Three fields where the standard answer asks you to hand over your identity, your data, or your ballot to an institution and hope it behaves. Three privacy-preserving constructions that let you prove what the institution needs to know, and nothing more, with a number that tells you exactly when the substitution is safe.
Here is a bold claim: Each paper is an industry breakthrough. Do not take my word for it. Next to each paper, click the "Verify with Claude" button to ask the question: "Does this paper manage to achieve something that the industry and civil rights organizations have been treating as impossible in practice?" The answer, surprisingly, speaks for itself.
Academic Paper 1 · Privacy-preserving attribute verification
A wave of 2026 laws now conditions online access on proving something about yourself, usually that you're over 18. The deployed method, uploading a government ID and a selfie to a third-party verifier, de-anonymizes adults and builds exactly the kind of identity database that keeps getting breached. The primitive that avoids this already exists. What was missing, and what this paper supplies, is the trust model and the distribution layer to make it real.
"Prove you're an adult" gets implemented as "send a stranger your driver's license and a photo of your face." Every verifier becomes a honeypot. These breaches already happened: a roughly 70,000-record government-ID leak through a third-party age-check vendor, and others. And selfie checks are increasingly defeated by deepfakes, so the method fails on both ends, leaking real identities while letting synthetic ones through.
This is not a hypothetical or a strawman. Anthropic has begun verifying identity on Claude, and the requirements are exactly the pattern above: a valid government-issued photo ID, the physical document in hand, plus a live selfie taken with your phone or webcam. The work is careful and privacy-minded, the ID and selfie are held by the verification partner rather than on Anthropic's own systems, and the data is contractually walled off from model training. It is about as responsible as this architecture allows. And that is the point. Even done well, it rests on what the help page states plainly: "We selected Persona Identities as our verification partner based on the strength of their technology, privacy controls, and security safeguards." Your privacy now depends on a chain of trust, you trust Anthropic, Anthropic trusts Persona, Persona trusts its own controls, and your government ID and face sit at the end of that chain in a third party's store. That is transitive trust, the precise thing this paper is built to remove. The breaches cited above were also at third-party vendors that someone had vetted and trusted.
What's actually being built
Run this way, age verification quietly constructs an identity-mediated internet: a record, somewhere, tying each adult to each site they entered. The goal of the paper is to satisfy the same laws without building that.
The building block is an unlinkable token that attests a predicate, "the holder is over 18," without carrying the birthdate or any identifier. You prove the fact and nothing else, and two presentations of it can't be tied together.
An unlinkable token still has to be issued by someone, and a single issuer is a single point of control: it can refuse you, tag you, or, if consulted at use time, watch you. The paper issues through an M-of-N threshold committee. No single party, the state included, can forge a token, deny an eligible person, or deanonymize anyone below the threshold. Trust drops from one authority to a quorum, with a stated, honest caveat: the guarantee is exactly as strong as the independence of those issuers.
Here's the subtle contribution. Even a perfectly unlinkable token can leak through its vintage, the era it was issued. If a token carries an issuance timestamp, or verifies against a key that the issuer rotates each year, then "this verifies under the 2026 key" silently narrows down its holder, and an old token implies a higher age than the predicate alone. Nobody had closed this channel.
The paper closes it two ways, and proves it. The clean way uses a stable predicate key that never rotates (security refreshed underneath by proactive resharing), so every token of every era verifies identically and the era signal vanishes. The retrofit way mixes tokens among current holders, reissuing fresh ones, with a guarantee that protection only grows the more you mix and never shrinks. The corrected proof is sharp: a sound mix leaves the era posterior equal to the prior, so the vintage leakage is exactly zero.
Last piece: how do you stop someone replaying a captured proof, or using a deepfake to pass the check? The proof is bound to a key sealed in your device's secure element, released only behind an on-device liveness gate. The biometric never leaves your device. A captured presentation can't be replayed against a fresh challenge, and a deepfake aimed at the verifier never reaches the local gate that releases the key, so it can't produce a valid proof. The residual risk is the gate's own false-accept rate, stated plainly rather than hidden.
The result
A jurisdiction can enforce an age mandate and preserve privacy at once: no identity disclosed, no honeypot to breach or subpoena. The person shifts from a reusable bureau credential to a per-action proof from their own device, linkable to nothing.
Academic Paper 2 · Reporting how groups voted without exposing how anyone did
Say you want to know how a demographic group voted: how veterans split on a measure, how a neighborhood leaned. You want the real breakdown, and you don't want anyone reconstructing how a specific person voted. The reflex from the privacy field is to add random noise to the numbers. This paper shows that often you don't have to, and gives you the test for when adding noise is actually necessary.
The architecture runs one sealed election per demographic dimension and gives each voter credentials that can't be linked across dimensions, so no combined "this person is a 40-year-old veteran who voted X" record is ever stored. What's published is the set of margins: the totals along each axis. The question is what someone can back out about an individual from those published totals.
Model the full breakdown as a grid (a contingency tensor). Publishing the margins is like publishing the row sums and column sums of a table without the inside. There are usually many different interiors consistent with the same edges, so the exact interior is generically not recoverable. How much is hidden has a clean closed form: the classic Fréchet bounds give the exact range each individual cell could occupy given the published margins.
