Private AI Inference on Midnight: Keep Your Data Secret, Prove Your Output is Real

# Install the Compact compiler (check docs.midnight.network for latest version)

# Download from: https://github.com/midnightntwrk/compact/releases

# Add the compact binary to your PATH



compact --version

# compact 0.22.x

node --version   # requires v22+



mkdir private-ai-midnight && cd private-ai-midnight

yarn init -y



yarn add @midnight-ntwrk/midnight-js-contracts \

         @midnight-ntwrk/midnight-js-network-id \

         @midnight-ntwrk/midnight-js-types \

         @midnight-ntwrk/wallet \

         typescript ts-node

private-ai-midnight/

├── contracts/

│   └── art-style-marketplace.compact    # Compact smart contract

├── src/

│   ├── vault.ts          # Encrypted private data vault

│   ├── commitment.ts     # Merkle commitment

│   ├── inference.ts      # Local AI inference

│   ├── deploy.ts         # Deploy the Compact contract

│   └── consumer.ts       # Consumer: pay and verify

├── package.json

└── tsconfig.json

# Clone the Midnight starter environment

git clone https://github.com/midnightntwrk/example-hello-world.git devnet

cd devnet && yarn install



# Start the local proof server and devnet (Docker required)

yarn env:up

// src/vault.ts

import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';



const ALGORITHM = 'aes-256-gcm';



export interface VaultRecord {

  artistId: string;

  styleEmbeddings: number[];   // private — artist's style vectors

  description: string;

}



export class PrivateVault {

  private key: Buffer;



  constructor(key?: Buffer) {

    this.key = key ?? randomBytes(32); // 256-bit key

  }



  static fromKey(keyHex: string): PrivateVault {

    return new PrivateVault(Buffer.from(keyHex, 'hex'));

  }



  getKeyHex(): string {

    return this.key.toString('hex');

  }



  encrypt(record: VaultRecord): Buffer {

    const nonce = randomBytes(12);          // 96-bit nonce for GCM

    const cipher = createCipheriv(ALGORITHM, this.key, nonce);

    const plaintext = JSON.stringify(record);

    const ciphertext = Buffer.concat([

      cipher.update(plaintext, 'utf8'),

      cipher.final(),

    ]);

    const authTag = cipher.getAuthTag();    // GCM authentication tag

    // Layout: [nonce (12)] [authTag (16)] [ciphertext]

    return Buffer.concat([nonce, authTag, ciphertext]);

  }



  decrypt(blob: Buffer): VaultRecord {

    const nonce = blob.subarray(0, 12);

    const authTag = blob.subarray(12, 28);

    const ciphertext = blob.subarray(28);

    const decipher = createDecipheriv(ALGORITHM, this.key, nonce);

    decipher.setAuthTag(authTag);

    const plaintext = Buffer.concat([

      decipher.update(ciphertext),

      decipher.final(),

    ]).toString('utf8');

    return JSON.parse(plaintext) as VaultRecord;

  }

}



// Usage (artist one-time setup)

const vault = new PrivateVault();

const record: VaultRecord = {

  artistId: 'alice_impressionist_v1',

  styleEmbeddings: [0.12, 0.87, 0.43, /* ... 512-dim vector */],

  description: 'Watercolour impressionist portfolio — 300 pieces',

};



const blob = vault.encrypt(record);

// Save: blob → vault.bin  |  vault.getKeyHex() → vault.key

// NEVER share vault.key

// src/commitment.ts

import { createHash } from 'crypto';



function sha256(data: Buffer): Buffer {

  return createHash('sha256').update(data).digest();

}



export function buildMerkleRoot(leaves: Buffer[]): string {

  if (leaves.length === 0) throw new Error('Need at least one leaf');



  let layer = leaves.map(l => sha256(l));



  while (layer.length > 1) {

    if (layer.length % 2 === 1) layer.push(layer[layer.length - 1]);

    const next: Buffer[] = [];

    for (let i = 0; i < layer.length; i += 2) {

      next.push(sha256(Buffer.concat([layer[i], layer[i + 1]])));

    }

    layer = next;

  }



  return layer[0].toString('hex');

}



export function commitToVault(records: object[]): string {

  /**

   * Commits to record METADATA only — not raw embeddings.

   * The root is published on-chain via the Compact contract.

   *

   * Example records: [{ embeddingId: 'style_001', shape: [512] }]

   */

  const leaves = records.map(r =>

    Buffer.from(JSON.stringify(r, Object.keys(r).sort()), 'utf8')

  );

  return buildMerkleRoot(leaves);

}



// Usage

const merkleRoot = commitToVault([

  { embeddingId: 'style_001', artistId: 'alice', shape: [512] },

  { embeddingId: 'style_002', artistId: 'alice', shape: [512] },

]);

console.log('Public commitment (goes on-chain):', merkleRoot);

// src/inference.ts

import { PrivateVault } from './vault';

import { createHash } from 'crypto';

import { readFileSync } from 'fs';



/**

 * StyleAdapter — fuses a public prompt embedding with

 * a private style embedding to produce a conditioned output.

 *

 * In production: replace with a real ONNX model or LoRA adapter.

 * The key invariant is: style_emb comes from vault, never from network.

 */

function styleAdapter(

  promptEmb: number[],

  styleEmb: number[],

): number[] {

  // Simplified: weighted combination (replace with real model)

  return promptEmb.map((p, i) => 0.6 * p + 0.4 * (styleEmb[i] ?? 0));

}



export interface InferenceResult {

  outputEmbedding: number[];

  outputHash: string;      // hash of output — used as public input to ZK proof

  commitmentRoot: string;  // artist's Merkle root — anchors to on-chain identity

}



export function runPrivateInference(

  promptEmbedding: number[],

  vaultBlob: Buffer,

  vaultKeyHex: string,

  commitmentRoot: string,

): InferenceResult {

  // 1. Load private style from vault (stays in memory only)

  const vault = PrivateVault.fromKey(vaultKeyHex);

  const record = vault.decrypt(vaultBlob);

  const styleEmb = record.styleEmbeddings;



  // 2. Run inference locally (private data NEVER leaves this function scope)

  const outputEmbedding = styleAdapter(promptEmbedding, styleEmb);



  // 3. Hash the output (public input for ZK verification)

  const outputHash = createHash('sha256')

    .update(JSON.stringify(outputEmbedding))

    .digest('hex');



  // style_emb is garbage-collected after this return — never persisted

  return { outputEmbedding, outputHash, commitmentRoot };

}

// contracts/art-style-marketplace.compact

pragma language_version >= 0.22;



import CompactStandardLibrary;



// ── On-chain state (public, persistent on Midnight ledger) 



// Registered artist profiles

export ledger artistCommitments: Map<Bytes<32>, ArtistProfile>;



// Used proof hashes (prevents replay attacks)

export ledger usedProofs: Set<Bytes<32>>;



// Total queries processed

export ledger totalQueries: Counter;



//  Data types 



struct ArtistProfile {

  commitment: Bytes<32>,       // Merkle root of private data vault

  pricePerQuery: Uint<64>,     // price in tDUST (smallest unit)

  active: Boolean,

  totalEarned: Uint<64>,

  totalQueries: Counter,

}



//  Witness (runs off-chain with private data) 



/**

 * The witness is the key privacy primitive.

 * It runs locally on the artist's machine, accesses the private vault,

 * and produces a proof that inference ran correctly — without any

 * private data reaching the blockchain.

 *

 * Inputs (private, never on-chain):

 *   - styleEmbedding: the artist's private style vector

 *   - promptEmbedding: the consumer's prompt vector

 *

 * Outputs (public, verified on-chain):

 *   - outputHash: SHA-256 of the inference output

 *   - commitmentRoot: artist's Merkle root (must match ledger)

 */

witness inferenceWitness(

  styleEmbedding: Bytes<64>,    // private — from encrypted vault

  promptEmbedding: Bytes<64>,   // public prompt, encoded as bytes

): { outputHash: Bytes<32>, commitmentRoot: Bytes<32> };



// Entry points (circuits)



/**

 * Artist registers their commitment on-chain.

 * Only the Merkle root is stored — no raw data.

 */

export circuit registerArtist(

  commitment: Bytes<32>,

  pricePerQuery: Uint<64>,

): [] {

  const artistKey = disclose(commitment);



  assert(!artistCommitments.member(artistKey), "Commitment already registered");

  assert(pricePerQuery > 0, "Price must be positive");



  artistCommitments.insert(artistKey, ArtistProfile {

    commitment: artistKey,

    pricePerQuery: disclose(pricePerQuery),

    active: true,

    totalEarned: 0,

    totalQueries: Counter.new(0),

  });

}



/**

 * Consumer submits a prompt and triggers proof verification.

 * The witness runs off-chain; the contract verifies the proof on-chain.

 * Payment in DUST is handled by the Midnight runtime.

 */

export circuit purchaseAndVerify(

  artistCommitment: Bytes<32>,

  promptEmbedding: Bytes<64>,

): Bytes<32> {

  // 1. Look up the registered artist

  assert(

    artistCommitments.member(artistCommitment),

    "Artist not registered"

  );

  const profile = artistCommitments.lookup(artistCommitment);

  assert(profile.active, "Artist profile is inactive");



  // 2. Run the witness off-chain (private inference + proof generation)

  //    The witness accesses the vault locally; only outputHash and

  //    commitmentRoot are returned to the on-chain circuit.

  const { outputHash, commitmentRoot } = inferenceWitness(

    /* styleEmbedding — provided by artist's local DApp, never on-chain */,

    promptEmbedding,

  );



  // 3. Verify the commitment matches the registered artist

  assert(

    commitmentRoot == artistCommitment,

    "Proof commitment does not match registered artist"

  );



  // 4. Prevent proof replay

  assert(!usedProofs.member(outputHash), "Output hash already used");

  usedProofs.insert(outputHash);



  // 5. Update counters

  totalQueries.increment(1);

  const updatedProfile = ArtistProfile {

    commitment: profile.commitment,

    pricePerQuery: profile.pricePerQuery,

    active: profile.active,

    totalEarned: profile.totalEarned + profile.pricePerQuery,

    totalQueries: profile.totalQueries,

  };

  artistCommitments.insert(artistCommitment, updatedProfile);



  // 6. Return the verified output hash to the consumer

  //    Consumer uses this to confirm the output they received is authentic

  return outputHash;

}



/**

 * Artist can deactivate their profile.

 */

export circuit deactivateArtist(commitment: Bytes<32>): [] {

  const key = disclose(commitment);

  assert(artistCommitments.member(key), "Not registered");

  const profile = artistCommitments.lookup(key);

  artistCommitments.insert(key, ArtistProfile {

    commitment: profile.commitment,

    pricePerQuery: profile.pricePerQuery,

    active: false,

    totalEarned: profile.totalEarned,

    totalQueries: profile.totalQueries,

  });

}



/**

 * Anyone can look up an artist profile by their commitment.

 */

export circuit getArtistProfile(commitment: Bytes<32>): ArtistProfile {

  assert(artistCommitments.member(commitment), "Artist not found");

  return artistCommitments.lookup(commitment);

}

compact compile \

  contracts/art-style-marketplace.compact \

  contracts/managed/art-style-marketplace.compact

// src/deploy.ts

import {

  ContractAddress,

  deployContract,

  findContractDeployment,

} from '@midnight-ntwrk/midnight-js-contracts';

import { NetworkId } from '@midnight-ntwrk/midnight-js-network-id';

import { WalletBuilder } from '@midnight-ntwrk/wallet';

import { commitToVault } from './commitment';



// The compiled contract artifacts (generated by `compact compile`)

import { ArtStyleMarketplaceContract } from '../contracts/managed/art-style-marketplace.compact/contract';



async function deployMarketplace() {

  // 1. Connect wallet (pre-funded devnet wallet for local testing)

  const wallet = await WalletBuilder.buildFromSeed(

    'http://localhost:9000',   // proof server

    'http://localhost:8080',   // indexer

    NetworkId.TestNet,

    process.env.WALLET_SEED!,

  );



  await wallet.sync();

  console.log('Wallet synced. DUST balance:', await wallet.balanceDust());



  // 2. Deploy the Compact contract

  const contract = new ArtStyleMarketplaceContract();

  const deployment = await deployContract(wallet, contract);



  console.log('Contract deployed at:', deployment.contractAddress);

  return deployment.contractAddress;

}



async function registerArtist(

  contractAddress: ContractAddress,

  vaultRecords: object[],

  pricePerQuery: bigint,

) {

  const wallet = await WalletBuilder.buildFromSeed(/* ... */);

  await wallet.sync();



  // Compute Merkle commitment from vault metadata (not raw data)

  const merkleRoot = commitToVault(vaultRecords);

  const commitmentBytes = Buffer.from(merkleRoot, 'hex');



  // Call the Compact contract entry point

  const contract = new ArtStyleMarketplaceContract();

  const deployment = await findContractDeployment(wallet, contract, contractAddress);



  await deployment.callTx.registerArtist(

    commitmentBytes,

    pricePerQuery,  // in tDUST

  );



  console.log('Artist registered with commitment:', merkleRoot);

  console.log('Price per query:', pricePerQuery, 'tDUST');

}



export { deployMarketplace, registerArtist };

// src/consumer.ts

import { findContractDeployment } from '@midnight-ntwrk/midnight-js-contracts';

import { WalletBuilder } from '@midnight-ntwrk/wallet';

import { ArtStyleMarketplaceContract } from '../contracts/managed/art-style-marketplace.compact/contract';

import { runPrivateInference } from './inference';

import { createHash } from 'crypto';



