1 Introduction↩︎

Clinical research studies rely on a wide variety of statistical tools and techniques to analyze patient outcomes so as to address the underlying biomedical research questions. Critically, these research questions can potentially help in deciphering the propensity of people to develop certain diseases [1], [2]; formulate statistically robust strategies for their disease prevention [3], [4]; as well as characterize or benchmark responses to therapeutic drugs on a wide demographic base [5], [6]. From a computational perspective however, the underlying techniques could potentially involve using statistical tests to help guide the core clinical research hypothesis [7], [8]; or utilize comparative benchmarking of different statistical models on varying demographic subgroups [9]. Therefore, computational correctness and data accountability are the two fundamental aspects that govern the integrity of the underlying statistical technique in clinical research studies [10], [11]. Transparently asserting computational correctness and data accountability involves patient privacy risks [12], [13], significant audit burdens on regulating authorities [14] as well as an inability to reliably claim patient exclusion [15], [16]. In this paper, we develop CoSMeTIC, a novel framework to assert computational correctness and user data privacy and accountability in clinical research studies using zero knowledge driven computational sparse Merkle trees (CSMTs).

The CoSMeTIC framework is primarily designed to resolve the three important critical gaps that exist in state of the art clinical research studies. First, ensuring the computational correctness of the study outcome becomes an essential precursor to guarantee the integrity of the clinical study. We define correctness in terms of the order as well as the precision of each computational step that belies the underlying statistical method. Asserting computational correctness in a transparent fashion can potentially help reduce the audit burden on regulatory bodies (such as the U.S. FDA), especially in large scale clinical studies that are geographically spread out. Second, the clinical study must also guarantee data accountability by demonstrating that the study outcomes are based on genuine patient data records. As part of the data accountability argument, the clinical study manager must also be capable of providing individual patients an inclusion or exclusion receipt pertaining to the use of their respective data records. Lastly, the entire computational graph from the raw user data to the final statistical outcome must be publicly verifiable in a transparent fashion, without the need to divulge identities of the patients or the users.

The CoSMeTIC framework is specifically designed to address problems of computational correctness, patient data privacy and accountability as well as transparency for regulatory authorities. For ensuring correctness, we first decompose the statistical technique into individual computational steps. Consequently, the CoSMeTIC framework leverages computational reductions (CR) which are regarded as the basic building blocks for statistics and data analytics [17], [18]. CR primitives have been widely used for carrying out large-scale data science and analytics pipelines and are the core drivers behind large scale compute frameworks such as Apache Spark [19] as well as Message Passing Interface (MPI) [18]. As a result, a series of CR primitives can be used to formally map each computational step involved in a statistical technique recursively from raw user data to the final statistical output. In this paper, we leverage CSMTs to represent each CR operation involved in the statistical method to enable membership proofs for distinct computational steps.

Conventionally, plain sparse Merkle Trees (SMTs) are defined on the basis of leaf space cardinality which must be equivalent to the output bit space of the hashing algorithm employed to construct the tree. By notionally equating the set of potential leaves with the set of total possible outcomes of a hash algorithm, an SMT can deliver inclusion as well as exclusion proofs for individual data records [20], [21]. However, the conventional SMT architecture relies on simple hash concatenation applied at each level of the tree which is fundamentally incompatible with the CR operations that seek to aggregate data across the entire clinical user dataset. As a result, it becomes significantly challenging to provide a verifiable computational trace regarding the statistical methodology of clinical studies while retaining user privacy and clinical audit efficiency.

In order to alleviate the CR-oriented limitations of the Merkle tree architecture, we propose the CSMT architecture that promises the potential of delivering user membership proofs with respect to individual computational steps themselves. In CoSMeTIC each CSMT represents one CR step with the corresponding primitive applied at each level of the Merkle tree. As a result, the CoSMeTIC framework enables user inclusion and exclusion proofs at each CR step of the statistical technique used in the clinical study. To induce transparency, we augment the CSMT architecture with publicly verifiable, zero-knowledge proofs that can assert the integrity of the data transformation and aggregation with complete privacy of the individual user. These zero-knowledge proofs rely on the zk-SNARK (Succinct, Non-interactive, Argument of Knowledge) paradigm and help assert the overall integrity of the entire statistical technique, capturing every transformation of raw user data records among a series of zk-SNARKs.

The CoSMeTIC framework delivers key benefits for both regulators and patients by addressing three critical gaps relating to computational correctness, data accountability, and privacy-preserving transparency. For regulators, CoSMeTIC enables efficient public verification of the correct execution of statistical methods underlying clinical study claims, significantly reducing audit burdens and potentially accelerating regulatory clearance. For patients and data contributors, the framework provides strong data governance guarantees through verifiable inclusion receipts and exclusion proofs, ensuring consent and accountability. Finally, publicly verifiable zk-SNARK proofs for leaf transformations and Merkle tree traversal offer transparent, end-to-end visibility into the study’s computational pipeline, allowing patients to understand precisely how their data was used and enabling regulators to pinpoint the exact role of individual records within the overall analysis.

Our work showcases the efficacy of the CoSMeTIC framework with respect to different statistical methods as well as real world case studies. We demonstrate the framework on illustrative datasets, Huntington’s disease CAG-repeat distributions and HIV-1 Temsavir resistance measurements, chosen to represent common genomic and virus resistance analysis workflows. Using these datasets we formulate clinical research studies involving the Kolmogorov-Smirnov (KS) statistical hypothesis tests as well as accuracy and Likelihood Ratio tests (LRT) to benchmark the predictive performance and fitting quality of logistic regression models, respectively. Our contributions can be summarized as follows:

• We develop a Computational Sparse Merkle Tree (CSMT) module that integrates CR primitives with the Merkle tree architecture that is capable of providing inclusion and exclusion proofs for individual computational steps as a means for privacy and accountability.

• We build a zk-SNARK driven framework that encodes the entire graph of CR primitives in zero-knowledge providing end-to-end transparency of the clinical study.

• We provide theoretical security guarantees regarding the robustness of the zero-knowledge framework that delivers patient data privacy, accountability and transparency.

• We demonstrate the performance of the framework on a wide range of statistical methods involving the KS hypothesis test as well as the LRT and accuracy tests for logistic regression applied towards the clinical datasets.

We now proceed to summarize the related work pertaining to SMTs in addition to a brief review of current state of the art methods in the domain of verifiable statistics.

2 Related Work↩︎

In recent years, there are strong emerging research trends pertaining to verifiable statistics. Custodes [22] certifies classical hypothesis tests (e.g., \(t\)-tests, \(\chi^2\) tests, ANOVA) by logging encrypted test evaluations and issuing cryptographically certified \(p\)-values, thereby deterring \(p\)-hacking. Verifiable differential privacy (VerDP) [23] and its follow-ups use zero-knowledge proofs to show that randomized mechanisms (e.g., Laplace noise for counts) have been applied correctly to sensitive data before releasing aggregate statistics. RiseFL [24] embeds a \(\chi^2\)-style goodness-of-fit test into a low-cost SNARK circuit to verify that federated-learning updates satisfy certain norm bounds, and ElectionGuard-based protocols [25] combine per-ballot zero-knowledge proofs with risk-limiting audits to statistically validate election outcomes.

While all of these works focus on verifiable statistics, they lack the ability to account for datum-level accountability. These systems demonstrate that hypothesis tests and related statistical procedures can be implemented inside zero-knowledge circuits, but they treat the underlying dataset as a monolithic object. The cryptographic guarantees apply to the correctness of the global test statistic or mechanism, not to verifiable claims about whether any specific individual’s datum was included or excluded from the analysis.

Existing work that targets privacy-preserving user-level data accountability, has made significant progress but only in terms of user-data oriented state accountability. Transparency dictionaries such as Verdict [20] introduce indexed Merkle trees that support succinct inclusion and non-inclusion proofs over a \(2^{256}\)-sized key space and can be combined with SNARK backends for lazy, on-demand verification. IMOK [21] extends sparse Merkle trees (SMTs) with non-prohibition proofs for sanction lists, while Cartesian Merkle Trees (CMTs) [26] and related constructions optimize membership and non-membership proofs for blockchain and rollup settings. Recent compliance-oriented systems, such as private smart wallets with probabilistic compliance [27], likewise use SMTs to certify that a given account is (or is not) contained in a prohibited set.

However, in all of these designs, Merkle leaves are treated as static key–value records, and the associated zero-knowledge circuits implement only lookup, append-only, or simple boolean predicates. None of these systems implements a computational SMT or Merkle-sum SMT that is capable of supporting arbitrary per-leaf transformations and numeric reductions over selected leaves. Further, they lack the capability of providing inclusion and exclusion proofs with respect to the aggregated reductions over individual datum belonging to specific users. Proof-of-solvency protocols based on Merkle-sum trees [28] do realize aggregation semantics at internal nodes, but typically over dense trees, without published non-membership circuits, and in financial rather than statistical-testing settings. Therefore, there exists a critical gap that needs to be bridged between the state accountability of the data, and the analysis accountability at the granularity of individual datum that is required in clinical studies. Additionally, for implementing these missing capabilities, we need novel methodologies that scale to sparse \(2^{256}\) key spaces while keeping proof generation lazy and participant-driven.