So disclosure depends on where the published margins land, not on the architecture. When a margin sits near an extreme (almost everyone in a tiny group voted the same way) the bounds collapse and the cell is exposed. The paper gives the collapse conditions and a constant-time rule for whether a given release keeps everyone covered.
Differential privacy, the field's default, protects by adding calibrated random noise to every release. That works, but it taxes accuracy whether or not the particular release was ever a threat. The result here is that privacy becomes a per-cell quantity you read off the data: the binding outcome, the most aggregated number of all, is published exactly with no noise; group breakdowns stay publishable while each voter stays unlinkable; and noise gets spent only on the specific cells near collapse, if any. For a large, ordinary electorate, that's often none.
The shift
From "blur everything by default" to "publish exact, measure the per-cell risk, add noise only where the numbers actually expose someone." The reconstruction threshold from the database-privacy literature still bounds how much you can release over time, and the paper places its releases below it.
The mechanism reaches well past voting. Any setting that needs honest group statistics from self-reported sensitive attributes can use the same unlinkable, one-account-per-person tokens, so the aggregate can't be inflated by ballot-stuffing and no individual is exposed. Three concrete cases:
Academic Paper 3 · Trustworthy remote elections
Voting from home sounds reckless to anyone who follows election security, and for good reason. The experts are right about the systems that exist. This paper asks a narrower question: can you build a remote election that gives you everything paper gives you, plus a result you can check yourself, and can you say precisely when that system is responsible to deploy?
Every voting method so far forces a trade among three things people want at once. A secret ballot, so no one can see how you voted or buy it from you. Integrity you can verify, so you know the count is real without taking an official's word. And a fast, available result.
Paper gives you the secret ballot and a kind of integrity rooted in physical custody, but no quick result and no way for you to check the count. Earlier electronic voting gives you a checkable count, but has never delivered a secret ballot and integrity that both survive a dishonest operator running the machine. That gap is the whole reason the expert consensus keeps electronic voting out of high-stakes elections.
The claim
A stack that holds all three at once: a secret ballot, integrity verifiable without trusting the operator, and a continuously available tally. The combination is what's new, not any single piece.
The construction assembles well-understood cryptographic parts, each doing one job. A blind signature lets the registrar certify that you're eligible without learning which ballot becomes yours, the way a notary could stamp a sealed envelope without seeing the letter. A commitment locks in your vote like a sealed envelope that can't be swapped later. A public bulletin board, built as a Merkle tree, lets anyone confirm their ballot is included and that no ballots were added or dropped. A verifiable tally, by mixing or by homomorphic addition, proves the final count follows from the posted ballots without ever opening them individually.
Add a threshold embargo, where several independent trustees must cooperate to open results, and no early partial count leaks. Put together, these give a property paper can't: after the election, you can confirm your own ballot counted and that the totals are honest, instead of trusting an authority's say-so.
A checkable ballot creates a new danger. If you can prove to yourself how you voted, you can often prove it to someone else, and anything you can prove, someone can force you to prove or pay you to prove. A system that lets you verify your vote and also hands you a receipt is a vote-buying machine.
You get a receipt that proves your choice. A coercer demands it. Now your secret ballot is for sale.
You can confirm your ballot is counted, but you cannot produce proof of which way you voted, even if you want to.
The paper closes this with two repairs. One withholds the opening information so a voter can't construct a usable receipt. The other, following the established JCJ approach, lets a coerced voter hand over a fake credential that silently produces a ballot which looks cast but never counts. The coercer can't tell the difference, so coercion stops paying.
Cryptography can secure the protocol, but it runs on your phone or laptop, and malware on that device can quietly change your vote before it's ever encrypted. This is the real reason serious people distrust internet voting, and pretending otherwise would be dishonest.
The answer here is a dual-root design. Your ballot is confirmed through two independent paths: an attested execution environment, and a separate device gated by an on-device biometric check that you're physically present. An attacker now has to subvert both independent roots at once to flip a vote without detection. The paper is explicit that this shrinks the risk rather than erasing it, and that when the safety condition fails, the honest fallback is paper.
This is the part that makes the paper more than a protocol. It reduces "should we deploy this?" to a single inequality you can actually evaluate. Define L, how much the outcome can move when a fixed fraction of ballots is corrupted (the Lipschitz constant of the voting rule). Secrecy, verifiability, and coercion-resistance hold regardless of L. The only thing L governs is how far an attacker who corrupts some ballots can shift the result.
In words: the value of stealing the election, times how much leverage the rule gives an attacker, must be less than the cost of subverting both roots, scaled by the largest fraction they could corrupt. Below that line, no rational attacker tries, because the prize is worth less than the break-in. Above it, you don't deploy. The same continuous-voting design that keeps stakes low per decision is what pushes most real elections to the safe side of the line.
The three papers attack different problems with the same move. In each, the status quo asks you to trust an institution: trust that the ID verifier won't leak or get breached, trust that the data collector won't look, trust the election authority's count. In each, the construction replaces that trust with something you can check or prove, while exposing less about yourself.
And each one ships with a number that says where the substitution is safe: the distribution and gate parameters for age, the per-cell identifiability width for reporting, the deployment inequality for voting. That's the part that turns a clever protocol into something you can actually decide to deploy.
The result
A person verifies or proves what an institution requires, rather than trusting it or surrendering identity to it, with a computable boundary for where that substitution is safe.