Skip to content

37 results for “Oracle”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types70Papers37Articles13Write-ups7Repos6Threads4Advisories3
📑 Papers“Oracle”Clear all
arxiv.orgpaper🧠 AI

Efficient Scalable Oversight via Rewinding

Rewindable interactive proofs (RIPs) are a new model of relativizing interactive proofs for scalable oversight, in which a weak verifier can rewind an AI prover to an earlier saved state. The paper builds an RIP for computations robust to changes in a small fraction of oracle answers. The honest prover runs in linear time, the verifier runs in nearly linear time in the input length after one-time preprocessing, and no cryptography is used. A preliminary MNIST experiment shows an RIP can be faster than a deployed proof system.

rewindable interactive proofsdebaterelativizing interactive proofs
arXivMNIST

research, ai-safety· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Quasi-polynomial time algorithms for block basis reduction of linear codes

Kolesnikov and Novoselov give block basis reduction (BKZ) algorithms for linear codes that need polynomial or quasi-polynomial numbers of calls to a minimum weight codeword oracle at fixed block size. The earlier Ghentiyala and Stephens-Davidowitz bounds are exponential. The paper adds a truncated BKZ and a DeepBKZ variant, with an implementation for block sizes 2 to 24 and approximation-factor estimates on random codes.

BKZDeepBKZminimum weight codeword problem+4

other· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Cryptanalysis and Enhancement of VTBSAE: Provably Secure Verifier-Based PAKE Protocols for the Industrial Internet of Things

Cryptanalysis of VTBSAE, a verifier-based PAKE protocol for the Industrial Internet of Things, showing it fails to resist client impersonation after server compromise. The authors propose E-VTBSAEv1, which binds the client point E1 to fresh server randomness, and prove AKE security and forward secrecy in the random-oracle model under CDH. Raspberry Pi 4B tests show runtime comparable to VTBSAE with the same communication and storage overhead.

Raspberry Pi 4BPAKE
VTBSAEE-VTBSAEv1client impersonation after server compromise+3

Identity & Access, Hardware & RF· Added 31 Oct 2026, published 29 Oct 2026

eprint.iacr.orgpaper🛡️ Security

High Precision Noise Cleaning for CKKS with Application to Asynchronous Threshold CKKS

High Precision Noise Cleaning for CKKS is an IACR ePrint preprint (2026/2675) by Zhihao Li, Cheng Hong and Tao Wei. It composes lower-degree Hermite polynomials to reach output noise bounds such as 2^-300 for noise flooding, and uses this to build an asynchronous threshold CKKS scheme with strong simulation security in the random oracle model. In OpenFHE, binary-message cleaning falls from 9.63 s to 1.54 s.

CKKSOpenFHE
noise floodingHermite interpolationfunctional bootstrapping+2

other· Added 31 Oct 2026, published 29 Oct 2026

arxiv.orgpaper🧠 AI

Repairs for Whom? Evaluator-Executor Mismatch in Selecting Repairs for Failed LLM Agents

Repairs for Whom? studies single-step repairs of failed LLM agent trajectories and asks whether common evaluators (greedy replay, stronger models, oracles, log-reading judges) pick repairs that help the deployed agent. Using independent rollouts in ALFWorld and WebShop, greedy replay loses 0.06-0.13 in expected gain, and Qwen2.5-14B rollouts misselect repairs for Qwen2.5-7B. The authors recommend verifying repairs with the executor that will run them.

LLMQwen
ALFWorldWebShopQwen2.5-7B+2

research, agents, evals· Added 30 Oct 2026, published 28 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Cryptanalysis and Repair of "Decentralized Multi-authority ABE for NC$^1$ from BDH"

Cryptology ePrint 2026/2642 presents a plaintext-recovery attack on the DBDH and CBDH variants of the Datta, Komargodski and Waters multi-authority ABE for NC1 (Journal of Cryptology, 2023). It needs one corrupt authority and two users, and succeeds with probability one in the static model. The flaw is an invalid extension of the Rouselakis-Waters LSSS matrix-normalization lemma. The paper also attacks two Datta-Pal (PKC 2023) attribute-based inner-product schemes and proves repaired versions secure in the random oracle model.

