Verde: Verification via Refereed Delegation for Machine Learning Programs

TL;DR

Verde introduces a cryptographic framework for machine learning program delegation that ensures correctness through dispute arbitration and hardware reproducibility, enabling clients to trust results from untrusted providers.

Contribution

The paper adapts refereed delegation to ML, designing dispute arbitration and reproducible operators to guarantee correctness and reproducibility across hardware.

Findings

Verde's arbitration protocol efficiently handles large-scale ML computations.

ReproOps library ensures bitwise reproducibility across diverse hardware.

Refereed delegation provides strong correctness guarantees with practical overheads.

Abstract

Machine learning programs, such as those performing inference, fine-tuning, and training of LLMs, are commonly delegated to untrusted compute providers. To provide correctness guarantees for the client, we propose adapting the cryptographic notion of refereed delegation to the machine learning setting. This approach enables a computationally limited client to delegate a program to multiple untrusted compute providers, with a guarantee of obtaining the correct result if at least one of them is honest. Refereed delegation of ML programs poses two technical hurdles: (1) an arbitration protocol to resolve disputes when compute providers disagree on the output, and (2) the ability to bitwise reproduce ML programs across different hardware setups, For (1), we design Verde, a dispute arbitration protocol that efficiently handles the large scale and graph-based computational model of modern ML programs. For (2), we build RepOps (Reproducible Operators), a library that eliminates hardware "non-determinism" by controlling the order of floating point operations performed on all hardware. Our implementation shows that refereed delegation achieves both strong guarantees for clients and practical overheads for compute providers.