VeriDP: Verifiable Differentially Private Training
Authors: Behzad Abdolmaleki (University of Sheffield), Amir R. Asadi (University of Cambridge), Vahid R. Asadi (University of Waterloo), Stefan Köpsell (Barkhausen Institut), Bhavish Mohee (University of Sheffield), Nahid Roustaeifar (University of Sheffield), Maryam Zarezadeh (Barkhausen Institut)
Volume: 2026
Issue: 3
Pages: 48–64
DOI: https://doi.org/10.56553/popets-2026-0070
Abstract: Stochastic Gradient Descent (SGD) is the foundation of modern machine learning (ML). In privacy-sensitive settings, gradients can reveal details about individual data points. Differential Privacy (DP) protects sensitive data during ML training by clipping gradients and adding calibrated Gaussian noise. However, existing frameworks assume semi-honest participants, which fails in adversarial or federated environments where malicious actors can bypass or alter the noise addition process, breaking privacy guarantees. We present VeriDP, a framework for verifiable differentially private training that cryptographically enforces and proves the correct execution of differentially private stochastic gradient descent (DP-SGD) in zero knowledge. VeriDP integrates Zero-Knowledge Proofs (ZKPs) with polynomial commitments, sumcheck and GKR-based proofs, and incrementally verifiable computation (IVC) to generate compact proofs of correct gradient computation, clipping, averaging, and Gaussian noise generation—without revealing private data or randomness. Unlike previous systems that only verify the final privacy budget, VeriDP enables per-iteration verifiability of each model update, providing strong privacy assurances even in adversarial settings. This establishes a novel and complete Zero-Knowledge Proof of Differentially Private Stochastic Gradient Descent (ZK-DPSGD), uniting differential privacy and verifiable computation for secure and auditable ML. Our evaluation shows that prover time increases linearly with the number of input samples, while both verifier time (2–5 ms) and proof size (3–4 KB) remain compact and effectively constant.
Keywords: Zero-Knowledge Proof, Differential Privacy, Verifiable Machine Learning, Stochastic Gradient Descent
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
