[Paper Review] Proof-of-Learning is Currently More Broken Than You Think

Congyu Fang, Hengrui Jia+6 more|arXiv (Cornell University)|Aug 6, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper demonstrates that Proof-of-Learning (PoL) is fundamentally insecure due to systemic vulnerabilities in its verification mechanism, showing that adversaries can generate valid proofs at a fraction of the cost of honest training. The authors identify core flaws in PoL's assumptions about gradient update uniqueness and noise tolerance, proving that existing spoofing attacks are not only feasible but systematically exploitable across configurations.

ABSTRACT

Proof-of-Learning (PoL) proposes that a model owner logs training checkpoints to establish a proof of having expended the computation necessary for training. The authors of PoL forego cryptographic approaches and trade rigorous security guarantees for scalability to deep learning. They empirically argued the benefit of this approach by showing how spoofing--computing a proof for a stolen model--is as expensive as obtaining the proof honestly by training the model. However, recent work has provided a counter-example and thus has invalidated this observation. In this work we demonstrate, first, that while it is true that current PoL verification is not robust to adversaries, recent work has largely underestimated this lack of robustness. This is because existing spoofing strategies are either unreproducible or target weakened instantiations of PoL--meaning they are easily thwarted by changing hyperparameters of the verification. Instead, we introduce the first spoofing strategies that can be reproduced across different configurations of the PoL verification and can be done for a fraction of the cost of previous spoofing strategies. This is possible because we identify key vulnerabilities of PoL and systematically analyze the underlying assumptions needed for robust verification of a proof. On the theoretical side, we show how realizing these assumptions reduces to open problems in learning theory.We conclude that one cannot develop a provably robust PoL verification mechanism without further understanding of optimization in deep learning.

Motivation & Objective

• To investigate the robustness of Proof-of-Learning (PoL) as a non-cryptographic method for verifying deep learning training integrity.
• To identify and exploit systemic weaknesses in PoL’s verification mechanism that allow low-cost spoofing attacks.
• To demonstrate that prior spoofing strategies are either non-reproducible or easily thwarted by hyperparameter tuning, revealing a gap in prior evaluations.
• To formalize the assumptions underlying PoL verification and show that their fulfillment reduces to open problems in deep learning optimization theory.
• To propose a hybrid approach combining cryptographic commitments and timestamping to strengthen PoL’s precedence guarantees.

Proposed method

• Systematically analyze PoL’s two roles: (1) efficient verification of valid training trajectories and (2) establishing computational precedence to prevent spoofing.
• Identify that noise tolerance in verification creates a sensitivity-specificity trade-off due to lack of precise models of gradient noise in deep learning.
• Demonstrate that verifying only a subset of updates—proposed by Jia et al.—introduces an attack surface allowing adversaries to control which updates are verified.
• Introduce reproducible spoofing strategies that succeed across diverse PoL configurations and cost significantly less than prior methods.
• Propose integrating cryptographic commitments to training data and timestamping to prevent replay and data-reuse attacks.
• Formalize the theoretical gap between PoL’s security assumptions and current understanding of optimization in deep neural networks.

Experimental results

Research questions

• RQ1 Can spoofing attacks on Proof-of-Learning be reliably reproduced across different PoL configurations, or are they fragile to hyperparameter changes?
• RQ2 To what extent do existing PoL verification mechanisms fail to prevent adversarial spoofing due to poor noise tolerance and incomplete verification?
• RQ3 What theoretical assumptions underlie PoL’s security, and how do they reduce to open problems in deep learning optimization?
• RQ4 Can cryptographic primitives like data commitments and timestamping be effectively integrated into PoL to strengthen precedence guarantees?
• RQ5 Is it possible to construct a provably robust PoL verification mechanism without resolving fundamental open problems in learning theory?

Key findings

• The authors demonstrate the first reproducible, cross-configuration spoofing strategies for PoL that succeed at a fraction of the cost of honest training.
• Prior spoofing attacks, including those by Zhang et al., are shown to be fragile and easily thwarted by minor hyperparameter changes, indicating they do not expose systemic flaws.
• The sensitivity-specificity trade-off in PoL verification cannot be optimally resolved due to the lack of a precise model of noise in deep learning training trajectories.
• Verifying only a subset of updates in a proof creates an exploitable attack surface, allowing adversaries to manipulate which steps are validated.
• Formalizing the security of PoL verification reduces to open problems in optimization and generalization theory, making provable robustness currently unattainable.
• Integrating cryptographic commitments to training data and timestamping can significantly reduce the attack surface and prevent replay and data-reuse attacks.