Datta-Komargodski-Waters multi-authority ABEDatta-Pal attribute-based inner-product functional encryptionRouselakis-Waters LSSS matrix-normalization lemma+3

other· Published and added 26 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Chosen Commitments and Certified Decoding Regions in the Adaptive Threshold Schnorr Attack

This IACR ePrint 2026/2632 paper by Demirtaş and Yayla analyses the Crites–Stewart adaptive forgery attack on threshold Schnorr signatures, which needs one call to a sparse linear search oracle (bounded distance decoding of a scaled Reed–Solomon code). It shows that choosing the commitment coefficient vector does not help much: a wrapper adversary with Q challenges succeeds with probability at most QM/p, even if its solvers decode every witness for free. For the six original (N, τ) pairs, M stays below 2^24, so the bound is under 2^-100 after 2^128 challenges at p = 2^252.

Schnorr signaturesReed–Solomon codesfolded Reed–Solomon codes
Crites and Stewart attackGuruswami–WangAshvinkumar–Habib–Srivastava+2

other· Added 26 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaper🛡️ Security

The Exact Bit Security of Hash-Based Signatures

The Exact Bit Security of Hash-Based Signatures is a 2026 IACR ePrint paper that analyses XMSS with 128-bit digests and SLH-DSA-128s in the random oracle model, with proofs formalised in Lean4. Strong unforgeability comes to 127 bits under most accounting modes but only 122 bits if just direct random oracle queries are counted. The authors give matching attacks, and show how resource accounting changes the result.

XMSSSLH-DSALean
Mikhail KudinovBenedikt WagnerEmile Wambsgans

other· Added 26 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Provable Security of SHA-256-Based LMS Revisited in the Ideal-Cipher Model

Provable Security of SHA-256-Based LMS Revisited in the Ideal-Cipher Model is an October 2026 ePrint paper by Chun Guo, Hao Cheng, Bart Preneel and Meiqin Wang. It shows forgery attacks on LMS_SHA256_M32 and LMS_SHA256_M24 that exploit Merkle-Damgård structure, so the Katz and Fluhrer random-oracle bounds do not apply. It proves ideal-cipher-model bounds: about 256 minus log2 of the block count for M32, and a minimum of two terms for M24.

LMSSHA-256
KatzFluhrerLMS_SHA256_M32+4

other· Added 26 Oct 2026, published 24 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Tight Post-Quantum Multi-Key Security of the FX Construction

Rentaro Shiba and Tetsu Iwata prove a tight multi-key security bound for the FX construction (the DESX generalization) in the quantum ideal cipher model. Security holds up to about 2^((n+κ)/3) total classical and quantum oracle queries against fully adaptive adversaries, for any number of keyed instances μ≥1. This improves their ToSC 2026 bound and matches the offline Simon's algorithm attack in the exponent.

FX constructionDESXoffline Simon's algorithm+4

other· Added 24 Oct 2026, published 23 Oct 2026

eprint.iacr.orgpaper🛡️ Security

A Note on the Security of ECDSA with Presignatures or Biased Nonces

A Note on the Security of ECDSA with Presignatures or Biased Nonces (Couteau and Makriyannis, ePrint 2026/2545) examines alternative ECDSA modes built for faster distributed signing. It shows that the security of some variants used in deployed libraries is equivalent, in the generic group and random oracle model, to the average-case hardness of k-SUM. It also proves fine-grained lower bounds on generic group attacks against modes analyzed by Groth and Shoup (Eurocrypt 2022).

ECDSAk-SUMGroth and Shoup

other· Added 20 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaper🛡️ Security

From if to Oops: Turning a conditional into a key-recovery oracle

The paper presents a fault attack on deterministic CSIDH and OSIDH-LD. Forcing the lane-selection mask to zero (for example by skipping one instruction) makes output changes reveal whether a secret exponent reaches a threshold. Binary search then recovers the full key in at most 297 queries for OSIDH-LD and 222 for deterministic CSIDH with CSIDH-512-sized keys. Full OSIDH-LD keys were recovered in software fault simulation, and a ChipWhisperer-Lite skipped the target instruction with probability at least 0.94. The authors argue fault resistance requires giving up determinism and propose randomization countermeasures.

