Zero-knowledge proofs — Applications and limits in CSAM detectionZero-knowledge proofs — Applications and limits in CSAM detection

"I can prove to you that I know the combination to the safe without opening it or telling you the number."

— That is the promise. What I cannot do is prove to you that there is nothing stolen inside the box without opening it. And that is the problem.

---

Zero-knowledge proofs (ZKP), along with FHE, are the other great technical promise that appears in debates about Chat Control. The idea is that a user could prove that their message does not contain CSAM without revealing the content of the message.

It sounds perfect. The devil is in the details.

What is a zero-knowledge proof?

A ZKP is a cryptographic protocol that allows a prover to demonstrate to a verifier that a statement is true, without revealing any additional information beyond the validity of the statement.

Formally, a ZKP protocol for a language $\mathcal{L}$ must satisfy:

1. Completeness: if the statement is true, the honest prover convinces the verifier
2. Soundness: if the statement is false, no dishonest prover can convince the verifier (with non-negligible probability)
3. Zero-knowledge: the verifier learns nothing more than the validity of the statement

Prover: "I have a proof that M ∉ B (CSAM)"
                │
                │  ███████████████████████
                │  █ ZKP Protocol ████████
                │  ███████████████████████
                │
                ▼
Verifier: ✓ "M is not in B" (without seeing M)

Private Set Intersection (PSI)

A relevant variant is private set intersection (PSI), where two parties can determine the intersection of their sets without revealing the non-shared elements.

In the context of CSAR, the idea would be:

• User: has a set of messages $\mathcal{M}$
• Platform/authority: has a set of known CSAM hashes $\mathcal{H}$
• PSI: determines whether $\mathcal{M} \cap \mathcal{H} \neq \emptyset$ without either party revealing their complete set

User: M₁, M₂, M₃, ... Mₙ
                    \
                    PSI → Non-empty intersection? → yes/no
                    /
Authority: h₁, h₂, h₃, ... hₖ (CSAM hashes)

If yes → the user has at least one CSAM message (but not known which)
If no → the user has no CSAM messages

The practical problems

1. Unknown CSAM is not detected

PSI only detects matches against a pre-existing database. But most CSAM detected today is new material —images and videos that were not in any database because they had not been previously reported.

A PSI-based system:

• Detects already known CSAM (existing hashes)
• Does not detect new CSAM (you cannot hash what you do not know)
• Requires constant database updates

2. The classifier is not a hash

Detecting new CSAM requires content-based classifiers (neural networks, perceptual embeddings). A classifier of this type is not a function that can be efficiently executed inside a ZKP.

Modern ZKPs (zk-SNARKs, zk-STARKs, Bulletproofs) can prove complex computations, but the cost of generating a proof for a medium-sized neural network remains prohibitive:

3. The update problem

Even if running a classifier inside a ZKP were viable, the problem of classifier updates would remain. If the authority can remotely update the classification model, then:

Time t:       Classifier C₁ → ZKP → "M is not CSAM"
Time t+1:     Classifier C₂ → ZKP → "M is CSAM" (for the same M)

The user cannot know whether the new classifier is looking for CSAM or anything else. And since proofs are verifiable, the authority can re-evaluate past messages with new classifiers.

4. False positives and privacy

A false positive in a ZKP system is qualitatively different from a false positive in a traditional system. In a traditional system, the operator manually reviews the content and discards the false positive. In a ZKP system:

• If the ZKP says "CSAM detected," the operator cannot review the content (it is encrypted)
• The operator must either trust the ZKP or request the decryption key to verify
• If they request the key, the ZKP becomes irrelevant
• If they do not request the key, they accept all classifier verdicts as true

ZKP says "CSAM detected":
    ├→ Request key → M is decrypted → privacy is lost
    └→ Trust ZKP → accept verdict → what if it is a false positive?

The dead end

ZKPs and PSI are powerful cryptographic tools for well-defined problems:

The conclusion is similar to that of FHE: ZKPs cannot solve the problem of CSAM detection in encrypted communications without breaking privacy, because:

1. They cannot detect uncatalogued material (which is the majority of CSAM)
2. They cannot run complex classifiers at scale
3. They do not prevent retrospective re-evaluation
4. They do not solve the classifier expansion problem

The underlying paradox is that cryptography can prove anything except that unseen content is safe. And that is precisely the proof that the law requires.

---

Related documents:

• Chat Control — Definition and context
• Cifrado y vigilancia — Why mass scanning breaks E2EE
• Criptografía homomórfica — Promises and limits
• Alternativas al escaneo masivo