Private Proofs of Innocence: Compliance Without Compromising Privacy

Privacy protocols live with a basic tension. Users deserve financial privacy, and bad actors would love to use privacy tools to hide illicit funds. Critics often argue that privacy and compliance simply can't coexist.

RAILGUN's answer is Private Proofs of Innocence, or PPOI: a system that proves your funds aren't connected to known bad actors while revealing nothing else about your transactions. Here's how it works.

The Problem: Privacy vs. Reputation

Traditional privacy tools have a reputation problem. If anyone can use the system with no checks at all, it becomes attractive for money laundering. That brings regulatory pressure and exchange delistings, and legitimate users end up avoiding the protocol entirely.

Some protocols chose radical transparency, where anyone can see everything. Others chose total opacity, with no compliance tools whatsoever.

RAILGUN chose a third path: privacy with provable innocence.

What is Private Proofs of Innocence?

PPOI is a zero-knowledge system that lets you prove your shielded tokens don't derive from known malicious sources. In effect you create a cryptographic certificate that says "my funds are clean" without revealing anything about where they came from or what you've done with them.

The key insight is that you can prove you're NOT on a blocklist without revealing which address you ARE.

It's like proving you're not a criminal without showing your ID. You demonstrate membership in the set of "people not on the wanted list" without disclosing who you actually are.

How PPOI Works

Several components work together here, and each one covers a gap the others leave open.

Blocklists and List Providers

List Providers maintain lists of addresses tied to known hacks, exploits or sanctioned entities. The default list is the free and public OFAC designated list, updated by Chainalysis. Users choose which lists they want to prove non-interaction against, based on their jurisdiction or requirements.

The Accumulator System

PPOI uses an accumulator, a cryptographic method that summarizes a set of values into a single root value. Any individual value can be proven to belong to the set without revealing which value it is.

The system keeps two of them. A shield accumulator tracks shields that are not on the exclusion list, and a transaction accumulator tracks valid private transactions.

When you shield tokens, the system checks whether your source address appears on any blocklist. If it's clean, your shield is added to the PPOI accumulator. The data in the accumulator is encrypted so only the sender and receiver can verify membership, which means no external observer learns anything about RAILGUN transactions from it.

The Unshield-Only Standby Period

New shields sit in a 1-hour standby period where the only thing you can do is unshield back to the original address. The wait gives List Providers time to update their data, so bad actors can't hop addresses quickly enough to outrun the updates.

Recursive SNARKs

This is where it gets clever. When you receive a private transfer, how do you prove your funds are clean if you can't see where they came from?

RAILGUN uses recursive SNARKs, zero-knowledge proofs that verify other zero-knowledge proofs. When someone sends you private tokens, their proof includes verification that their own inputs were already proven clean, and that chain of proofs runs all the way back to the original shield transaction.

So your UTXO is proven clean because the sender's UTXOs were proven clean, and because the sender's proof itself verified the proofs of their inputs. The chain of innocence survives every private transaction without ever revealing the actual transaction graph.

List Providers and Decentralization

The default list is the Chainalysis-maintained OFAC list, but the system supports multiple independent List Providers with different criteria. OFAC lists track addresses sanctioned by the U.S. Treasury. Hack lists cover wallets associated with known exploits and thefts. Regional lists can be maintained for specific jurisdictions, so users can comply with local regulations.

Users pick which lists they want to prove non-interaction against. A German user might choose EU authority lists, while an American user might prefer DoJ or Treasury lists. That flexibility lets each user meet their own compliance needs.

The decentralization matters. No single entity decides what counts as "dirty" funds, so the system stays censorship-resistant while still offering compliance options.

Verification: anyone can check PPOI proofs by entering a RAILGUN transaction hash at ppoi.info. External parties can confirm that funds are legitimate without compromising the user's privacy.

The User Experience

For regular users, PPOI runs in the background.

When You Shield

Your wallet checks whether your source address appears on any configured blocklist. If it doesn't, the wallet generates a PPOI proof automatically and your shielded tokens are marked as clean.

When You Transact Privately

Each private transaction includes recursive proof verification, which your wallet handles automatically. You're maintaining your chain of innocence without doing anything.

When You Unshield

You can hand over a proof of innocence along with your unshielded tokens. That's useful when you're sending to a regulated exchange or institution that wants assurance about where the funds came from.

Most users never think about PPOI at all. They get privacy, and their funds are demonstrably legitimate on top.

What Happens to Dirty Funds?

If someone tries to shield tokens from a blocklisted address, the restrictions stack up. Their UTXO won't have a valid proof of innocence, so many wallets and interfaces won't process transactions that use it. Broadcasters, which I'll cover in the next article, may refuse to relay those transactions too. In practice the funds end up quarantined inside the system.

The funds aren't seized or frozen, because the protocol can't do that. But the social and practical infrastructure around it makes blocklisted funds hard to use normally.

Privacy is Preserved

This part is crucial: PPOI proves innocence without revealing transaction details.

An observer learns exactly two things: that you have a valid proof of innocence, and that your funds don't derive from blocklisted addresses. They can't learn your actual address, your transaction history, who you've transacted with, your current balance, or even which specific addresses you've been proven not to be.

You're proving set membership ("I'm in the clean set") without revealing your identity within that set.

The Technical Magic of Recursive SNARKs

I want to go a little deeper on recursive proofs, because they're what lets PPOI scale.

A normal zk-SNARK proves a statement about some data. A recursive zk-SNARK proves a statement about other proofs, and you can stack these indefinitely.

In RAILGUN the levels look like this:

Level 0: "My source address isn't blocklisted" (original shield) Level 1: "My inputs have valid level 0 proofs" (first private transfer) Level 2: "My inputs have valid level 1 proofs" (second transfer) ...and so on

Each proof is the same size no matter how deep the chain goes. Whether your funds went through 2 private transactions or 200, the proof is compact and fast to verify.

That's what makes PPOI practical. Without recursive proofs, you'd need exponentially growing proofs as transaction chains got longer.

Compliance Use Cases

PPOI enables several compliance scenarios.

Exchange Deposits

When you withdraw to an exchange, you can include your proof of innocence. The exchange sees clean funds coming from a privacy protocol instead of suspicious funds of unknown origin.

Institutional Adoption

Funds, DAOs and corporate treasuries need compliance. PPOI lets them use privacy while keeping their innocence auditable.

Regulatory Cooperation

If regulators require proof that funds aren't derived from specific sources, users can provide PPOI proofs without revealing their entire financial history.

Selective Disclosure

Combined with viewing keys, users can both prove innocence AND give their full transaction history to specific parties, while staying private from everyone else.

The Philosophical Balance

PPOI is a considered middle ground in the privacy debate.

It rejects the idea that privacy has to mean no accountability: legitimate users can prove they're legitimate. It also rejects the idea that compliance requires surveillance: you can be compliant without being watched.

That balance is what makes RAILGUN viable for mainstream adoption. It isn't a tool only for people who want to hide everything. It's privacy infrastructure for everyone, including people with compliance requirements.

The Bottom Line

Private Proofs of Innocence tackle one of the hardest problems in blockchain privacy: keeping bad actors out without surveilling good actors.

Through recursive zero-knowledge proofs, RAILGUN lets you prove your funds aren't connected to blocklisted addresses while your transactions stay fully private. You can take part in compliance requirements without giving up that privacy, and you choose which List Providers you trust.

It's privacy with a reputation system, built on math rather than trust.

In the final article of this series I'll look at the Broadcaster network and RAILGUN's broader ecosystem: how you submit private transactions without revealing your IP, and what makes gasless private transactions possible. That's the infrastructure that ties it all together.