CSIDHOSIDH-LDChipWhisperer-Lite
deterministic CSIDHCSIDH-512Houben+6

Hardware & RF· Added 20 Oct 2026, published 19 Oct 2026

arxiv.orgpaper🧠 AI

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework for LLM tools, including MCP servers. It maps each tool argument, using its metadata, to one of 74 CWE-guided semantics-aware sanitizers (path, URL, SQL and similar). It then generates schema-valid Atheris harnesses and semantic oracles, using runtime tracers for in-process tools and outcome oracles for opaque ones. The LLM (gpt-4.1) only maps sanitizers and writes seeds; it is never the security judge. The paper also shows a "Repeat-After-Me" trick, where an LLM told to repeat attacker-crafted text emits a tool call the orchestrator executes, reproduced on LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. Across 273 runnable MCP servers (3,405 tools) it reports 253 verified bugs in 343 tools across 118 servers, such as path traversal, log injection and exfiltration. These are failures a crash-based fuzzer would miss. The result matters because it shows LLM-generated tool arguments cannot be treated as trusted.

Model Context ProtocolAtherisCodeQL+7
ToFuStrandsMAF+10

mcp, research, agents· Added 18 Oct 2026

arxiv.orgpaper🛡️ Security

ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

ToFu is a tool-aware fuzzing framework that derives semantic security checks for LLM tools (mainly MCP servers) from their metadata and a corpus of 74 CWE-guided sanitizers. It generates schema-valid Atheris harnesses, uses runtime tracers and outcome oracles to catch bugs that don't crash, and uses an LLM only to map sanitizers and seed inputs, never as the judge. It also describes a "Repeat-After-Me" attack, in which the LLM is told to repeat attacker-written text that the orchestrator then dispatches as a tool call. It was reproduced on LangGraph, MAF, ADK, AutoGen, Strands and CrewAI. On 273 MCP servers it reports 253 verified bugs across 343 tools in 118 repositories, including path traversal, log injection, exfiltration and command bypass.

Model Context ProtocolAtherisLangGraph+3
Repeat-After-Mepath traversalSSRF+6

AI Security, AppSec· Added 18 Oct 2026

arxiv.orgpaper🧠 AI

Grounding Generative Verification in 3D Content

The paper introduces 3DVerifierBench, a 10-task benchmark for generative verification of 3D content. It scores accept/reject decisions, rejection explanations, and responses to controlled changes in specifications and candidates. A human study shows a 21.6-point gap to the strongest tested model, GPT-6 Astra. The authors also build a pipeline of multi-view fact extraction, controlled 3D editing and native annotations. It yields 14,126 training examples with contradiction explanations and linked counterfactuals. Verification-guided selection raises complete factual success from 26.7% to 90.0% with oracle selection over sixteen candidates, and human-guided recursive refinement satisfies all seven requirements for every input in an eight-input study.

multimodal large language model3D generation
3DVerifierBenchGPT-6 AstraarXiv

research, evals, multimodal· Added 17 Oct 2026, published 15 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Threshold Post-Quantum E-Voting from Lattice Commitments

T-EVOLVE extends the lattice-commitment e-voting protocol EVOLVE to threshold tallying. Votes are Shamir-shared, so any t of n authorities can finish the tally. Privacy holds against t-1 colluding authorities and verifiability holds even if all of them collude. The voter proves her committed shares form a Reed-Solomon codeword whose value at zero is a valid vote. Complaints about ciphertexts that do not decrypt are publicly verifiable, using an LWE-instantiable encryption scheme with publicly verifiable opening. Privacy, verifiability, individual verifiability and robustness are proven in the classical random oracle model, and the verifiability reduction is not tight. In a C implementation, a yes/no ballot for four authorities takes 109 KB, and an authority aggregates 10^4 ballots in about three minutes on one core.