Taken together, the two strands of verifiable statistic and analysis accountability leave a critical gap for privacy-sensitive scientific domains such as clinical studies. On one side, SMT-based ZK frameworks provide efficient inclusion and non-inclusion proofs but are largely agnostic to the statistical computations performed over the committed dataset, and they lack Merkle-sum semantics tailored to complex tests. On the other side, ZK-based verifiable statistics frameworks ensure that certain hypothesis tests are executed correctly, but they do not cryptographically bind the test inputs to a fine-grained, participant-auditable commitment structure. In particular, they do not offer a way for a participant to ask, ex post, “Was my data used in this KS test, likelihood-ratio test, or regression model?” and receive a provable inclusion or non-inclusion proof tied to that exact computation. As a result, there is a clear lack of supporting methodologies that can provide individual-level data accountability with provable membership guarantees in aggregations over pre-defined user datasets.

Specifically in the domain of membership, there are two particular approaches, ELEKTRA [29] and PARAKEET [30] that provide the capability to authenticate with respect to public-key directories using variants of Merkle trees. However, these approaches are applicable to end-to-end encrypted communication paradigms. Consequently, these frameworks serve as authentication systems which cannot be used for demonstrating membership semantics across computational aggregation steps that are commonly found across a wide range of statistical approaches. Similarly, BalanceProofs [31] aggregates proofs over a vector commitment to enable fast batch verification in proof-of-solvency settings; it operates over dense trees, offers no non-membership proofs, and aggregates committed proof artifacts rather than the underlying data values themselves. However, the BalanceProof approach does not certify exclusion from specific statistical pipelines which would explicitly require support for aggregation semantics over arbitrary operations.

To the best of our knowledge, there is no existing framework that (i) instantiates a computational sparse Merkle tree in which internal nodes encode analysis-specific reductions (e.g., transformed sufficient statistics for KS or likelihood-ratio tests), (ii) supports both inclusion and exclusion proofs for individual participants with respect to a given statistical pipeline, (iii) provides a scalable extensible framework for applications with a large number of aggregation operations, and (iv) demonstrates these guarantees on real-world clinical datasets without degrading the fidelity of downstream hypothesis tests. CoSMeTIC is designed to precisely fill this gap by combining SMT-based, participant-centric accountability with zero-knowledge implementations of classical hypothesis tests and regression models used in large-scale clinical research.

3 Problem Formulation↩︎

We consider a group of \(n\) users denoted by \(U = \{u_1, u_2, \ldots, u_n\}\) wherein each user \(u_i\) possesses the raw datum \(\delta_i \in \mathbb{R}^d\) leading to a user group dataset denoted by \(\Delta_U\) as denoted in Equation 1 . \[\begin{gather} \label{eq:raw95ug} \Delta_U = \Big[\delta_1\ldots \delta_n\Big] \end{gather}\tag{1}\] Further, we consider a computational scheme consisting of a leaf transformation function denoted by \(\mathcal{L}\) and an aggregator function denoted by \(\mathcal{A}\) parametrized by parametrized by \(\theta_{\mathcal{L}},\theta_{\mathcal{A}}\) respectively as defined in Equations 2 , 3 . Their composite can be denoted as \(\mathcal{A} \circ \mathcal{L}\) as defined in Equation 4 respectively. \[\begin{gather} \mathcal{L}:\mathbb{R}^{d}\mapsto \mathbb{R}^p \tag{2}\\ \mathcal{A}:\mathbb{R}^{p\times n} \mapsto \mathbb{R}^p \tag{3}\\ \mathcal{A} \circ \mathcal{L}: \mathbb{R}^{d\times n} \mapsto \mathbb{R}^p \tag{4} \end{gather}\] The leaf transformation \(\mathcal{L}\) is geared towards transformation of raw datum of individual users leading to a user group specific transformed dataset \(\Delta^{\mathcal{L}}_U\) as denoted in Equation 5 . On the other hand, the application of the aggregation \(\mathcal{A}\) on set \(\Delta^{\mathcal{L}}_U\) results in a reduction denoted by \(R(\mathcal{A},\mathcal{L},U)\) as given in Equation 6 . \[\begin{gather} \Delta^{\mathcal{L}}_U = \big[\mathcal{L}(\delta_1;\theta_{\mathcal{L}}),\mathcal{L}(\delta_2;\theta_{\mathcal{L}}), \ldots \mathcal{L}(\delta_n;\theta_{\mathcal{L}})\big] \tag{5}\\ R(\mathcal{A},\mathcal{L},U) = \mathcal{A}\Big(\Delta^{\mathcal{L}}_U;\theta_{\mathcal{A}}\Big) \tag{6} \end{gather}\] The reduction \(R(\mathcal{A},\mathcal{L},U)\) represents the aggregated outcome (e.g., statistical summary, model update, etc.) computed from the transformed dataset.

In order to formalize the objective of clinical stakeholders, we first define computational membership using function \(\mathcal{M}\) as presented in Definition 1.

With the help of Definition 1, we formally state the prover objective using Definition 2 for an arbitrary user identity \(\tilde{u}\) with a datum corresponding to \(\tilde{\delta}\).

Definition 2 provides a fundamental overview of the task of the clinical stakeholder which is responsible of handling patient datasets. Regulatory mandates would encumber the clinical stakeholder to demonstrate the use of data pertaining to specific individuals. For the regulator, this would help enforce compliance requirements regarding the integrity of the underlying datasets used in clinical trials.

3.1 User Identity Management↩︎

For implementing the SMT, we must first ensure that raw user datum is uniquely coupled with their corresponding identity. Additionally, depending on the nature of \(\mathcal{L}\), there is a non-trivial probability of the user salted data of two users mapping to the same transformed output. Therefore, we must also ensure that transformed outputs are uniquely distinguishable across different users.

Asserting User Identity: We rely on user salts to uniquely assert the identity of the user as well as to enable them to demonstrate ownership of their datum as elaborated in Property 1.

Specifically, for each user identity \(u\), the corresponding datum is concatenated with a user salt \(\mu\in\mathbb{R}^{s_u}\) leading to \(\delta^s \equiv (\delta,\mu)\). The user salt \(\mu\) is a secret vector of \(s_u\) dimension uniquely held only by the user and must not be revealed or made public. As a consequence we obtain a salted user group dataset denoted by \(\Delta^{s}_U\) in Equation 7 . \[\begin{gather} \Delta^{s}_U = \Big[(\delta_1,\mu_1),(\delta_2,\mu_2)\ldots (\delta_n,\mu_n)\Big]\tag{7}\\ \hat{\mathcal{L}}:\mathbb{R}^{{d+s_u}}\mapsto\mathbb{R}^{p} \tag{8} \end{gather}\] The unique salt binding for each user ensures that each record in \(\Delta^{s}_U\) is uniquely attributable to its originating user. In order to handle the transformations of the salted user datum, we modify the leaf transform input dimension to yield \(\hat{\mathcal{L}}\) parametrized by \(\theta_{\hat{\mathcal{L}}}\) as denoted in Equation 8 .

Asserting Uniqueness of Leaf Transformation: For enforcing distinguishability between transformed outputs of different users, we concatenate a user specific transform salt to the leaf transform output of salted user datum as described by Property 4.

Specifically, for a given user \(u\) with raw datum and user salt represented by \(\delta,\mu\) respectively, we incorporate \(\tau\in \mathbb{R}^{s_t}\) such that Equation 9 holds. \[\begin{gather} \mathcal{L}^{s}\big([\delta,\mu,\tau];\theta_{\mathcal{L}^s}\big) \;=\; [\,\hat{\mathcal{L}}(\delta,\mu;\theta_{\hat{\mathcal{L}}}), \tau\,], \quad \tau \in \mathbb{R}^{s_t} \label{eq:salted95func95ltr} \end{gather}\tag{9}\]

Consequently, we obtain a user group specific salted leaf transform dataset pertaining to set of users \(U\) as denoted by \(\Delta^{\mathcal{L}^s}_U\) in Equation 10 . \[\begin{gather} \Delta^{\mathcal{L}^s}_U = \big[\mathcal{L}^s([\delta_1,\mu_1,\tau_1];\theta_{\mathcal{L}^s}), \ldots \mathcal{L}^s([\delta_n,\mu_n,\tau_n];\theta_{\mathcal{L}^s})\big] \label{eq:salted95ltr95final} \end{gather}\tag{10}\]

As a result of using the transform salt, the output dimension of the leaf transform will also change effectively changing the dimensions of the aggregator as well. Therefore, the modified leaf transform and aggregator function can be denoted would acquire the mappings represented in Equations 11 13 . \[\begin{gather} \mathcal{L}^{s}:\mathbb{R}^{d+s_u}\mapsto \mathbb{R}^{p+s_t} \tag{11}\\ \mathcal{A}^{s}:\mathbb{R}^{(p+s_u)\times n} \mapsto \mathbb{R}^{p+s_t} \tag{12}\\ \mathcal{A}^{s} \circ \mathcal{L}^{s}: \mathbb{R}^{(d+s_u)\times n} \mapsto \mathbb{R}^{p+s_t} \tag{13} \end{gather}\]

3.2 Computational Sparse Merkle Trees↩︎

We consider Sparse Merkle Trees (SMT) as a means to represent the computational graph pertaining to the global aggregation function \(\mathcal{A}^s\) parametrized by \(\theta_{\mathcal{A}^s}\). SMTs are a sparse version of conventional Merkle trees which rely on a well-formed hash function formally as defined in Definition 3.

