Track me if you can: Ephemeral coin tracing

The paper introduces ephemeral coin tracing (ECT), a cryptographic primitive for targeted tracing in privacy-preserving payment systems with cryptographically enforced bounds on surveillance capacity. The authors state: "We introduce ephemeral coin tracing (ECT), a primitive for targeted tracing with cryptographically enforced expiry. The authority initiates a trace by embedding an encrypted identifier in a suspect’s account. After exactly h hops, the tag collapses to zero and becomes indistinguishable from an untraced tag, even to the authority."

The motivation is that existing coin tracing schemes grant authorities unbounded capabilities: "The tracing schemes proposed in the literature, however, grant authorities unbounded capabilities: once initiated, tracing propagates through the transaction graph or persists across all future transactions of a user, and may eventually deanonymize the entire ledger. ECT addresses this by bounding both the number of simultaneously traced users and the number of hops each trace survives: The authority issues tracing tags that degrade at each hop; after a protocol-defined number of hops, a tag collapses into a value indistinguishable from that of an untagged coin. Within a tracing period the bound is absolute: no authority, however motivated, can follow a tag past its budget."

The technical approach uses a nilpotent map on the plaintext ring of an additively homomorphic encryption scheme: "The key conceptual advance in our work is to replace a probabilistic notion of degradation (as in the previous approaches) with an algebraic one... It requires an additively homomorphic encryption scheme whose plaintext ring R contains an element ν that is nilpotent of index h, that is, ν h = 0 but ν h−1 ≠ 0, and for which multiplication of a plaintext by ν is realizable as a public operation on ciphertexts. The paper gives two constructions: one over exponential ElGamal and one over Damgård–Jurik encryption."

For the exponential ElGamal instantiation, the scheme operates "in a cyclic group G = ⟨g⟩ of order q h, where q is prime and the public parameter h is the hop budget. The prime-power order is essential: multiplication by q in the exponent is non-invertible and erases all information after h applications. Degradation is implemented as raising the ciphertext components to the q-th power, changing an encryption of mq t into one of mq t+1. The plaintext map m 7→ qm mod q h is nilpotent: after h applications, q h m ≡ 0 (mod q h)."

For the Damgård–Jurik instantiation, "the plaintext ring is ZN s, the nilpotent element is the modulus N, of index s, and degradation is c 7→ cN; setting s = h reproduces the same decay, with the practical advantage that decryption returns the plaintext integer directly, so tracing is polynomial rather than a bounded discrete-logarithm search, and with semantic security resting on DCR rather than on DDH in a prime-power-order group."

The scheme uses a positional encoding: "User idi receives the plaintext identifier mi = ri−1, for a base r ≥ 2 satisfying rn < q. Thus each identifier occupies one base-r position and the complete encoding fits within one base-q digit. Merging is handled homomorphically: Multiplying ElGamal ciphertexts adds their plaintexts. Within a depth, the base-r representation separates identifiers... Across depths, the base-q representation provides a second layer of separation."

The paper formalizes six security properties: trace correctness, merge correctness, indistinguishability, ephemeral traceability, unforgeability, and unlinkability. Ephemeral traceability is the central guarantee: once a tag has been degraded beyond its hop budget, the authority irrevocably loses the ability to recover the traced identifier, even in possession of sktrace . The paper proves this property holds unconditionally: The argument is information-theoretic; no computational assumption is used.

The efficiency comparison shows: An exponential ElGamal tag contains two elements of G ⊆ Z∗p and therefore occupies 2⌈log2 p⌉ bits... With h = 10 and a 256-bit q, this gives a 0.75 KB tag and an identifier capacity of nmax = 28. For Damgård–Jurik: "A Damgård–Jurik tag is a single element modulo N h+1 and occupies (h + 1)⌈log2 N ⌉ bits. For h = 10 and a 3072-bit modulus this is 4.1 KB, about five and a half times the size of the minimal ElGamal tag. In return, the same modulus gives nmax = 341."

The paper discusses applications including time-bounded regulatory investigation, user-requested protective tracing, and temporary institutional transparency. It also notes a limitation: A central limitation is that ECT is prospective: Trace can recover an identifier only if the authority previously encoded it with b = 1.

The conclusion states: "We have introduced ephemeral coin tracing (ECT), a cryptographic primitive that provides bounded and accountable surveillance in anonymous payment systems. ECT tags degrade algebraically and expire exactly at a predetermined hop budget h, giving the authority no tracing capability beyond this bound."

Improvements to AI Systems:

1. Privacy-Preserving Graph Analytics with Hard Expiry Constraints

• Improvement: Integrate ECT’s nilpotent degradation into AI models that analyze transaction graphs (e.g., fraud detection, money-laundering pattern recognition). Instead of allowing the model to trace indefinitely, the AI’s tracing capability is cryptographically capped at h hops.

• Capability: An AI system can perform targeted investigations (e.g., tracing a suspect’s transactions) while guaranteeing that after h hops, the model’s internal state becomes indistinguishable from random—preventing any future deanonymization, even if the model is later compromised or subpoenaed.

