Consortium forVerified Computing

K-0024

Cryptographic commitment

A way to fix a value now without revealing it, so that it can later be opened and shown not to have changed.

Source reviewed 2026-09-25

01 / The mechanism and its boundary

What is being described

A cryptographic commitment lets a party fix a value now while keeping it hidden, and later reveal it with assurance that it has not changed S-1606.

A commitment must keep the value hidden until it is opened S-1606, and it must be binding: hard to open in more than one way S-1607. A Merkle hash tree commits to many items with one root hash, and any single item can later be opened with a proof whose size grows only logarithmically with the number of items S-1607. Its binding property reduces to the collision resistance of the hash function, meaning that finding two inputs with the same output is computationally infeasible S-1607 S-1600. In AI verification, commitments fix evidence before anyone checks it:

  • Traffic. The Oxford Martin report describes networking hardware and enclosures that make commitments about all traffic S-0004, and in one design taps send out hashes of captured traffic while the prover keeps the plaintext S-0018, as in network taps and certifiers.
  • Weights. In zero-knowledge proofs of inference the prover commits to its weights once and proves each output against that commitment S-0023.
  • Training. A proposed zero-knowledge scheme combines a pre-committed training specification with Merkle commitments to intermediate computation S-0025, as in zero-knowledge proofs of training constraints.
  • Audits. In one scheme the prover commits to sampled weights at each training step before it learns whether that step will be audited, so that it cannot fabricate consistent records afterwards S-0017.

Connections in the research map

Related research

mechanism / R1

Chip registries and manufacturing records

Recording each AI chip's identity and owner from the fab onwards, and cryptographically fixing manufacturing records, so that chips can be accounted for later.

mechanism / R2

Confidential multi-party verification

Lets mutually distrusting parties run an agreed check over private models or records inside attested enclaves or zero-knowledge proofs, revealing only the result.

mechanism / R3

Model identity attestation

Establishes that responses come from a specific, committed set of model weights, using enclave measurements or recomputation of sampled outputs.

mechanism / R1

Network taps and certifiers

Devices on a cluster's network links that copy and hash all traffic, so a verifier can later check sampled records against declared work.

mechanism / R2

Safeguard attestation

Hardware-signed evidence that an AI service ran its declared safeguards, such as a guardrail classifier or monitor, when producing a given response.

mechanism / R3

TEE remote attestation for AI workloads

Trusted execution environments (TEEs) in CPUs and GPUs sign reports of loaded software, so a remote party can check which code ran an AI workload.

mechanism / R2

Zero-knowledge proofs of inference

A prover produces a cryptographic proof that an output came from running a committed model on a given input, without revealing the weights.

implementation / R2

Attestable Audits

A research prototype that runs AI safety benchmarks inside a trusted execution environment and publishes attestations binding the model, the audit and the results.

implementation / R1

Attestable zero-knowledge inference prover

Attestable's zero-knowledge prover, which the company reports proves large language model outputs came from committed weights at tens of tokens per second.

implementation / R2

EZKL

EZKL is a library from Zkonduit that turns neural networks into zero-knowledge circuits, so a prover can show an output came from a committed model.

implementation / R3

Pearl proof-of-useful-work blockchain

A blockchain whose mining is designed to be a by-product of GPU matrix multiplications in AI workloads, with public node and miner code.

implementation / R3

Tinfoil model identity (Modelwrap)

Tinfoil's method for proving which model weights its enclave-hosted inference service runs, by binding a dm-verity hash of the weights into remote attestation.

implementation / R3

TOPLOC

TOPLOC is a hashing scheme from Prime Intellect that lets a verifier check whether an inference provider ran the model, prompt and precision it claims.

implementation / R2

zkLLM

zkLLM is a GPU-accelerated zero-knowledge proof system that proves a large language model's output came from committed weights without revealing those weights.

Sources and provenance

  1. S-1606 / Tier B

    ZKProof Community Reference ↗

    D. Benarroch, L. Brandão, M. Maller, E. Tromer · 2022 · ZKProof

    Supports: ideal commitment: value kept hidden, later retrieved with assurance it did not change

    Locator: §2.1.1, p. 19

    Version and catalogue details
  2. S-1607 / Tier A

    Proofs of Space ↗

    S. Dziembowski, S. Faust, V. Kolmogorov, K. Pietrzak · 2015 · CRYPTO 2015 (IACR Cryptology ePrint Archive 2013/796)

    Supports: hash-tree commitment to N items with N−1 hash invocations; opening one item with L log N bits; binding property reduces to collision resistance

    Locator: §5 (hash trees)

    Version and catalogue details
  3. S-1600 / Tier A

    NIST Computer Security Resource Center (CSRC) Glossary ↗

    National Institute of Standards and Technology · 2026 · NIST Computer Security Resource Center

    Supports: collision resistance of approved hash functions

    Locator: term: hash_function (FIPS 203/204/205)

    Version and catalogue details
  4. S-0004 / Tier B

    Verification for International AI Governance ↗

    B. Harack, R. F. Trager, A. Reuel, D. Manheim, M. Brundage, O. Aarne, A. Scher, Y. Pan, J. Xiao, K. Loke, S. N. Adan, G. Bas, N. A. Caputo, J. C. Morse, J. Ahuja, I. Duan, J. Egan, B. Bucknall, B. Rosen, R. Araujo, V. Boulanin, R. Lall, F. Barez, S. Alvira, C. Katzke, A. Atamli, A. Awad · 2025 · Oxford Martin AI Governance Initiative

    Supports: networking hardware and enclosures making cryptographic commitments about all traffic

    Locator: p. 13

    Version and catalogue details
  5. S-0018 / Tier B

    A System Overview for Near-Term, Low-Trust AI Compute Verification ↗

    N. Cankaya · 2026 · Machine Intelligence Research Institute

    Supports: taps send out hashes of captured traffic while the prover keeps the plaintext

    Locator: §3.2.1

    Version and catalogue details
  6. S-0023 / Tier A

    zkLLM: Zero Knowledge Proofs for Large Language Models ↗

    H. Sun, J. Li, H. Zhang · 2024 · 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS 2024)

    Supports: one-time commitment to model weights, then per-query proofs against it

    Locator: §3; §8, Table 1

    Version and catalogue details
  7. S-0025 / Tier B

    Zero knowledge verification for frontier AI training is possible ↗

    P. Peigné, K. Nguyen, P. Wang · 2026 · arXiv

    Supports: pre-committed training specification and Merkle commitments of intermediate computation

    Locator: abstract

    Version and catalogue details
  8. S-0017 / Tier C

    Example Schemes for Verifying High-Stakes AI Agreements ↗

    Amodo Design · 2026 · Amodo Design

    Supports: prover commits a hash of sampled weights before it learns whether a step will be audited

    Locator: pre-training scheme

    Version and catalogue details
Source review date
2026-09-25
Drafted by (source map)
ai
Review handles (source map)
codex-review