK-friendly model design with practical, edge-friendly verification capabilities.

Abstract

Verification of the integrity of deep learning inference is crucial for understanding whether a model is being applied correctly. However, such verification typically requires access to model weights and (potentially sensitive or private) training data. So-called Zero-knowledge Succinct Non-Interactive Arguments of Knowledge (ZK-SNARKs) would appear to provide the capability to verify model inference without access to such sensitive data. However, applying ZK-SNARKs to modern neural networks, such as transformers and large vision models, introduces significant computational overhead. We present TeleSparse, a ZK-friendly post-processing mechanisms to produce practical solutions to this problem. TeleSparse tackles two fundamental challenges inherent in applying ZK-SNARKs to modern neural networks: (1) Reducing circuit constraints: Over-parameterized models result in numerous constraints for ZK-SNARK verification, driving up memory and proof generation costs. We address this by applying sparsification to neural network models, enhancing proof efficiency without compromising accuracy or security. (2) Minimizing the size of lookup tables required for non-linear functions, by optimizing activation ranges through neural teleportation, a novel adaptation for narrowing activation functions' range. TeleSparse reduces prover memory usage by 67% and proof generation time by 46% on the same model, with an accuracy trade-off of approximately 1%. We implement our framework using the Halo2 proving system and demonstrate its effectiveness across multiple architectures (Vision-transformer, ResNet, MobileNet) and datasets (ImageNet,CIFAR-10,CIFAR-100). This work opens new directions for ZK-friendly model design, moving toward scalable, resource-efficient verifiable deep learning.

TeleSparse: Practical Privacy-Preserving Verification of Deep Neural Networks

TL;DR

TeleSparse tackles the high cost of verifiable deep learning via ZK-SNARKs by post-processing pre-trained models to be ZK-friendly. It combines two core ideas: sparsification to reduce circuit constraints and neural teleportation to shrink activation lookup-table ranges, implemented on Halo2. Across Vision Transformers, ResNet, and MobileNet, TeleSparse achieves up to 67% prover-memory reduction and 46% faster proof generation with around 1% accuracy loss, demonstrated on ImageNet, CIFAR-10, and CIFAR-100. This work enables scalable, privacy-preserving verifiable inference for large DL models and opens a path toward ZK-friendly model design with practical, edge-friendly verification capabilities.

Abstract

Verification of the integrity of deep learning inference is crucial for understanding whether a model is being applied correctly. However, such verification typically requires access to model weights and (potentially sensitive or private) training data. So-called Zero-knowledge Succinct Non-Interactive Arguments of Knowledge (ZK-SNARKs) would appear to provide the capability to verify model inference without access to such sensitive data. However, applying ZK-SNARKs to modern neural networks, such as transformers and large vision models, introduces significant computational overhead. We present TeleSparse, a ZK-friendly post-processing mechanisms to produce practical solutions to this problem. TeleSparse tackles two fundamental challenges inherent in applying ZK-SNARKs to modern neural networks: (1) Reducing circuit constraints: Over-parameterized models result in numerous constraints for ZK-SNARK verification, driving up memory and proof generation costs. We address this by applying sparsification to neural network models, enhancing proof efficiency without compromising accuracy or security. (2) Minimizing the size of lookup tables required for non-linear functions, by optimizing activation ranges through neural teleportation, a novel adaptation for narrowing activation functions' range. TeleSparse reduces prover memory usage by 67% and proof generation time by 46% on the same model, with an accuracy trade-off of approximately 1%. We implement our framework using the Halo2 proving system and demonstrate its effectiveness across multiple architectures (Vision-transformer, ResNet, MobileNet) and datasets (ImageNet,CIFAR-10,CIFAR-100). This work opens new directions for ZK-friendly model design, moving toward scalable, resource-efficient verifiable deep learning.
Paper Structure (37 sections, 2 theorems, 39 equations, 6 figures, 5 tables, 2 algorithms)

This paper contains 37 sections, 2 theorems, 39 equations, 6 figures, 5 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Works
  3. Verifiable deep model inference
  4. Sparse training/inference
  5. Neural Network Teleportation
  6. System and Threat Model
  7. Potential Threats
  8. Design Goals
  9. Methodology Overview
  10. Sparsification
  11. Preliminaries
  12. Matrix-Vector Multiplication in Halo2
  13. DNN Sparsification
  14. Teleportation
  15. Advantages of Zero-Order Methods
  16. ...and 22 more sections

Key Result

Theorem 4.1

In a matrix-vector multiplication circuit in Halo2, where the matrix $W$ is stored in fixed columns, eliminating constraints corresponding to zero entries $W_{i,j} = 0$ does not compromise the soundness of the proving system.

Figures (6)

  • Figure 1: System diagram of ZK-SNARK DNN inference.
  • Figure 2: System overview: the neural network weight is fed as the private input to the Halo2 circuit. Input and output of the neural network is public input to the circuit.
  • Figure 3: (A) represent a Halo2 circuit without removing sparse weights constraints while (B) represents it after removing zero-weight entries.
  • Figure 4: Effect of sparsity ratio on memory usage, proving time, and top-1 accuracy (equal to average accuracy due to balanced classes) for ResNet20 on CIFAR-100.
  • Figure 5: Transformer architecture contains two parts of attention and MLP. We split each part to generate proof in a separate ZK circuits.
  • ...and 1 more figures

Theorems & Definitions (2)

  • Theorem 4.1
  • Theorem 7.1