Privacy-Preserving AI Verification via Minimal Information Disclosure
Sleem Abdelghafar, Gabriel Kulp
cs.CR, cs.AI
Submitted: 2026-08-03
Code: https://github.com/iden3/circom
License: http://creativecommons.org/licenses/by-nc-sa/4.0/
The gist: AI verification crosses a trust boundary: a verifier must learn enough to establish an authorized claim, yet the same evidence can reveal sensitive details about the model, workload, or hardware.
Terminology
Abstract
AI verification crosses a trust boundary: a verifier must learn enough to establish an authorized claim, yet the same evidence can reveal sensitive details about the model, workload, or hardware. We introduce minimal information disclosure (MID), which designs and quantifies the information content of verifier-facing evidence itself. MID measures collateral leakage with conditional mutual information: what the release reveals about the protected property after the authorized result is known. MID is general by design: it can accommodate different verification goals, protected properties, evidence sources, and deployment constraints. To demonstrate MID's practicality, we evaluate it on four physical measurements and six verification tasks spanning execution type, hardware identity, compute scale, and model identity. These experiments use three mechanism-design variables--the evidence channel, collection policy, and release transformation--but MID is not limited to these choices and can accommodate other deployable mechanisms. Across these tasks, MID produces three releases with perfect held-out verification and zero measured collateral leakage, while the remaining tasks yield explicit privacy--utility frontiers. MID also supports ZKP-certified releases: we demonstrate our proposed linear-projection mechanism using a Groth16 zk-SNARK.
Sources
- Hardware-Enabled Mechanisms for Verifying Responsible AI Development
- Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment
- Flexible Hardware-Enabled Guarantees for AI Compute
- Computing Power and the Governance of Artificial Intelligence
- What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring
- Agentic Witnessing: Pragmatic and Scalable TEE-Enabled Privacy-Preserving Auditing
- Mechanisms to Verify International Agreements About AI Development
- Hardware-Level Governance of AI Compute: A Feasibility Taxonomy for Regulatory Compliance and Treaty Verification
- Bit-Exact AI Inference Verification Without Performance Tradeoffs
- DiFR: Inference Verification Despite Nondeterminism
- Verifying LLM Inference to Detect Model Weight Exfiltration
- Beyond Privacy Trade-offs with Structured Transparency
- Verifiable evaluations of machine learning models using zkSNARKs
- PAL*M: Property Attestation for Large Generative Models
- Detecting Hidden ML Training With Zero-Overhead Telemetry
- Timing and Memory Telemetry on GPUs for AI Governance
- ShadowScope: GPU Monitoring and Validation via Composable Side Channel Signals
- Input-Dependent Power Usage in GPUs
- Proposals and challenges for zero-knowledge verification of frontier AI training
- Privacy-Utility Tradeoffs under Constrained Data Release Mechanisms
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills