$π$Creds: Privately Inferred Credentials
2026-06-02 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors introduce πCreds, a new system that uses large language models (LLMs) to create privacy-preserving digital credentials from verified data. Unlike older systems that only work with structured data and are complex, πCreds can handle unstructured information like text. The authors also identify new security and privacy risks caused by using LLMs and define two problems to describe them: one about attackers manipulating data to get false credentials and another about leaking private information through model choices. Their prototype works with real-world data in finance, health, email, and software, demonstrating the system's capabilities and studying the risks.
verifiable credentialsdecentralized systemszero-knowledge proofslarge language modelsprivacy-preservingadversarial examplespredicate poisoningauthenticated datasemantic reasoningcredential issuance
Authors
Samuel Breckenridge, Dani Vilardell, Derek Leung, Andrés Fábrega, James Austgen, Farinaz Koushanfar, Ari Juels
Abstract
Decentralized verifiable credential systems have seen limited deployment in practice. Existing constructions, built on zero-knowledge proofs, are complex, application-specific, and largely restricted to predicates over structured data. We present Privately Inferred Credentials ($π$Creds): privacy-preserving, legacy-compatible, decentralized verifiable credentials generated by trusted LLM inference over authenticated data. LLMs' ability to semantically reason over unstructured data substantially expands the range of claims $π$Creds can certify over existing credential systems. The use of LLMs also introduces new application-level threats, which we formalize through two problems: the Source-Constrained Adversarial Example (SCAE) problem, which captures robustness against adversaries that manipulate authenticated data to obtain misleading credentials, and the Authenticated Covert Predicate Poisoning (ACPP) problem, which captures privacy leakage through adversarial model selection. We characterize applications of $π$Creds over user data, and a novel class of credentials over proprietary software that certifies properties of a service without revealing its source code. Our prototype supports issuing credentials over live financial, health, email, and code sources, and we empirically study the SCAE and ACPP threats on a product expertise credential over real financial data.