💻 computer science

Hermes Seal: Zero-Knowledge Assurance for Autonomous Vehicle Communications

This paper introduces Hermes Seal, a zk-SNARK-based framework that enables autonomous vehicles to generate privacy-preserving cryptographic proofs for verifiable V2V and V2I communications without revealing proprietary models or sensor data, achieving real-time performance with 8 ms proof generation and 1 ms verification.

Original authors: Munawar Hasan, Apostol Vassilev, Edward Griffor, Thoshitha Gamage

Published 2026-03-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Munawar Hasan, Apostol Vassilev, Edward Griffor, Thoshitha Gamage

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are driving a self-driving car through a busy city. Suddenly, your car needs to make a split-second decision: Should I brake?

Usually, your car relies on its own eyes (cameras and lasers) to see the road. But what if a tall building blocks your view? You might miss a cyclist running a red light. To stay safe, your car needs to "talk" to other cars nearby to ask, "Hey, do you see anything I'm missing?"

Here's the problem: If your car asks for help, the other car might say, "Yes, there's a cyclist!" But how do you know they aren't lying? Maybe they are a hacker trying to make you slam on your brakes for no reason. Or maybe they are a rival car company trying to steal your secret "brain" (their AI software) by forcing you to share your raw data in exchange for their help.

Enter "Hermes' Seal."

Think of Hermes' Seal as a magical, unbreakable notary stamp that a self-driving car can slap onto its messages. It allows cars to say, "I promise I see a cyclist, and I promise I followed all the safety rules to figure that out," without showing you their secret camera footage or revealing how their AI brain works.

Here is how it works, broken down into simple concepts:

1. The "Magic Envelope" (Zero-Knowledge Proofs)

Imagine you have a secret recipe for the world's best cookie. You want to prove to a judge that you baked a perfect cookie, but you don't want to show them the recipe or the ingredients.

Normally, you'd have to hand over the whole kitchen for inspection. But with Hermes' Seal, you put the cookie in a special magic envelope. You shake the envelope, and it makes a specific sound that only a perfect cookie makes. The judge hears the sound, checks a magic list of rules, and says, "Okay, I'm 100% sure you baked a perfect cookie, but I still don't know your secret recipe."

In the paper, this "magic envelope" is called a Zero-Knowledge Proof (ZKP). It proves the math is right without showing the data.

2. The "Traffic Cop" (The Enforcing Authority)

Who decides what a "perfect cookie" looks like? Who sets the safety rules?

In the real world, we have the NHTSA (the US traffic safety police). In this paper, they are called the Enforcing Authority (EA).

The EA writes the rulebook: "If you see a stop sign, you must be at least 25 meters away before stopping."
The EA gives every car a special stamp (a cryptographic key) that only works if the car follows those exact rules.
The EA never sees the cars' private data; they just set the rules and hand out the stamps.

3. Two Real-World Examples

The paper tested this idea with two specific scenarios:

Scenario A: The "Safe Stop" Proof

The Situation: A car is approaching a stop sign. It needs to prove to the car behind it that it is stopping safely.
The Old Way: The car would have to broadcast its exact speed, GPS location, and camera images. This is a privacy nightmare.
The Hermes Way: The car uses the magic envelope to prove: "I am currently 30 meters away, and my math says I can stop safely." The car behind checks the envelope, sees the "Safe" stamp, and relaxes. The car behind never sees the speed or the camera feed.

Scenario B: The "Honest Test" (Model Auditing)

The Situation: A government wants to check if a car's AI is smart enough to spot pedestrians. Usually, the car has to send its AI software to a government server to be tested. This is like asking a chef to send their entire restaurant kitchen to the government for inspection.
The Hermes Way: The government sends a "test menu" (a set of tricky images). The car runs the test on its own computer. Instead of sending the results, it sends a magic proof that says: "I got 99% of the pedestrians right, and I didn't cheat." The government verifies the proof instantly. The car keeps its secret recipe safe, but the government knows it's doing a good job.

4. Why is this so fast? (The "GPU" Magic)

You might think, "Wait, doing all this math sounds slow! If my car takes 10 seconds to check a proof, I'll crash!"

The paper tested this on powerful computer chips (GPUs, the same ones used for gaming). They found that:

Creating the proof takes about 8 milliseconds (faster than a human blink).
Checking the proof takes 1 millisecond.

This is fast enough for a car driving at 60 mph. It's like having a super-fast librarian who can check a book's authenticity in the time it takes to blink.

The Big Picture

Hermes' Seal solves the "Trust vs. Privacy" paradox in self-driving cars.

Without it: Cars either don't talk to each other (unsafe) or they share all their secrets (unsafe for business and privacy).
With it: Cars can cooperate like a team, proving they are following the rules and seeing the dangers, all while keeping their secret sauces and private data locked away.

It's like a world where everyone can vouch for their honesty without ever having to show their ID cards or tell their life stories. Just a quick, magical "Seal" that says, "Trust me, I did the math."

1. Problem Statement

Autonomous Vehicles (AVs) rely on Cooperative Perception (V2X) to overcome physical limitations like occlusions and blind spots by sharing sensor data with other vehicles and infrastructure. However, this broadcast model faces two critical, conflicting challenges:

Trust and Verification: Receiving vehicles cannot verify if the broadcasted perception data (e.g., "obstacle detected at X coordinates") is accurate or if it complies with safety regulations without re-running the sender's entire AI model, which is computationally infeasible.
Privacy and Intellectual Property (IP): AV manufacturers are unwilling to share raw sensor data or proprietary AI model weights (the "black box") with competitors or auditors, as this would leak trade secrets.