/**

 * Consumer flow:

 * 1. Look up artist profile on-chain

 * 2. Send prompt to artist's service (off-chain)

 * 3. Receive output embedding + outputHash from artist

 * 4. Call purchaseAndVerify — Midnight verifies the ZK proof

 * 5. Confirm the on-chain outputHash matches what artist sent

 */

async function purchaseInference(

  contractAddress: string,

  artistCommitment: string,

  promptEmbedding: number[],

) {

  // 1. Connect consumer wallet

  const wallet = await WalletBuilder.buildFromSeed(

    'http://localhost:9000',

    'http://localhost:8080',

    /* NetworkId.TestNet, */

    process.env.CONSUMER_WALLET_SEED!,

  );

  await wallet.sync();



  const contract = new ArtStyleMarketplaceContract();

  const deployment = await findContractDeployment(

    wallet, contract, contractAddress

  );



  // 2. Encode prompt as bytes for the contract

  const promptBytes = Buffer.from(JSON.stringify(promptEmbedding));



  // 3. Call purchaseAndVerify

  //    - Midnight routes the DUST payment privately

  //    - The witness runs on the artist's machine (off-chain)

  //    - The on-chain circuit verifies commitment + proof

  //    - Returns the verified outputHash

  const verifiedOutputHash = await deployment.callTx.purchaseAndVerify(

    Buffer.from(artistCommitment, 'hex'),

    promptBytes,

  );



  console.log(' Proof verified on-chain!');

  console.log('Verified output hash:', Buffer.from(verifiedOutputHash).toString('hex'));



  return verifiedOutputHash;

}



/**

 * After receiving the output embedding from the artist off-chain,

 * the consumer can confirm it matches the on-chain verified hash.

 */

function confirmOutputAuthenticity(

  outputEmbedding: number[],

  verifiedOutputHash: Uint8Array,

): boolean {

  const localHash = createHash('sha256')

    .update(JSON.stringify(outputEmbedding))

    .digest();



  const matches = Buffer.from(verifiedOutputHash).equals(localHash);



  if (matches) {

    console.log(' Output is authentic — hash matches on-chain verification');

  } else {

    console.log('Output hash mismatch — do not trust this output');

  }



  return matches;

}



export { purchaseInference, confirmOutputAuthenticity };

// scripts/artist-setup.ts

import { PrivateVault } from '../src/vault';

import { deployMarketplace, registerArtist } from '../src/deploy';

import { writeFileSync } from 'fs';



async function setup() {

  // 1. Create and encrypt the private vault

  const vault = new PrivateVault();

  const record = {

    artistId: 'alice_impressionist',

    styleEmbeddings: [/* 512-dim vector from CLIP or fine-tuned model */],

    description: 'Watercolour impressionist portfolio',

  };

  const blob = vault.encrypt(record);



  writeFileSync('vault.bin', blob);

  writeFileSync('vault.key', vault.getKeyHex(), 'utf8');

  console.log('Vault encrypted and saved.');



  // 2. Deploy the marketplace contract (once per platform)

  const contractAddress = await deployMarketplace();

  writeFileSync('contract-address.txt', contractAddress, 'utf8');



  // 3. Register artist on-chain with Merkle commitment

  await registerArtist(

    contractAddress,

    [{ embeddingId: 'style_001', shape: [512] }],

    BigInt(1_000_000),  // 1 tDUST per query

  );



  console.log('Artist registered on Midnight.');

  console.log('Contract:', contractAddress);

}



setup();

// scripts/consumer-query.ts

import { purchaseInference, confirmOutputAuthenticity } from '../src/consumer';

import { readFileSync } from 'fs';



async function query() {

  const contractAddress = readFileSync('contract-address.txt', 'utf8');

  const artistCommitment = process.env.ARTIST_COMMITMENT!;



  // Consumer's prompt (e.g., from a text embedding model)

  const promptEmbedding = Array.from({ length: 512 }, () => Math.random() - 0.5);



  // 1. Call purchaseAndVerify on Midnight

  //    DUST payment routed privately

  //    Witness runs on artist's machine (private inference)

  //    Contract verifies proof on-chain

  const verifiedHash = await purchaseInference(

    contractAddress,

    artistCommitment,

    promptEmbedding,

  );



  // 2. Artist sends output embedding off-chain (e.g., via API)

  const outputEmbedding = [/* received from artist's service */];



  // 3. Confirm authenticity

  const authentic = confirmOutputAuthenticity(outputEmbedding, verifiedHash);

  console.log('Authentic:', authentic);

}



query();