Can AI Oversight Be Zero Knowledge?

What it claims

A theory paper by Chiesa, Guan and Yıldız (EPFL/MIT) with two results.

Negative result (Theorem 1 / 4.1). There is an oracle-aided computation in the random oracle model that has no witness-hiding relativized argument. This holds even when:

• succinct verification is not required (prover and verifier may run much longer than the computation);
• soundness only has to hold against polynomial-time cheating provers;
• privacy is weakened from zero knowledge to witness hiding, meaning the verifier only has to be unable to recover the full witness or find a different passing witness.

Because zero knowledge implies witness hiding, zero knowledge is ruled out too. The bound is stronger than the summary's "no zero-knowledge proofs" suggests.

Positive result (Theorem 2 / 5.2). Assuming only collision-resistant hash functions, every oracle-aided computation has a zero-knowledge single-prover argument with an efficient prover and succinct verification. The condition is that the oracle is replaced by a signed oracle. This holds "for every oracle relative to which collision-resistant hash functions exist."

How it works

Why prior workarounds fail under privacy.

• [BCG25] already ruled out succinct verification in the random oracle model.
• [CKX26] gets around that by assuming the computation is robust, so the verifier can spot-check a few oracle queries. In zero knowledge, though, the verifier's own queries leak the witness. Example: asking whether a molecule with a given structure binds to a target reveals the whole structure.
• Debate gets around [BCG25] by assuming one prover is honest. There are two cases:
• If both debaters hold the witness, no privacy is possible, because a dishonest debater can simply send the witness to the verifier.
• If only the honest debater holds it, the paper rules out even the weakest requirement: the opponent and verifier cannot recover the witness while following the protocol.

Signed oracle. This generalizes Chiesa–Tromer's [CT10] signed random oracle. Each query q returns (a, σ), where σ = Sign(sk, (q, a)). Anyone holding vk can check the answer without querying f themselves. Section 5 builds a zero-knowledge argument of knowledge for the universal relation, using PCPs and vector commitments (both listed in the preliminaries).

flowchart LR
  P[AI prover: x, secret w] -->|queries| S[Signer + oracle f]
  S -->|answer + signature| P
  P -->|ZK argument| V[Verifier: x, vk only]
  V -.checks signatures with vk.-> V

The verifier never queries the oracle. It relies on signatures checked with the public key vk, and that is where the trust boundary moves.

How to use it

There is no implementation, code or benchmark. The page names concrete ways to deploy the signer:

• Digital oracles (a database or a model): trusted hardware evaluates the oracle and signs its answers.
• Human judgment: the person (for example, the physician) signs their own judgments.
• Physical experiments: the lab running the assay signs its results.

Limits

• New trust assumption. The signer sees every query, as the oracle does. It must be trusted to sign only genuine answers and to keep sk private. Confidentiality toward the signer is not addressed.
• Narrow lower bound. The impossibility is proved in the random oracle model and for single-prover arguments, with a separate appendix for debate. It shows that some oracle-aided computation is infeasible, not that every computation of practical interest is.
• Theoretical only. There are no concrete costs, proof sizes or experiments.
• Truncated text. The fetched text cuts off at the start of the technical overview, so the proof details and the construction's specifics in Sections 2.1 onward are not covered here.