It is becoming important for the client to be able to check whether the AI inference services have been correctly calculated. Since the weight values in a CNN model are assets of service providers, the client should be able to check the correctness of the result without them. The Zero-knowledge Succinct Non-interactive Argument of Knowledge (zk-SNARK) allows verifying the result without input and weight values. However, the proving time in zk-SNARK is too slow to be applied to real AI applications. This article proposes a new efficient verifiable convolutional neural network (vCNN) framework that greatly accelerates the proving performance. We introduce a new efficient relation representation for convolution equations, reducing the proving complexity of convolution from O(ln) to O(l+n) compared to existing zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) approaches, where l and n denote the size of the kernel and the data in CNNs. Experimental results show that the proposed vCNN improves proving performance by 20-fold for a simple MNIST and 18,000-fold for VGG16. The security of the proposed scheme is formally proven.

Image is a visual representation of a certain fact and can be used as proof of events. As the utilization of the image increases, it is required to prove its authenticity with the protection of its sensitive personal information. In this paper, we propose a new efficient verifiable image redacting scheme based on zk-SNARKs, a commitment, and a digital signature scheme. We adopt a commit-and-prove SNARK scheme which takes commitments as inputs, in which the authenticity can be quickly verified outside the circuit. We also specify relations between the original and redacted images to guarantee the redacting correctness. Our experimental results show that the proposed scheme is superior to the existing works in terms of the key size and proving time without sacrificing the other parameters. The security of the proposed scheme is proven formally.

In a surveillance system, the privacy becomes important since those who are not relevant to an event may be recorded by many surveillance systems. On the other hand, the authenticity of video frames in surveillance systems should be guaranteed if a video is used as evidence. Hence a signature is attached for each frame. However, it is contradictory to provide both privacy and authenticity of a video since the privacy requires deletion of objects in an original video image while the authenticity disallows any modification of the original image. This paper devises a new novel privacy aware secure signature scheme for the surveillance system. In the proposed scheme, deletion (or masking) of objects in an image is allowed while a signature still remains valid for the modified image. The proposed scheme utilizes a chameleon hash so that deletion of objects in an image does not invalidate the signature. The proposed scheme provides forward security minimizing the damage from the secret key exposure. The deletion is executed in an authorized way. Experimental results show that the proposed scheme is practical in a real-time video surveillance system due to the high performance of signature generation (40ms per frame) and a small signature size overhead (1%).