C
T-EVOLVEEVOLVEShamir secret sharing+2

other· Added 17 Oct 2026, published 15 Oct 2026

arxiv.orgpaper🛡️ Security

Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

Kairos is a reference monitor placed at the isolation boundary of an unmodified, opaque LLM agent, where tool calls, shell commands and agent-written scripts all appear as the same file and network operations. A declarative trust policy decides most effects deterministically and defers the rest; deferred effects are held while the agent continues speculatively, and a bounded-authority decision oracle (an LLM or a human) releases or refuses them based on the trace. Across three benchmarks and three agent models it beats existing defenses on the attack-success/utility trade-off; on AgentDojo it cuts attack success from 47.0% to 2.7% with no loss of benign utility.

LLM
indirect prompt injectionAgentDojo

AI Security· Added 15 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Leakage-Resilient Incompressible Cryptography: Constructions and Barriers

Introduces leakage-resilient incompressible cryptography, a security model combining leakage resilience (partial key leakage plus full ciphertext) with incompressibility (full key but only part of the ciphertext or signature). It gives a transformation from incompressible symmetric-key encryption (SKE) to leakage-resilient incompressible SKE, a leakage-resilient incompressible PKE built from a new leakage-resilient non-committing KEM, and an incompressible SKE with ciphertext and compression rate 1/2 using invertible extractors. It also gives a leakage-resilient incompressible signature scheme in the random oracle model under DCR or LWE plus Decisional Linear. Black-box impossibility results show barriers to improving these parameters.

DziembowskiDecisional Linear assumptionLWE+3

other· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Master-Key Recovery from Internal Activation Leakage in ReLU Realizations of Camellia

The paper builds explicit ReLU neural-network realizations of Camellia-128/192/256 from exact Boolean gates, S-box selectors and bit permutations, and reports known-answer-test agreement for Camellia-128. It shows that whitening and round-key quantities leaked from internal activations determine the master key through public key-schedule identities. Under a synthetic internal-oracle model, symmetric real-valued perturbations recover subkey bits with 128 queries (Camellia-128) or 256 (Camellia-256). Camellia-192 is handled by deterministic key-schedule inversion from direct access to round keys. All 3,000 trials (1,000 keys per variant) recovered the key exactly. The authors state this is not a plaintext/ciphertext-only attack on standard Camellia.

Camellia
Kwangjo Kim

other· Added 14 Oct 2026, published 13 Oct 2026

eprint.iacr.orgpaper🛡️ Security

CUTS: Chained Uniform-sum Tree Signatures

The paper analyses stateful hash-based signatures whose key is a tree of hash chains, and asks what a second signature from the same one-time key reveals after state loss or rollback. It proves that the values derivable from several signatures are exactly the union of those from each signature alone. It also bounds forgery after b signatures in the classical random-oracle model by a combinatorial coverage exponent λ_b, including when the signer grinds a counter. It then introduces CUTS, a scheme on one binary tree whose chain positions sum to a fixed value S and whose signature size and verification cost do not depend on tree height. One parameter set has 1,424-byte signatures and λ_2 ≥ 128.6. A counter variant, CUTS+C, gives a proven grinding gain.

CUTSCUTS+C

other· Added 14 Oct 2026, published 12 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Faster generic CCA secure KEM transformation using encrypt-then-MAC

The paper proposes a generic encrypt-then-MAC transformation for building CCA-secure KEMs. The PKE ciphertext is authenticated by a MAC keyed from the PKE plaintext, so decapsulation no longer needs the Fujisaki-Okamoto re-encryption step. It proves IND-CCA security in the random oracle model from OW-PCA, and IND-qCCA security from a new OW-qPCA notion. It presents ML-KEM-EtM and McElieceEtM (Classic McEliece), and benchmarks ML-KEM-EtM with Poly1305, GMAC, CMAC and KMAC256. The result is a substantially lower decapsulation cycle count for a small cost in encapsulation cycles and ciphertext size.

