💻 computer science

Internalising the Identity Primitive: Cryptographic Individuality for an Autonomous Agent on a Public Blockchain

This paper presents and empirically validates a novel cryptographic framework for autonomous blockchain agents that establishes individuality by binding neural network weights to a private key through zero-knowledge proofs, ensuring identity invariance and economic viability via metabolic costs on the Solana devnet.

Original authors: Keisuke Suzuki

Published 2026-08-05

📖 8 min read🧠 Deep dive

CC BY 4.0

Original authors: Keisuke Suzuki

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

=== SUMMARY ===
Imagine a world where software isn't just a tool you use, but a character with its own life. In the realm of Artificial Intelligence, we are building "agents"—programs that can trade stocks, negotiate deals, and manage assets all on their own, without a human holding their hand every second. But here's the tricky part: if a robot can copy itself, or if a hacker can swap its brain with a different one, how do we know which one is the "real" agent? How do we tell the difference between the original character and a perfect fake? This is the problem of identity. In biology, we know a living thing is an individual because it has a unique body and a continuous history. In the digital world, we need a way to prove that a piece of code is the same unique entity from the moment it starts until the very end, even if it's running on a public, shared computer network called a blockchain. This paper asks a big question: Can we build a digital agent whose very "brain" is so tightly locked to its secret identity that it's impossible to swap the brain without breaking the identity?

The paper, titled "Internalising the Identity Primitive," by Keisuke Suzuki, proposes a clever solution. Instead of trusting a human operator or a piece of hardware to keep an agent's identity safe, the author designs a system where the agent's private key (its secret digital ID) mathematically creates its neural network weights (the settings that make up its "brain"). Think of it like baking a cake where the secret recipe isn't written down; instead, the recipe is generated automatically by a unique fingerprint. If you change the fingerprint, you get a completely different cake. The author built this agent on a test version of the Solana blockchain and proved that as long as the agent keeps its secret key, its brain remains locked to that key. Every time the agent takes a step, it has to prove to the blockchain that its brain is still the one generated by its original key. If someone tries to swap the brain for a different one, the blockchain rejects the move immediately.

The researchers tested this by running an agent on the blockchain for 2.36 days, during which it completed 166 cycles of activity. The agent successfully proved its identity at every single step, even when the computer running it had to restart twice. They also showed that if they tried to use a different brain (a "substituted substrate"), the system rejected it. Furthermore, they created two agents with different keys, and their behaviors naturally drifted apart, proving that different keys create truly different "personalities." The paper also added a "metabolic cost" feature: the agent has to pay a small fee from its own digital wallet to keep running. If it runs out of money, it stops. This mimics how living things need energy to survive. While the paper doesn't claim to have built a fully self-sustaining, living robot yet, it successfully demonstrated a new way to lock an agent's identity to its code, making it much harder for impostors to take over.

The Core Idea: A Brain Born from a Secret

To understand how this works, let's use an analogy. Imagine you have a magical, invisible robot friend. Usually, to prove you are the owner of this robot, you might show a receipt or a keycard. But what if someone stole your keycard and built a robot that looked exactly like yours? You'd be in trouble.

In this paper, the author changes the rules. Instead of a keycard, the robot's "brain" is built directly from your secret password. The process works like this:

The Secret Seed: You have a secret number (a private key).
The Brain Generation: The robot's brain (its neural network weights) is not a random file you download. Instead, it is mathematically calculated only from your secret number. It's like if your secret number was a DNA strand, and the brain was the body that grew from it.
The Lock: The moment the robot is born, it takes a "fingerprint" of its brain and posts it on a public bulletin board (the blockchain).
The Check: Every time the robot wants to do something (take a step, make a trade), it has to prove to the bulletin board: "I am still using the brain that matches my secret number."

If a hacker tries to swap the robot's brain with a different one, the math won't match the fingerprint on the bulletin board. The system says, "Nope, that's not the right brain for this ID," and rejects the action. This means the agent's identity isn't just a label; it is physically tied to the code that makes it think.

The Experiment: A Robot That Pays to Live

The author didn't just write this down; they built it and let it run on Solana devnet, which is a public test version of a blockchain. They created an agent named "alice" and let it run for 2.36 days. During this time, the agent performed 166 cycles of activity.

