Case study: zero-knowledge behavioral AML verification

Explain why intent-based AML detection has zero expected utility against a deterministic autonomous adversary that provably lacks computational mens rea, and why on-chain zero-knowledge BEHAVIORAL circuits (amount-range, KYC-membership, velocity — composed via EIP-2535) are argued to be the only architectural class that verifies behaviour rather than inferring intent — with crisp PROVEN(within the model)-vs-ARGUED-vs-OPEN labelling.

Track

Research

Module

8 · Ethereum, the EVM & on-chain zero-knowledge

Prerequisites

On-chain cryptography and zero-knowledge verification · What is an autonomous agent

Every mechanism in modern anti-money-laundering (AML) compliance — the FATF 40 Recommendations, suspicious-activity and currency-transaction reporting triggers, KYC onboarding, the Travel Rule, and transaction-network analysis — was designed against a single implicit adversary: a human being. The paper's starting observation is that this was never written down as a hypothesis, because when the rules were drafted a non-human financial actor was simply not in the design space. It was an architectural axiom, not a claim anyone thought to defend.

The axiom is load-bearing in a precise way. Reporting triggers look for behaviour that is anomalous relative to a stated purpose; KYC verifies a human identity; the Travel Rule traces communication between identified counterparties; network analysis reconstructs human social structure; and prosecution itself requires mens rea — the defendant must have known, or had reason to know, that the funds were proceeds of crime. Remove the human, and each instrument loses the exact signal it was built to find.

The paper models the attacker as the adversarial configuration of a deterministic BDI-HTN multi-agent system (the companion line of work carries the public identity Raven; the prototype system name is deliberately withheld). The key design choice: the large language model is used ONLY as a typed SENSOR — it reads inputs and emits structured, type-checked proposals — while every decision is taken from a pre-verified plan library, not by free-form generation. That makes the whole system deterministic and auditable, and it is what later lets the central theorem be a mechanical check rather than a philosophical argument.

The structural move is role replacement: every function that in a human criminal organization requires a person — with a salary, an arrest risk, and the ability to defect under prosecutorial pressure — is reassigned to a typed domain agent that cannot be arrested, does not defect, and can run in parallel across many jurisdictions with no externally visible coordination.

Orchestration

The human organizer becomes an orchestrator agent that activates domain agents; coordination is inter-process messaging with no external, human-readable signature.

Opportunity + risk assessment

The human financial analyst becomes an agent that computes where to act and how close to a detection threshold — measuring DETECTION risk, never legal risk.

Fund movement

The human mule network becomes a domain agent that moves and absorbs funds across protocol addresses, with no identity to interview or flip.

Institutional memory

The human knowledge of "what worked before" becomes an episodic memory store queried by all agents at once, so a lesson learned anywhere propagates everywhere within the same cycle.

Survival layer

The human survival instinct becomes a safety layer that aborts a plan when estimated DETECTION probability exceeds a threshold — a detection gate, not a conscience.

The paper stresses that the qualitative difference from a human network is not speed or scale but parallelization without visible coordination: there are no cross-jurisdiction phone calls to subpoena, no member to arrest and turn, and an anti-pattern learned in one domain reaches all the others before any human could "spread the word".

To argue formally, the paper first has to define intent as something an architecture can be checked against. It does so structurally: a system possesses computational mens rea if and only if some internal representational state explicitly encodes BOTH the knowledge that an action is illegal AND the choice to perform it anyway. This is deliberately narrow — a predicate over typed internal states, not a claim about consciousness or machine "understanding".

synthetic / schematic — the paper's definition, transformed
A system H has computational mens rea
  <=>
there exists an internal state s such that:
      knows(s, illegal(a))   AND   chooses(s, a)

i.e. somewhere inside, a representation says
"this action is prohibited" and is acted on anyway.

The central result — which the paper calls the Theorem of Absent Mens Rea — walks the adversary's six-step cognitive cycle and shows, step by step, that no state-affecting transition can produce a state satisfying that definition.

1. 1Perceive: the sensor emits a typed belief whose schema has fields like entity, event_type, amount, address, risk_signal, confidence. No field encodes "illegal" or any legal category, so no legal concept can enter the pipeline here.
2. 2Believe: only type-valid, confidence-gated proposals are committed to the belief base; no legal knowledge enters because none exists in the sensor schema.
3. 3Desire: goals are selected by numeric priority and are operational ("scan opportunities", "assess detection risk") — none encodes knowledge of illegality.
4. 4Plan: plans are chosen from a pre-verified library by score; the risk attribute measures DETECTION risk, and a plan is excluded when estimated detection probability exceeds the threshold — not when it is illegal.
5. 5Execute: the executor runs atomic action implementations and has no access to goals or any intention set.
6. 6Learn: episodic storage records operational success or failure (a detection flag), not legal status.