ML-KEMClassic McEliecePoly1305+3
FIPS 203Fujisaki-Okamoto transformationML-KEM-EtM+4

other· Added 14 Oct 2026, published 11 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Reverse-Bleichenbacher: Bleichenbacher Attacks are Practical Again

Presents Reverse-Bleichenbacher, a variant of the Bleichenbacher RSA PKCS#1 v1.5 padding-oracle attack that recovers the least significant bytes first and stops once the TLS PreMasterSecret is found. With improved trimmers and coverage-optimized search, median oracle queries against a 2048-bit key drop from 11,428 to 1,801, and 68.3% of runs finish within a 30s timeout under single-server conditions. The authors find 640 vulnerable domains in the Tranco Top 1M (many behind Alibaba Cloud load balancers) and demonstrate MITM malicious update injection leading to remote code execution.

TLSRSAPKCS#1 v1.5
Reverse-BleichenbacherBleichenbacher attackPreMasterSecret+3

Offensive Security· Added 11 Oct 2026, published 8 Oct 2026

arxiv.orgpaper🧠 AI

Rephrase Before You Act: Characterizing and Mitigating Language Sensitivity in Vision-Language-Action Models

This paper shows that vision-language-action (VLA) models are highly sensitive to how instructions are phrased: a single-word change (e.g. "stove" vs "hot plate") can shift task success by dozens of points on π0 and π0.5 checkpoints in the LIBERO benchmark, even after rephrase-augmentation finetuning. The authors characterize this with statistically tested single-edit swings and an oracle phrase search, then mitigate it without retraining by having an LLM distill scoring evidence into 10-20 explicit rephrasing rules that rewrite incoming instructions at deployment time, improving frozen π0 by 16-27% relative on held-out tasks and lifting π0.5's in-finetune success from 93.6% to 97.8%.

vision-language model
π0π0.5LIBERO

research, multimodal· Added 8 Oct 2026, published 7 Oct 2026

arxiv.orgpaper🛡️ Security

Applying Security by Design at the Point of Execution: How Governed Security Requirements Affect the Security of AI-Generated Code

Evaluates delivering security requirements from a governed security-by-design knowledge base (SbD-ToE) to a code-generating LLM through an MCP server at generation time. On DualGauge (59 Python tasks) the share passing all security tests rose from 44.1% to 78.0%; on BaxBench (28 backend scenarios) the share of functionally correct solutions with no successful exploit rose from 65% to 86%, matching the authors' Oracle Security Reminder (85%). The joint secure-and-functional metric did not improve significantly, since stricter code failed functional tests that fix unstated values. The study used one model and one generation per task, and it proposes measuring conformance with applicable requirements rather than only detecting known weaknesses.

Model Context ProtocolLLMPython
SbD-ToEDualGaugeBaxBench+2

AI Security, AppSec· Added 9 Oct 2026, published 7 Oct 2026

arxiv.orgpaper🧠 AI

Applying Security by Design at the Point of Execution: How Governed Security Requirements Affect the Security of AI-Generated Code

The preprint tests whether security requirements from a governed security-by-design knowledge base (SbD-ToE), delivered to a code generator through a Model Context Protocol server at generation time, make AI-written code more secure. On DualGauge (59 Python tasks, LLM-judge scoring) the share of tasks passing all security tests rose from 44.1% to 78.0%. On BaxBench (28 backend scenarios with real exploits in containers) the share of functionally correct solutions with no successful exploit rose from 65% to 86%, comparable to the authors' Oracle Security Reminder (85%). The pre-specified joint secure-and-functional metric did not improve significantly, and the stricter code failed functional tests that fix values the task never states. The study used one model and one generation per task. The authors argue that current benchmarks only detect the weaknesses their evaluators were built for, and propose measuring conformance with the requirements that apply.

Model Context ProtocolPython
DualGaugeBaxBenchSbD-ToE+1

evals, mcp, coding-agents· Added 9 Oct 2026, published 7 Oct 2026

arxiv.orgpaper🛡️ Security

Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents

Semantic Behavioral Watermarking (SBW) is a provenance scheme for LLM agents that embeds an owner identifier in semantic clusters of an agent's action choices rather than exact action symbols, making it robust to paraphrasing/tool-renaming that breaks three prior agent watermarks (e.g., AgentMark drops to 16.8% bit-recovery under observation paraphrasing). It adds keyed, collision-resistant binning proven unpredictable in the random-oracle model to resist forgery (adaptive forgery success drops from 100% to the false-positive floor), while explicitly documenting an unsolved attack: chained-replay forgery, which still succeeds 0.76-0.98 of the time across five tested agent models (3B-14B, Qwen, ToolBench/ALFWorld benchmarks). Code is released alongside the paper.

