Unlocking Web3's Full Potential: The Critical Role of Privacy-Enhancing Technologies - Part 1

Special thanks to Elan Neiger, Bryce Ferguson, Charles Wayn, and David Toh for their valuable feedback.

Introduction

Data drives the modern economy, fueling innovation, enhancing user experiences, and driving economic growth. However, the insatiable demand for data has triggered a privacy crisis. While regulations like Europe’s General Data Protection Regulation (GDPR) and Singapore’s Personal Data Protection Act (PDPA) address some concerns, legislation alone cannot fully safeguard privacy. What’s needed are systems designed with privacy at its core.

This urgency becomes even more apparent with technologies like Artificial Intelligence (AI) and blockchain. AI’s reliance on vast datasets introduces significant risks, including privacy breaches, bias amplification, and systemic discrimination, emphasizing the critical need for robust privacy protections. Similarly, blockchain technology, while transparent by design, exposes user transactions and financial intentions to potential exploitation. Public transaction mempools heighten these risks, allowing predatory bots to front-run or "sandwich" user transactions, extracting unfair profits and further underscoring the need for privacy-focused innovation.

We at Mirana Ventures believe that Privacy-Enhancing Technologies (PETs) offer a critical bridge between safeguarding user data and fostering innovation in AI and Web3. By investing in PETs, Mirana aims to align the demands of data-driven systems with the necessity for privacy, ensuring sustainable growth and adoption across both industries.

In this article, we explore how PETs can safeguard privacy while unleashing the transformative potential of AI and Web3, reshaping the future of trust and innovation.‍

Why PETs

PETs are designed to protect user data while enabling privacy-compliant, data-driven innovation. Before diving into specific PETs and their Web3 applications, it’s crucial to understand the key principles behind them:

• Data Minimization:  Data collection and processing is limited to only what is necessary, minimizing exposure risks.
• Data Anonymization: User identities are safeguarded even in the event of a data breach, using advanced anonymization techniques.
• Secure Sharing and Analysis: Privacy-respecting insights and regulatory compliance are enabled through secure data sharing and processing.

These principles are the foundation of diverse PET technologies, each tailored to specific use cases and benefits.

‍Types of PETs and their use cases

While all these techniques enhance privacy, the first four—ZKP, HE, TEE, and SMPC—are particularly significant for Web3 applications. We will cover ZKPs in this article and our next article in this series will cover HE, TEE and SMPC.

The diagram above illustrates the diverse landscape and activity making up the PET ecosystem.

Zero Knowledge Proofs (ZKPs)‍

Zero-Knowledge Proofs (ZKPs) are founded on two key features: succinctness, the ability to verify that a computation was performed correctly without redoing the entire process, and zero-knowledge, the capability to conceal sensitive parts of the computation while still ensuring its correctness. These unique properties have made ZKPs indispensable for enhancing privacy, scalability, and trust in decentralized systems, solidifying their position as one of the most widely adopted PETs in the Web3 ecosystem.

ZKPs have unlocked a wide array of privacy-enhancing applications in Web3.

