# ZKROWNN: Zero Knowledge Right of Ownership for Neural Networks

arXiv: https://arxiv.org/abs/2309.06779 · HTML: https://mlsanity.com/paper/2309.06779/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 10 of its 25 references that are in the map.
- First posted on arXiv 13 Sep 2023.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 10 of 10)

- [Megatron-LM: Training Multi-Billion Parameter Language Models Using Model Parallelism](https://mlsanity.com/paper/1909.08053/) (2019)
- [This Looks Like That: Deep Learning for Interpretable Image Recognition](https://mlsanity.com/paper/1806.10574/) (2018)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Recent Trends in Deep Learning Based Natural Language Processing](https://mlsanity.com/paper/1708.02709/) (2017)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [A survey of deep neural network watermarking techniques](https://mlsanity.com/paper/2103.09274/) (2021)
- [Model Watermarking for Image Processing Networks](https://mlsanity.com/paper/2002.11088/) (2020)
- [Digital Watermarking for Deep Neural Networks](https://mlsanity.com/paper/1802.02601/) (2018)
- [DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks](https://mlsanity.com/paper/1804.03648/) (2018)
- [When Face Recognition Meets with Deep Learning: an Evaluation of Convolutional Neural Networks for Face Recognition](https://mlsanity.com/paper/1504.02351/) (2015)

## Built on by (most cited first, 6 of 6)

- [Zero-Knowledge Proof-based Verifiable Decentralized Machine Learning in Communication Network: A Comprehensive Survey](https://mlsanity.com/paper/2310.14848/) (2023)
- [Watermarking Large Language Models and the Generated Content: Opportunities and Challenges](https://mlsanity.com/paper/2410.19096/) (2024)
- [Optimizing Privacy-Preserving Primitives to Support LLM-Scale Applications](https://mlsanity.com/paper/2509.25072/) (2025)
- [ZK-WAGON: Imperceptible Watermark for Image Generation Models using ZK-SNARKs](https://mlsanity.com/paper/2510.01967/) (2025)
- [Robust and Secure Code Watermarking for Large Language Models via ML/Crypto Codesign](https://mlsanity.com/paper/2502.02068/) (2025)
- [Internalising the Identity Primitive: Cryptographic Individuality for an Autonomous Agent on a Public Blockchain](https://mlsanity.com/paper/2608.02986/) (2026)

## Abstract (arXiv)

Training contemporary AI models requires investment in procuring learning data and computing resources, making the models intellectual property of the owners. Popular model watermarking solutions rely on key input triggers for detection; the keys have to be kept private to prevent discovery, forging, and removal of the hidden signatures. We present ZKROWNN, the first automated end-to-end framework utilizing Zero-Knowledge Proofs (ZKP) that enable an entity to validate their ownership of a model, while preserving the privacy of the watermarks. ZKROWNN permits a third party client to verify model ownership in less than a second, requiring as little as a few KBs of communication.