Can an algorithm prove that it produced its own output?

79 Views Asked by At

Apologies in advance for my ignorance. I am working on a research question in a different area, and it would be helpful to know the answer to the following question, or even a reference to any such results or discussion (I don't even know what terms to look for).

Imagine that you have a well-defined algorithm that takes some input data, does some operations and perhaps generates or uses some random numbers/coin flips, and then based on these steps produces an output. Suppose an outside observer is told that this algorithm ran to produce some output. The outside observer sees the output, but does not see the input (or all of the input). Is there a way to structure the algorithm in a way that allows the outside observer to CHECK or VERIFY that the output came from the algorithm and was not tampered with by a malicious actor?

I am sure this is a question that has been studied before, I just don't know what to look for when searching for the answer. Any guidance would be much appreciated!

1

There are 1 best solutions below

2
On

There are 2 ways to look at this.

(SCENARIO 1) Observer ( OB ) has no way to control the algorithm & has no way to query the algorithm for later verification & has no way to know the Input & has only the Output to Observe

In this Case , there is no way to confirm or verify , in most general terms.
It is generally valid to assume that the algorithm has multiple outputs , which vary with the inputs.
Then Malicious Actor ( MA ) can give Input $I_1$ , collect the output $O_1$ & store it for later use.
When OB wants the Output to Input $I_2$ ( which OB is not even aware of ) , then MA can give $O_1$ , not $O_2$ , which OB will never figure out.

At most , we can try to be sure that the Output was generated by the algorithm , by making the algorithm insert some Cryptographic CodeWord , which can be extracted by some Computations , while being Cryptographically hard to insert.
In that Case , MA can not make up fictitious Output $O_3$ , because the Cryptographic CodeWord Extraction will fail.

(SCENARIO 2) Observer ( OB ) can control the algorithm , having a way to query the algorithm for later verification ( while not knowing the Input ) & can get the Output to Observe

In this Case , when the algorithm is about to make the calculations , OB can give a Secret CodeWord Input while the Core Input is not known. The calculation can continue & at the end , the algorithm can generate the Cryptographic Hash of Core Input , Core Output & Secret Input.
When this Output is given to OB , then OB can try to Extract the Secret CodeWord Input. If it matches , then the Output is valid.
OB can then Extract the Core Output & use it.
The Malicious Actor ( MA ) can not tamper with the Output , because the Secret Input is not known.
When MA gives some other Output $O_4$ to OB , then the Secret CodeWord Extraction will give some other Secret , alerting the OB that the Output is not valid.

Some Cryptography Keywords involved here are : Zero-Knowledge Proofs , Cryptographic Hashing , Tamper Detection , E-Voting Verification , Non-repudiation , Confidentiality, Integrity, Availability, Authenticity, Digital Signature , Public-Key Cryptography . . .

I have come across E-Voting Algorithms where each Person can vote ( Secret Input ) , & when the Votes are counted & Declared ( Core Output ) , each Person can verify that the Individual Vote was indeed included ( Extracting the Secret Input ) & thus can confirm that the over-all Count ( Core Output ) is Correct.
With this verification , no Person can check what some other Person voted.

[[ All of this should be taken with a Pinch of Salt , I am not involved in Cryptography !
This Question should go to Cryptography Stack Exchange or Information Security Stack Exchange where the Experts can give better thoughts ! ]]

Here are 2 Articles to know more about the topics listed :

https://medium.com/edge-elections/what-is-a-zero-knowledge-proof-aebe33cb47af

https://www.techtarget.com/searchsecurity/definition/nonrepudiation

Cryptography is very vast !
There is too much to list in this Single Answer !