{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "K-0024",
    "slug": "cryptographic-commitment",
    "title": "Cryptographic commitment",
    "aliases": [
      "commitment scheme",
      "hash commitment"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [],
    "flags": [],
    "one_liner": "A way to fix a value now without revealing it, so that it can later be opened and shown not to have changed.",
    "sources": [
      {
        "source": "S-1606",
        "supports": "ideal commitment: value kept hidden, later retrieved with assurance it did not change",
        "locator": "§2.1.1, p. 19"
      },
      {
        "source": "S-1607",
        "supports": "hash-tree commitment to N items with N−1 hash invocations; opening one item with L log N bits; binding property reduces to collision resistance",
        "locator": "§5 (hash trees)"
      },
      {
        "source": "S-1600",
        "supports": "collision resistance of approved hash functions",
        "locator": "term: hash_function (FIPS 203/204/205)"
      },
      {
        "source": "S-0004",
        "supports": "networking hardware and enclosures making cryptographic commitments about all traffic",
        "locator": "p. 13"
      },
      {
        "source": "S-0018",
        "supports": "taps produce signed hashes instead of transmitting plaintext",
        "locator": "evidence capture"
      },
      {
        "source": "S-0023",
        "supports": "one-time commitment to model weights, then per-query proofs against it",
        "locator": "§3; §8, Table 1"
      },
      {
        "source": "S-0025",
        "supports": "pre-committed training specification and Merkle commitments of intermediate computation",
        "locator": "abstract"
      },
      {
        "source": "S-0017",
        "supports": "prover commits a hash of sampled weights before it learns whether a step will be audited",
        "locator": "pre-training scheme"
      }
    ],
    "related": [
      "K-0010",
      "K-0019",
      "K-0014",
      "K-0020"
    ],
    "type": "concept",
    "url": "https://trustbutveri.fyi/concepts/cryptographic-commitment/",
    "source_file": "content/concepts/cryptographic-commitment.md",
    "flags_all": [
      "ai-drafted"
    ],
    "body_markdown": "A cryptographic commitment lets a party fix a value now while keeping it hidden, and later reveal it with assurance that it has not changed [[S-1606]].\n\nA commitment must keep the value hidden until it is opened [[S-1606]], and it must be binding: hard to open in more than one way [[S-1607]]. A Merkle hash tree commits to many items with one root hash, and any single item can later be opened with a proof whose size grows only logarithmically with the number of items [[S-1607]]. Its binding property reduces to the collision resistance of the hash function, meaning that finding two inputs with the same output is computationally infeasible [[S-1607]] [[S-1600]]. In AI verification, commitments fix evidence before anyone checks it:\n- **Traffic.** The Oxford Martin report describes networking hardware and enclosures that make commitments about all traffic [[S-0004]], and tap designs produce signed hashes instead of transmitting plaintext [[S-0018]], as in [[M-0013|network taps and certifiers]].\n- **Weights.** In [[M-0004|zero-knowledge proofs of inference]] the prover commits to its weights once and proves each output against that commitment [[S-0023]].\n- **Training.** A proposed zero-knowledge scheme combines a pre-committed training specification with Merkle commitments to intermediate computation [[S-0025]], as in [[M-0005|zero-knowledge proofs of training constraints]].\n- **Audits.** In one scheme the prover commits to sampled weights at each training step before it learns whether that step will be audited, so that it cannot fabricate consistent records afterwards [[S-0017]].",
