The sections above verify what a device did, but a verifier may also want to test whether a declared training process plausibly produced the submitted model, so this extension surveys checkpoint, proof-of-learning, and zero-knowledge approaches and shows how far each is from deployment.
This extension asks a different question: can a verifier test whether a declared training process plausibly produced the submitted checkpoints or model?
Possible evidence includes:
- Training records and code or data commitments
- Periodic checkpoints or weight snapshots
- Authenticated transcripts
- Sampled re-execution
- Probabilistic recomputation
- Dedicated verification clusters
- Proof-of-learning or proof-of-training-data protocols
Yonadav Shavit’s 2023 compute-monitoring proposal decomposed a possible system into on-chip weight snapshots, records intended to support later verification of training, and supply-chain monitoring intended to prevent accumulation of untracked chips. This decomposition remains useful because it separates verification of a declared run from completeness of the fleet.
Y. Shavit, What Does It Take to Catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring — arXiv:2303.11341, 2023.
Proof-of-learning research shows both the promise and fragility of checkpoint-based verification. Jia and colleagues proposed proofs based on logged intermediate states. Subsequent work demonstrated adversarial constructions and serious weaknesses in the original approach. Choi, Shavit, and Duvenaud later proposed a broader toolkit for verifying claims about training data, while explicitly treating its tests as heuristic and noting substantial confidentiality and access assumptions.
H. Jia et al., Proof-of-Learning: Definitions and Practice — arXiv:2103.05633, 2021. R. Zhang et al., Adversarial Examples for Proof-of-Learning — arXiv:2108.09454, IEEE Symposium on Security and Privacy, 2022. C. Fang et al., Proof-of-Learning Is Currently More Broken Than You Think — arXiv:2208.03567, revised 2023. J. Choi, Y. Shavit, and D. Duvenaud, Tools for Verifying Neural Models’ Training Data — arXiv:2307.00682, 2023.
Keep three claims separate:
- Declared-run correctness: the submitted model or checkpoint plausibly arose from the declared process.
- Declared-run completeness: the submitted transcript covered all relevant steps associated with that declared run.
- Fleet completeness: no separate prohibited run occurred on other hardware.
Training transcripts and recomputation mainly address the first claim, with varying assurance. They do not automatically establish the third.
A June 2026 paper proposes a zero-knowledge architecture for frontier training claims, but it also identifies thirteen open problems and a critical requirement that has not yet been demonstrated at relevant scale: a zero-knowledge proof of backpropagation for a nontrivial model. Treat this as an ambitious research proposal, not evidence that zero-knowledge verification of frontier training is deployment-ready.
Zero Knowledge Verification for Frontier AI Training Is Possible — arXiv:2606.05433, June 2026. The paper presents an architecture and estimates, while documenting open problems and unproven critical components.
Activity: Buy Assurance With a Verification Budget
You receive a declared transcript and a limited verification-compute budget. Split it among the seven methods below, and for each one record cost, confidentiality exposure, spoofing opportunity, expected assurance, and the claim that remains untested.