Applications of ZKPs

• Private Transactions on Blockchains: Zero-Knowledge Proofs (ZKPs) enable private transactions on both public and privacy-focused blockchains by concealing key details such as the sender, receiver, and transaction amount. These systems typically use a structure called "notes," which encapsulate essential information, including the asset owner, asset type, transaction value, a spending key for authorizing transactions, and a unique nullifier to prevent double-spending. ZKPs use a Merkle tree of cryptographic commitments, which represents all valid notes. When a note is created, its commitment is added to this tree, accompanied by a proof of validity. To spend a note, the user must prove the note's inclusion in the commitment tree, authorize the transaction using their spending key, and reveal a unique identifier called a nullifier. The nullifier is then tracked on-chain to ensure the note can only be used once. This design balances privacy and security by maintaining transactional confidentiality while preventing fraud, making ZKPs a foundational technology for private blockchain interactions.
  • Key Projects:
    • Privacy-focused blockchains: Zcash, Penumbra.
    • Applications: TornadoCash (Ethereum), Elusiv (Solana), and Hinkal.
    • Aleo, which launched its mainnet recently, expands the Zcash model to enable encryption of both user assets as well as arbitrary application states‍
• Scaling L1 with ZK rollups: ZKPs can also play a crucial role when scaling Layer 1 blockchains to Layer 2 (L2) solutions. Aztec, for instance, is developing a ZK Layer 2 rollup that combines L2 scalability with privacy. In this system, ZKP generation happens directly on the user’s device, where private data is processed, and a ZK proof of validity is generated. Aztec’s sequencer then verifies these proofs from the user’s device and consolidates them into a single validity proof covering all transactions, which is subsequently verified on the Layer 1 blockchain. Aztec's approach stands apart from solutions like zkSync, Scroll, and Taiko. While these platforms also use validity proofs to reduce congestion on Layer 1 by shifting transactions to Layer 2, they do not conceal transaction details and, as a result, do not offer privacy. By integrating privacy into its scaling solution, Aztec provides a distinctive combination of enhanced scalability and confidentiality. ‍
• Privacy-preserving data sharing with zkTLS: zkTLS allows users to prove the authenticity of their data from platforms (e.g., banks, social media) to third parties, revealing only selective information. For instance, a user could verify to a third party that they have more than a certain threshold of assets in a bank or centralized exchange (CEX) without disclosing their exact holdings or asset details. This technology has diverse applications, including identity verification, healthcare data sharing, player reputation sharing from platforms like Steam, collecting user data from platforms like Reddit and LinkedIn, and even incentivizing users from competing Web3 platforms to join your platform.zkTLS allows users to prove the authenticity of their data from platforms (e.g., banks, social media) to third parties, revealing only selective information. For instance, a user could verify to a third party that they have more than a certain threshold of assets in a bank or centralized exchange (CEX) without disclosing their exact holdings or asset details. This technology has diverse applications, including identity verification, healthcare data sharing, player reputation sharing from platforms like Steam, collecting user data from platforms like Reddit and LinkedIn, and even incentivizing users from competing Web3 platforms to join your platform.‍
  • Key Projects:‍
    • Popular implementations of zkTLS include open-source projects like TLSNotary by Ethereum Foundation’s Privacy and Scaling Explorations (EF PSE) group and zkTLS by Reclaim Protocol. Reclaim Protocol offers solutions such as AppClip and InstantApp for Apple and Android, enabling users to generate ZK proofs without the need for additional extensions or app installations. This approach is crucial for minimizing user friction and enhancing the ease of use for ZKP generation.
    • Other zkTLS projects include Deco, a privacy-preserving oracle developed by IC3 and Chainlink, zkPass is building Transgate that combines MPC networks with ZKTLS to transfer Web2 private data to Web3 using ZKPs.
• ‍Privacy-Preserving Identity, Voting, and Reputation Systems: ZKPs enable selective disclosure of identity attributes while protecting other user data. They also allow users to prove group membership and send messages such as a private vote or endorsement anonymously while preventing double signalling. This enables use cases including private voting, whistleblowing, anonymous DAOs, and mixers.‍ ‍
  • Key Projects:‍
    • Galxe is building Galxe Identity Protocol, a self-sovereign identity infrastructure powered by Zero-Knowledge Proofs that allows developers to add Sybil prevention in airdrops, reputation systems for rewards, credit or discounts, private data markets, and decentralized review systems. Generated ZKPs can be verified on-chain or off-chain and Galxe can use Nebra as a proof aggregator to reduce the cost of on-chain verifications.‍
    • Zupass is a digital identity and community management web app using ZKPs. Zupass enables features like ticketing, polls, gated chats, and anonymous chatbots. With the PCD (proof-carrying data) framework, Zupass acts as a foundational data layer for building identity tooling, membership, and governance.
    • ‍Holonym has developed Zeronym, a ZK-based identity and proof of personhood protocol.‍
    • Semaphore enables anonymous group membership.‍
    • WorldID by Worldcoin is a privacy-preserving proof-of-personhood protocol. It leverages secure multiparty computation (SMPC) to encrypt and store segments of a user’s iris data securely. Using the World App, users can generate zero-knowledge proofs (ZKPs) to verify their uniqueness without revealing their personal information.‍
    • zkMe is building a decentralised identity network infrastructure that leverages Zero-knowledge Proofs (ZKPs) to securely and privately attest & verify credential ownership across ecosystems. ZkMe enables smart contracts to securely access off-chain identity or credential-related data feeds and web APIs.‍‍
• Zero Knowledge Machine Learning (ZKML): ZKMLs enhance traditional machine learning models by using ZKPs to verify that a model produced a specific result (inference) based on a given input. This enables use cases where either the input remains private while the model is public or the model remains private while the input is public. For example, ZKML could allow a user to retrieve their credit score from a machine learning model without disclosing personal data. Alternatively, it could enable an institution to prove the fairness of its admissions process without revealing the model’s proprietary selection criteria. However, converting large-scale models like GPT-4, and Llama 3 into ZK circuits remains impractical due to their size, though advances in cryptography and specialized hardware have significantly improved our capabilities.
  • Key Projects:
    • Modulus Labs recently proved the 1.5 billion-parameter GPT-2 XL model with ZK. They are working on enhancing the Lyra finance options protocol AMM with intelligent features.
    • Giza is helping Yearn Finance to prove that a complex yield strategy that utilizes ML is being correctly executed on-chain.
    • Zkonduit's EZKL library facilitates the generation of zero-knowledge proofs for machine-learning models exported via ONNX. This enables verification of a model's outputs without exposing the underlying model or sensitive input data.‍
• DeFI with ZKPs: DeFi protocols are adopting ZKPs to ensure order privacy and verifiable execution of AI-driven yield strategies.‍
  • Key Projects:‍
    • Lumina and Panther aim to create decentralized exchanges that provide privacy while maintaining compliance. Lumina is a KYC-enabled DEX with ZKP that enables private transactions with verified counterparties without exposing sensitive information.‍
    • Renegade takes a different approach by combining multi-party computation (MPC) and ZKPs to enable dark pool trading. This keeps the order book private, allowing large institutional or whale traders to place orders without alerting other market participants.‍
    • Noya's AI agents can execute multiple DeFi strategies, such as aggregation, borrowing optimization, liquidity provisioning, and collateral management with ZKML enabling trustless & verifiable strategy execution.
• Key projects working on ZK Hardware Acceleration:
  • Companies like Ingonyama, Cysic, Irreducible (formerly Ulvetanna), Fabric, etc are working on both ZK hardware acceleration and ZK cryptography.
  • Ingonyama's ICICLE is a cryptography library designed to accelerate ZKPs using multiple compute backends, including GPUs and CPUs.
  • Irreducible came up with Binius, a hardware-optimized SNARK construction based on 32-bit Binary tower fields.

