---
title: Proof of Ownership Verification
url: https://www.emergentmind.com/topics/proof-of-ownership
type: topic
---

# Proof of Ownership Verification

Proof of ownership denotes a protocol, credential, or statistical test by which a claimant convinces a verifier, challenger, or judge that a disputed object is legitimately tied to that claimant. In the literature, the object of proof ranges from RFID tags and consumer IoT devices to neural-network parameters, training traces, digital tokens, and AI-generated images. The recurring design goals are completeness, soundness or unforgeability, robustness against removal and ambiguity attacks, and, in many settings, public verifiability and privacy preservation. Recent work also separates ordinary ownership claims from stronger origin claims: for latent diffusion models, a seed-bound construction is described as “proof-of-authorship” because only the true generator can legitimately claim the object, whereas time-stamping and watermarking remain proofs of ownership in which being “first” may suffice [2603.17513]. Formal treatments of model ownership similarly cast the problem as an owner–thief–judge game and ask when unremovable ownership proofs exist at all [2606.30423].

## 1. Formal problem statements

Across domains, proof of ownership is usually formalized as an adversarial game. In black-box machine-learning proofs of ownership, the owner applies a marking algorithm to obtain a transformed model and a witness, the thief receives black-box access to the transformed model, and the judge receives only the public parameters, the witness, and oracle access to a suspect model. Security is defined by unremovability: the thief should not be able to output a model that remains similar to the marked model while causing the judge’s tester to reject, except with negligible probability [2606.30423].

In RFID, the closely related notion is proof of possession. The system is modeled as
$$
RS=(Setup, Reader, \{Tag_i\}_i, Auth, PoP),
$$
and the adversary is a PPT algorithm with adaptive access to `Send`, `Corrupt`, and one `TestPoP` query. The PoP security goal requires
$$
Adv^{PoP}_{\mathcal A}(\lambda)=Pr[Exp^{PoP}_{\mathcal A}(1^\lambda)=1]
$$
to be negligible for any PPT adversary, under the additional expectations that `Auth` satisfies completeness, mutual authentication, and untraceability [2210.10244].

Protocol-oriented work on deep neural networks introduces a further institutional layer. In decentralized ownership verification, the principal parties are the owner, a verification community, and an adversary or challenger. The owner first watermarks a clean model locally, then registers a time-stamped commitment
$$
msg_0=\langle time \,\Vert\, H(key)\,\Vert\, H(verify)\,\Vert\, H(info)\rangle
$$
through a consensus protocol, and later reveals
$$
msg_1=\langle M \,\Vert\, key \,\Vert\, verify\rangle
$$
when a suspect model must be tested. The protocol explicitly addresses replay, redeclaration, and “spoil attack” scenarios, and introduces watermark capacity and watermark independence as protocol-level metrics rather than embedding-level properties alone [2108.09065].

These formulations show that proof of ownership is not a single primitive. It can be a property of a signed credential, a watermark witness, a training transcript, or a public statistical decision rule. The shared structure is a separation between honest provenance and forgery under a specified threat model.

## 2. Cryptographic and statistical substrates

The mechanisms used to realize proof of ownership vary widely, but they are usually built from a small set of recurring cryptographic or statistical components.

| Mechanism | Representative use | Source |
|---|---|---|
| PRF-bound randomness | Seed binding with $s=f_i(\kappa)$ or $t=PRF_{k'_i}(c)$ | [2603.17513], [2210.10244] |
| Hash watermark + signatures | $h=H(pk_1\Vert\cdots\Vert pk_K)$ plus `Sign`/`Verify` | [2305.06085] |
| zkSNARK relation | Prove $BER(wm,\hat{wm})\le \theta$ without revealing watermark keys | [2309.06779] |
| Vector commitments | Commitment, opening, aggregation, and update with worker-bound proofs | [2401.05895] |
| Chameleon or irreversible hash | Trapdoor collisions or SHA-512-derived signatures for passports | [2505.24536], [2404.02889] |
| Verifiable credentials | DID-based credentials, revocation, and DIDComm exchange | [2408.17184] |

PRFs and hashes are frequently used to bind a public identity to a hidden or derived value while preserving pseudorandomness. Signatures provide non-repudiation and public auditability. In some constructions, these mechanisms are sufficient by themselves: RFID PoP uses a hash, a PRF, and EU-CMA signatures to produce a credential
$$
cred=(u,\sigma_R,t,\sigma_T)
$$
after successful mutual authentication [2210.10244]. In others, they are paired with watermark extraction or model behavior. FedSOV compresses all clients’ public keys into a fixed-length hash watermark and then requires the claimant to produce a valid digital signature under the corresponding private key, thereby ruling out ambiguity attacks under standard assumptions [2305.06085].