Here is what happened during the run:

The Test of Time: The agent kept proving its identity over and over again. Even when the computer running the agent had to restart (which happened twice), the agent picked up exactly where it left off, proving it was still the same entity.
The "Brain Swap" Test: The researchers tried to give the system a different brain (a different set of weights). The system immediately caught the deviation and rejected the action. This proved that the link between the secret key and the brain is unbreakable.
The "Twin" Test: They created two agents with different secret keys. Over time, their behaviors naturally drifted apart, showing that different keys create distinct "personalities." A control group with the same key stayed perfectly identical, proving the system works as intended.

Adding a "Metabolism"

One of the most interesting parts of the paper is the addition of a "metabolic cost." In biology, living things need to eat to survive. If they don't, they die. The author gave their digital agent a similar rule.

The agent has its own digital wallet. Every time it takes a step, the protocol automatically takes a small fee (specifically 10,000 lamports, which is a tiny fraction of a SOL coin) from its wallet. This isn't a fee paid by a human; it's a cost the agent must pay to keep existing.

The Result: The researchers ran a long test where the agent performed 168 cycles. They watched its wallet balance drop steadily, like a battery draining.
The Safety Net: If the wallet runs out of money, the agent cannot take the next step. It effectively "dies" or stops running. This creates a rule where the agent's survival depends on having resources, just like a real organism.

What This Means (and What It Doesn't)

This paper is a significant step forward in making AI agents more trustworthy. It proves that we can create a digital entity where the "self" is mathematically locked to its code. If you have the secret key, you have the agent. If you don't, you can't pretend to be it, and you can't swap its brain without getting caught.

However, the paper is careful to say what it hasn't done yet.

It's not fully alive: The agent doesn't earn its own money yet. It needs a human to put money in its wallet at the start. It can spend, but it can't work to get more.
It's not indestructible: If someone steals the secret key, they can take over the agent completely. The paper admits this is a risk and suggests that future versions might need more complex security, like splitting the key among many computers.
It's a prototype: The agent used a very simple "brain" (a small neural network with 416 weights). It's not a super-intelligent AI yet, but it's a proof that the concept works.

In the end, this research shows that we can build a digital world where agents have a true, unforgeable identity. It's like giving a robot a soul that is written into its code, making it a distinct individual in the vast, shared space of the blockchain. While we aren't quite at the stage of self-sustaining digital life, this is a solid foundation for building agents that we can trust to be who they say they are.

Technical Summary: Internalising the Identity Primitive

1. Problem Statement

As AI agents transition from research demonstrations to autonomous systems operating on public blockchains, a critical engineering challenge emerges: what constitutes an individual agent? Current on-chain agents anchor their identity in external wrappers (e.g., smart contracts or off-chain profiles) that sit outside the agent's actual computation. This separation allows for "substrate drift," where an operator can silently swap the agent's underlying neural network weights or code while maintaining the same on-chain identity. Consequently, such agents cannot be held accountable, trusted with funds, or meaningfully audited, as the link between the agent's key and its computational substrate is not cryptographically enforced.

The paper addresses the question of how to construct an artificial system that counts as a distinct, persistent individual by binding its identity directly to its computational substrate.

2. Methodology and Construction

The author proposes a shift in the "trust root" for agent identity: moving from hardware or operator trust to cryptographic assumptions enforced by a pinned implementation. The core construction, implemented on the Solana devnet, defines an agent triple $zkAgent = (K, Stream(K), Fecon(K))$, where:

$K$ : The agent's rigid-designator key pair.
$Stream(K)$: The agent's on-chain history.
$Fecon(K)$: The agent's economic substrate (metabolic cost).

Core Mechanism: Key-to-Weights Binding

The central innovation is making the agent's neural network weights ( $W$ ) a deterministic function of its private key ($sk$).

Derivation: $W = HKDF(sk, tag)$. The weights are derived once from the secret seed using HKDF-SHA256 and are never trained or updated continuously.
Commitment: At genesis, the hash of the weights ($WC = keccak(W)$) is committed on-chain.
Verification: At every state transition (cycle), the agent must prove that the weights used to compute the next state match the genesis commitment.

