Verify, Don't Trust — Three Ways to Prove Without Exposing

🎂When age checks need not reveal identity

Academic Paper 1 · Privacy-preserving attribute verification

A wave of 2026 laws now conditions online access on proving something about yourself, usually that you're over 18. The deployed method, uploading a government ID and a selfie to a third-party verifier, de-anonymizes adults and builds exactly the kind of identity database that keeps getting breached. The primitive that avoids this already exists. What was missing, and what this paper supplies, is the trust model and the distribution layer to make it real.

🪪The problem: the ID-and-selfie honeypot

"Prove you're an adult" gets implemented as "send a stranger your driver's license and a photo of your face." Every verifier becomes a honeypot. These breaches already happened: a roughly 70,000-record government-ID leak through a third-party age-check vendor, and others. And selfie checks are increasingly defeated by deepfakes, so the method fails on both ends, leaking real identities while letting synthetic ones through.

This is not a hypothetical or a strawman. Anthropic has begun verifying identity on Claude, and the requirements are exactly the pattern above: a valid government-issued photo ID, the physical document in hand, plus a live selfie taken with your phone or webcam. The work is careful and privacy-minded, the ID and selfie are held by the verification partner rather than on Anthropic's own systems, and the data is contractually walled off from model training. It is about as responsible as this architecture allows. And that is the point. Even done well, it rests on what the help page states plainly: "We selected Persona Identities as our verification partner based on the strength of their technology, privacy controls, and security safeguards." Your privacy now depends on a chain of trust, you trust Anthropic, Anthropic trusts Persona, Persona trusts its own controls, and your government ID and face sit at the end of that chain in a third party's store. That is transitive trust, the precise thing this paper is built to remove. The breaches cited above were also at third-party vendors that someone had vetted and trusted.

What's actually being built

Run this way, age verification quietly constructs an identity-mediated internet: a record, somewhere, tying each adult to each site they entered. The goal of the paper is to satisfy the same laws without building that.

The building block is an unlinkable token that attests a predicate, "the holder is over 18," without carrying the birthdate or any identifier. You prove the fact and nothing else, and two presentations of it can't be tied together.

🧑‍🤝‍🧑No single issuer to trust

An unlinkable token still has to be issued by someone, and a single issuer is a single point of control: it can refuse you, tag you, or, if consulted at use time, watch you. The paper issues through an M-of-N threshold committee . No single party, the state included, can forge a token, deny an eligible person, or deanonymize anyone below the threshold. Trust drops from one authority to a quorum, with a stated, honest caveat: the guarantee is exactly as strong as the independence of those issuers.

📅The leak nobody noticed: vintage

Here's the subtle contribution. Even a perfectly unlinkable token can leak through its vintage , the era it was issued. If a token carries an issuance timestamp, or verifies against a key that the issuer rotates each year, then "this verifies under the 2026 key" silently narrows down its holder, and an old token implies a higher age than the predicate alone. Nobody had closed this channel.

The paper closes it two ways, and proves it. The clean way uses a stable predicate key that never rotates (security refreshed underneath by proactive resharing), so every token of every era verifies identically and the era signal vanishes. The retrofit way mixes tokens among current holders, reissuing fresh ones, with a guarantee that protection only grows the more you mix and never shrinks. The corrected proof is sharp: a sound mix leaves the era posterior equal to the prior, so the vintage leakage is exactly zero.

👤Binding a proof to a live person

Last piece: how do you stop someone replaying a captured proof, or using a deepfake to pass the check? The proof is bound to a key sealed in your device's secure element, released only behind an on-device liveness gate . The biometric never leaves your device. A captured presentation can't be replayed against a fresh challenge, and a deepfake aimed at the verifier never reaches the local gate that releases the key, so it can't produce a valid proof. The residual risk is the gate's own false-accept rate, stated plainly rather than hidden.

The result

A jurisdiction can enforce an age mandate and preserve privacy at once: no identity disclosed, no honeypot to breach or subpoena. The person shifts from a reusable bureau credential to a per-action...