01
AI verdicts settle as records, not entries
An attestation record is encrypted to the owner's view key. The off-chain model input description, hash, and verdict are inputs to a proof, never public ledger rows.
Verifiable AI Attestation
AI agents cannot attest on a ledger that publishes every input.
Running AI evaluations on public ledgers exposes private training data, medical scans, or proprietary code. For enterprises, that is not a tradeoff to manage — it is a leakage vector to competitors and counterparties.
Veil records AI agent verdicts on Aleo, where input commitments are encrypted at the protocol layer. Verification and binding proofs are generated in zero knowledge. The chain confirms the attestation happened and learns nothing else.
Oracle Node Role
Submit an attestation
Securely record AI agent verdicts on-chain. Generate input commitments and encrypt disclosure records under the holder's key.
Auditor Role
Audit a verdict
Audit on-chain commitments without exposing off-chain private inputs. Verify that the agent executed cleanly on the claimed data.
Read the originTestnet build in progress — no mainnet deployment yet.
The core premise
AI agents increasingly make consequential calls.
Decisions like security verdicts, credit assessments, or moderation flags are executed on data nobody else can see. Once posted, there is no way to check that a verdict was genuinely computed from what is claimed, without exposing the sensitive input data itself.
Veil binds each verdict to a cryptographic commitment of its input, encrypted at the protocol layer rather than an application-level permission layer. Anyone can verify the verdict is genuine, while no one ever sees the input.
Privacy and auditability, unified.
What the protocol guarantees
Three properties, and none of them optional.
02
Selective disclosure is native
Verification consumes the attestation record and returns a recreated record alongside a match verdict in zero-knowledge. This proves commitment validity without exposing the input hash on-chain until verification.
03
The explorer shows a nullifier
What an observer sees on-chain is a transaction hash and spent-record markers. The input commitments and verdicts remain private to the disclosure holder until verified.
The difference
Privacy is not an option.
Most systems add privacy as a separate layer that can be misconfigured, bypassed, or skipped. Veil starts from a protocol where privacy was never separate to begin with.
The usual approach
Privacy as application code
An access layer bolted on after the fact that someone has to maintain, sitting on a public ledger not built to hide anything. The privacy guarantee is only as strong as the code surrounding it.
Veil — Aleo
Privacy as the protocol
Records are encrypted by the network itself. There is no pool to maintain and no ledger to hide from, because the base layer never held the plaintext to begin with.