# VeriML: Enabling Integrity Assurances and Fair Payments for Machine Learning as a Service

arXiv: https://arxiv.org/abs/1909.06961 · HTML: https://mlsanity.com/paper/1909.06961/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Sep 2019.

## Built on by (most cited first, 28 of 28)

- [zkLLM: Zero Knowledge Proofs for Large Language Models](https://mlsanity.com/paper/2404.16109/) (2024)
- [Verifiable and Provably Secure Machine Unlearning](https://mlsanity.com/paper/2210.09126/) (2022)
- [A Survey of Zero-Knowledge Proof Based Verifiable Machine Learning](https://mlsanity.com/paper/2502.18535/) (2025)
- [pvCNN: Privacy-Preserving and Verifiable Convolutional Neural Network Testing](https://mlsanity.com/paper/2201.09186/) (2022)
- [zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Training](https://mlsanity.com/paper/2307.16273/) (2023)
- [Zero-Knowledge Proof-based Verifiable Decentralized Machine Learning in Communication Network: A Comprehensive Survey](https://mlsanity.com/paper/2310.14848/) (2023)
- [Proof of Unlearning: Definitions and Instantiation](https://mlsanity.com/paper/2210.11334/) (2022)
- [FairProof : Confidential and Certifiable Fairness for Neural Networks](https://mlsanity.com/paper/2402.12572/) (2024)
- [ezDPS: An Efficient and Zero-Knowledge Machine Learning Inference Pipeline](https://mlsanity.com/paper/2212.05428/) (2022)
- [SVIP: Towards Verifiable Inference of Open-source Large Language Models](https://mlsanity.com/paper/2410.22307/) (2024)
- [Game of Coding: Sybil Resistant Decentralized Machine Learning with Minimal Trust Assumption](https://mlsanity.com/paper/2410.05540/) (2024)
- [Device-Bind Key-Storageless Hardware AI Model IP Protection: A PUF and Permute-Diffusion Encryption-Enabled Approach](https://mlsanity.com/paper/2212.11133/) (2022)
- [Towards Open Federated Learning Platforms: Survey and Vision from Technical and Legal Perspectives](https://mlsanity.com/paper/2307.02140/) (2023)
- [Intellectual Property in Graph-Based Machine Learning as a Service: Attacks and Defenses](https://mlsanity.com/paper/2508.19641/) (2025)
- [Recoverable Privacy-Preserving Image Classification through Noise-like Adversarial Examples](https://mlsanity.com/paper/2310.12707/) (2023)
- [A Framework for Cryptographic Verifiability of End-to-End AI Pipelines](https://mlsanity.com/paper/2503.22573/) (2025)
- [ZKPROV: A Zero-Knowledge Approach to Dataset Provenance for Large Language Models](https://mlsanity.com/paper/2506.20915/) (2025)
- [Game of Coding: Coding Theory in the Presence of Rational Adversaries, Motivated by Decentralized Machine Learning](https://mlsanity.com/paper/2601.02313/) (2026)
- [Spatial-Frequency Discriminability for Revealing Adversarial Perturbations](https://mlsanity.com/paper/2305.10856/) (2023)
- [zkDFL: An efficient and privacy-preserving decentralized federated learning with zero-knowledge proof](https://mlsanity.com/paper/2312.04579/) (2023)
- [VeriSplit: Secure and Practical Offloading of Machine Learning Inferences across IoT Devices](https://mlsanity.com/paper/2406.00586/) (2024)
- [VeriLoRA: Fine-Tuning Large Language Models with Verifiable Security via Zero-Knowledge Proofs](https://mlsanity.com/paper/2508.21393/) (2025)
- [mathsfVISTA: Decentralized Machine Learning in Adversary Dominated Environments](https://mlsanity.com/paper/2605.07841/) (2026)
- [A Generative Framework for Low-Cost Result Validation of Machine Learning-as-a-Service Inference](https://mlsanity.com/paper/2304.00083/) (2023)
- [Privacy-Preserving UCB Decision Process Verification via zk-SNARKs](https://mlsanity.com/paper/2404.12186/) (2024)
- [SoK: Verifiable Cross-Silo FL](https://mlsanity.com/paper/2410.09124/) (2024)
- [Privacy-Preserving Verifiable Neural Network Inference Service](https://mlsanity.com/paper/2411.07468/) (2024)
- [Agree on the Model, Verify the Inference: GKR Protocols for HND-Based Transformer Inference](https://mlsanity.com/paper/2607.21162/) (2026)

## Abstract (arXiv)

Machine Learning as a Service (MLaaS) allows clients with limited resources to outsource their expensive ML tasks to powerful servers. Despite the huge benefits, current MLaaS solutions still lack strong assurances on: 1) service correctness (i.e., whether the MLaaS works as expected); 2) trustworthy accounting (i.e., whether the bill for the MLaaS resource consumption is correctly accounted); 3) fair payment (i.e., whether a client gets the entire MLaaS result before making the payment). Without these assurances, unfaithful service providers can return improperly-executed ML task results or partially trained ML models while asking for over-claimed rewards. Moreover, it is hard to argue for wide adoption of MLaaS to both the client and the service provider, especially in the open market without a trusted third party. In this paper, we present VeriML, a novel and efficient framework to bring integrity assurances and fair payments to MLaaS. With VeriML, clients can be assured that ML tasks are correctly executed on an untrusted server and the resource consumption claimed by the service provider equals to the actual workload. We strategically use succinct non-interactive arguments of knowledge (SNARK) on randomly-selected iterations during the ML training phase for efficiency with tunable probabilistic assurance. We also develop multiple ML-specific optimizations to the arithmetic circuit required by SNARK. Our system implements six common algorithms: linear regression, logistic regression, neural network, support vector machine, Kmeans and decision tree. The experimental results have validated the practical performance of VeriML.