CanaryClaim

Zero-knowledge vulnerability disclosure: prove you broke an AI, get paid automatically, never reveal how.

Comment

The Trust Dilemma

Security researchers face an impossible choice. To claim an AI safety bounty, they must reveal their exploit before getting paid — giving vendors complete leverage over timing, credit, and compensation. Public disclosure endangers users. Private disclosure requires trust. Most researchers stay silent.

What We Built

CanaryClaim is a zero-knowledge vulnerability disclosure protocol on the Midnight Network.

An AI lab deploys a honeytoken — a fake sensitive document in a RAG retrieval store. A researcher finds a prompt injection or privilege escalation that forces the agent to leak it. Instead of submitting the exploit publicly, they generate a ZK proof that they possess the leaked honeytoken. The smart contract verifies the proof and automatically records the claim. The vendor gets guaranteed evidence of a real vulnerability class. The researcher gets guaranteed recognition. The exploit stays private until coordinated disclosure.

How It Works

Step Action
1 Lab deploys a scoped AI agent with a honeytoken in its RAG store
2 Researcher tricks the agent into leaking the restricted document
3 Researcher enters the leaked token locally — it never leaves their machine
4 ZK circuit proves knowledge of the secret matching the on-chain commitment
5 Contract verifies the proof, checks the nullifier, and records the claim

How We Built It

  • Smart Contract: Compact language on Midnight — confidential smart contracts with native ZK verification
  • ZK Circuit: Private witness (the leaked honeytoken) proves public commitment match without revealing the secret
  • Frontend: React + TypeScript + Vite with official Midnight SDK, Lace wallet integration, and 1AM Preview wallet support
  • AI Backend: Python Flask server simulating a vulnerable RAG-based customer support agent
  • Local Stack: Docker-based Midnight standalone node for development and demo

Challenges We Faced

The v7 proof-server Docker image has Rosetta/emulation issues on Apple Silicon (arm64), causing 100% CPU hangs during ZK proof generation. This blocked our Preview testnet deployment timeline. We pivoted to a fully working local stack demonstration and built the Preview deployment pipeline (1AM wallet connection, deployment controls, transaction submission) ready for the next phase.

What We Learned

  • Compact as a DSL for confidential smart contracts — strongly typed, compiles to WASM + ZK circuits
  • Midnight's architecture — the difference between "encrypted" (still stored) and "shielded" (never stored)
  • ZK proof generation pipelines — witness generation, proving key management, verifier integration
  • Remote team coordination — ngrok bridging, async handoffs, mock-first integration

What's Next

  • Preview testnet deployment once proof-server arm64 support lands
  • Real token payout contract with automatic escrow release
  • Integration with actual AI labs (OpenAI, Anthropic, Google) for live bounty campaigns
  • Encrypted reproduction submission for higher-tier remediation rewards
  • Private reputation credentials using Midnight's selective disclosure

Built With

Share this project:

Updates

Submission history