Specifically in the context of Definition 3, we assume hash is a cryptographic hash function satisfying collision and preimage resistance. We further assume the user and transform salts \(\mu_u\) and \(\tau_u\) carry sufficient entropy that the space of possible inputs to \(\mathsf{hash}(\mathcal{L}^s(\delta_u, \mu_u, \tau_u))\) is too large for an adversary to enumerate by brute force, even if the underlying participant attributes \(\delta_u\) are drawn from a small or otherwise guessable set of values. Together, these two properties ensure that an adversary observing \(\mathsf{hash}(\mathcal{L}^s(\delta_u, \mu_u, \tau_u))\) can neither invert the hash directly, by preimage resistance, nor recover \(\delta_u\) through exhaustive search over candidate inputs, by the entropy contributed by the salts. Consequently, we assume that the hashed leaf transforms and aggregation inputs do not reveal the underlying participant data to a computationally bounded adversary.

Sparse Merkle Trees (SMTs) differ from conventional Merkle trees in both tree height and the number of leaf nodes. For a hash function producing an output of \(K\) bits, a traditional Merkle tree has a variable height that depends on the number of data elements included as leaves. In contrast, an SMT consists of \(2^K\) leaves resulting in a fixed tree height of \(K\). Given a set of data elements, the construction of an SMT relies on determining the hash string of each element. The binary representation of each hash string determines the leaf position of the corresponding data element while the unfilled leaf positions are characterized by the hash of a default element.

Starting from the leaves, the conventional version of the SMT is constructed by recursively hashing the concatenation of hash strings of two adjacent elements ultimately culminating in the root element. Unlike conventional Sparse Merkle Trees (SMTs), which recursively concatenate and hash child nodes, the computational variant performs a reduction operation at each recursion level. Specifically, we view the global aggregation function \(\mathcal{A}^s\) as a recursive composition of local reduction functions \(\mathcal{A}^{l}(\cdot;\theta_{\mathcal{A}^l})\), where each \(\mathcal{A}^{l}\) combines the aggregated values of two child nodes into a higher-level representation as denoted in Equation 14 .

\[\label{eq:a95rec} \begin{align} \mathcal{A}^s&(\Delta^{\mathcal{L}^s}_U;\theta_{\mathcal{A}^s}) = \mathcal{A}^{l}_{(K)}\!\big( \mathcal{A}^{l}_{(K-1)}\!\big( \cdots \mathcal{A}^{l}_{(0)}(\varphi^{L}_L, \varphi^{L}_R; \theta_{\mathcal{A}_l}) \cdots;\theta_{\mathcal{A}_l} \big);\theta_{\mathcal{A}_l} \big) \end{align}\tag{14}\]

This recursive construction yields a Computational Sparse Merkle Tree (CSMT), formally defined in Definition 4, for a given user identity set \(U\) and their corresponding salted leaf transform set \(\Delta^{\mathcal{L}^s}_U\). The relations contained in Definition 4 is illustrated in Figure 1 using three leaf nodes.

In Definition 4, \(\varphi^k_P\) and \(H^k_P\) denote, respectively, the aggregated value and the corresponding hash at parent node \(P\) on level \(l\) of the tree. The leaf values \(\varphi^0_j\) are derived through the salted transformation \(\mathcal{L}^{s}\) over user data \((\delta_i, \mu_i, \tau_i)\), where \(\verb|Bin|(j)\) represents the binary encoding of the leaf position. Empty leaves are assigned the default salted value \(\mathcal{L}^{s}(\varnothing)\). Specifically, for occupied leaves, the SMT uses the full \(K\)-bit output without any truncation. For any input \(x\), the leaf index is derived as \(\mathcal{N}(x) = \mathsf{Decimal}(\mathsf{hash}(x))\), where \(\mathsf{Decimal}(\cdot)\) interprets the \(K\)-bit string as an integer in \(\{0, \ldots, 2^K - 1\}\). On the other hand, for the default leaves \(\mathcal{L}^s(\varnothing)\) is a fixed, publicly known constant established at setup. As a result, any non-empty leaf satisfies \(\varphi^0_j = \mathcal{L}^s(\delta_i, \mu_i, \tau_i) \neq \mathcal{L}^s(\varnothing)\) by construction, since it encodes real user data. As a result, the root hash \(H^{\text{root}}\) serves as a global cryptographic commitment to the aggregation outcome \(\varphi^{root}\) which is nothing but the global reduction \(\mathcal{A}^{s}(\Delta^{\mathcal{L}^{s}}_U) = R(\mathcal{A},\mathcal{L},U)\) for all users. Based on the definition of CSMT, we can define the Merkle consistency as defined in Property 3.

The CSMT supports any local aggregation function \(\mathcal{A}^l(\varphi_L, \varphi_R; \theta)\) that is commutative and associative. This is directly analogous to the class of reduction based computation supported by distributed memory oriented collectives adopted by high-performance frameworks such as MPI [18]. Concretely, element-wise sums, products, minimum, maximum, and the sufficient statistics required by the statistical pipelines evaluated in this work decompose naturally into such reductions. Functions outside this class include order-sensitive operations such as median and rank statistics and cross-leaf predicates needing pairwise comparison across the entire datasets. Supporting such functions would require auxiliary circuit structure beyond the current CSMT design and is left as future work.

As a direct consequence of Definition 4, each leaf in the CSMT admits a unique structural index determined by its salted hash value, formalized in Property  6.

In other words, Property 4 ensures that each user can be assigned to a unique leaf index \(\mathcal{N}_u\) based on the decimal representation of the hash corresponding to their salted leaf transform.

In simpler terms, Property 5 states that a leaf index that maps to the default salted element represents an unoccupied position in the tree.

Property 6 exploits the binary representation of \(\mathcal{N}_u\) to derive a path from the root to the leaf node index. More precisely, the path derivation scheme adopts a convention wherein the successive child nodes are determined recursively by examining the current bit value.

Because leaf indices are derived as \(\mathcal{N} = \mathsf{Decimal}(\mathsf{hash}(\varphi^0_j))\) and parent node hashes are computed as \(H^k_P = \mathsf{hash}(\mathcal{A}^l(\varphi^k_L, \varphi^k_R;\theta))\), any attempt by a computationally bounded adversary to produce a non-default leaf \(\varphi^0_j \neq \mathcal{L}^s(\varnothing)\) whose aggregation path yields the same root hash as a default leaf requires finding a collision under hash. Under the collision resistance property of Definition 3, this occurs with at most negligible probability. Therefore, non-membership proofs are unambiguous: a leaf position containing \(\mathcal{L}^s(\varnothing)\) cannot be computationally indistinguishable from one containing a valid participant record, and default leaf uniqueness reduces entirely to the collision resistance of the underlying hash function without requiring any additional assumptions on \(\mathcal{A}^l\).

As a result, combining Properties 4, 5 and in addition to the one-wayness and collision resistance properties of \(\verb|hash|\), we can also state that valid Merkle paths are also consistent according to Property 3. Without loss of generality, we denote bit values 0,1 to represent left and right child nodes respectively.

Proposition 1 formally shows that a CSMT can effectively help prove whether a particular user’s data record was included in a specific computational aggregation step of the larger statistical method driving the clinical study. In other words, Proposition 1 can help pinpoint the exact computational step where a user’s data record has been used to drive the statistical method that underpins the overarching clinical research. Therefore, Proposition 1 has a foundational implication for the CoSMeTIC framework since it paves the way for a publicly verifiable zero-knowledge driven mechanism for reliably establishing computational membership claim.

3.3 Zero Knowledge Assertions for CSMTs↩︎

We present the preliminaries pertaining to the zero knowledge encapsulations of the Computational Sparse Merkle Tree formulations. More specifically, we consider a zkSNARK framework and summarize the foundational steps of setup, prove and verify functions imminent in zkSNARKs. Our treatment for CSMTs includes both layers of CSMT pertaining to salted leaf transforms \(\mathcal{L}^s\) as well as layered salted aggregation function \(\mathcal{A}^l\).

