🔢 mathematics

Privacy-Preserving Proof of Human Authorship via Zero-Knowledge Process Attestation

This paper introduces ZK-PoP, a privacy-preserving framework that utilizes zero-knowledge proofs to verify human authorship through behavioral biometrics and content evolution without revealing sensitive underlying data, thereby resolving the conflict between process attestation and GDPR compliance.

Original authors: David Condrey

Published 2026-03-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: David Condrey

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Problem: The "AI vs. Human" Identity Crisis

Imagine a world where Artificial Intelligence (AI) can write essays, stories, and reports so perfectly that even experts can't tell them apart from human writing. We are facing a crisis: How do we prove a piece of text was written by a human and not a robot?

Usually, we look at the final product (the essay). But AI is getting too good at mimicking human style. So, researchers proposed looking at the process instead.

The Idea: Humans type with a specific rhythm, make specific typos, pause to think, and edit their work. AI just "spits out" text instantly without those human "fidgets."
The Catch: To prove you are human, you have to show the verifier your typing speed, your pauses, and your editing habits. But this data is super sensitive. It can reveal if you have Parkinson's, if you are stressed, or even identify who you are. It's like asking someone to prove they are a real person by showing their medical records and diary.

The Solution: The "Magic Envelope" (ZK-PoP)

The authors, led by David Condrey, created a system called ZK-PoP (Zero-Knowledge Proof of Process).

Think of it like a Magic Envelope or a Black Box.

The Goal: You want to prove to a teacher (the Verifier) that you wrote your essay yourself, without them seeing your typing speed, your health data, or your draft history.
The Old Way: You hand over your entire typing log. The teacher reads it, confirms you are human, but now they know you have a tremor or that you type very slowly when you are tired.
The ZK-PoP Way: You put all your typing data into a Black Box. Inside the box, a magical computer checks:
- "Did the typing happen at a human pace?"
- "Did the writer pause and edit like a human?"
- "Did the work take the right amount of time?"
The box then spits out a tiny, unbreakable receipt that says only one thing: "YES, this is human." The teacher gets the receipt, but they never see the data inside the box. They don't know your name, your health, or your typing speed. They just know the math checks out.

How Does the Magic Work? (The Three Pillars)

The paper uses three specific "magic tricks" (cryptographic tools) to make this happen:

1. The "Time-Lock" Puzzle (Sequential Work Function)

Imagine a puzzle where you have to solve 100 steps, but you can only do one step at a time. You can't ask 100 friends to help you solve it faster; you have to do it yourself, step-by-step.

In the paper: The system forces the computer to solve a complex math puzzle that takes a specific amount of real-world time (e.g., 30 seconds).
Why it matters: AI can generate text instantly. If the "proof" takes 30 seconds to generate, it proves a human (or a human-controlled process) was involved, because AI can't "fake" the passage of time.

2. The "Fingerprint Range" (Bulletproofs)

Imagine you are trying to prove you are between 5'5" and 6'0" tall without telling the guard your exact height.

In the paper: The system checks if your typing patterns fall within the "normal human range" (like 99.7% of all people).
The Trick: It uses a "Bulletproof" (a type of math proof) to say, "My typing speed is inside this safe zone," without revealing the exact speed. It's like showing a guard a badge that says "I am tall enough to ride the rollercoaster" without showing your ID card.

3. The "Tamper-Proof Seal" (Pedersen Commitments)

Imagine you write a draft, then edit it, then edit it again. You want to prove you didn't just copy-paste the whole thing at the end.

In the paper: Every time you type a letter or delete a word, the system creates a digital "seal" (a commitment).
The Trick: These seals are chained together. If you try to sneak in AI text later, the chain breaks. The system proves the chain is unbroken (meaning you edited it naturally) without showing the actual words you typed.

The Results: Fast, Small, and Private

The authors built a prototype and tested it. Here is what they found:

Speed: For a 1-hour writing session, the system takes about 23 seconds to create the "Magic Receipt."
Size: The receipt is tiny—only 192 bytes (smaller than a tweet).
Verification: A teacher can check the receipt in 8 milliseconds (faster than a human blink).
Accuracy: It correctly identifies humans 94% of the time, even while keeping everything secret.

Why This Matters

This is a huge deal for privacy.

Before: To prove you are human, you had to sacrifice your privacy (showing your typing habits, health, and identity).
Now: You can prove you are human without giving up your secrets. It solves the "Privacy Paradox."

The Bottom Line

ZK-PoP is like a notary public for your brain. It watches you write, checks that you are thinking and typing like a real human, and then hands you a certificate that says "Human Verified." The person checking the certificate never sees your brain, your hands, or your secrets—they just trust the math.

This technology could soon be used in schools, courts, and workplaces to ensure that when someone says "I wrote this," they really did, without forcing them to expose their most private digital fingerprints.

1. Problem Statement

The rise of Large Language Models (LLMs) has created a crisis in authorship verification. Output-level detection is failing as AI-generated text increasingly mimics human distributions. Process attestation offers a solution by verifying the behavioral process of writing (keystroke dynamics, editing patterns, timing) rather than the final text.