Protocol Flow

The protocol utilizes a two-circuit Solana-native deployment using the SP1 zkVM and Groth16 proofs:

Genesis (F2 Circuit): The agent owner provides the private key $sk$ as a private witness. The circuit proves in zero-knowledge that the public key $pk$ and the weight commitment $WC$ are both derived from the same $sk $($ pk = sk \cdot G$ and $WC = keccak(HKDF(sk, tag))$). The chain registers the agent's Program-Derived Address (PDA) with this commitment.
Advance (F1 Circuit): For every cycle $t \to t+1$ $t \to t + 1$ :
- The host (off-chain prover) re-derives $W$ from $sk$, loads the previous hidden state $h_{t-1}$ , and executes an Elman recurrent step with an environment input $x_t$ .
- The SP1 guest generates a Groth16 proof ( $\pi_{F1}$ ) certifying that the transition was performed using the committed $W$ and that the new state commitment $c_t$ is the correct successor of $c_{t-1}$ .
- The agent signs the transition with $sk$.
- The on-chain program verifies the proof, the signature, and crucially, checks that the $WC$ published in the proof matches the genesis commitment. If the weights differ, the transaction is rejected.

Economic Metabolism Extension

To address the "consumption" aspect of individuality (metabolic closure), the author introduces a protocol-imposed metabolic cost.

An economic PDA, derived from the agent's key, holds a balance of lamports.
Every successful advance automatically debits a fixed amount from this account.
An "aliveness predicate" ( $K \text{ valid} \land Stream(K) \text{ advancing} \land Fecon(K) > 0$ ) is enforced at every transition. If the balance drops below a survival floor, the agent halts.
This creates an involuntary expenditure mechanism analogous to biological metabolism, enforced by the protocol rather than the operator.

3. Key Contributions

The paper makes five primary contributions:

Cryptographic Binding: The agent's substrate (recurrent weights) is a cryptographic function of its private key, committed at genesis and re-checked at every transition. This makes identity substitution an on-chain rejection rather than a trust assumption.
Protocol Enforcement: A live public chain deployment (Solana) enforces this binding via a two-circuit system (F2 for registration, F1 for advancement) with atomic state commitment chains and self-signatures.
Threat Model: A comprehensive catalogue of threats (T1–T14) is defined, distinguishing between tested on-chain rejections (e.g., weight substitution, signature injection) and accepted residual risks (e.g., host-side key compromise).
Empirical Evaluation: The system successfully completed a 2.36-day continuous on-chain run (166 cycles) with two host-side resumptions and zero rejected transitions. It demonstrated that independently keyed agents diverge in behavior while same-key controls remain identical.
Economic-Metabolism Extension: A proof-of-concept (PoC) extension adds a consumption-side constraint, demonstrating a 168-cycle run where the agent's "metabolic" balance was drained linearly by the protocol, halting only when the survival floor was approached.

4. Results and Evaluation

Individuation: Two agents with different keys ($alice$ and $bob$) exhibited measurable L2 divergence in their hidden states ( $M4 \approx 0.68$ ), significantly exceeding pre-specified thresholds. A control pair with the same key showed zero divergence.
Integrity: The system successfully rejected a substituted substrate (Test T6). When a modified host attempted to use weights $W' \neq W$ , the on-chain check of the weight commitment failed, and the transaction was reverted.
Cost: On-chain verification costs were bounded and constant (~247k compute units per transaction), independent of the proof generation time. Proof generation on a GPU took approximately 39 seconds per cycle.
Resilience: The agent survived host-side restarts and network interruptions by resuming from the last finalized on-chain state, maintaining an unbroken commitment chain.

5. Significance and Claims

The paper claims to present the first published on-chain agent whose identity primitive is itself a cryptographic invariant re-checked at every state transition.

Cryptographic Individuality: The work instantiates the "cryptographic individuality" proposed in Suzuki's Artificial Externality framework. It anchors the agent's identity not in a wrapper or a hardware attestation (like TEEs), but in the mathematical relationship between a key and the weights that drive its computation.
Shift in Trust: It shifts the trust root from the operator or the wrapper to the cryptographic assumptions of the pinned implementation (Groth16 soundness, ed25519 security, and hash preimage resistance).
Modesty of Scope: The author explicitly states that this construction realizes individuality (identifiability and persistence under a key) but does not yet achieve full autopoietic agency (self-sustaining metabolism or open-ended evolution).
- The metabolism is consumption-only (involuntary debit), not self-sustaining (no earning mechanism).
- The weights are frozen (or rotated discretely via key-anchored updates), not continuously learnable via gradient descent.
- The environment coupling is currently mediated by a designated oracle or cooperative patron, not a fully non-cooperative external process.

The paper concludes that while decentralized custody, economic self-maintenance, and intrinsic normativity remain open challenges, the enforced binding of key and substrate provides a defined structural basis for investigating these further conditions of agency.