Current solutions either require sharing sensitive data (violating privacy) or rely on unverified trust (violating safety). There is a lack of a mechanism that allows AVs to cryptographically prove their perception outputs are correct and compliant with safety policies without revealing the underlying data or model.

2. Methodology: Hermes' Seal Framework

The authors propose Hermes' Seal, a framework utilizing zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) to enable privacy-preserving, verifiable communication.

Core Architecture

The system operates on a Model-Agnostic principle, acting as a cryptographic wrapper around the AV's perception stack. It involves three main entities:

Enforcing Authority (EA): A trusted third party (e.g., NHTSA, SAE) that defines safety policies (constraints) and generates the cryptographic keys.
Prover (P): The AV. It runs its perception model, generates a "witness" (internal state), and creates a zk-SNARK proof that its output satisfies the EA's constraints.
Verifier (V): Any receiving entity (other AVs, RSUs, auditors) that verifies the proof using a public key without needing to see the private data.

Technical Workflow

Setup: The EA defines a set of logical constraints ( $L$ ) (e.g., "Safe stopping distance must be maintained"). These are compiled into an arithmetic circuit (using Circom) and transformed into a Rank-1 Constraint System (R1CS).
Key Generation: Using a universal setup file (Powers of Tau), the EA generates a Proving Key ($pk$) for manufacturers and a Verification Key ($vk$) for the public.
Proof Generation (Prover):
- The AV processes sensor data.
- It separates data into Public Inputs ( $X$ ) (e.g., object location, timestamp) and Private Inputs ( $W$ ) (e.g., raw sensor data, model weights, exact speed).
- It generates a Witness satisfying the circuit constraints.
- It generates a zk-SNARK proof ( $\pi$ ) using the Groth16 protocol (chosen for its small proof size and constant-time verification).
- The proof is signed with the vehicle's digital signature to ensure non-repudiation.
Verification (Verifier): The verifier checks the digital signature and then validates the zk-SNARK proof against the public inputs and the verification key. If valid, the data is accepted as truth.

Key Design Features

Quantization: Since zk-SNARKs operate over finite fields ( $F_p$ ) while AVs use floating-point numbers, the framework employs a scaling function to convert real numbers to integers without losing necessary precision.
Domain Separation: To prevent replay attacks or context confusion (e.g., using a "brake" proof for a "lane change" scenario), a 4-byte domain separator is embedded in the proof.
Inference-Level Verification: The framework verifies specific inference outputs (e.g., "Is the distance safe?") rather than the entire neural network, balancing security with the strict latency requirements of AVs.

3. Key Contributions

Hermes' Seal Framework: A novel, modular framework enabling verifiable information exchange in AVs that conceals proprietary models and raw sensor data.
Two Real-World Case Studies:
- Case I (Perception Integrity): Proving a vehicle maintains a safe stopping distance (based on the RSS model) from a stop sign without revealing its speed or exact location.
- Case II (Semantic Interoperability/Model Auditing): Proving a perception model meets specific Precision/Recall benchmarks on a challenge dataset without revealing the model's bounding boxes or weights.
Performance Optimization: Demonstration that the framework is feasible for real-time AV applications through hardware acceleration (GPU).
Open Source Implementation: The authors released the code on GitHub, facilitating reproducibility and further research.

4. Experimental Results

The framework was evaluated on three platforms: SnarkJS (JavaScript/CPU), Rapidsnark (C++/CPU), and Rapidsnark-GPU (C++/GPU).

Performance Gains:
- Proof Generation: On a GPU, proof generation took 5 ms (vs. 300 ms on SnarkJS), representing a 60x speedup.
- Proof Verification: On a GPU, verification took 1 ms (vs. 233 ms on SnarkJS), representing a 233x speedup.
- Witness Generation: Reduced from 69 ms (SnarkJS) to 3 ms (GPU).
Case Study Results:
- Perception Integrity: Successfully generated proofs for safe distance calculations in real-time.
- Model Auditing: Successfully verified model performance against a challenge set (5 images, 20 ground truths). The system correctly identified a "fail" when a safety-critical object was missed, demonstrating the logic's correctness.
Conclusion on Feasibility: The results confirm that with GPU acceleration, zk-SNARKs can meet the millisecond-level latency requirements of autonomous driving, making them viable for V2X communication.

5. Significance and Impact

Trust without Transparency: Hermes' Seal solves the "trust paradox" in AVs. It allows regulators and other vehicles to trust that an AV is operating safely and compliantly without forcing the manufacturer to reveal their "secret sauce" (IP).
Regulatory Compliance: Provides a mathematical mechanism for authorities to audit AV fleets for safety compliance (e.g., "Did this car detect the pedestrian?") without invasive inspections.
Scalable Interoperability: By decoupling the verification logic from the specific AI model architecture, it enables heterogeneous fleets (e.g., Tesla vs. Waymo) to communicate and trust each other's data.
Foundation for Future Ecosystems: The paper lays the groundwork for "Proof of Execution" (integrating Trusted Execution Environments) and privacy-preserving leaderboards for AI model benchmarking, potentially revolutionizing how autonomous systems are regulated and traded.

In summary, Hermes' Seal bridges the gap between the need for rigorous safety verification in autonomous driving and the necessity of protecting proprietary intellectual property, using advanced cryptography to create a trustworthy, privacy-preserving, and real-time cooperative perception network.