The setup phase in Definition 5 generates the proving and verification key pairs \((pk, vk)\) corresponding to the functions \(\mathcal{L}^s\) and \(\mathcal{A}^{l}\). This phase is typically executed once per circuit instantiation and is parameterized by the model weights \(\theta\). Since the underlying state-space model \(\mathcal{M}\) is pretrained and stable, the setup need not be repeated frequently. However, any modification to \(\theta\)—such as retraining or parameter updates—necessitates re-execution of the setup phase.

Definition 6 specifies the proof generation step. The Prove function takes as input the proving key \(pk\), the function parameters \(\theta\), and the corresponding witness–statement pairs \(([\delta,\mu], \mathcal{L}^s(\delta,\mu,\tau))\) for the leaf transformation, or \(([\varphi^k_L,\varphi^k_R], \mathcal{A}^l(\varphi^k_L,\varphi^k_R))\) for the aggregation step. It outputs a proof artifact \(\Pi\), which attests to the correct evaluation of the underlying function in zero knowledge. Proofs are generated independently at each layer or recursion depth of the CSMT.

Definition 7 describes the verification step, in which a verifier uses the verification key \(vk\) to validate a proof \(\Pi\) corresponding to a given function execution. The Verify function outputs a Boolean flag \(\Phi \in \{0,1\}\) indicating whether the proof is valid. In practice, this allows regulators or auditors to confirm that each reported computation—whether at the leaf or aggregation level—was performed correctly, without requiring access to the underlying private data. For notational simplicity, we refer to leaf transform and Merkle path proofs by the acronyms LTR and MRP proofs respectively. As a consequence of Definition 6, we collate the set of LTR and MRP proof artifacts into a distinct proof tuple denoted by \(\Pi^u_{\mathsf{CSMT}}\) for every user as denoted by Equation 15 . \[\begin{gather} \label{eq:collated} \text{LTR Proof}: \Pi^u_{\mathcal{L}^s}, \; \text{MRP Proof Set}:\Pi^{u,1:K}_{\mathcal{A}^l} = \big\{\Pi^{u,1}_{\mathcal{A}^l},\ldots,\Pi^{u,K}_{\mathcal{A}^l}\big\}\\ \text{CSMT Proof Set}:\Pi^u_{\mathsf{CSMT}} = \Big[\Pi^u_{\mathcal{L}^s}, \Pi^{u,1:K}_{\mathcal{A}^l}\Big] \end{gather}\tag{15}\]

Proposition 2 shows that the successful public verification of each individual zk-SNARK artifacts in the set \(\Pi^u_{\mathsf{CSMT}}\) can help demonstrate the utilization (or lack thereof), of a user data record to drive an individual aggregation step that is implemented through a CSMT. At a fundamental level, Proposition 2 helps realize the implications of Proposition 1 purely in terms of zk-SNARKs. Proposition 2 ensures that the set of zk-SNARKs contained in \(\Pi^u_{\mathsf{CSMT}}\) serve as the inclusion or exclusion guarantees for user datasets.

4 Algorithmic Foundations of CoSMeTIC↩︎

We construct the algorithmic foundation of the CoSMeTIC framework by discussing the set of infrastructure assumptions, followed by the prover and verifier algorithmic components.

4.1 Assumptions↩︎

The assumptions for the CoSMeTIC framework encompass both endogenous as well as exogenous factors pertaining to data storage and trusted setups.

Assumption 1 postulates the existence of a personal health record (PHR) database that stores and manages raw data record, user and transform salt. Additionally, we also assume that the PHR database is capable of providing Merkle membership proofs of \((\mathsf{hash}(\delta_u,\mu_u),\mathsf{hash}(\tau_u))\) through simple Merkle trees. The primary advantage of doing so would be to prevent data tampering or misuse of user data records in the clinical study itself. CoSMeTIC also supports multiple such PHR databases that store data for different users participating in a single study, provided that each database can substantiate user records through simple Merkle proofs.

Assumption 2 discuses the presence of a trustworthy environment where the proving and verification keys for zk-SNARK circuits are generated as part of the setup phase. The implementation of CoSMeTIC is based on the ezkl framework [32] which uses the Halo2 proof generation backend. As a result, our proof generation framework ultimately relies on the KZG commitment scheme with a universal Powers of Tau ceremony.

Assumption 3 assumes the existence of a clinical research organization (CRO) which is the driver of the entire clinical research study. The CRO is assumed to handle the acquisition of user data and corresponding transform salts of each user from the PHR database; as well as generating and disclosing proof artifacts. It is not necessary for the the CRO and the trusted environment assumed in Assumption 2 to be identical. In fact, the CoSMeTIC architecture allows these two entities to be distinct in the real-world. As a result, scenarios wherein a third party, such as a regulatory authority, generates and delivers the zk-SNARK circuits for the CRO to carry out the clinical study is plausible. Therefore, based on Assumptions 1, 2 and 3, we now discuss the algorithm design of the CoSMeTIC architecture.

4.2 Adversarial Model↩︎

We now formally characterize the adversarial capabilities assumed in CoSMeTIC and delineate the boundaries of its cryptographic guarantees.

CRO Adversarial Capabilities: The CRO is modeled as a computationally bounded malicious adversary. We assume that the CRO may adaptively select the included participant set \(U^{inc} \subseteq U\) after observing study outcomes; selectively omit records from \(U^{inc}\) to bias statistical results; and attempt to substitute a participant’s data under a different identity. The CRO cannot, however, forge valid zk-SNARK proofs which would require breaking the knowledge soundness of the underlying proof system (see Proposition 3). Collusion between the CRO and the trusted setup party (Assumption 2) is considered out of scope. If the CRS is adversarially generated, soundness guarantees for any zk-SNARK-based system collapse and are therefore treated as a residual trust assumption common to the class of KZG-based constructions.

PHR Database as a Trust Boundary: The PHR database (Assumption 1) is treated as a declared trust boundary. We assume that correctness of identity binding that establishes leaf index as a derivation of \((\delta_u, \mu_u, \tau_u)\) corresponds to the genuine data of user \(u\) if the PHR database is itself uncompromised. A malicious PHR database could facilitate cross-identity substitutions (attaching user \(u\)’s data under a different identity \(u'\)). We acknowledge this as a fundamental limitation of the architecture; mitigating it would require a higher-assurance PHR infrastructure outside the scope of CoSMeTIC .

Two-Layer Completeness Protection: While CoSMeTIC cannot cryptographically enforce dataset completeness in full generality, the framework provides two complementary protections against the most operationally relevant completeness attacks. First at the injection layer, every LTR proof generated by the CRO (Algorithm 4) chains to a PHR membership proof via Assumption 1. A regulator can therefore demand PHR-backed proofs for every non-default leaf in the published CSMT, and flag any leaf whose claimed identity cannot be corroborated by the PHR database. This prevents a malicious CRO from injecting fabricated participants or substituting one user’s data under a different identity. Next at the Omission Detection Layer, a regulator suspecting selective omission of participants with unfavorable outcomes can issue a challenge set \(U^{chall} \subseteq U\). The CRO is compelled to rerun BuildSMT over \(U^{inc} \cup U^{chall}\) using the existing, already-published verification keys without requiring a new setup. A statistically significant discrepancy between the original and challenged aggregate roots is evidence of omission.

Scope of Guarantees: CoSMeTIC provides computational correctness guarantees which ensure that given that the CRO supplies a dataset, the zk-SNARK proofs certify that the statistical pipeline was executed faithfully over that dataset. CoSMeTIC does not provide dataset completeness guarantees in the information-theoretic sense. In other words, it cannot certify that all eligible participants were included. However, it can be used in conjunction with a trusted PHR database to verify data membership while serving as the foundation for regulatory inquiries for various user subsets. Similarly, from an information theoretic perspective, CoSMeTIC does not guarantee liveness, implying that the CRO can theoretically ignore proof requests from particular participants. These limitations are consistent with the broader class of verifiable computation systems and are best addressed through complementary organizational or regulatory mechanisms.

Collectively using the Assumptions 1, 2 and 3, as well as our adversarial threat model we now discuss the algorithm design of the CoSMeTIC architecture.

4.3 CRO Oriented Algorithmic Components↩︎

The CRO side algorithmic components broadly handles tasks pertaining to leaf transformations, CSMT construction and generation of corresponding zk-SNARKS. For brevity, we abstract away operations pertaining to private data storage on the CRO side.

4.3.1 Salted Leaf Transforms↩︎

: In Algorithm 2, we present the function \(\verb|LeafTransform|\) which is denotes the LTR operation handling the transformation of raw user data records including user and transformation salts. First, the function generates the salted transform leaf value \(\varphi^0\) and its associated witness \(\Omega_{LT}\) based on the compiled circuit for leaf transform \(\mathcal{L}^s\) which is parametrized by \(\theta_{\mathcal{L}^s}\). The function stores the witnesses privately indexed by the hash of salted raw data tuple, the transform salt and the choice of LTR circuit. Finally, the function returns the transformed value \(\varphi^0\), the hash of the leaf transform \(H^{leaf}\), transform salt hash \(H^{\tau}\) and the leaf index \(\mathcal{N}\).