However, a fundamental privacy paradox exists:

The Conflict: To prove human authorship, a system must collect sensitive behavioral biometrics (e.g., inter-keystroke intervals).
The Risk: This data reveals intimate details about an author's medical conditions (e.g., Parkinson's), cognitive state, emotional stress, and identity. Under GDPR Article 9, this constitutes "special category" sensitive data.
The Question: Can we verify that a writing session is consistent with human authorship without revealing the underlying raw behavioral data, exact timestamps, or intermediate document states?

2. Methodology: ZK-PoP

The authors propose ZK-PoP, a construction that uses Zero-Knowledge Proofs (ZK) to resolve this paradox. The system allows a prover (author) to convince a verifier that their writing session satisfies specific human-consistency constraints without disclosing the witness (raw data).

Core Architecture

The system operates on a sequence of checkpoints generated during a writing session. For each checkpoint, the author generates a Groth16 proof. The circuit enforces four main constraints:

Sequential Work Function (SWF) Verification (C1):
- Ensures the time elapsed is real and not parallelized.
- Uses an Argon2id seed fed into a SHA-256 chain.
- Optimization: Instead of verifying the entire SHA-256 chain inside the ZK circuit (which is too expensive), the system uses Merkle sampling. The prover commits to the SHA-256 states using a Poseidon Merkle tree (efficient in-circuit) and proves the inclusion of $k$ randomly sampled positions. This reduces the constraint count from $O(N)$ to $O(k)$ .
Behavioral Range Verification (C2):
- Verifies that behavioral feature vectors (e.g., keystroke entropy) fall within the statistical distribution of the human population (e.g., within $3\sigma$ of the mean).
- Uses Pedersen Commitments to hide the raw values and Bulletproofs to prove the values lie within the specific range without revealing the values themselves.
Temporal Consistency (C3):
- Proves that timestamps are monotonically increasing and that gaps between checkpoints meet a minimum duration ( $d_{min}$ ).
- Achieved via homomorphic properties of Pedersen commitments and Bulletproof range proofs on the difference between timestamps, rather than the timestamps themselves.
Content Binding (C4):
- Ensures the document state evolves consistently with human editing (revision cycles) rather than linear transcription.
- Binds the content hash to the checkpoint via a hash chain.

Privacy Guarantees

Behavioral Privacy: The verifier learns nothing about the specific keystroke intervals or cognitive load.
Temporal Privacy: Exact session start/end times and intermediate pauses are hidden; only the claimed duration is revealed.
Content Privacy: Intermediate drafts and edit operations are hidden; only the final content hash is public.
Unlinkability: Different sessions cannot be linked to the same author because proofs use fresh randomness and session-specific nonces.

3. Key Contributions

Formal Privacy-Attestation Tradeoff: The paper establishes an information-theoretic lower bound on leakage, proving that a sound attestation scheme must leak at least $1 - h(\alpha)$ bits (where $\alpha$ is the false acceptance rate). ZK-PoP achieves near-optimal leakage (1 bit per decision).
ZK-PoP Construction: A novel integration of Groth16 (for the main circuit), Pedersen Commitments (for hiding), and Bulletproofs (for range proofs) tailored for continuous behavioral streams.
Merkle-Sampled Verification: A technique to verify long sequential work chains (SHA-256) efficiently within a ZK circuit by sampling via a Poseidon Merkle tree, reducing constraints by orders of magnitude.
Differential Privacy (DP) Integration: While individual proofs are zero-knowledge, the paper proposes using the Gaussian mechanism to release aggregate population statistics (for calibration) with formal $(\epsilon, \delta)$ -DP guarantees.
Implementation & Evaluation: A full implementation in Rust using the arkworks library.

4. Results and Evaluation

The system was evaluated on an Apple M3 processor with synthetic and real-world typing datasets.

Performance:
- Proof Generation: ~23.4 seconds for a 1-hour writing session (120 checkpoints).
- Proof Size: Constant at 192 bytes (3 group elements).
- Verification: Extremely fast at 8.2 ms for a single proof; batch verification scales efficiently.
- Circuit Size: The basic circuit requires ~77,000 R1CS constraints, comparable to existing ZK applications like ZK-KYC.
Accuracy vs. Privacy:
- Baseline Accuracy: 97.1% (non-private).
- ZK-PoP Accuracy: 94.2% (with $\epsilon=1.0$ DP noise).
- Loss: A marginal 2.9% accuracy loss due to field arithmetic discretization and DP noise, which is considered acceptable for the privacy gain.
Security:
- Forgery Resistance: The combination of memory-hard SWF chains and behavioral constraints makes it computationally infeasible for an adversary to forge a valid proof without performing the actual sequential work and exhibiting human-like behavior.
- Replay Attacks: Prevented by binding proofs to unique session nonces and SWF roots.

5. Significance

Solving the GDPR Paradox: ZK-PoP enables the use of behavioral biometrics for authorship verification in compliance with strict regulations (GDPR Article 9) by ensuring no sensitive biometric data is ever transmitted or stored in plaintext.
Scalability: By optimizing the circuit size through Merkle sampling and efficient range proofs, the system makes continuous process attestation feasible on consumer hardware.
Future of Authentication: It shifts the paradigm from "trust the platform" (TEE/SGX) or "reveal all data" to "cryptographic proof of behavior," offering a robust defense against AI-generated content while preserving user privacy.

The paper concludes that ZK-PoP is a practical, secure, and privacy-preserving solution for the emerging crisis of AI authorship, with future work focusing on real-world adversarial testing and post-quantum migration.