A privacy-first protocol for AI data and intellectual property.

Abstract

Individuals and organizations need to keep the data that trains and feeds their AI without handing it to an operator. Existing decentralized stores provide availability, not confidentiality; content is public by default, and the provenance of training data cannot be checked without trusting someone.

Ghostdrive combines (i) content-defined chunking with client-side AES-256-GCM under keys derived from the user's own credentials, with every encrypted block a standard IPFS block; (ii) a libp2p swarm where every block is verified against its address; (iii) storage proofs any stranger can check, settled by an escrow contract on Base; and (iv) a recursive zk-SNARK registry in which one constant-size proof attests that every entry carries a quality score signed by a quorum of reviewers.

Data layer

Files are split by a Gear rolling hash (FastCDC-style): minimum 32 KiB, target 128 KiB, maximum 256 KiB − 28 bytes. Each chunk is encrypted and addressed by its ciphertext, so every block is a standard raw IPFS leaf.

A key ring is derived with HKDF-SHA256 from the user's root material (a wallet signature, a passkey PRF output, or a recovery phrase). Under the default convergent policy each chunk has its own key, so identical chunks of one user encrypt to identical blocks — that is what deduplicates versions — while different users never share keys. A file's manifest lists its chunk addresses and keys and is itself encrypted; sharing is a capability: drive369:v3:<manifestCID>:<key>.

CID = CIDv1( raw, sha2-256( E(chunk) ) )

kᵢ = HMAC( convKey, "chunk:" ‖ SHA-256(chunkᵢ) )
IVᵢ = HMAC( ivKey(kᵢ), SHA-256(chunkᵢ) )[0..12)

Distribution layer

Nodes run libp2p with Noise and Yamux, a Kademlia DHT and a block protocol (/ghostdrive/block/1.1.0: want-lists of up to 64 blocks per stream, so a file costs a few round trips, not one per block). Browsers connect over WebSockets and reach each other directly over WebRTC, signalled through any node acting as a circuit relay. Readers become seeders: every fetched block is re-announced, and blocks of one file are striped across holders by rendezvous hashing. Every block is re-hashed against its CID on arrival.

Succinct registry

The registry holds reviewed datasets, model cards and works. It is committed by a recursive o1js proof. For every entry the circuit enforces a score between 85 and 100, valid Schnorr signatures from at least two of three committee reviewers, and correct folding. Each checkpoint carries the previous checkpoint as its base and is anchored on Base by RegistryAnchor, which accepts only an append to the latest checkpoint. A light client checks the anchor chain, fetches the proof by its CID and verifies it.

headᵢ = Poseidon( headᵢ₋₁, H(entryᵢ), scoreᵢ )

Incentive layer

An owner opens a StorageEscrow deal with a storage root, a number of epochs, a price per epoch and a provider stake. In each epoch the deal's challenged segment indices (32 by default) are derived from the epoch-start block hash mixed with a drand randomness round verified on-chain, the provider submits those segments with their Merkle paths, and the contract verifies them itself and pays at once. Two missed epochs forfeit the stake and refund every unpaid epoch. Providers earn on data they can never read.

leaf = SHA-256( 0x00 ‖ segment )
node = SHA-256( 0x01 ‖ left ‖ right )

Evaluation

Apple M5 Pro, Node 26, protocol v3.1 — reproduce with npm run bench.

What it does not claim

• A storage proof shows that someone holds the data each epoch; it cannot prove three providers hold three distinct copies. Replication is enforced by stake and repair; erasure-coded deals are the planned remedy.
• The registry proves that a quorum of named reviewers signed a score — not that their judgment is good. That is governance.
• Training lineage is a tamper-evident record of which registry state a model claims, not a proof that training consumed that data.
• The contracts are not yet deployed or audited. Mainnet waits for an external audit.