‍Challenges of ZKPs

1. Proof Generation on Edge Devices: ZKP generation often requires significant computational power and memory, making it challenging for resource-constrained devices like mobile phones or IoT devices to generate even moderately large proofs.‍
2. Balancing Privacy with Regulatory Compliance: Balancing privacy with regulatory compliance is a challenge. For example, platforms like Zcash allow selective disclosures for compliance.
3. Need for Regulatory Adoption: To integrate ZKPs into identity verification and compliance systems, regulatory frameworks must evolve to support privacy-enhancing technologies, along with a broader shift toward privacy-centric infrastructure.
4. Post-Quantum Security Concerns: Some ZKP schemes, such as SNARKs, rely on elliptic curve cryptography (ECDSA), which is not secure against quantum computing. STARKs, however, are post-quantum secure as they rely on cryptographically secure hash functions.
5. Auditing and Security Complexity: ZKP systems are difficult to audit and secure due to the complexity of cryptographic techniques and the rapid pace of advancements in ZKP algorithms. This increases the potential for undetected vulnerabilities that could compromise privacy.

Conclusion

Zero Knowledge Proofs are at the forefront of Web3 privacy innovation, enabling a variety of applications in private blockchain transactions, scaling, privacy-preserving data sharing, identity systems, ZKML, and DeFi. As cryptographic advancements and hardware acceleration drive adoption, ZKPs have become a cornerstone of privacy-preserving systems.

In Part 2, we'll explore complementary technologies — Homomorphic Encryption, Trusted Execution Environments, and Secure Multi-Party Computation—that, alongside ZKPs, are shaping the future of privacy in Web3.