# Expert-Activation Signatures (EAS) for Sparse MoE Models Version 1.0 — 2026-10-03. This is a formal profile, not a claim that a particular implementation has been audited. ## 1. Public model profile and syntax Let a sparse mixture-of-experts model have `M >= 1` experts and fixed routing width `1 <= k <= M`. The model profile fixes an input encoding, a router algorithm, signed fixed-point widths, rounding and overflow behavior, and a total tie-break order. `model_params` is ``` (model_id, router_root, M, k, arithmetic_profile, circuit_id) ``` `router_root` is a Merkle root over the canonical router parameters. The profile identifier is ``` model_id = H("EAS/model/v1" || encode(router_root, M, k, arithmetic_profile, circuit_id)) ``` For private encoded input `x`, ``` input_hash = H("EAS/input/v1" || encode(x)) ``` An EAS is exactly the tuple ``` (model_id, input_hash, S, commitment_c, proof_pi) ``` `S` is a canonical strictly increasing list of exactly `k` distinct expert indices in `[0, M)`. `commitment_c` is a hiding commitment to the complete activation vector. `proof_pi` is a zero-knowledge proof for the relation in Section 3. Encodings use length prefixes and fixed-width integers; malformed encodings, duplicate indices, out-of-range indices, or a profile mismatch are rejected before proof verification. The router computes scores for all experts and chooses the `k` greatest scores; ties are resolved by the profile's index order. A deployment must publish the profile and `router_root`; EAS does not prove that the publisher's profile is the intended model release. ## 2. Commitment and activation semantics The activation vector is `b in {0,1}^M`, where `b_i = 1` exactly when the committed router activates expert `i`. For privacy, the prover samples fresh uniform blinders `r_i` and commits each bit with a Pedersen leaf: ``` leaf_i = Com("EAS/leaf/v1" || i || b_i; r_i) ``` The leaves are padded to a power-of-two width with canonical zero leaves and hashed in a domain-separated Merkle tree. `commitment_c` is the root together with a binding context containing `model_id`, `input_hash`, `M`, and `k`: ``` commitment_c = H("EAS/commit/v1" || model_id || input_hash || M || k || root) ``` The Pedersen commitment is computationally hiding and binding under the discrete-log assumption in the selected prime-order group. The blinding values are never reused for another input or model. The Merkle hash is collision resistant. The commitment is not a commitment to expert outputs; no expert output is an input to the relation. ## 3. Correctness relation and verifier Let `Active(model_params, x)` be the exact set returned by the deterministic router profile after evaluating `x` with the parameters committed by `router_root`. The proof relation `R_EAS` has private witness ``` (x, parameter_openings, router_trace, b, r, Merkle_paths) ``` and public statement ``` (model_id, input_hash, S, commitment_c, M, k, router_root, circuit_id) ``` The relation enforces all of the following inside the proof circuit: 1. `H("EAS/input/v1" || encode(x)) == input_hash`. 2. The supplied parameter openings reconstruct `router_root` and the supplied profile reconstructs `model_id`. 3. The router trace uses the published fixed-point arithmetic, range checks, rounding, overflow rules, and tie-break order. It computes all `M` scores. 4. `b_i` is one for precisely the `k` greatest scores and zero otherwise; the strict ordering rule includes the declared tie-break. The public `S` is exactly the set of indices with `b_i = 1`. 5. Each `leaf_i` is computed from `b_i` and fresh `r_i`, and the resulting tree root reconstructs `commitment_c` with the public context. 6. No witness, constraint, or public output contains an expert output or an expert execution trace. The algorithm is: ``` Verify(S, commitment_c, proof_pi, input_hash, model_params) -> true or false ``` It first checks canonical encodings, profile consistency, `|S| == k`, strict ordering and index bounds. It then verifies `proof_pi` for `R_EAS` and accepts only when the proof verifier returns true. In the ideal relation, an honestly generated proof accepts if and only if `S == Active(model_params, x)` for the committed input. In the computational statement, an accepted false set can be produced only with negligible probability under proof knowledge soundness, collision resistance of `H`, and binding of `Com`. A malformed or arbitrary proof for