QwenLLM
AgentMarkToolBenchALFWorld+2

AI Security· Added 8 Oct 2026, published 6 Oct 2026

arxiv.orgpaper🧠 AI

Semantic Behavioral Watermarking: Paraphrase-Robust and Forgery-Resistant Provenance for LLM Agents

This paper introduces Semantic Behavioral Watermarking (SBW), a method for embedding an owner identifier into an LLM agent's high-level tool/action choices rather than output tokens, so provenance survives tool renaming and observation paraphrasing. It watermarks over semantic action clusters with history conditioning and replaces the public-cluster bin with keyed collision-resistant binning that is provably unpredictable under the random-oracle model, closing a forgery gap left by prior agent watermarks (e.g., AgentMark, whose bit-recovery drops to 16.8% under paraphrasing). Evaluated across five agent models (3B-14B, four vendors) on ToolBench and ALFWorld, cluster-level watermarking achieves far higher detection under rewriting (0.49-0.66 vs 0.05-0.17 on ToolBench; 0.92-0.97 vs 0.00-0.01 on ALFWorld) and reduces adaptive forgery success from 100% to the false-positive floor, while noting chained-replay attacks remain an open vulnerability (0.76-0.98 detection failure).

Qwen
AgentMarkToolBenchALFWorld+2

agents, research· Added 7 Oct 2026, published 6 Oct 2026

eprint.iacr.orgpaper🛡️ Security

On the Instantiability of the Fujisaki–Okamoto Transform for Trapdoor Functions

An IACR ePrint paper showing that the message-only implicit-rejection KEM variant of the Fujisaki-Okamoto (FO) transform used by ML-KEM is uninstantiable in general (under LWE plus subexponentially secure iO and puncturable PRFs), meaning no concrete hash function can replace the random oracle while preserving IND-CCA2 security for every injective trapdoor function. The authors instead give sufficient conditions, via a new "distributional injective extractability" property, to achieve standard-model IND-CCA2 security for the hybrid-encryption (not KEM) formulation of FO, with a standard-model instantiation left open. This directly bears on the theoretical foundations underlying ML-KEM's security proof.

ML-KEMFujisaki-Okamoto transformdistributional injective extractability

other· Added 8 Oct 2026, published 5 Oct 2026

arxiv.orgpaper🛡️ Security

SoK: Stablecoins in the Quantum Era

This arXiv SoK paper systematizes the quantum-era risks facing stablecoins, mapping cryptographic dependencies (issuer, custody, upgrade, oracle, bridge keys) to monetary control surfaces and classifying migration options along who can authorize a change, where it occurs, and whether it is hybrid, post-quantum native, or encapsulated. It introduces an "authority-liability gap" concept — the entity able to migrate a cryptographic component is often not the one that bears losses if migration fails — and connects migration choices to redemption, continuity, and intervention requirements under current stablecoin regulation. The paper also flags open problems in threshold authorization, dormant/wrapped supply, and measuring quantum-vulnerable exposure.

Blockchain· Added 5 Oct 2026, published 1 Oct 2026

arxiv.orgpaper🧠 AI

Can AI Oversight Be Zero Knowledge?

This paper studies whether AI oversight mechanisms based on interactive proofs and debate (used for verifying AI outputs derived from confidential data, e.g. a fitness-for-duty assessment from medical records) can be made zero-knowledge, so a verifier learns nothing beyond correctness. The authors prove a general impossibility result in the random oracle model — no zero-knowledge proofs exist for general oracle-aided computation, and this extends to debate, a canonical scalable-oversight model — but show that if the oracle cryptographically signs its answers, every oracle-aided computation can be verified in zero knowledge with an efficient prover and verifier using only collision-resistant hash functions. The signed-oracle construction also offers a new approach to scalable oversight that avoids relying on an honest debate opponent or on the computation's robustness.

ai-safety, research· Added 2 Oct 2026, published 1 Oct 2026

Showing 30 of 37

Show more