A second family replaces explicit credentials with succinct proofs of knowledge. ZKROWNN compiles watermark extraction into a Groth16 circuit and proves, non-interactively, that querying the suspect model on a secret trigger set yields an extracted watermark with bit-error rate at most $\theta$. The setup is one-time for a fixed circuit; the resulting proof size is 127 bytes, with verifier time 29.4 ms for the MLP circuit and 1 ms for the CNN circuit [2309.06779].

A third family relies on statistical adjudication rather than direct knowledge proofs. In diffusion-based authorship claims, the verifier computes a similarity statistic and then estimates a tail probability under the null hypothesis of random latent draws. The proof object is therefore not merely a secret string or credential; it is an evidentiary score with a confidence interval and an explicit false-claim probability [2603.17513].

## 3. Generated objects, authorship, and digital provenance

For latent diffusion models, proof of ownership is reformulated as proof of authorship. The central idea is that the author controls the LDM seed and can bind that seed to identity via a cryptographic pseudorandom function. Given generation parameters
$$
\kappa=\langle m,e,r\rangle,
$$
the author computes
$$
s=f_i(\kappa), \qquad S=G(s)\sim\mathcal D_0, \qquad J=L_m(e,S).
$$
The public release is $(i,\kappa,J)$. During a dispute, the probabilistic adjudicator recomputes the latent, encodes both the regenerated image and the contested image, and evaluates
$$
T=Sim(\mathcal L_J,t(\mathcal L_I)).
$$
It then estimates
$$
q=P_{S'\sim \mathcal D_0}[Sim(\mathcal L_J,L_m(e,S'))\ge T]
$$
by Monte Carlo. Under Assumption A2, Theorem 4.1 gives additive error $\alpha$ with confidence $1-\delta$ using
$$
n=O(\ln^2(1/\alpha)\ln(1/\delta))
$$
samples, and authorship is accepted when the upper confidence bound falls below a threshold such as $2^{-50}$ [2603.17513].

This framework is notable for two reasons. First, it explicitly distinguishes proof-of-authorship from time-stamping and watermarking: only the generator who controlled the seed can mount the successful claim. Second, the framework “does not involve any secret”; the binding is public, the pseudorandomness is public-keyed by the author’s public identifier, and security rests on PRF indistinguishability plus the adjudicator’s statistical test [2603.17513]. The same paper analyzes random forgers, malicious forgers, malicious model providers, colluding adjudicators, $\ell_p$ perturbations, and mild affine transforms, and states that no PPT adversary can forge or remove the linkage with more than negligible probability.

A very different lineage appears in distributed-ledger ownership of digital property. In NFT-style systems, a transaction is a tuple
$$
\delta=(t,o_{prev},o_{new},m,\sigma,h_{prev}),
$$
the ledger is a time-ordered list
$$
L=[\delta_1,\delta_2,\ldots,\delta_n],
$$
and the current owner of token $t$ is the `o_new` field in the suffix-most transaction involving $t$. Verification consists of finding the latest transaction for the token, checking the signature and hash linkage, and reading the new-owner field [2206.01566]. Hyperownership preserves this proof primitive and instead augments it with temporal bipartite graphs and hypertext traversal. This suggests two broad models of provenance: source-bound proof, in which the origin process itself yields the evidence, and ledger-bound proof, in which ordered transfer records constitute the evidence.

## 4. Neural-network ownership verification

Neural-network ownership verification has produced several distinct families of schemes. A classical watermarking line uses triggers and extraction tests. In knowledge-free black-box watermarking for image classification, a generator obtained from data-free distillation produces “anchors” that stabilize performance during trigger injection. The owner’s identity key is expanded into a one-way sequence of binary codes, each code is mapped to a trigger image and a pseudorandom label, and verification reveals a contiguous block of codes and applies four checks: trigger consistency, label consistency, model response consistency, and one-way linkage. If `acc` rows pass, the protocol computes
$$
\hat\mu=\frac{acc}{K}, \qquad \hat\sigma=\sqrt{\frac{\hat\mu(1-\hat\mu)}{K}},
$$
and accepts when
$$
\Phi\!\Bigl(\frac{1/C-\hat\mu}{\hat\sigma}\Bigr)\le \tau.
$$
The reported theorems establish accuracy, unambiguity, and identity preservation [2204.04522].