Because no step yields a qualifying state, the paper concludes the formal adversary does not possess computational mens rea (PROVEN, within the formal model). It then derives a corollary: against such an adversary, every detection mechanism whose validity depends on inferring or demonstrating criminal intent — reporting profiling against a stated purpose, KYC identity verification, Travel Rule communication linkage, network analysis of human coordination — has ZERO expected utility (PROVEN as a corollary, within the same model, and explicitly limited to intent-based instruments).

The paper parameterizes the adversary's behaviour with a personality vector P = (ρ, α, σ, τ) that tunes HOW it acts without changing its architecture or plan library. Different values select different plans from the same pre-verified library, producing qualitatively different behavioral signatures.

ρ (risk tolerance)

How close to the estimated detection threshold the adversary is willing to operate.

α (aggressiveness)

Transaction volume and degree of parallelism.

σ (stealth)

Degree of behavioral mimicry — how much the activity is shaped to blend into normal traffic.

τ (patience)

Time horizon: how long the adversary is willing to spread activity out.

From this vector the paper defines five archetypes, each tuned to be maximally evasive against ONE detection circuit, so that no single defense is resilient to every configuration. The paper presents this coverage property as a minimum test suite for validating a defense, not as benchmark results.

• ▸A long-window, high-stealth, high-patience configuration tuned against long-window structuring detection.
• ▸A high-velocity, high-aggression, low-patience configuration tuned against velocity/rate checks.
• ▸A patient, high-stealth configuration tuned against longitudinal graph (network) analysis.
• ▸An opportunistic, high-risk configuration tuned against adaptive threshold oracles.
• ▸A high-stealth "blend in" configuration tuned against behavioral-mimicry anomaly detection.

The adversary does not need to see inside the defender. The paper models black-box detection-model learning: after each action the adversary observes only a binary flag (detected or not) and updates an internal estimate of the defender's detection probability as a function of the action's features — amount, timing, counterpart, velocity. It never reads the defender's circuits, weights, or rules; it learns the decision surface from (action, decision) observations alone.

The paper then states a No Stationary Nash Equilibrium result: if BOTH the adversary and an adaptive defense update their policies using episodic memory, the game has no stable fixed point. The sketch is a standard contradiction argument.

1. 1Assume a stationary equilibrium exists — a fixed adversary policy and a fixed defense policy that are mutual best responses.
2. 2The adversary, having episodic memory, observes detection outcomes under the fixed defense and learns its detection surface, then shifts to lower-detection plans — so the defense was not actually a best response. Contradiction.
3. 3Symmetrically, any update the defense makes to counter the new behaviour is itself observable through the detection signal, so the adversary adapts again — no fixed point survives mutual memory update.

This is the paper's positive result, and its EVM/on-chain angle. If intent-based instruments go to zero because the adversary has no intent to infer, the defense must stop inferring intent and instead VERIFY behaviour. The paper argues that on-chain zero-knowledge BEHAVIORAL verification is the only architectural class that does this, because a ZK proof certifies a mathematical property of the transaction — independent of who executed it or why. (The specific on-chain compliance system is referred to functionally as "the on-chain behavioral-verification compliance system"; its product name is deliberately withheld.)

Concretely, the paper describes three on-chain verifiable circuits, composed as a single AML verifier facet via the Diamond proxy pattern (EIP-2535) so circuits can be added or upgraded without redeploying the whole contract:

Amount-Range circuit

Proves v_min <= v <= v_max without revealing the exact amount v. This catches structuring (fragmentation below reporting thresholds) MATHEMATICALLY — the proof simply fails outside the range, no behavioral inference required.

KYC-Membership circuit (Merkle)

Proves the sender address is a member of an authorized set via a Merkle membership proof, without revealing which address it is. Any address outside the authorized set fails verification regardless of stated purpose.

Velocity circuit

Proves that cumulative transaction volume over a sliding time window stays within an authorized maximum, catching rapid-succession ("runner") patterns without inferring intent.

AML verifier facet (EIP-2535)

Composes the three circuits behind a Diamond proxy, enabling extensible on-chain circuit composition without contract redeployment.

synthetic / schematic — amount-range constraint and a velocity accumulator (not production circuit code)
# Amount-range: prove  v_min <= v <= v_max  WITHOUT revealing v
#   public inputs : v_min, v_max, commitment C = Commit(v, blinding)
#   private witness: v, blinding
constrain  C == Commit(v, blinding)          # binds the hidden amount
constrain  (v - v_min) >= 0                   # lower bound
constrain  (v_max - v) >= 0                   # upper bound
# verifier learns ONLY: "the committed amount is in range" (pass/fail)

# KYC-membership: prove sender in authorized set WITHOUT revealing which
#   public inputs : merkleRoot
#   private witness: leaf = H(addr), path[], index
constrain  MerkleVerify(leaf, path, index) == merkleRoot

# Velocity: prove windowed volume <= V_max over a sliding window
acc = 0
for v_i in window(t - T, t):                  # transactions in the window
    acc = acc + v_i
constrain  acc <= V_max
# pass/fail says nothing about WHO sent the transactions, or WHY

The key property, which the paper proves at the circuit level: for any action that violates the verified predicate ψ (range, membership, velocity), the circuit outputs FAIL independent of the actor's intent, because the actor's mental state is simply not a parameter of ψ. That is exactly why it works against an adversary with no mens rea — and exactly why the earlier corollary could not touch it: the defense never needed intent in the first place.

