Anamorphic Proofs of Knowledge from Prover Randomness

What it is

"Anamorphic Proofs of Knowledge from Prover Randomness" (IACR ePrint 2026/2706, received 31 October 2026, approved 4 November 2026) is a preprint by Zhi Lu, Songfeng Lu and Jiaheng Zhang. It defines a proof that certifies a normal public statement and also convinces a designated checker that the prover knows a witness for a separately registered statement, such as a long-term credential. The abstract describes only the construction and security claims. It gives no code, parameters or benchmarks.

How it works

The normal prover already commits to its own randomness. In anamorphic mode the prover adds a secret mask to the anamorphic witness and uses the sum as the coins for that commitment. The existing commitment therefore carries the anamorphic statement. The public statement, proof format, proof length and normal verifier do not change.

flowchart LR
    A[Normal prover] -->|fresh coins| C[Randomness commitment]
    B[Anamorphic prover] -->|mask + anamorphic witness| C
    C --> P[Same-format proof]
    P --> V[Normal verifier: accepts]
    P --> K[Designated checker: learns knowledge claim]

Preconditions

The normal proof system must meet two properties:

• Its randomness commitment must be extractable.
• The complete proof must be simulatable at a commitment fixed in advance by the checking key. The authors state that ordinary zero knowledge does not provide this.

Instantiations are random-base Compressed Sigma and Bulletproofs with range aggregation, both in the random-oracle model.

Claimed guarantees

• Normal and anamorphic modes are indistinguishable to an outside observer, even given both witnesses and the normal prover's actual random coins.
• The same opening extractor gives anamorphic knowledge soundness.
• The checker cannot produce an accepting proof for a statement registered independently of its key.
• The checker cannot produce a proof and witness for a statement of its own choice.
• Both checker guarantees hold at an unused label, after the checker has seen honest proofs at other labels.
• The checker learns neither witness.

Caveats

Three-move protocols with witness-assisted challenge transfer cannot support the primitive in a local-checking model. This covers Schnorr and uncompressed representation protocols, so existing Schnorr-style deployments cannot adopt it directly. The work is a preprint, and the abstract mentions no implementation.