    "body_text": "A cryptographic commitment lets a party fix a value now while keeping it hidden, and later reveal it with assurance that it has not changed [S-1606]. A commitment must keep the value hidden until it is opened [S-1606], and it must be binding: hard to open in more than one way [S-1607]. A Merkle hash tree commits to many items with one root hash, and any single item can later be opened with a proof whose size grows only logarithmically with the number of items [S-1607]. Its binding property reduces to the collision resistance of the hash function, meaning that finding two inputs with the same output is computationally infeasible [S-1607] [S-1600]. In AI verification, commitments fix evidence before anyone checks it: - Traffic. The Oxford Martin report describes networking hardware and enclosures that make commitments about all traffic [S-0004], and tap designs produce signed hashes instead of transmitting plaintext [S-0018], as in network taps and certifiers. - Weights. In zero-knowledge proofs of inference the prover commits to its weights once and proves each output against that commitment [S-0023]. - Training. A proposed zero-knowledge scheme combines a pre-committed training specification with Merkle commitments to intermediate computation [S-0025], as in zero-knowledge proofs of training constraints. - Audits. In one scheme the prover commits to sampled weights at each training step before it learns whether that step will be audited, so that it cannot fabricate consistent records afterwards [S-0017].",
    "referenced_by": [
      {
        "id": "M-0024",
        "title": "Bounding unexplained information in outputs",
        "url": "https://trustbutveri.fyi/mechanisms/bounding-unexplained-information/"
      },
      {
        "id": "M-0019",
        "title": "Chip registries and manufacturing records",
        "url": "https://trustbutveri.fyi/mechanisms/chip-registries-and-manufacturing-records/"
      },
      {
        "id": "M-0025",
        "title": "Confidential multi-party verification",
        "url": "https://trustbutveri.fyi/mechanisms/confidential-multi-party-verification/"
      },
      {
        "id": "M-0012",
        "title": "Model identity attestation",
        "url": "https://trustbutveri.fyi/mechanisms/model-identity-attestation/"
      },
      {
        "id": "M-0013",
        "title": "Network taps and certifiers",
        "url": "https://trustbutveri.fyi/mechanisms/network-taps-and-certifiers/"
      },
      {
        "id": "M-0023",
        "title": "Safeguard attestation",
        "url": "https://trustbutveri.fyi/mechanisms/safeguard-attestation/"
      },
      {
        "id": "M-0008",
        "title": "TEE remote attestation for AI workloads",
        "url": "https://trustbutveri.fyi/mechanisms/tee-remote-attestation/"
      },
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "M-0005",
        "title": "Zero-knowledge proofs of training constraints",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-training-constraints/"
      },
      {
        "id": "I-0007",
        "title": "Attestable Audits",
        "url": "https://trustbutveri.fyi/implementations/attestable-audits/"
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0012",
        "title": "Low-trust AI compute verification system overview",
        "url": "https://trustbutveri.fyi/implementations/low-trust-compute-verification-system-overview/"
      },
      {
        "id": "I-0004",
        "title": "Pearl proof-of-useful-work blockchain",
        "url": "https://trustbutveri.fyi/implementations/pearl-proof-of-useful-work/"
      },
      {
        "id": "I-0006",
        "title": "Tinfoil model identity (Modelwrap)",
        "url": "https://trustbutveri.fyi/implementations/tinfoil-model-identity/"
      },
      {
        "id": "I-0001",
        "title": "TOPLOC",
        "url": "https://trustbutveri.fyi/implementations/toploc/"
      },
      {
        "id": "I-0003",
        "title": "zkLLM",
        "url": "https://trustbutveri.fyi/implementations/zkllm/"
      },
      {
        "id": "C-0007",
        "title": "A training run stayed within declared limits",
        "url": "https://trustbutveri.fyi/claims/training-within-declared-limits/"
      },
      {
        "id": "K-0019",
        "title": "Evidence binding",
        "url": "https://trustbutveri.fyi/concepts/evidence-binding/"
      },
      {
        "id": "K-0014",
        "title": "Network tap",
        "url": "https://trustbutveri.fyi/concepts/network-tap/"
      },
      {
        "id": "K-0012",
        "title": "Proof of space",
        "url": "https://trustbutveri.fyi/concepts/proof-of-space/"
      },
      {
        "id": "K-0009",
        "title": "Recomputation",
        "url": "https://trustbutveri.fyi/concepts/recomputation/"
      },
      {
        "id": "K-0020",
        "title": "Sampling and assurance",
        "url": "https://trustbutveri.fyi/concepts/sampling-and-assurance/"
      },
      {
        "id": "K-0010",
        "title": "Zero-knowledge proof",
        "url": "https://trustbutveri.fyi/concepts/zero-knowledge-proof/"
      }
    ]
  }
}