Federated learning adds a multi-owner dimension. FedSOV compresses all clients’ public keys into a fixed-length hash watermark
$$
h=H(pk_1\Vert pk_2\Vert \cdots \Vert pk_K)
$$
and embeds it by regularizing the batch-norm scale parameters:
$$
L_{total}=L_{task}+\alpha\cdot HL(sign(W_\gamma\cdot E),h).
$$
Verification first extracts the watermark and checks its similarity against a security boundary, then challenges a claimant to sign a fresh message with the client’s private key. Theoretical security is tied to q-SDH unforgeability of the signature and near-collision resistance of the hash. Reported results include fidelity drop \(<2\%\) versus FedAvg, watermark detection rate \(r\approx 99\%\) for \(K\) up to 200 clients, \(r>r(n)\approx 82\%\) for \(n=2048\) even after fine-tuning or 80% pruning, signing \(\approx 11\) ms, and verification \(\approx 40\) ms [2305.06085].

Privacy-preserving verification is the focus of ZKROWNN. There, a proof of ownership is a non-interactive zero-knowledge proof that a suspect model, queried on a secret trigger set, yields an extracted watermark with
$$
BER(wm,\hat{wm})\le \theta.
$$
The prover runs `Prove(PK,x,w)` for public statement \(x=(M,\theta)\) and witness \(w=(X^{key},wm,A,\ell_{wm})\), and the verifier runs `Verify(VK,x,\pi)`. Because the circuit is fixed for a given model, the trusted setup is one-time; subsequent proofs are public, non-interactive, and constant-size at 127 B [2309.06779].

Other schemes avoid watermark exposure by using model behavior itself. In the gray-box ownership framework based on white-box adversarial attacks, the owner uses white-box access to the original model to generate an adversarial example \(x_{adv}\) whose output probability for a chosen target class is driven toward a designated value while preserving the original top-1 class. Verification measures
$$
D^{prob}(p,q)=|p-q|/p.
$$
On 100 random ImageNet validation images, with ResNet50-v1 as the owner’s model and ResNet50-v1, ResNet50-v2, and VGG variants as suspects, the reported outcomes are \(TPR\approx 1.0\), \(FPR\approx 0.0\), and average \(SSIM(x,x_{adv})\ge 0.9875\) [2505.17579].

Passport-based schemes bind ownership to affine parameters in normalization layers. “Steganographic Passport” hides a user identity image into an owner-side passport via an invertible steganographic network,
$$
P_u=E_\theta(I_u,P_o), \qquad I_u'=D_\phi(P_u,k_s),
$$
and uses an irreversible, collision-resistant hash function to derive a model signature from the owner passport. Ownership verification combines integrity, fidelity, and sign-agreement tests; the reported tables show zero AD in integrity and resilience under pruning, fine-tuning, and Expanded Residual Block ambiguity attacks [2404.02889]. CHIP replaces the irreversible hash with a discrete-log-based chameleon hash
$$
CH(PK,m,r)=g^r\cdot h^{H_0(m)} \bmod p,
$$
derives owner and user passports plus licensee certificates through trapdoor collisions, and verifies ownership through four tests \(V^F\), \(V^D\), \(V^H\), and \(V^L\). On AlexNet and ResNet-18 over CIFAR-10, CIFAR-100, Caltech-101, and Caltech-256, passport-free and passport-aware accuracies are reported to remain within 0.1–0.3% of clean baselines, while training time increases by \(\approx 3.7\times\) for AlexNet and \(\approx 3.3\times\) for ResNet-18 [2505.24536].

## 5. Training traces, distributed computation, and work-based proof

A separate line treats ownership as evidence of computational effort rather than of an embedded watermark. Proof-of-Learning defines a scheme
$$
PoL=(Gen,Prove,Verify)
$$
in which the prover stores checkpointed model states, batch indices, and data-signature hashes during SGD. Verification decrypts the proof, checks the initialization, identifies the largest inter-checkpoint jumps, and re-executes selected updates. The formal intuition is entropy accumulation in stochastic optimization: for SGD with additive noise,
$$
W_{t+1}=W_t-\eta_t\cdot \nabla_{W_t}\ell(f_{W_t};D[I_t])+z_t,
$$
Theorem 1 states linear entropy growth in forward SGD, Theorem 2 states that reverse entropy is at least forward entropy, and the corollary states that any adversary must perform at least \(\Omega(T)\) work to forge a valid transcript. With \(Q\ll S\), verification is reported to be less than 10% of original training time [2103.05633].