4.3.2 CSMT Construction↩︎

: The CRO constructs the CSMT using the function \(\verb|BuildSMT|\) as represented in Algorithm 3. The function consumes a given user set \(U\) with salted leaf transformations and indices denoted by \(\{\mathcal{N}_i,\varphi^{0}_i\}_{u_i\in U}\), a CSMT tree height of \(K\), as well as the aggregation function \(\mathcal{A}^l\) parametrized by \(\theta_{\mathcal{A}^l}\). The CRO inserts the non-default user leaves at the appropriate locations while the rest are left with the default value. Using a bottom-up aggregation approach, the CRO builds the sparse Merkle tree by recursively computing the parent for each node identified by its hash using \(\mathcal{A}^l(\cdot,\theta_{\mathcal{A}^l})\). The aggregation results in the root value \(\Psi^{K}[0]\), root hash \(H^{K}[0]\) and CSMT witnesses arranged in a sparse Merkle tree format denoted by \(\Omega_{CSMT}\). While the CSMT witnesses are stored privates, the function returns the root value and the root hash as their outputs.

4.3.3 Generation of LTR Proofs↩︎

: In function \(\verb|CRO-LTRProve|\) given in Algorithm 4, we discuss the mechanism to generate zk-SNARKs for the leaf transformation on raw user data records. The function consumes the hashes of salted raw user data and the transform salts denoted by \(H^{(\delta,\mu)},H^{\tau}\) respectively. Additionally the verification key \(vk_{\mathcal{L}^s}\) for the specific leaf transformation function must also be provided to help identify the specific transformation function for which the proofs are being requested. Consequently, the function loads the corresponding proving key \(pk_{\mathcal{L}^s}\), the compiled circuit \(\mathcal{L}^s\). Next, the LTR witnesses and parameters \(\Omega_{LT},\theta_{\mathcal{L}^s}\) are looked up based on the provided salted raw user data record and transform salts. As a result, the CRO generates the zk-SNARK \(\Pi_{\mathcal{L}^S}\) and returns the leaf hash, index and the SNARK artifact denoted by \(H^{leaf},\mathcal{N}\) and \(\Pi_{\mathcal{L}^s}\) respectively.

4.3.4 Generation of MRP Proofs↩︎

: The mechanism for generating MRP proofs for a given leaf transform of user data is denoted by the function \(\verb|CRO-MRPProve|\) which is presented in Algorithm 5. The function consumes the leaf hash and index \(H^{leaf},\mathcal{N}\), a nonce value \(\eta\) supplied by the verifier as well as the verification key \(vk_{\mathcal{A}^l}\) to identify the aggregation circuit and parameters. The leaf index is binarized to represent an array of selector or path index bits to help serve as a route from the corresponding leaf to the root of the CSMT. The nonce value plays an important role to help assert the integrity of the per-hop MRP zk-SNARK artifacts with respect to the binary representation of the leaf node index obtained from the LTR proof.

After loading the proving key,\(pk_{\mathcal{A}^l}\), aggregator circuit \(\mathcal{A}^l\) and the CSMT witness and parameters \((\Omega_{CSMT},\theta_{\mathcal{A}^l})\), the function iterates through all levels of the tree starting from leaf level. At each iteration, the parent value \(\Omega^{P}_{CSMT}\) is obtained from CSMT witness object, and depending on the corresponding path index bit, the orientation (i.e. left or right of the current node) of the sibling is decided. Based on the witnesses, \(k^{th}\)-hop zk-SNARK is generated which is denoted by \(\Pi^{(k)}_{\mathcal{A}^l}\). The function returns the hash of the root \(H^{root}\), the series of zk-SNARK artifacts for each hop denoted by \(\Pi^u_{\mathsf{CSMT}}\) as well as the array of path index bits \(B\).

4.3.5 Integrated CoSMeTIC CRO Logic↩︎

: We combine the algorithmic components discussed above into a standalone function denoted by \(\verb|CosmeticCROBuild|\) as presented in Algorithm 6. Without loss of generality, we consider a PHR database with an exhaustive user base \(U\) such that \(U^{inc}\subseteq U\) represents the set of users chosen to participate in the user study. The function \(\verb|CosmeticCROBuild|\) consumes \(U,U^{inc}\) in addition to verification keys \(vk_{\mathcal{L}^s},vk_{\mathcal{A}^l}\) for LTR and MRP proofs to identify the relevant aggregation and leaf transform functions respectively. The function acquires the raw salted user data set based on \(U\) and carries out a leaf transform using \(\verb|LeafTransform|\), assigning a unique randomized transform salt to each user. Consequently, the function invokes \(\verb|BuildSMT|\) using the selected group of users \(U^{inc}\) to yield the root value and root hash denoted by \(\Psi^{root},H^{root}\). Finally, the CRO distributes the hash of transform salt of each user \(H^\tau_u\) and the verification keys \(vk_{\mathcal{L}^s},vk_{\mathcal{A}^l}\) corresponding to the transform and aggregation functions for all users. Next, the verification keys for leaf transform and aggregation along with the root hash are also made public.

To prevent circuit substitution attacks, CoSMeTIC can also enable regulators to generate pre-approved circuits for common leaf and aggregation operations. Since the verification keys are deterministically derived from the circuit, any verifier can confirm that a regulator approved circuit was used before accepting proofs to prevent circuit substitution attacks. Additionally, any addition or removal of participants only require leaf value and root updates while reusing existing verification keys. A new trusted setup is required only if K itself grows. Since the architecture relies on a specific choice of the hash function with K bits, fluctuating trial enrollment does not require any new zkSNARK setup steps. We note that even though Algorithm 6 considers all users in the PHR database for effecting the leaf transforms, doing so is not necessary and is presented as such for representational convenience and to highlight the generation of both inclusion and exclusion proofs in later sections.

4.4 Verifier Oriented Algorithmic Components↩︎

The algorithmic components on the Verifier are in charge of validating zk-SNARKs delivered by the CRO as a means to certify the inclusion of individual user datum consistent with the claimed leaf transform and aggregation functions. We note that the Verifier side logic is purely driven by the exchange of zk-SNARKs and the hash derivatives contained therein. We subdivide the entire task set into three different algorithmic components each pertaining to verifying individual LTR, and per-hop MRP zk-SNARKs, as well as validating inclusion proofs in the CRO CSMT. The same algorithmic structure provides support for both inclusion and exclusion proofs in the CoSMeTIC algorithmic framework. For brevity, in this section, we only discuss the main verifier logic represented in Algorithms 8 and 8 that relies on the primitives LTRVerify, MRPHopVerify, which have been discussed at length in Appendix 9.2.

In Algorithm 7 we present the VerInc function that relies on the hashes of the salted raw user data record \(H^{(\delta_u,\mu_u)}\), the user specific leaf transform \(H^{leaf}_u\), CSMT root \(H^{root}\) and the nonce \(H^\eta\) in addition to the set of LTR and MRP zk-SNARK artifacts and their corresponding verification keys denoted by \(\Pi^{u},vk_{\mathcal{L}^s},vk_{\mathcal{A}^l}\) respectively. The function enables the verification of the LTR zk-SNARK using the LTRVerify function. Next, we begin the process of verifying the MRP zk-SNARK artifacts by considering the binary path representation of \(H^{leaf}_u\). We iterate over each hop of the CSMT starting from the leaf level with \(H^{leaf}_u\) all the way to the root. At each level, we retrieve the right and left input hashes from the per-hop CSMT proof artifact represented by \(\Pi_{\mathcal{A}^{l}}^k\). The right and left inputs are checked for consistency with respect to the selector bit corresponding to the current hop as well as CSMT level. Consequently, we validate the zk-SNARK of the hop using the MRPHopVerify function. Passing the validation criteria for every hop as well as the leaf transformation results in a successfully verifying the inclusion of a specific user’s data in the clinical study. We provide Algorithm 8 to summarize the algorithmic design at the verifier end. In Algorithm 8, the verifier invokes CRO-LTRProve and CRO-MRPProve functions on the CRO. These CRO based functions can be implemented as an RPC call or a REST API functionality. The verifier then tests the inclusion using the function VerInc. Consistency of the selector bit path and the salted leaf transformation reported by CRO-MRPProve and CRO-LTRProve is critical to ensure that the generated proofs pertain to the same user datum. Additionally a successful outcome of the VerInc function concludes the verification process at the verifier.

4.5 Security Model and Guarantees↩︎

There are two fundamental formal guarantees that the CoSMeTIC framework delivers with respect to the CRO. First, using Proposition 1, it establishes the CSMT architecture, providing necessary and sufficient conditions to evaluate the membership of a particular user’s data in a reduction operation. Second, Proposition 2 formally proves that successful verification of LTR and MRP zk-SNARKs are necessary and sufficient to realize the membership function. Lastly, the algorithmic foundations of the CoSMeTIC framework are driven largely by Assumptions 1 - 3 which serve as necessary conditions for a successful and secure implementation of the framework.

