# PoLO: Proof-of-Learning and Proof-of-Ownership at Once with Chained Watermarking

arXiv: https://arxiv.org/abs/2505.12296 · HTML: https://mlsanity.com/paper/2505.12296/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 33 of its 66 references that are in the map.
- First posted on arXiv 18 May 2025.

## Builds on (most cited first, 30 of 33)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Wide Residual Networks](https://mlsanity.com/paper/1605.07146/) (2016)
- [Convolutional Neural Networks for Sentence Classification](https://mlsanity.com/paper/1408.5882/) (2014)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [A Survey on Distributed Machine Learning](https://mlsanity.com/paper/1912.09789/) (2019)
- [On the Necessity of Auditable Algorithmic Definitions for Machine Unlearning](https://mlsanity.com/paper/2110.11891/) (2021)
- [A Survey of Text Watermarking in the Era of Large Language Models](https://mlsanity.com/paper/2312.07913/) (2023)
- [Proof-of-Learning: Definitions and Practice](https://mlsanity.com/paper/2103.05633/) (2021)
- [DVMark: A Deep Multiscale Framework for Video Watermarking](https://mlsanity.com/paper/2104.12734/) (2021)
- [REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data](https://mlsanity.com/paper/1911.07205/) (2019)
- [Detecting Voice Cloning Attacks via Timbre Watermarking](https://mlsanity.com/paper/2312.03410/) (2023)
- [Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution](https://mlsanity.com/paper/2405.04825/) (2024)
- [FedIPR: Ownership Verification for Federated Deep Neural Network Models](https://mlsanity.com/paper/2109.13236/) (2021)
- [PromptCARE: Prompt Copyright Protection by Watermark Injection and Verification](https://mlsanity.com/paper/2308.02816/) (2023)
- [FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Model](https://mlsanity.com/paper/2211.07160/) (2022)
- [UnMarker: A Universal Attack on Defensive Image Watermarking](https://mlsanity.com/paper/2405.08363/) (2024)
- ["Adversarial Examples" for Proof-of-Learning](https://mlsanity.com/paper/2108.09454/) (2021)
- [Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscation](https://mlsanity.com/paper/2303.09732/) (2023)
- [Gradient Leakage Attack Resilient Deep Learning](https://mlsanity.com/paper/2112.13178/) (2021)
- [IronForge: An Open, Secure, Fair, Decentralized Federated Learning](https://mlsanity.com/paper/2301.04006/) (2023)
- [Moderating Model Marketplaces: Platform Governance Puzzles for AI Intermediaries](https://mlsanity.com/paper/2311.12573/) (2023)
- [Golden Grain: Building a Secure and Decentralized Model Marketplace for MLaaS](https://mlsanity.com/paper/2011.06458/) (2020)
- [Dataset Ownership Verification in Contrastive Pre-trained Models](https://mlsanity.com/paper/2502.07276/) (2025)
- [DeepEclipse: How to Break White-Box DNN-Watermarking Schemes](https://mlsanity.com/paper/2403.03590/) (2024)
- [Secure Watermark for Deep Neural Networks with Multi-task Learning](https://mlsanity.com/paper/2103.10021/) (2021)
- [Split Unlearning](https://mlsanity.com/paper/2308.10422/) (2023)
- [Is Your AI Truly Yours? Leveraging Blockchain for Copyrights, Provenance, and Lineage](https://mlsanity.com/paper/2404.06077/) (2024)
- [Proof-of-Learning with Incentive Security](https://mlsanity.com/paper/2404.09005/) (2024)

## Abstract (arXiv)

Our evaluation shows that PoLO achieves 99% watermark detection accuracy for ownership verification, while preserving data privacy and cutting verification costs to just 1.5--10% of traditional methods. Forging PoLO demands 1.1--4× more resources than honest proof generation, with the original proof retaining over 90% detection accuracy even after attacks.