BackGround
Machine learning has become increasingly prominent and is widely used in various applications in practice. Despite its great success, the integrity of machine learning predictions and accuracy is a rising concern. The reproducibility of machine learning models that are claimed to achieve high accuracy remains challenging, and the correctness and consistency of machine learning predictions in real products lack any security guarantees.
1 Traditional proofs
Example1, Prover wants to prove that there exists value of y such that y 5 + y2 + 7 = 0 .To prove it, prover can send this value like y = n to Verifier. Verifier can check equation satisfied. If prover lying: will be caught by Verifier.
Example2, Prover wants to prove that N is a product of exactly two primes. To prove it, prover can send these primes p, q to Verifier. Verifier verifies that p, q are primes and N = pq. If prover lying, he will be caught by Verifier.
We can see the main problem of traditional proofs is when prover convinces the verifier, he also revealed his secret of the question. Like the exact value of y in example1 or what exactly p and q is in example2.
So, Can prover convince the verifier without revealing his secret? Prover’s main task is convince the verifier “I know the answer! But on earth what the answer is ,I don’t want to tell you~”
2 Zero Knowledge Proofs
Zero Knowledge Proofs is used to proving an assertion (statement) without leaking anything. When Verifier is convinced, he still doesn’t learn the value of y. Sounds cool, but how can verifier check without the right value of y?
2.1 Two Key Properties of Zero Knowledge Proofs
“Zero-Knowledge” Verifiers learns nothing “new” from the interaction except that the
statement is true.
“Soundness” If statement false, no matter what proof π* prover cooks up, verifier
should detect the lie with high probability.
Note: To achieve Zero Knowledge Proofs, sometimes prover and verifier have to “talk” in multiple rounds.
Here is a simple example of Zero Knowledge Proofs. Assuming that you meet a Magician, he said “You have N hairs, but I can’t tell you how many it is, I just want you know that I know it!”, how can you believe or verify him? Easy, go behind a door, randomly take out eigher 0 or 1 hairs, come back and ask him again. Then he may say “Now still N” or “Now N-1”, and you can repeat it 100 times until you totally believe him.
2.2 Graph 3-Coloring Problem
Graph 3-coloring: given a graph G, 3 colors (R, G, B), assign a color to every vertex, If two vertices share an edge, their colors should be different.
Graph 3-Coloring Problem is a very hard problem to solve, there is no good algorithms to color vertices, almost every algorithmic problem of interest can be reduced to graph 3-coloring.
So now, if a prover and a verifier have a graph. Prover knows a 3 coloring, he can send it to verifier: if verifier checks every edge, of course he can verify if the prover is right, but this reveals the entire coloring to verifier!
We can apply Zero Knowledge Proofs to solve this problem. Overall, given a 3-coloring of graph, there are 6 colorings that can be obtained by permuting the 3 color names (3! colorings) If we exchange R and B, the coloring still remains a valid 3-coloring. So prover blind all the nodes with a locked box, Verifier picks an edge at random and asks to open the boxes at both ends of the edge. And verifier can check if the the two ends are different, if they are different, verifier accepts.
Every time, after verifier picks an edge and checked, prover randomly chooses one of the 6 colorings obtainable from the secret coloring. As above, prover repeats with independent permutations, If all iterations accept, verifier finally admits!
Let’s check the soundness: If graph not 3-colorable, at least one edge has same color, 1/m chance of catching. If repeat cm times, Probability of fooling the Verifier for all cm, challenges = (1 - 1/m)^cm < (1/e)^c, taking c=100, this is very small.
So, that is how zero-knowledge proofs works in Graph 3-Coloring Problem. A good fact is: Everything provable is provable in zero-knowledge!