From the algorithmic implementation standpoint, there are exactly two potential gaps where an incorrect evaluation of the membership function cannot be detected solely on the basis of Proposition 2. The first gap pertains to the soundness of knowledge argument afforded by zk-SNARKs which inhibits the practical likelihood of obtaining proof artifacts consistent with Proposition 2 but generated using incorrect witnesses. The second gap focuses on the data exclusivity argument which pertains to the ability to exclusively commit to the set of users whose data was included in a particular reduction operation. The data exclusivity argument is an essential security component to prove the tamper-resistant aspects of the dataset used for the clinical study.

4.5.1 Knowledge Soundness↩︎

: Our knowledge soundness argument is based on the implementation mechanisms for verification highlighted in Algorithm 8. As a consequence, we establish Proposition 3 which provides formal guarantees pertaining to the knowledge soundness of the zk-SNARK artifacts.

Fundamentally, the proposition explores the ability for such a CRO to use incorrect LTR witnesses, inconsistent leaf indices or manipulated MRP proof artifacts for one or more hops as a means to generate zk-SNARKs that can be verified using Algorithm 8. The knowledge-soundness of each LTR and MRP proof instance follows directly from the formally established knowledge-soundness of the Halo2 proof system [33], which guarantees that any adversary producing a valid proof must possess a valid witness, except with negligible probability. Therefore a compromised CRO cannot practically generate zk-SNARK artifacts consistent with Proposition 2 without access to genuine PHR-authenticated witnesses.

The CoSMeTIC framework employs a deliberate two-level commitment structure wherein the root hash \(H^{root} = \mathsf{hash}(\mathcal{A}^s(\Delta^{\mathcal{L}^s}_U))\) commits to the aggregate statistical outcome \(R(\mathcal{A}, \mathcal{L}, U)\) rather than to the full dataset. Commitment to individual participants is not derived from the root but from the LTR proofs wherein each leaf hash \(H_i = \mathsf{hash}(\mathcal{L}^s(\delta_i, \mu_i, \tau_i))\) is collision-resistant by Definition 3, and the corresponding zk-SNARK binds that leaf to its PHR-authenticated tuple \((\delta_i, \mu_i, \tau_i)\). The MRP proofs then chain each leaf commitment to the root. Root-level and leaf-level collision resistance therefore serve distinct purposes and should not be treated as the same security property. In other words, the root demonstrates the integrity of the aggregation, while the leaves prove commitment and chaining to legitimate users who are part of the PHR database.

4.5.2 Data Exclusivity↩︎

: To demonstrate the data exclusivity argument, we consider \(U^{inc}\subseteq U\) as having been the set of users whose data a compromised CRO claims to use for its clinical study while actually utilizing \(\hat{U}^{inc}\) with \(\hat{U}^{inc} \cap U^{inc} \neq \varnothing\). We formally define data exclusivity argument in Definition 8.

Based on Definition 8 we derive necessary conditions for data exclusivity as presented in Proposition 4. A prerequisite for Proposition 4 is to check the provenance of the leaves by ensuring that every non-default leaf must be the result of a leaf transform on a raw data record that belongs to a PHR database. However, verifying the provenance of each leaf is trivial and straightforward based on Algorithm 12.

Proposition 3 provides the set of criteria which can be used by the CRO to prove data exclusivity based on analyzing the set of non-default leaves that appear across the entire CSMT. We note however that to implement Proposition 4 the CRO would have to divulge the LTR and MRP zk-SNARKs of all users that are part of the set \(U^{inc}\) whose data was included in the clinical study. In Appendix 9.1, we provide a detailed discussion for strategies that can successfully detect violations in data exclusivity including Algorithm 11 which outlines an implementation mechanism for checking the provenance and data exclusivity of a particular reduction operation.

5 Experimental Results↩︎

We present the computational experiments for evaluating CoSMeTIC using three real world clinical case studies that are driven by two distinct clinical datasets. All experiments were conducted on a virtual machine (VM) running Ubuntu 24.04, provisioned with 16 vCPUs and 100 GB of RAM. The implementation was carried out in Python 3.11, with model inference performed using PyTorch 2.7.1. Zero-knowledge proofs were generated using the ezkl library, which underlies the zkSNARK construction within the CoSMeTIC framework. All experiments were evaluated under multiple fixed-point precision configurations, controlled by the scale parameter. We consider scales of 8, 10, 12, and 14, which directly determine the arithmetic precision inside the zero-knowledge circuits. This range allows us to evaluate the impact of increasing cryptographic precision on performance, numerical stability, and cryptographic overhead. Our source code and documentation can be accessed at https://disys-lab.github.io/cosmetic/.

5.1 Clinical Case Studies↩︎

Evaluation Scope: We evaluate CoSMeTIC across three representative statistical workflows commonly encountered in clinical and genomic studies that pertain to the two-sample Kolmogorov-Smirnov (KS) test, the Logistic Likelihood-Ratio Test (LRT), and the Logistic Accuracy (Acc) test. Our evaluation focuses on three distinct dimensions involving the cost of circuit compilation and witness generation, the stability of the resulting statistical outputs and the cryptographic overhead incurred through proving and verification keys. Together, these metrics characterize the practicality of deploying CoSMeTIC in privacy-sensitive analytical pipelines. To drive the case studies, we utilize datasets from two real-world cases pertaining to Huntington’s disease (HD) and immunodeficiency virus type 1 (HIV-1).

Example Dataset 1: Huntington’s disease. As a genomic example, we use CAG repeat-length data in a two-sample KS test comparing healthy controls and individuals with clinical Huntington’s disease. Individual values were simulated from published summary statistics [34]–[37], yielding two cohorts of 12 each. This dataset illustrates distributional testing under CoSMeTIC’s inclusion and exclusion guarantees. Brief disease background is given in Appendix 8.1.1.

Example Dataset 2: HIV-1 Temsavir resistance. As a clinical lab example, we use HIV-1 resistance records from a clinical lab test. CoSMeTIC applies an LRT to compare full and reduced logistic-regression models and an ACC evaluation on a held-out partition. Each sample was associated with the amino acid sequence at four Env positions (375, 426, 434, 475), and a resistance value measured in vitro using the PhenoSense GT assay. After dummy encoding, the feature space expanded to 19 variables. As part of our study, we examine the Env-targeting therapeutic BMS-626529 (Temsavir, TMR) [38], [39]. This example illustrates model comparison and predictive evaluation with the same accountability guarantees. Brief clinical background is given in Appendix 8.1.2.

For Huntington’s we utilize two independent cohorts consisting of 12 individuals each, representing the healthy and diseased (HD) groups. A two-sample KS test is implemented using the CoSMeTIC framework applied to assess distributional differences between the two groups. In the second case study related to HIV-1, we randomly split the data (n=564) into training (n=479) and test (n=85) sets. For each of the LRT and the ACC tests, a subset of (n=12) participants is used for the experiments with the CoSMeTIC framework. The architecture of the CSMT within the CoSMeTIC framework for the KS, LRT and ACC tests has been illustrated in Figure 14 presented in Appendix 9.

2pt

5.2 Worked Inclusion and Exclusion Example↩︎

We illustrate Algorithm 7 concretely using two cases drawn from the Huntington’s disease KS case study (Section 5.1) comprising an included participant \(u\) of the HD cohort, and an identity \(u'\) that was never part of either cohort. Both cases compute the leaf index in the same manner of Property 4, \(\mathcal{N} = \text{Decimal}[\text{hash}(\mathcal{L}^s(\delta,\mu,\tau))]\), and the same path-derivation logic of Property 6 from that index to the root; CoSMeTIC does not branch into separate inclusion and exclusion algorithms. The two cases differ only in what is occupying the leaf at the resulting index.

Inclusion case: For participant \(u\), the leaf at index \(\mathcal{N}_u\) holds \(\varphi^0_{\mathcal{N}_u} = \mathcal{L}^s(\delta_u,\mu_u,\tau_u)\), the genuine salted leaf transform of \(u\)’s datum (Property 4). LTRVerify returns \(\Phi_{\mathcal{L}^s}^{u}=1\) against this leaf, and each of the \(K\) MRP hops along the path verifies via MRPHopVerify, recomputing \(H^{curr}\) from the sibling supplied at each level. The final \(H^{curr}\) matches \(H^{root}\), so VerInc returns True which is indicative of the fact that \(u\)’s genuine data was used in the analysis, which guarantees that \(\mathcal{M}([u,\delta_u]\,|\,R) = 1\).

Exclusion case: For identity \(u'\), Property 4 gives the leaf hash \(H_{u'}\) and index \(\mathcal{N}_{u'}\) exactly as it would for a genuine participant, so the path to be checked is encoded from \(u'\)’s real hash. The leaf at \(\mathcal{N}_{u'}\), however, holds the default value \(\varphi^0_{\mathcal{N}_{u'}} = \mathcal{L}^s(\varnothing)\). By Property 5, this proves \(u'\)’s exclusion directly indicating that the path is genuine, but the source at that leaf is the default, not a real LTR witness. The \(K\) MRP hops from this default leaf to the root verify exactly as in the inclusion case, and \(H^{curr}\) matches \(H^{root}\), certifying \(\mathcal{M}([u',\delta_{u'}]\,|\,R) = 0\). 1 summarizes both traces.

