AI Verification LandscapeSearch

Glossary

Cryptographic commitment

A way to fix a value now without revealing it, so that it can later be opened and shown not to have changed.

A cryptographic commitment lets a party fix a value now while keeping it hidden, and later reveal it with assurance that it has not changed 1.

A commitment must keep the value hidden until it is opened 1, and it must be binding: hard to open in more than one way 2. A Merkle hash tree commits to many items with one root hash, and any single item can later be opened with a proof whose size grows only logarithmically with the number of items 2. Its binding property reduces to the collision resistance of the hash function, meaning that finding two inputs with the same output is computationally infeasible 2 3. In AI verification, commitments fix evidence before anyone checks it:

  • Traffic. The Oxford Martin report describes networking hardware and enclosures that make commitments about all traffic 4, and tap designs produce signed hashes instead of transmitting plaintext 5, as in network taps and certifiers.
  • Weights. In zero-knowledge proofs of inference the prover commits to its weights once and proves each output against that commitment 6.
  • Training. A proposed zero-knowledge scheme combines a pre-committed training specification with Merkle commitments to intermediate computation 7, as in zero-knowledge proofs of training constraints.
  • Audits. In one scheme the prover commits to sampled weights at each training step before it learns whether that step will be audited, so that it cannot fabricate consistent records afterwards 8.

Related

Used in

Sources

  1. BD. Benarroch et al. (2022). ZKProof Community Reference. ZKProof. Source recordSupports: ideal commitment: value kept hidden, later retrieved with assurance it did not change · §2.1.1, p. 19
  2. AS. Dziembowski et al. (2015). Proofs of Space. CRYPTO 2015 (IACR Cryptology ePrint Archive 2013/796). Source recordSupports: hash-tree commitment to N items with N−1 hash invocations; opening one item with L log N bits; binding property reduces to collision resistance · §5 (hash trees)
  3. ANational Institute of Standards and Technology (2026). NIST Computer Security Resource Center (CSRC) Glossary. NIST Computer Security Resource Center. Source recordSupports: collision resistance of approved hash functions · term: hash_function (FIPS 203/204/205)
  4. BB. Harack et al. (2025). Verification for International AI Governance. Oxford Martin AI Governance Initiative. Source recordSupports: networking hardware and enclosures making cryptographic commitments about all traffic · p. 13
  5. BN. Cankaya (2026). A System Overview for Near-Term, Low-Trust AI Compute Verification. Machine Intelligence Research Institute. Source recordSupports: taps produce signed hashes instead of transmitting plaintext · evidence capture
  6. AH. Sun et al. (2024). zkLLM: Zero Knowledge Proofs for Large Language Models. 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS 2024). Source recordSupports: one-time commitment to model weights, then per-query proofs against it · §3; §8, Table 1
  7. BP. Peigné et al. (2026). Zero knowledge verification for frontier AI training is possible. arXiv. Source recordSupports: pre-committed training specification and Merkle commitments of intermediate computation · abstract
  8. CAmodo Design (2026). Example Schemes for Verifying High-Stakes AI Agreements. Amodo Design. Source recordSupports: prover commits a hash of sampled weights before it learns whether a step will be audited · pre-training scheme