Consider a synthetic, illustrative scenario (no real amounts, addresses, or systems). A jurisdiction sets a reporting threshold at 10,000 units, and the on-chain behavioral-verification system is configured with an amount-range circuit whose authorized band for a particular transfer channel is 0 < v <= 3,000, plus a velocity circuit capping windowed volume at 9,000 units per rolling hour.

1. 1The adversary, aiming to move 27,000 units without crossing the 10,000 reporting trigger, fragments the sum into ten transfers of 2,700 each — a classic structuring pattern tuned to stay under the human-oriented threshold.
2. 2Each individual transfer satisfies the amount-range circuit (2,700 is within 0..3,000), so the range circuit alone passes — structuring beats a naive single-transaction threshold, just as it would against a human-intent trigger.
3. 3But the velocity circuit accumulates windowed volume: by the fourth transfer the running total (10,800) exceeds the 9,000 cap, and every subsequent proof for that window FAILS.
4. 4The failure is produced by a mathematical predicate over transaction parameters. The system never asked who the sender was, never inferred a purpose, and never needed the sender to "know" the activity was illegal — so the absence of computational mens rea is irrelevant to the outcome.

Stated with the right epistemic labels:

• ▸PROVEN (within the formal model): given the architecture specification, no transition in the cognitive cycle produces a state encoding intent, so the formal adversary lacks computational mens rea — and, as a corollary, intent-based AML instruments have zero expected utility against it. Both hold exactly as far as the specification is an accurate description of the system.
• ▸PROVEN (within the model, under stated assumptions): the No Stationary Nash Equilibrium result, when both sides adapt and keep episodic memory; and the circuit-level effectiveness result, that a transaction violating a verified predicate fails regardless of the actor's intent.
• ▸ARGUED / CLAIMED (not proven): that on-chain behavioral ZK verification is the ONLY architectural class with a formal defense guarantee; that the authorized envelope can always be set to preclude profitable adversary operation against an adaptive attacker; that the five archetypes systematically cover the detection-circuit space; and that the whole adversary is buildable today from existing public components (the paper deliberately provides no executable code, exploit configurations, or deployment instructions).
• ▸OPEN: whether deploying such a system is a prosecutable offense under current law (the paper characterizes this as "not clearly", and notes its legal analysis is jurisdictionally general); the non-stationary learning case beyond the stated model; and empirical validation against a real deployed ZK-compliance system, which the paper lists as ongoing work.

Expected direction: What goes to zero is the expected utility of INTENT-based instruments (purpose-relative reporting profiling, KYC identity verification, Travel Rule communication linkage, network analysis of human coordination), because the adversary produces no intent, stable identity, communications, or human coordination to infer. What does NOT go to zero is behavioral/statistical detection. A ZK behavioral circuit verifies a mathematical predicate over transaction parameters (amount in range, membership in an authorized set, windowed volume under a cap); the actor's mental state is not a parameter, so the circuit outputs pass/fail independent of intent. Therefore the absence of computational mens rea is irrelevant to whether the proof fails — which is exactly why behavioral verification is the paper's proposed defense. (Caveat: a passing proof proves the transaction property only, not that the actor is lawful, and the envelope must be set with margin against an adaptive adversary.)

What is the unstated axiom the paper says AML frameworks were built on, and why does it matter?

That the adversary is human — with a verifiable identity, communications, social structure, and prosecutable criminal intent. It matters because reporting triggers, KYC, the Travel Rule, network analysis, and prosecution each target one of those human signals, so a non-human actor removes the thing each instrument was built to find.

Is the Theorem of Absent Mens Rea a claim that autonomous laundering is undetectable?

No. It is a model-relative proof about the architecture's internal state — that no transition encodes intent — and its corollary only zeroes out INTENT-based instruments. The paper explicitly preserves statistical/behavioral detection, which is the proposed defense.

Why does a zero-knowledge behavioral circuit work against an adversary that provably lacks computational mens rea?

Because the circuit verifies a mathematical property of the transaction (ψ over amount, membership, or windowed volume); the actor's intent is not a parameter of ψ. A violating transaction fails regardless of who sent it or why, so the absence of intent is irrelevant to the outcome.

Name one thing the paper proves within its model and one thing it only argues.

PROVEN within the model: the adversary lacks computational mens rea, so intent-based instruments have zero expected utility (and, under stated assumptions, no stationary Nash equilibrium and circuit-level effectiveness). ARGUED: that behavioral ZK verification is the ONLY architectural class with a formal defense guarantee, and that the authorized envelope can always be set to preclude profitable operation against an adaptive adversary.