PANDA Proves Neural Network Robustness Without Revealing Weights

The short version

Youwei Zhong and coauthors built PANDA, a tool that proves a neural network meets a robustness claim without showing its weights. Proofs use zero knowledge math and scale to networks with about 2.9 million parameters. The paper is accepted at NeurIPS 2026 and ships as open code.

What the researchers did

The Yale linked team describes Certified but Private: Scalable Zero-Knowledge Proofs for Neural Network Guarantees in the official PANDA GitHub repo. NeurIPS 2026 acceptance is noted there. Zero knowledge proofs let a verifier learn that a statement is true without seeing secret data.

PANDA starts from CROWN style linear bounds that already check local robustness of neural nets. It wraps those bounds in a proof system so model owners keep weights private. Supported activations include ReLU, sigmoid, and tanh. The demo runs on CPU without a trusted setup ceremony.

Photo: ThisIsEngineering / Pexels

What they found

The README cites example proving and verifying times on a large CPU. One demo pair takes about 22.6 seconds to prove and 0.8 seconds to verify on an EPYC core. Proof size is about 3 megabytes with roughly 1 to 2 gigabytes peak memory. Networks up to 2.9 million parameters are listed as supported.

Tests include the safeNLP medical text robustness set bundled with the repo. Verifiers print success when proofs pass, giving auditors a machine check without weight access.

These numbers are lab measurements, not a promise for every network shape you deploy.

Photo: cottonbro studio / Pexels

Why it matters for you

Blockchain and fintech stacks increasingly call AI models from smart contracts or custody workflows. Zero knowledge proofs let on chain logic trust a robustness statement while weights stay off chain. That pattern fits compliance where model secrecy is contractual.

Protocol engineers can read PANDA as a sample zkML pipeline. It remains research software, not an audited prover service for live funds.

Pin the GitHub release you reviewed. Time prove and verify steps on your own hardware before you promise latency to partners.

What to keep in mind

The repo warns the code is not independently audited for security. Cost still grows with network size and property complexity. NeurIPS acceptance is not a green light for production custody.

This desk does not cover token prices. The story is cryptography for verifiable ML claims.

What a careful reader should do next

Clone the repo on a spare server and run the quick start example. Record prove time and memory on your hardware class. Share those logs with legal before you mention on chain proofs to customers.

Key takeaways

• PANDA proves local neural network robustness while hiding weights.
• NeurIPS 2026 acceptance is stated in the official repository.
• Demo CPU times are on the order of tens of seconds to prove.
• Common activations and multi million parameter models are in scope.
• Treat the release as research, not production finance software.

Sources

• Primary — GitHub, youweizhong/PANDA (2026). Paper title, acceptance note, benchmarks, and timing examples.
• Secondary — NeurIPS acceptance note in repository README (2026). Confirms venue named by authors with the open code drop.