PoLO: Proof-of-Learning and Proof-of-Ownership at Once with Chained Watermarking

TL;DR

PoLO introduces a unified framework that jointly proves training effort (PoL) and establishes model ownership (PoO) by embedding a chain of watermarks across training shards, where each watermark is deterministically derived from the previous shard through a cryptographic hash. This chaining binds the entire training trajectory, enabling tamper-resistant PoL verification without exposing training data, while the final watermark provides robust PoO in a privacy-preserving manner through selective differential privacy. The approach supports arbitrary watermarking schemes, reduces verification overhead to a fraction of traditional PoL methods, and shows strong resistance to forgery attacks, with 99% ownership-detection accuracy and up to 4x higher forging cost. Experimental results across diverse models and datasets confirm PoLO’s efficiency, compatibility, and security benefits, highlighting its potential for trustworthy model marketplaces, incentive-driven distributed learning, and collaborative training pipelines.

Abstract

Machine learning models are increasingly shared and outsourced, raising requirements of verifying training effort (Proof-of-Learning, PoL) to ensure claimed performance and establishing ownership (Proof-of-Ownership, PoO) for transactions. When models are trained by untrusted parties, PoL and PoO must be enforced together to enable protection, attribution, and compensation. However, existing studies typically address them separately, which not only weakens protection against forgery and privacy breaches but also leads to high verification overhead. We propose PoLO, a unified framework that simultaneously achieves PoL and PoO using chained watermarks. PoLO splits the training process into fine-grained training shards and embeds a dedicated watermark in each shard. Each watermark is generated using the hash of the preceding shard, certifying the training process of the preceding shard. The chained structure makes it computationally difficult to forge any individual part of the whole training process. The complete set of watermarks serves as the PoL, while the final watermark provides the PoO. PoLO offers more efficient and privacy-preserving verification compared to the vanilla PoL solutions that rely on gradient-based trajectory tracing and inadvertently expose training data during verification, while maintaining the same level of ownership assurance of watermark-based PoO schemes. Our evaluation shows that PoLO achieves 99% watermark detection accuracy for ownership verification, while preserving data privacy and cutting verification costs to just 1.5-10% of traditional methods. Forging PoLO demands 1.1-4x more resources than honest proof generation, with the original proof retaining over 90% detection accuracy even after attacks.

Figures (7)

• Figure 1: Why at once? PoL verifies training effort but lacks ownership tracking, while PoO ensures ownership but fails to justify training efforts. Separating PoL and PoO creates attribution risks and ownership conflicts.
• Figure 2: PoLO design: The verifier shares a secret nonce with the prover to initialize watermark parameters ($\Lambda_{1}$, $k_1$, $Y$) for the first shard $s_1$. Prior to watermark embedding, the model owner computes the watermark $\Lambda_{x-1}$ and its corresponding embedding key $k_{x-1}$ for shard $s_x$ using a hash function $\mathbb{H}(\cdot)$ over the previous model $W_{x-1}$, auxiliary information, and the secret nonce. During training, $\Lambda_{x-1}$ is embedded into the model using $k_{x-1}$, while monitoring the watermark detection rate $\eta$. Once $\eta$ exceeds the threshold $\eta_G$, DP noise is applied to enhance robustness against inference attacks. Training proceeds to the next shard with new $\Lambda_x$ and $k_x$. The process continues until the model converges.
• Figure 3: The verification of chained watermarking for PoL: ① (verifier) requests verification for shard $x$; ② (prover) sends checkpoints $W_{x-1}$ and $W_x$; ③ (verifier) derives the selection matrix $Y$ from the locally recorded nonce $\mu$ associated with the prover, if $Y$ has not already been obtained. Using the received checkpoints, the verifier then derives the watermark $\Lambda_x$ and the extraction key $k_x$ from $W_{x-1}$, also based on $\mu$, and finally extracts the watermark $\hat{\Lambda}_x$ from $W_x$ using $k_x$ and $Y$; ④ (verifier) validates the watermark and main task accuracy; ⑤ (verifier) returns the result and repeats for earlier shards if needed.
• Figure 4: The $Acc_{main}$ comparison of the two $\mathbb{P}$ forge attacks with baseline - PoLO. The number followed by the dataset is the watermark size. In each subplot, the vertical lines perpendicular to the x-axis represent the completion times for each shard.
• Figure 5: The $\eta$ of the last 1-6 intermediate shards' watermark attempts to be extracted from the last shard models.

Theorems & Definitions (4)

• Definition 1: Proof-of-anything, PoX
• Definition 2: Proof-of-Learning, PoL
• Definition 3: Proof-of-Ownership (PoO)
• Definition 4