> For the complete documentation index, see [llms.txt](https://docs.mindcp.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mindcp.ai/technology/system-architecture/cryptographic-attestation-and-verification-model-cavm.md).

# Cryptographic Attestation & Verification Model (CAVM)

MindCP introduces a novel cryptographic attestation framework designed to prove the provenance, integrity, and authenticity of outputs generated by decentralized agents. This model leverages digital signatures, zero-knowledge proofs, and deterministic state representations to achieve verifiability without relying on centralized authorities.

### 1. Formal Representation of Model State

Let a MindCP Agent be defined by a deterministic function

$$
f
θ
​
:X→Y
$$

where X denotes the input space, Y the output space, and θ∈R<sup>n</sup> represents the fixed model parameters.

To cryptographically bind an output to a specific model instance, we derive a state commitment using a collision-resistant hash function H:

$$
C=H(f
θ
​
∥θ∥m)
$$

where m is the message or input prompt, and ∥ denotes byte-level concatenation.

### 2. Attestation Signature Scheme

Each agent instance is initialized with a public-private key pair (pk,sk). Upon generating an output y=f\ <sub>θ</sub>(m), the agent signs the tuple (m,y,C) using a digital signature algorithm such as EdDSA:

$$
σ=Signsk
​
(m,y,C)
$$

The tuple (m,y,C,σ,pk) forms the **attestation package**, which can be independently verified:

$$
Verify
pk
​
(m,y,C,σ)=true
$$

### 3. Deterministic Output Verification

To avoid nondeterminism in generative AI outputs, MindCP constrains the agent behavior using seed-locked generation:

$$
y=f
θ
​
(m;s)
$$

where sss is a shared PRNG seed. This ensures that the same input and seed always produce the same output, satisfying the deterministic constraint:

$$
f
θ
​
(m
1
​
;s)=f
θ
​
(m
2
​
;s)⇒m
1
​
\=m
2
​
$$

The seed is included in the attestation hash:

$$
C=H(f
θ
​
∥θ∥m∥s)
$$

### 4. Zero-Knowledge Proof of Execution

For sensitive models, MindCP optionally supports zk-SNARK-compatible attestation, where a prover generates a succinct proof π such that:

$$
π=Prove(R
f
​
,m,y)
$$

where R<sub>f​</sub> encodes the execution circuit of f<sub>θ</sub>​. A verifier can then check:

$$
VerifyZK(π,m,y)=true
$$

This enables third parties to trust the correctness of model outputs without revealing the model parameters or internal architecture.

### 5. Blockchain Anchoring

To ensure immutability, MindCP periodically commits attestation hashes to a smart contract on Ethereum:

$$
SubmitAttestation(C,t)→on-chain
$$

where ttt is a timestamp or block height. This creates a tamper-proof log of model responses that can be queried and audited by any party.

### 6. Security Assumptions

The security of MindCP’s attestation model is based on the following cryptographic hardness assumptions:

* **Collision resistance** of hash function H
* **Unforgeability** of the digital signature scheme under chosen message attacks (UF-CMA)
* **Soundness and completeness** of the zk-SNARK protocol
* **Determinism** of the model f<sub>θ</sub>​ under fixed seeds

Together, these ensure that any claimed output can be cryptographically linked to a specific model, input, and execution instance, forming the backbone of trustless AI verification.