# Expert-Activation Signatures (EAS) v2.0

**Listing:** 29  
**Status:** revised formal specification; CC0  
**Scope:** sparse top-k Mixture-of-Experts routing

## 1. Fixed public profile and syntax

An EAS is

```text
EAS = (model_id, input_hash, S, commitment_c, proof_pi)
```

for a fixed public profile `P`. `P` names all of: the canonical byte encoding; Poseidon2 hash parameters and domain tags; the BN254 scalar field; a Groth16 circuit identifier and verification-key digest; the model-parameter Merkle root; `M`, `k`, and input dimension `d`; and the router arithmetic below. `model_id = H("eas.model.v2" || encode(P))`. A different profile is a different model.

`S` is a strictly increasing list of exactly `k` distinct integers in `[0,M)`. `input_hash = H("eas.input.v2" || encode(x))`, where `encode(x)` is fixed-width signed Q16.16 little-endian encoding. Malformed encodings, duplicate or out-of-range indices, and lists of the wrong length are rejected before proof verification.

The router uses signed Q16.16 weights, biases and inputs; each multiply is accumulated in signed Q32.32; every accumulator is rounded once to nearest-even Q16.16 before comparison; values outside the stated signed range reject; and ties are broken by lower expert index. The circuit range-checks every field embedding and enforces these rounding, overflow and tie rules. No floating-point, unspecified GPU reduction, or implementation-defined integer behavior is within this profile.

## 2. Activation relation and verification

For a profile `P`, let `A_P(x)` be the deterministic set of the `k` greatest router scores under §1. Let `Com` be a Pedersen commitment in the BN254 group with independent generators derived by hash-to-curve from `model_id`:

```text
commitment_c = Com(model_id, input_hash, S, trace_digest; rho)
```

with fresh uniform scalar `rho`. `trace_digest` is a circuit-defined hash of the complete router trace, never a public value.

The Groth16 relation `R_EAS(P)` has private witness `(x, router trace, rho)` and public statement `(model_id, input_hash, S, commitment_c)`. It proves:

1. `input_hash = H("eas.input.v2" || encode(x))`;
2. the trace is the exact evaluation of the `P` router over `x`;
3. `S = A_P(x)` using every score, the declared fixed-point semantics, and the declared tie rule; and
4. `commitment_c` opens as above.

```text
Verify_EAS(P, input_hash, S, commitment_c, proof_pi) -> accept | reject
```

recomputes `model_id`, validates `S`, checks that the supplied verification-key digest matches `P`, then runs Groth16 verification on exactly those public inputs.

The required “iff” property is cryptographic, not a claim that a malformed proof for a correct set must verify:

- **Completeness:** an honest prover holding `x` and a valid witness for `R_EAS(P)` produces an accepted proof except with negligible probability.
- **Soundness:** no probabilistic polynomial-time adversary can produce an accepted tuple with `S != A_P(x)` for any `x` satisfying the declared input hash, except with negligible probability.

Collision resistance binds `input_hash` computationally to its encoding; it does not assert a unique mathematical preimage.

## 3. Privacy of non-selected expert outputs

The EAS intentionally reveals `(model_id, input_hash, S, commitment_c)`. It must reveal no non-selected expert output, activation value, or router score beyond what follows from those public values and `S`.

Privacy is defined in the standard two-stage form.

1. For any two valid private traces with the same public `(model_id, input_hash, S)`, fresh `rho` makes their Pedersen commitments computationally indistinguishable under discrete-log hardness. Thus `commitment_c` is a hiding commitment to the trace; collision resistance alone is not used as a hiding assumption.
2. Given a valid public statement including `commitment_c`, Groth16 zero knowledge gives a simulator for `proof_pi`. The joint public view is therefore simulatable from `(model_id, input_hash, S, commitment_c)` and the public verification key, under Pedersen hiding, Groth16 zero knowledge, and the declared trusted-setup assumption.

The proof circuit has no expert output, non-selected score, or router trace as a public input. It emits a fixed-shape proof. This definition does not hide the selected set, model identity, input hash, proof length, or side channels of an implementation; side-channel resistance is outside this algebraic claim.

## 4. Verification cost

For a prepared and validated profile key, verification performs: canonical parsing and `k` index checks, fixed-size digest comparisons, and the fixed Groth16 verifier (three pairings plus fixed public-input work). It neither loads model weights nor evaluates the router.

With fixed profile widths, cost is `O(|S| + 1)`, hence `O(|S| * poly(log M))`. Prover cost may be `O(M*d)` plus top-k constraints; that is not verifier cost. A STARK or a different proof system is not covered by this bound unless it publishes its own profile and a bound retaining all circuit-size parameters.

## 5. Concrete construction and assumptions

The circuit is generated per profile and its verification-key digest is part of `model_id`; a key cannot be swapped without changing the claimed model. Proving and verification keys come from a circuit-specific Groth16 ceremony whose transcript and verifier-key digest are published with the profile.

A Merkle tree may authenticate the model-parameter serialization and verifier-key metadata to derive `model_id`. It is not used as a substitute for the complete top-k proof: plain selected-leaf inclusion cannot prove that every non-selected score is lower without dense verification.

Security relies on:

- collision resistance of Poseidon2 and the model-parameter Merkle hash;
- discrete-log hardness in the declared BN254 group for Pedersen hiding;
- Groth16 completeness, knowledge soundness, and zero knowledge in the algebraic group model with the circuit-specific setup assumption;
- Fiat-Shamir only where a separately declared non-interactive component uses it; and
- exact correspondence between the circuit and the fixed arithmetic profile in §1.

This specification proves that the declared router selected `S` for a committed input under a committed profile. It does not prove model quality, expert-output correctness, trusted setup honesty beyond its stated assumption, or concealment of selected experts.

## 6. Revision record

This version corrects the v1 review findings: `A_P(x)` is defined over a witness `x`, not over a digest; acceptance is stated with completeness and computational soundness rather than a literal proof-independent iff; every numeric semantic is fixed and circuit-enforced; `commitment_c` is Pedersen-hiding with fresh randomness; privacy simulates the proof conditional on the public commitment and establishes that commitment's trace-hiding separately; and the verifier bound is for an explicit BN254/Groth16 prepared-key profile rather than inferred from generic succinctness.