a correct `S` is not promised to verify; completeness applies to the specified honest prover. ## 4. Concrete construction This profile instantiates `proof_pi` with a Groth16 zk-SNARK over a named prime-order pairing curve, with the circuit digest `circuit_id` included in `model_id`. The proving and verification keys are generated for that exact circuit and profile; an implementation must publish the verification-key digest and the ceremony transcript or a transparent setup alternative. The SNARK uses the standard knowledge-of-exponent/q-power assumption in the algebraic group model and a collision-resistant transcript hash. A deployment must state the curve, hash, security parameter, and setup ceremony; an unspecified “SNARK” is not a conforming implementation. The circuit uses Merkle authentication for router parameters and for the activation commitment. It computes the complete routing relation privately, so a verifier does not scan `M` experts and cannot replace `router_root` with a different parameter set. The prover's work is `O(M * d + M log M)` field operations for router cost `d`, plus the proof-system overhead. This is a prover cost, not a claim of sublinear proving. The Pedersen commitment's hiding is separate from SNARK zero knowledge: collision resistance alone would not hide `commitment_c`. The simulator for the privacy claim samples a fresh valid-looking hiding commitment and invokes the SNARK's zero-knowledge simulator; fresh blinders and the commitment assumption are therefore part of the security theorem. ## 5. Privacy property For any two private witnesses with the same public `(model_id, input_hash, S, M, k, router_root, circuit_id)`, the distributions of `(commitment_c, proof_pi)` are computationally indistinguishable, except for information intentionally revealed by `S` and the public profile. This follows from Pedersen hiding for `commitment_c` and zero knowledge of the SNARK for `proof_pi`, assuming the composition uses independent fresh blindings and the proof simulator's public statement includes the commitment. In particular, the relation contains no output, logit, activation value, or execution trace from any non-`S` expert. Thus `proof_pi` reveals no information about outputs of non-`S` experts beyond what follows from the public `S` and the other public statement. The claim does not hide `S`, `M`, model metadata, or information inferable from a low-entropy `input_hash`; applications needing that protection need an additional input-privacy protocol. ## 6. Efficiency bound The verifier performs canonical checks in `O(|S|)` time, hashes the fixed-size public inputs, and runs a constant number of pairing checks for the fixed Groth16 circuit. If a deployment additionally exposes Merkle paths for the `|S|` active indices, their verification costs `O(|S| log M)` and does not change the result. With the security parameter and profile widths fixed, ``` T_verify = O(1 + |S| + |S| log M) = O(|S| * poly(log M)). ``` The verifier never loads expert weights, evaluates expert outputs, or loops over all `M` experts. The bound is for a prepared verification key and a canonical public profile; parsing an externally supplied circuit or rebuilding the router commitment is setup work and is excluded explicitly. ## 7. Security assumptions and limits * The SNARK has completeness, knowledge soundness, and zero knowledge under its stated curve, setup, and random-oracle assumptions. * The Pedersen group has a hard discrete-log problem, and blinders are fresh; the Merkle hash and transcript hash are collision resistant. * Fixed-point range checks and tie semantics are enforced in the circuit. A field-wraparound or floating-point implementation that omits those checks is not this profile. * EAS proves the exact activation set of the committed router and input; it proves neither model quality nor output correctness and does not authenticate model ownership. * Proving cost grows with `M`; large models may need recursion or batching, but such optimizations must preserve the exact relation. A conforming test suite should verify the honest vector, a changed input hash, a changed model identifier, a duplicate or out-of-range index, a wrong tie break, a mutated commitment, and a proof that tries to omit a non-`S` active expert. It should also run the privacy simulator with different hidden non-`S` values and check that no expert-output field enters the transcript.