Proof-of-Training refines this idea by asking what distinguishes honest training records from forged ones. The record is a quadruple
$$
\mathcal T_{R,n}=(\mathcal I_A,\mathcal T_A,\mathcal T_T,D),
$$
with trajectory updates
$$
M_{i+1}=M_i+\mathcal T_{A,i}(M_i,D_i)+z_i.
$$
The key claim is a universal distinction criterion: honest records encode enough information about the underlying data distribution that trajectory matching can recover higher-fidelity synthetic data from them than from forged records. The paper models four attacks, proves a mutual-information separation
$$
I(D;\mathcal T_{T,[i:i+k]})>I(D^{(M)};\mathcal T^{(M)}_{T,[i:i+k]}),
$$
and evaluates a verifier that synthesizes data from candidate records and scores it by retraining accuracy. The discrimination degree is
$$
\eta=\frac{\score(S_{honest})}{\max_{forgery}\score(S_{forgery})},
$$
with success iff \(\eta>1\). Reported experiments show zero false accepts, zero false rejects, and end-to-end verification time of \(\sim 10\) min on a single GPU for SDS=500 [2410.04397].

PoLO unifies proof-of-learning and proof-of-ownership through chained watermarking. Training is partitioned into shards, each shard embeds a watermark generated from the hash of the preceding shard, the full chain serves as PoL, and the final watermark serves as PoO. The reported evaluation gives 99% watermark detection accuracy for ownership verification, verification cost at 1.5–10% of traditional methods, forging cost at 1.1–4× honest proof generation, and original proofs retaining over 90% detection accuracy even after attacks [2505.12296].

Distributed training introduces commitment-oriented variants. Binary Linear Tree Commitment–based ownership protection commits to a weight vector
$$
\mathbf W=(w_0,w_1,\ldots,w_{l-1})\in \mathbb Z_p^l,\qquad l=2^n,
$$
supports coordinate openings with proof size \(O(\log l)\), supports updates in \(O(\log l)\), and aggregates many openings via inner-product arguments. Proofs are watermarked by worker identity keys so that stolen proofs cannot be replayed by another worker. For \(l=2^{30}\), the reported benchmarks include 0.44 s total for 1024 commitment updates, 0.94 s total for updating all proofs, and aggregation times that grow linearly with the number of opened positions [2401.05895].

## 6. Decentralization, transfer, and fundamental limits

Operational deployments often require public verifiability, transferability, and revocation. In decentralized DNN ownership verification, the verification community stores time-stamped hashes of the owner’s watermark key and verification algorithm, then later re-executes verification collectively through a consensus protocol. This design is intended to prevent redeclaration and to avoid reliance on a single trusted notary, while introducing “spoil-attack resistance” as an explicit system-level goal [2108.09065].

For consumer IoT devices, ownership proof is carried by self-sovereign identity infrastructure rather than by watermark extraction. The main entities are the manufacturer, distributor, buyers and sellers, a mediator, and a ledger. The manufacturer issues a `ProofOfOwnership` verifiable credential to the first buyer, later revokes it on-chain during transfer, and issues a new credential to the next buyer after DIDComm-based challenge/response. The credential contains the issuer DID, tracking ID, owner DID, status, and an `Ed25519Signature2018` proof; the ledger stores DIDs, schema and credential definitions, and revocation registry entries. In the ProVerif analysis, secrecy and authenticity queries all returned “RESULT is true” [2408.17184].

The strongest general limitation comes from the formal theory of black-box model ownership. Under correlation-intractable hash families for poly-time evasive relations, a family of binary classifiers admits an unremovable black-box proof of ownership if and only if it does not admit a correctable canonicalization, or equivalently is not self-correctable [2606.30423]. The constructive direction marks a classifier on pseudorandomly chosen inputs and tests whether the suspect model reproduces the hidden labels often enough; the impossibility direction shows that a self-corrector would strip the watermark while preserving functionality. This result does not say that all practical ownership schemes fail; rather, it isolates a precise boundary for one black-box notion of proof.

A recurring misconception is that any watermark automatically yields a decisive ownership claim. The surveyed literature is more restrictive. Ambiguity attacks, trigger exposure, watermark overwriting, fine-tuning, pruning, public verification leakage, and malicious infrastructure all require separate treatment. Some schemes answer with signatures, some with zero knowledge, some with statistical tail bounds, some with public ledgers and revocation, and some with work-based transcripts. The modern literature therefore treats proof of ownership not as a single algorithmic trick but as a family of evidentiary systems whose validity depends on the adversarial model, the object being claimed, and the precise meaning of “ownership” in that domain.

Source: https://www.emergentmind.com/topics/proof-of-ownership