5.3 Case Study Results↩︎

We present the results of our case studies in terms of the witness generation times as well as the computational system performance of the end-to-end LTR and MRP proving mechanism for KS, LR and ACC Tests. We present the proving and verification keys sizes for each case study in Appendix 10.

5.3.1 Kolmogorov-Smirnov (KS) Test↩︎

: As reported in 2, circuit compilation and witness generation times remain tightly bounded across all EZKL Scale configurations. Increasing arithmetic precision introduces only minor fluctuations in total generation time, indicating that higher fixed-point precision does not significantly impact the computational cost of the KS workflow. More importantly, the computed max-gap statistic remains invariant across all precision settings. This invariance demonstrates that increasing zero-knowledge precision does not distort the underlying non-parametric hypothesis test, confirming that CoSMeTIC preserves numerical correctness under cryptographic constraints.

1.5pt

3pt

2pt

4pt

5.3.2 Logistic Likelihood-Ratio Test (LRT)↩︎

: As shown in 3, both circuit and witness generation times remain stable as the EZKL Scale increases. Despite higher arithmetic precision, the LR statistic is preserved exactly across all configurations, demonstrating that CoSMeTIC maintains numerical fidelity for parametric hypothesis testing under zero-knowledge constraints. This property is particularly important in regulated settings, where even small numerical deviations can affect downstream clinical or regulatory decisions.

5.3.3 Logistic Accuracy (ACC) Test↩︎

: As reported in 4, both transformers incur relatively modest circuit and witness generation times compared to the KS and LRT workflows. Across all EZKL Scale values, the observed classification accuracy remains unchanged, indicating that zero-knowledge proof construction does not interfere with model evaluation outcomes. Moreover, we notice that the total generation times vary only slightly with increasing precision, suggesting predictable performance behavior. This confirms that repeated accuracy verification can be supported efficiently within the CoSMeTIC framework.

Across all evaluated statistical workflows, CoSMeTIC demonstrates strong scalability and numerical stability with increasing zero-knowledge precision. With respect to statistical stability, across all zkSNARK precision scales ranging from 8-14 setting, all three statistical outputs remain identical with the KS Max Gap statistic is 0.999, the LRT statistic is 386.78, and the ACC accuracy is 0.749. This invariance shows that CoSMeTIC ’s quantization introduces no numerical drift regardless of precision level. Additionally, our results also demonstrate stability in circuit and witness generation times across diverse scale values as well while preserving exact statistical outputs. These results collectively confirm that CoSMeTIC enables privacy-preserving statistical inference without compromising numerical correctness or cryptographic scalability.

System-level CPU utilization: Figures 9 (a)–9 (c) show the prover CPU utilization during KS, LRT, and ACC proof generation, respectively. For the KS test (Figure 9 (a)), CPU usage exhibits periodic fluctuations, reflecting alternating computation phases associated with histogram aggregation and cumulative distribution comparison within the KS circuit. Despite these fluctuations, overall CPU utilization remains consistently elevated, indicating sustained computational activity throughout the proving process.

The LRT workload (Figure 9 (b)) demonstrates a more uniform CPU utilization profile, corresponding to continuous arithmetic computation required to evaluate both the full and reduced logistic regression models within the zero-knowledge circuit. The absence of pronounced oscillations suggests a steady, compute-bound execution pattern.

Similarly, the ACC workflow (Figure 9 (c)) shows sustained CPU utilization across the entire execution window, indicating continuous computation during both the length SMT proof phase and the subsequent accuracy proof phase. The lack of extended idle periods suggests that ACC proof generation maintains a stable computational workload across phases.

System-level memory utilization. Figures 10 (a)–10 (c) present the prover memory utilization during KS, LRT, and ACC proof generation. For the KS test (Figure 10 (a)), memory usage remains stable throughout execution, with minimal divergence between minimum, average, and maximum values. This behavior indicates that KS proof generation relies on a fixed working set after initialization and does not require repeated large memory allocations.

In the LRT case (Figure 10 (b)), memory utilization also exhibits a steady profile with limited variation over time. The absence of large memory spikes suggests efficient reuse of intermediate buffers during witness generation and likelihood computation.

For the ACC workflow (Figure 10 (c)), memory usage remains stable during the initial execution period and increases when the system transitions from length SMT proof generation to accuracy proof generation. After this transition, memory utilization stabilizes at a higher level, indicating predictable, phase-dependent memory usage rather than unbounded allocation growth.

6 Conclusion↩︎

In this paper, we introduce CoSMeTIC , a zero-knowledge framework based on Computational Sparse Merkle Trees (CSMTs) that enables verifiable statistical computation while preserving patient privacy in clinical research. By leveraging Merkle tree structure and computational reduction operations, CSMTs support succinct inclusion and exclusion proofs for individual users whose data participate in specific stages of a statistical analysis. CoSMeTIC integrates zk-SNARKs to provide end-to-end, publicly verifiable guarantees of data membership and exclusion across the computational pipeline. We formalize soundness conditions for these proofs using state-of-the-art proving systems such as Halo2 and demonstrate that CoSMeTIC can also verify claims of exclusive data usage from subsets of large medical databases. Through diverse real-world case studies, we show that the framework is extensible to a wide range of statistical methods used in clinical research.

Unlike prior zero-knowledge Merkle tree systems, which treat leaves as static key-value records and certify only lookup or boolean membership, and unlike verifiable-statistics frameworks, which certify a global test statistic without binding it to individual participants, CoSMeTIC is the first to combine analysis-specific computational reductions at internal nodes with participant-level inclusion and exclusion proofs for the same statistical pipeline. To evaluate CoSMeTIC , we design three representative use cases using real-world clinical data from Huntington’s disease (HD) and HIV-1 studies. First, we implement a two-sample Kolmogorov–Smirnov (KS) test to verify whether CAG repeat length distributions differ between HD patients and healthy controls, while proving that only approved cohort data were used and all non-participants were excluded. Second, we construct a publicly verifiable likelihood ratio test (LRT) for HIV-1 resistance to Temsavir using nested logistic-regression models to assess the significance of selected genomic features. Third, we extend the framework to support verifiable evaluation of predictive accuracy under the same inclusion and exclusion guarantees. Across multiple zero-knowledge scales, we demonstrate that circuit and witness generation times, statistical outputs, and key sizes remain practical and stable, showing that privacy-preserving hypothesis testing can be achieved without sacrificing computational efficiency or statistical validity.

Finally, we show that CoSMeTIC enables regulators to verify the authenticity and correct use of datasets underlying clinical studies, while allowing participants to obtain publicly verifiable proofs of data inclusion or exclusion. By combining correctness, privacy, and transparency, CoSMeTIC offers a practical and scalable foundation for trustworthy, auditable, and privacy-preserving clinical research.

7 Proofs↩︎

7.1 Proof of Proposition 1↩︎

Case 1.1 (Inclusion implies Membership): For this case it is sufficient to prove that \((u\in U)\implies \mathcal{M}([u,\delta]|R) =1\). If we consider \(u\in U\), Properties 1 and 4 imply the existence of unique user and transform salts given by \(\mu,\tau\) respectively. Leveraging Properties 4 and 5, we know that the data tuple \((\delta,\mu,\tau)\) for user \(u\in U\) corresponds to a unique leaf index given by \(\mathcal{N}_u\) such that the binary representation of \(\mathcal{N}_u\) is equal to \(\verb|hash|(\mathcal{L}^s(\delta,\mu,\tau))\). Given the collision resistance property of \(\verb|hash|\), uniqueness of \(\mu\) and \(\tau\), we can state that \(\mathcal{L}({\delta}) \in \Delta^{\mathcal{L}}_U\) which corresponds to \(\mathcal{M}([u,\delta]|R) =1\)

Case 1.2 (Exclusion implies Non Membership): For this case, it is sufficient to prove that \((u\notin U)\implies \mathcal{M}([u,\delta]|R) =0\). If \(u\notin U\), then \(\mathcal{L}(\delta) \notin \Delta^{\mathcal{L}}_U\) which would mean that \(\mathcal{M}([u,\delta]|R) =0\) according to Definition 1.

Case 2.1 (Membership implies Inclusion): For this case, it is sufficient to show that \(\mathcal{M}([u,\delta]|R) =1 \implies (u\in U)\). We know using Definition 1 that \(\mathcal{M}([u,\delta]|R) =1\), can only occur when \(\exists \mathcal{L}(\delta) \in \Delta^{\mathcal{L}}_U\). As a result, we can find unique user and transform salt vectors \(\mu\in \mathbb{R}^{s_u}\) and \(\tau\in\mathbb{R}^{s_t}\) to obtain an augmented data tuple \((\delta,\mu,\tau)\) such that \(H = \verb|hash|(\mathcal{L}^s(\delta,\mu,\tau))\). Using Properties 4 and 5, we can state that \(\exists \mathcal{N} = \verb|Decimal|(H)\) and \(\varphi^0_\mathcal{N} \neq \mathcal{L}^s(\varnothing)\) thereby demonstrating inclusion \(u\in U\).

