Attack. Two structurally-correct spoofs that defeat the threshold and the top-Q heuristic.

THE SECOND BREAK, and note the author list -- this is largely the ORIGINAL PoL TEAM breaking their own scheme, which is the most honest thing in this file. Two attacks, both cheaper and more robust than the first break. The INFINITESIMAL UPDATE ATTACK simply linearly interpolates the checkpoints between the initialization and the stolen final model, then logs a learning rate of ~0 so that every update is smaller than the verification threshold delta. Reproduced and logged updates are both negligible, so their difference is negligible, so verification passes. Cost: NO TRAINING AT ALL -- one floating-point operation per parameter per step, upper-bounded by a single forward pass, against the previous break's ~31 gradient computations per step. The BLINDFOLD TOP-Q ATTACK defeats the other half of the scheme: make exactly Q genuinely-valid updates per epoch with a large learning rate so they have the largest magnitudes, interpolate everything else, and the verifier's "check the Q biggest updates" heuristic lands on precisely the Q real ones, every time, and never inspects the fakes. It is also a correction of pol-adversarial: that paper's Attack 1 is "not reproducible" (neither team could make it work), and its Attack 2 assumed the attacker controls k and delta, which "should be set by the verifier and is thus out of the attacker's control". So the first break was real but weaker than advertised, and the scheme is worse than either paper thought. THE CONCLUSION IS WHY THIS PAPER IS IN THE SOK: "We conclude that one cannot develop a provably robust PoL verification mechanism without further understanding of optimization in deep learning." And the way out, in their words: "One possible solution to circumvent these fundamental limits in ML theory and our understanding of optimization, is to rely more on cryptography." Both attack papers arrive at the same door. Everything else in this category is what is behind it.

The second break of Proof-of-Learning, and look at the author list. Fang, Jia, Thudi, Yaghini, Choquette-Choo, Dullerud, Chandrasekaran, Papernot.

That is largely the original Proof-of-Learning team, breaking their own scheme. It is the most honest thing in this corpus.

The attacks

Two, both cheaper and far more robust than PoL Adversarial Examples's.

The infinitesimal update attack. Linearly interpolate the checkpoints between the initialization and the stolen final model. Then log a learning rate of approximately zero, so that every update is smaller than the verification threshold $\delta$. The logged update is negligible; the verifier's replayed update is negligible; their difference is therefore negligible; verification passes.

The cost is the punchline: no training at all. One floating-point operation per parameter per step, upper-bounded by a single forward pass, against the previous break's ~31 gradient computations per step.

The blindfold top-Q attack kills the other half of the scheme. Proof-of-Learning verifies the $Q$ largest updates per epoch. So: make exactly $Q$ genuinely-valid updates with a large learning rate, so they have the largest magnitudes by construction, and interpolate everything else. The verifier's top-$Q$ heuristic lands on precisely the $Q$ real updates, every time, and never inspects the fakes.

What it establishes

The two implicit assumptions under Proof-of-Learning, that training is reproducible within $\delta$, and that the largest updates are representative of the run, are both false, and neither was ever stated.

It also corrects the first break, which matters if you were about to cite it: PoL Adversarial Examples's Attack 1 is "not reproducible" (neither team could make it work), and its Attack 2 assumed the attacker sets $k$ and $\delta$, which are the verifier's to choose. So the earlier attacks are "easily thwarted by changing hyperparameters of the verification." These are not.

The conclusion, which is why the paper is here

We conclude that one cannot develop a provably robust PoL verification mechanism without further understanding of optimization in deep learning.

Fang et al. · Abstract

And the way out, in their own words:

"One possible solution to circumvent these fundamental limits in ML theory and our understanding of optimization, is to rely more on cryptography."

Both attack papers arrive at the same door, from opposite directions. The zkPoT cell is what is behind it.

What to distrust, in the good sense

The paper is careful about what it has not shown, and the care is worth inheriting. It does not show that PoL's precedence guarantee is broken: empirically, data-ordering attacks and synthesized adversarial data both fail to reach the target weights from an independent initialization, so knowledge of the final weights appears genuinely essential to a spoofing adversary.

It shows that PoL's guarantee is unproven, not that it is false. That is a distinction the citing literature routinely loses, and it is the same distinction this SoK keeps making about soundness-versus-statement everywhere else.