2. Federated Learning with Ephemeral User Identifiers

• Improvement: Use ECT’s positional encoding and homomorphic merging to assign ephemeral, degradable identifiers to users in federated learning. The AI server can aggregate updates (via homomorphic addition) but can only trace a user’s contribution for a limited number of aggregation rounds.

• Capability: A federated learning system can enforce that a user’s data influence vanishes after a fixed number of training rounds, enabling compliance with data deletion regulations (e.g., GDPR’s “right to be forgotten”) without requiring the server to store or delete raw data—just let the tag expire.

3. AI-Driven Regulatory Compliance with Bounded Surveillance

• Improvement: Embed ECT into AI systems that monitor financial transactions for regulatory compliance (e.g., anti-money laundering). The AI can initiate traces on suspicious accounts, but the trace’s hop budget is enforced by the cryptographic primitive, not by policy.

• Capability: The system can prove to auditors that its surveillance capacity is cryptographically bounded—e.g., “no trace can survive more than 10 hops” — making the AI’s behavior auditable and preventing mission creep or unauthorized mass surveillance.

4. Secure Multi-Party Computation (MPC) with Ephemeral Linkability

• Improvement: Replace probabilistic linkability in MPC protocols with ECT’s algebraic degradation. AI models that run over encrypted data (e.g., using Damgård–Jurik) can now support “temporary” linkage between records, where the linkage key collapses after a defined number of operations.

• Capability: An AI system can perform joint analysis across multiple data silos (e.g., hospitals) while ensuring that cross-silo record linkage is only possible for a limited number of queries—after which the linkage becomes cryptographically impossible, even for the AI operator.

5. Self-Expiring AI Memory for Continuous Learning

• Improvement: Use ECT’s nilpotent map to design AI memory modules where stored information (e.g., user embeddings) degrades algebraically after a fixed number of accesses or updates.

• Capability: An AI assistant can “forget” user-specific data after a predetermined number of interactions, providing a provable, cryptographically enforced version of memory decay—useful for privacy-preserving personalization without long-term retention risks.

6. Bounded-Time Model Explanations (XAI)

• Improvement: Apply ECT to explainability tools: when an AI model explains a prediction, the explanation trace (which features contributed to the output) can be encoded with a hop budget. After h steps of backpropagation or feature attribution, the trace collapses.

• Capability: An AI system can provide explanations that are verifiably limited in depth—preventing adversarial probing of the model’s internal decision boundaries beyond a cryptographically enforced threshold, enhancing model security against reverse-engineering.

7. Unlinkable AI Training Data Audits

• Improvement: Use ECT’s unlinkability property to allow AI systems to audit training data provenance without linking multiple records to the same user. The AI can verify that a trace (e.g., a data point’s origin) is valid for a limited number of hops, then becomes unlinkable.

• Capability: An AI system can prove to regulators that it can trace a specific training sample back to its source for at most h steps (e.g., through a data pipeline), after which the link is irreversibly broken—enabling privacy-compliant data provenance without persistent user tracking.

8. Post-Quantum Resilient AI Cryptography

• Improvement: The Damgård–Jurik instantiation (based on DCR) and the ElGamal variant (based on DDH in prime-power groups) can be integrated into AI systems that require quantum-resistant privacy. The nilpotent degradation is algebraic, not probabilistic, so it remains secure against quantum adversaries.

• Capability: An AI system can offer long-term privacy guarantees (e.g., for medical records) where tracing capabilities expire even if the system is later attacked by a quantum computer—since the tag’s collapse is information-theoretic, not computational.

What the improved AI system can do overall:

• Enforce hard, cryptographically provable limits on surveillance, memory, and linkage—replacing soft policy constraints with mathematical guarantees.

• Operate in multi-party settings where data owners require that AI models cannot trace or link data beyond a predefined hop budget.

• Provide auditable, privacy-preserving analytics with built-in expiry, making it suitable for regulated industries (finance, healthcare) and decentralized AI.

Privacy-preserving payment systems are well understood, yet their adoption in regulated settings, such as central bank digital currencies (CBDCs), institutional stablecoins, and other compliant payment infrastructures, has been limited by concerns over their potential misuse for illicit activities. Regulators counter financial crime with a toolbox of complementary measures to identify, trace, and stop criminal actors. Tracing is one key tool: acting on outside evidence that a user is implicated in a crime such as money laundering, law enforcement follows the suspect's funds through the ledger to uncover laundering routes and accomplices. The tracing schemes proposed in the literature, however, grant authorities unbounded capabilities: once initiated, tracing propagates through the transaction graph or persists across all future transactions of a user, and may eventually deanonymize the entire ledger. Only the goodwill of the authority, or the honesty of a committee, keeps surveillance targeted and temporary. We introduce ephemeral coin tracing (ECT), a primitive whose tracing capacity is bounded by construction, both in the number of simultaneously traced users and in the number of hops each trace survives. The authority issues tracing tags that degrade at each hop; after a protocol-defined number of hops, a tag collapses into a value indistinguishable from that of an untagged coin. Within a tracing period the bound is absolute: no authority, however motivated, can follow a tag past its budget. We formalize ECT, define its security and privacy guarantees, and give two constructions, one over exponential ElGamal and one over Damg rd--Jurik encryption.