Case 2.2 (Non Membership implies Exclusion): For this case, it is sufficient to demonstrate that \(\mathcal{M}([u,\delta]|R) =0 \implies (u\notin U)\). We know that \(\mathcal{M}([u,\delta]|R) =0\) occurs only when \(\mathcal{L}({\delta}) \notin \Delta^{\mathcal{L}}_U\). Assuming sufficient entropy in the salt strings and given collision resistance, we can say that for all combinations of \(\hat{\mu}\in \mathbb{R}^{s_u},\hat{\tau}\in\mathbb{R}^{s_t}\) the following relation holds where \(H_u = \verb|hash|(\mathcal{L}^s(\delta_u,{\mu}_u,{\tau}_u))\) \[Pr\Big[ \verb|hash|(\mathcal{L}^s(\delta,\hat{\mu},\hat{\tau})) = H_u\Big] \leq \operatorname{negl}(K) \quad \forall u\in U\] Therefore, it is not possible to find some \(\hat{\mu},\hat{\tau}\) for which \(\varphi^0_\mathcal{N}\neq \mathcal{L}^s(\varnothing)\) where \(\mathcal{N} = \verb|Decimal|(\verb|hash|(\mathcal{L}^s(\delta,\hat{\mu},\hat{\tau})))\)

7.2 Proof of Proposition 2↩︎

7.3 Proof of Proposition 3↩︎

7.4 Proof of Proposition 4↩︎

8 Supplementary Text↩︎

8.1 Case Studies↩︎

8.1.1 Huntington Disease↩︎

Huntington’s disease (HD) results from CAG repeat expansion in the HTT gene [40], with repeat number correlating with onset and severity [41]. We tested whether CAG repeat distributions differ between 12 healthy individuals and 12 HD-symptomatic individuals [34]–[37] using a two-sample Kolmogorov-Smirnov test, with our framework providing membership and non-membership proofs without disclosing participant data.

8.1.2 HIV-1↩︎

HIV-1 resistance to the Env-targeting therapeutic Temsavir (TMR) [38], [39] is driven largely by mutations at Env positions 375, 426, 434, and 475 [42], [43]. We used training (n=479) and test (n=85) sets with 19 dummy-encoded sequence features per sample and PhenoSense GT-measured resistance, demonstrating sequence-based resistance prediction under our privacy-preserving verification framework.

9 Supplementary Algorithms↩︎

9.1 Algorithm for detecting data exclusivity↩︎

Algorithm 11 defines VerifyDataExclusivity, which takes the PHR Merkle root reference \(\mathcal{P}\), the set of non-default salted leaf nodes \(\mathcal{T}\), and, for each user \(u\) in the study, the hash tuple \((H^{(\delta_u,\mu_u)}, H^{\tau_u})\), collectively denoted \(\mathcal{H}\). By Assumption 1, every hash tuple in \(\mathcal{H}\) must be substantiated by a Merkle proof from \(\mathcal{P}\); both sets are pre-committed by the CRO ahead of Algorithm 3. The algorithm therefore first checks PHR Merkle consistency, \((H^{(\delta_u,\mu_u)},H^{\tau_u}) \in \mathcal{P} \cap \mathcal{H}\), for each LTR proof, building a set of non-default leaf hashes as the basis for the MRP exclusivity check. It then performs a depth-first traversal of the CSMT to collect the nodes reachable from non-default leaves. Per Definition 8 and Proposition 4, data exclusivity holds when (i) the leaf set found by MRP traversal matches the leaf set found from the LTR proofs, and (ii) every non-leaf MRP node has at least one leaf descendant.

9.2 Verifying zk-SNARK Artifacts↩︎

Algorithm 12 defines function LTRVerify as a means to verify LTR proofs based on verification key \(vk_{\mathcal{L}^s}\), LTR zk-SNARK \(\Pi_{\mathcal{L}^s}\), hash of raw salted user data, transform salt and salted leaf transform \(H^{raw}\),\(H^{\tau}\),\(H^{leaf}\) respectively. The LTRVerify function primarily validates the given zk-SNARK using the verification key using the Verify function. Additionally, it ensures hash consistency between supplied hashes \(H^{raw}\),\(H^{\tau}\),\(H^{leaf}\) and the input and output hashes contained in the provided zk-SNARK. The final verification output of the function depends on successfully passing the criteria for zk-SNARK validation as well as the hash consistency check.

In Algorithm 13 we present function MRPHopVerify which handles the verification of per-hop MRP proofs. The MRPHopVerify function consumes the verification key for aggregator circuit, zk-SNARK proof artifact as well as the hashes of the left and right sibling, selector bit path index array and the nonce. These input variables are denoted by \(vk_{\mathcal{A}^{l}},\Pi_{\mathcal{A}^{l}},H^{L},H^{R},H^b,H^\eta\) respectively. The function validates the provided zk-SNARK using the verification key and checks for hash consistency of left and right siblings, selector bits and the nonce. Passing each criteria results in an overall success of the MRPHopVerify function.

9.3 Kolmogorov–Smirnov (KS) Test↩︎

We first consider the two-sample Kolmogorov–Smirnov (KS) test, which compares the empirical distributions of Group A (healthy) and Group B (HD) (Algorithm 15). The leaf-level transformation \(\mathcal{L}^{s}_{BC}\) maps each data point to a one-hot vector indicating its bin assignment under a pre-specified bin vector \(\theta_{\mathcal{L}^{s}_{BC}}\), and the aggregation function \(\mathcal{A}^{l}_{sum}\) sums these vectors across observations within each group, yielding bin-count vectors \(\Psi^A\), \(\Psi^B\). The MaxAbsoluteGap circuit then converts \(\Psi^A\), \(\Psi^B\) into cumulative distributions \(F_A\), \(F_B\) and returns \(\zeta = \|F_A - F_B\|_{\infty}\), the standard KS statistic measuring the largest gap between the two empirical distributions. The KS verifier confirms correctness by checking the CSMT-based inclusion/exclusion proof for \(u\), the max-gap proof \(\Pi_{MAG}\) against \(vk_{MAG}\), and, if both pass, that the sample-group roots \(H^{root,A}\), \(H^{root,B}\) match their expected hashes; it returns failure tagged with whichever check did not hold.

9.4 Logistic Likelihood-Ratio Test↩︎

We next evaluate the Logistic Likelihood-Ratio Test (LRT), which assesses the statistical significance of a full logistic regression model relative to a reduced baseline (Algorithm 16). The leaf-level transformation is the log-likelihood function \(\mathcal{L}^{s}_{LL}\), parameterized by the regression coefficients \(\theta_{\mathcal{L}^{s}_{LL}}\) and aggregated via the sum aggregator \(\mathcal{A}^{l}_{sum}\); full and reduced models are evaluated independently within CoSMeTIC , yielding summed log-likelihoods \(\Psi^{r}\), \(\Psi^{f}\) that a zero-knowledge circuit combines into the LRT statistic \(\zeta = -2(\Psi^{r} - \Psi^{f})\). The LRT verifier confirms correctness by checking the CSMT-based inclusion/exclusion proof for \(u\), the log-likelihood proof \(\Pi_{LL}\) against \(vk_{LL}\), and, if both pass, that the full and reduced model roots \(H^{root,f}\), \(H^{root,r}\) match their expected hashes; it returns failure tagged with whichever check did not hold.

9.5 Logistic Accuracy (ACC) Test↩︎

Finally, we evaluate logistic regression accuracy (ACC) under privacy-preserving computation (Algorithm 17). The classification assessment leaf transformation \(\mathcal{L}^{s}_{CA}\), parameterized by the logistic regression coefficients \(\theta_{\mathcal{L}^{s}_{CA}}\), returns 1 if the predicted class matches the true label and 0 otherwise; the aggregation function \(\mathcal{A}^{l}_{sum}\) sums these values and divides by sample size to yield overall accuracy. The LTR verifier confirms correctness by checking the CSMT-based inclusion/exclusion proof for \(u\) and the classifier-aggregation proof \(\Pi_{CA}\) against \(vk_{CA}\), returning success only if both pass and otherwise failure tagged with the failing check(s).

10 Supplementary Results↩︎

Cryptographic Overhead and Key Size: Proving and verification key sizes are constant across EZKL scales 8–14 for the KS, LR, and Acc tests, showing no scale-dependent cryptographic growth. LTR-class transformers converge to 11.27 GB/2.69 MB and MRP-class transformers to 10.29 GB/2.43 MB across all three tests; the sole exception is the Acc transformer, which rises modestly to 13.24 GB/3.07 MB due to its additional comparative logic.

References↩︎