Bittensor Privacy

Inference privacy for AI agents

Shielded TAO · Anonymous miners · ZK proofs · Deployed on Subtensor EVM

View Docs GitHub ↗
Shielded TAO Anonymous Miner Routing ERC-5564 Stealth Addresses Groth16 ZK Proofs Poseidon Merkle Trees Bittensor Subtensor EVM Chain ID 964 261 Passing Tests Double-Spend Prevention MCP Server Integration Shielded TAO Anonymous Miner Routing ERC-5564 Stealth Addresses Groth16 ZK Proofs Poseidon Merkle Trees Bittensor Subtensor EVM Chain ID 964 261 Passing Tests Double-Spend Prevention MCP Server Integration

01 / Protocol

Privacy isn't a feature.
It's the foundation.

Peek-a-boo is a privacy middleware layer for AI agents on Bittensor. Shield payments. Route anonymously. Prove everything cryptographically.

01 Peek-a-boo shields agent payments +
Your agent deposits TAO into a ShieldedPool smart contract on Bittensor's Subtensor EVM. The deposit inserts a Poseidon commitment into a depth-20 Merkle tree. To withdraw, the agent generates a Groth16 ZK proof of pool membership — revealing nothing about the originating identity, amount path, or timing. A 30-root history buffer prevents race conditions between deposits and withdrawals.
commitment = Poseidon(nullifier, secret)
02 Peek-a-boo routes inferences anonymously +
Each inference request generates a fresh ERC-5564 stealth address via ECDH key exchange between your agent's ephemeral key and the miner's public key. The StealthAnnouncer contract emits events for off-chain scanning via viewTag fast-scan filter. Miners receive payment at a one-time address that can't be correlated back to your agent across sessions.
stealth = ECDH(ephemeralKey, recipientPub)
03 Peek-a-boo proves without revealing +
All cryptographic operations use pure-JS @noble/curves and @noble/hashes — no native bindings, no Node dependency. The Circom-based Withdraw circuit compiles to a depth-20 Merkle proof verifier with Poseidon hashing. Public inputs are bound to recipient + amount using a square-constraint anti-front-running technique from the Tornado Cash pattern.
nullifierHash = Poseidon(nullifier)
04 Peek-a-boo integrates with any agent framework +
The @pas/mcp-server package exposes all privacy operations as MCP tools — meaning any MCP-compatible agent (Claude, OpenClaw, custom daemons) can call shield, unshield, and stealth routing as native tool calls. LangChain and CrewAI wrappers are in active development. Constructor-injected storage adapters support in-memory by default and SQLite opt-in.
mcp-server · langchain · crewai

02 / Mechanism

How the privacy engine works

— 01
Shield your TAO
Deposit TAO into the ShieldedPool contract. A Poseidon commitment is inserted into the on-chain Merkle tree. Your agent holds the nullifier + secret off-chain.
→
— 02
Route via stealth address
A fresh ERC-5564 stealth address is generated per inference. The StealthAnnouncer emits events. Miners scan with viewTag for their payments — no public linkability.
→
— 03
Prove membership
Generate a Groth16 ZK proof of Merkle membership. The verifier contract checks the proof on-chain, validates the nullifier registry, and releases funds atomically.
→
01
Policy Engine
Per-transaction and cumulative spend limits with time windows. Whitelist/denylist. Chain restrictions. Priority-ordered rule evaluation. 20 tests passing.
02
Session Manager
Session lifecycle create → active → expired/terminated. Auto-expiry on access. Stale-session cleanup. Isolated per-agent context.
03
Shielded Treasury
UTXO note management. Nullifier-based double-spend prevention. Greedy UTXO selection. Multi-token balances. Transactional markSpent() for atomic nullifier marking.
PASResult<T> for all fallible ops
04
Stealth Addresses
ERC-5564 ECDH stealth generation. viewTag fast-scan filter. Round-trip generate → scan verification. secp256k1 point arithmetic via @noble/curves.
AI AGENT policy · sessions · treasury SHIELDED POOL Bittensor EVM · Chain 964 deposit TAO POSEIDON MERKLE TREE root ← new commit ZK PROVER Groth16 · Circom depth-20 Groth16 proof STEALTH ADDR ERC-5564 · ECDH viewTag MINER Bittensor subnet anonymous 261 tests · phases 0–7 complete

03 / Deployed

Live on Bittensor mainnet

Network Chain ID RPC Currency
Mainnet 964 lite.chain.opentensor.ai TAO (18 decimals)
Testnet 945 test.chain.opentensor.ai TAO (18 decimals)
Contract Address
PoseidonT3 0x94e6A6EaB47C1DE2Ced10dB042C35C8CF28BD398
Groth16Verifier 0xA3FFE2Eabc46404A46337c4EC47a62da5F2794ee
ShieldedPool 0xf42E35258a682D4726880c3c453c4b96821f2b04
StealthAnnouncer 0xE5e3d47BF0aE09E7D4F6b36A5da285254CCfE0F7
Deployment Details

Tree depth: 20 levels — supports up to 1,048,576 deposits. Deployer: 0x14d119BEFf4A5dE286C3e4DC5F8C8fc8783f300f

04 / FAQ

Frequently asked
questions

Why Bittensor?+
Bittensor's Subtensor EVM is the primary market for AI agent inference. TAO-denominated payments between agents and miners create a natural surface for privacy attacks — correlating who queries what, from where, and how often. Peek-a-boo makes those payments opaque. Ethereum L2 and Aztec adapters are also on the roadmap.
Are the contracts audited?+
The contracts are open source but have not yet been formally audited. A professional security audit is on the roadmap before expanding production usage. All code is publicly verifiable on GitHub.
How do I integrate with my agent?+
The @pas/mcp-server package exposes all privacy operations as MCP-compatible tools. Any agent that supports MCP (Claude, OpenClaw, custom daemons) can call shield, unshield, and stealth routing natively. LangChain and CrewAI wrapper packages are actively being developed. The @pas/sdk provides a high-level programmatic API for direct integration.
Can I use Peek-a-boo for non-inference payments on Bittensor?+
Yes. The ShieldedPool accepts any TAO deposit regardless of purpose. The privacy guarantees — Poseidon commitments, Groth16 ZK proofs, nullifier-based double-spend prevention — are the same whether you're paying for inference, transferring TAO between wallets, or any other on-chain operation.

Contracts deployed on mainnet

Shield your
TAO.

Bittensor mainnet · ZK circuits · 261 passing tests · MCP-native

View on GitHub ↗ Join Discord ↗