PAC to the Future: Zero-Knowledge Proofs of PAC Private Systems

Abstract: Privacy concerns in machine learning systems have grown significantly with the increasing reliance on sensitive user data for training large-scale models. This paper introduces a novel framework combining Probably Approximately Correct (PAC) Privacy with zero-knowledge proofs (ZKPs) to provide verifiable privacy guarantees in trustless computing environments. Our approach addresses the limitations of traditional privacy-preserving techniques by enabling users to verify both the correctness of computations and the proper application of privacy-preserving noise, particularly in cloud-based systems. We leverage non-interactive ZKP schemes to generate proofs that attest to the correct implementation of PAC privacy mechanisms while maintaining the confidentiality of proprietary systems. Our results demonstrate the feasibility of achieving verifiable PAC privacy in outsourced computation, offering a practical solution for maintaining trust in privacy-preserving machine learning and database systems while ensuring computational integrity.

• The paper introduces the first zero-knowledge framework for verifying that PAC-private noise is correctly computed and applied, using transparent, non-interactive zk-STARKs in RISC Zero.
• The framework implements PAC-private K-means, SVM, and database statistics while preserving fixed circuit structure, with proof-generation costs scaling approximately affinely in samples, clusters, dimensions, and database size.
• The results demonstrate predictable feasibility on small datasets, but fixed-iteration approximations, semi-honest verifier assumptions, missing proof-size and wall-clock measurements, and limited scalability remain important deployment constraints.

Motivation and problem statement

Outsourced computation on sensitive data presents a dual trust problem: a client must trust that a server computes results correctly, and that any promised privacy mechanism is actually applied. Existing verifiable-privacy work has concentrated on differential privacy (DP), e.g., VerDP for private queries (Sevilla-Escoboza et al., 2015) and Confidential-DPproof for DP-SGD training (Gong et al., 2023), together with certified probabilistic mechanisms (Allcock et al., 2024). The paper argues that DP-centric approaches inherit DP's known utility degradation at scale, whereas Probably Approximately Correct (PAC) Privacy (Hussain et al., 2023) determines, from black-box access to the mechanism alone, the minimal noise needed to bound the mutual information $MI(X;\mathcal{M}(X)+\mathcal{B}) \le \beta$. The gap addressed here is that no prior framework provides zero-knowledge proofs attesting that PAC-private noise has been correctly computed and applied.

Framework design

The construction rests on two deterministic functions amenable to circuit-based proving:

• $f_h$ (noise determination): given data points $x_1,\dots,x_m$, the prover runs the anisotropic noise-generation algorithm of Sridhar et al. (Tekdir, 2024) inside a ZK circuit, producing a Gaussian covariance matrix $\Sigma$, and outputs only $h(\Sigma)$ for a public collision-resistant hash $h$. The matrix itself remains private; the proof $\pi$ attests it was computed soundly.
• $f_{PAC}$ (noisy release): with private inputs $x$ and a Gaussian seed $s$, and public input $f_h$0, the prover asserts $f_h$1 in-circuit, deterministically derives noise from $f_h$2 — via Cholesky decomposition so that $f_h$3 with $f_h$4 — and outputs $f_h$5 with a proof of correct computation.

The privacy guarantee follows from Theorem 1 of (Tekdir, 2024): Gaussian noise with covariance $f_h$6 satisfies the mutual-information bound, and for reasonable mechanisms the required noise scales as $f_h$7 in $f_h$8 norm, i.e., proportionally to $f_h$9.

Threat model: the prover (server) is malicious; the verifier (client) is semi-honest, with verifier-supplied randomness deemed sufficient under Fiat-Shamir-style assumptions. This is an explicit assumption: a fully malicious verifier setting would require additional care around randomness generation within the circuit.

The scheme uses non-interactive zk-STARKs (transparent, hash-based, post-quantum plausibly secure, no trusted setup), instantiated in RISC Zero rather than zk-SNARKs, which are rejected for their trusted-setup requirements and elliptic-curve cryptography.

Mechanism instantiations

Three mechanisms are implemented inside the zkVM, each requiring adaptations forced by the fixed-circuit model (execution traces must be input-independent):

• K-means: initial centroids are taken as the first $x_1,\dots,x_m$0 input points rather than random draws; cluster assignments use fixed-size lists of (point, bool) pairs so group sizes remain constant regardless of actual membership; iteration counts are fixed rather than run-to-convergence; and centroids are canonicalized by class inference (lexicographic sorting failed in high dimensions).
• SVM: minimal structural changes, but all models $x_1,\dots,x_m$1 used for noise estimation are normalized ($x_1,\dots,x_m$2, $x_1,\dots,x_m$3) since hyperplanes are scale-invariant.
• Database statistics: queries of the form "function of Attribute with filter $x_1,\dots,x_m$4" over a private database, where filters are encoded as fixed-size vectors of interval bounds per attribute to satisfy circuit constraints. Random filters for noise generation are drawn uniformly per coordinate span; the authors note decision-tree-derived filters as an unexplored alternative.

Experimental evaluation

All experiments run in RISC Zero on small datasets, measuring simulated RISC-V cycle counts (machine-independent). Key observations:

Mechanism	Scaling behavior
K-means	Perfectly affine in number of samples $x_1,\dots,x_m$5, in $x_1,\dots,x_m$6, and in dimension $x_1,\dots,x_m$7
SVM	Approximately affine in $x_1,\dots,x_m$8, with fluctuations attributed to cache behavior
Database statistics	Affine in database size across $x_1,\dots,x_m$9

For K-means with $\Sigma$0 and 1000-point databases, cycles grow linearly from roughly 78k (1 sample) to about 291k (15 samples). Varying $\Sigma$1 from 2 to 10 yields cycle counts ranging from ~135M to ~1.2B depending on iterations and dimension. Once noise parameters are generated, executing the PAC version costs essentially the same as a single-sample run. The affine scaling is expected given the deterministic loop structure, but it also confirms that proof overhead scales predictably rather than pathologically. All experiments are limited to small datasets, so the claimed feasibility applies to small-to-medium applications only.

Limitations and open questions

The paper concedes several constraints plainly. First, NIZK overhead bounds the complexity of mechanisms expressible in the zkVM; large-scale ML training is not demonstrated. Second, the fixed-circuit requirement forces approximations — fixed iteration counts instead of convergence checks, deterministic pseudo-random initialization instead of true randomness — whose effect on model quality relative to standard K-means/SVM is not quantified beyond qualitative claims of near-plaintext utility. Third, the semi-honest verifier assumption leaves fully malicious-verifier security unresolved. Fourth, filter generation for database statistics is ad hoc (uniform coordinate sampling); whether learned or tree-based filter distributions yield tighter noise (smaller $\Sigma$2) is left open. Finally, no end-to-end wall-clock timings or proof sizes are reported, making deployment cost comparisons against VerDP-style DP systems difficult.

Conclusion

This paper formulates the first ZKP framework attesting correct computation and application of PAC Privacy noise, using transparent, non-interactive zk-STARKs in RISC Zero across K-means, SVM, and statistical database queries. Its contribution is primarily architectural: showing that PAC's black-box noise determination can be embedded in arithmetical circuits despite determinism constraints, with provably affine proof-generation cost in the relevant parameters. Whether the approach extends to larger models and adversarial verifiers remains open.