# OVIG: Optimistic Verification of AI Training Integrity via Gradient Signals

arXiv: https://arxiv.org/abs/2606.21045 · HTML: https://mlsanity.com/paper/2606.21045/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 25 of its 58 references that are in the map.
- First posted on arXiv 19 Jun 2026.

## Builds on (most cited first, 25 of 25)

- [BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding](https://mlsanity.com/paper/1810.04805/) (2018)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Entangled Watermarks as a Defense against Model Extraction](https://mlsanity.com/paper/2002.12200/) (2020)
- [LLM Dataset Inference: Did you train on my dataset?](https://mlsanity.com/paper/2406.06443/) (2024)
- [Proof-of-Learning: Definitions and Practice](https://mlsanity.com/paper/2103.05633/) (2021)
- [Artificial Intelligence Index Report 2025](https://mlsanity.com/paper/2504.07139/) (2025)
- [Handcrafted Backdoors in Deep Neural Networks](https://mlsanity.com/paper/2106.04690/) (2021)
- [Randomness In Neural Network Training: Characterizing The Impact of Tooling](https://mlsanity.com/paper/2106.11872/) (2021)
- [Watermarking Makes Language Models Radioactive](https://mlsanity.com/paper/2402.14904/) (2024)
- [Mind the box: l1-APGD for sparse adversarial attacks on image classifiers](https://mlsanity.com/paper/2103.01208/) (2021)
- [Towards Training Reproducible Deep Learning Models](https://mlsanity.com/paper/2202.02326/) (2022)
- [Tools for Verifying Neural Models' Training Data](https://mlsanity.com/paper/2307.00682/) (2023)
- [opML: Optimistic Machine Learning on Blockchain](https://mlsanity.com/paper/2401.17555/) (2024)
- [zkDL: Efficient Zero-Knowledge Proofs of Deep Learning Training](https://mlsanity.com/paper/2307.16273/) (2023)
- [Proof-of-Learning is Currently More Broken Than You Think](https://mlsanity.com/paper/2208.03567/) (2022)
- [A scalable verification solution for blockchains](https://mlsanity.com/paper/1908.04756/) (2019)
- [Laminator: Verifiable ML Property Cards using Hardware-assisted Attestations](https://mlsanity.com/paper/2406.17548/) (2024)
- [Optimistic Verifiable Training by Controlling Hardware Nondeterminism](https://mlsanity.com/paper/2403.09603/) (2024)
- [Casper the Friendly Finality Gadget](https://mlsanity.com/paper/1710.09437/) (2017)
- [It Takes Two: A Peer-Prediction Solution for Blockchain Verifier's Dilemma](https://mlsanity.com/paper/2406.01794/) (2024)
- [vTune: Verifiable Fine-Tuning for LLMs Through Backdooring](https://mlsanity.com/paper/2411.06611/) (2024)
- [Specular: Towards Secure, Trust-minimized Optimistic Blockchain Execution](https://mlsanity.com/paper/2212.05219/) (2022)
- [Towards Understanding and Enhancing Security of Proof-of-Training for DNN Model Ownership Verification](https://mlsanity.com/paper/2410.04397/) (2024)
- [SoK: Understanding zk-SNARKs: The Gap Between Research and Practice](https://mlsanity.com/paper/2502.02387/) (2025)
- [Backdoor Detection through Replicated Execution of Outsourced Training](https://mlsanity.com/paper/2504.00170/) (2025)

## Abstract (arXiv)

The rapid growth of AI has increased the demand for domain-specific models. Post-training of open-source models offers a more economical way to meet this growing demand, but the cost of accelerator infrastructure often pushes organizations to outsource the process to third-party providers. An untrusted provider may deviate from the declared training procedure to save computation or inject malicious behavior. A potential solution is to audit the training by having an independent verifier replay the training and compare the results. This faces two key challenges: benign numerical drift from floating-point computation across heterogeneous accelerators is difficult to distinguish from malicious deviations, and the checkpoints and metadata required for verification introduce substantial storage and transmission costs. Existing approaches either have security limitations or high deployment costs. We present OVIG, an optimistic verification framework that verifies training using an empirical boundary on gradient differences calibrated from honest heterogeneous replay. Gradient differences that exceed this boundary are treated as malicious deviations. OVIG further uses optimistic verification and partitions training into stride-s intervals, retaining evidence only at interval endpoints to reduce storage and transmission costs. Across shortcut training attacks and adaptive targeted manipulation attacks, OVIG maintains (0%) ASR on language, vision, and diffusion workloads. On Qwen3, increasing the stride from (s=1) to (s=2000) reduces off-chain storage and evidence transmission by (1996×) while preserving (0%) ASR and only adds (14.3%) system computation overhead relative to unverified training.