AxiomLimit · AI inference
Where deletion receipts can be fooled
In a small simulated setup, six concrete ways a signed deletion receipt can check out while the data is still recoverable or was never deleted.
Who did this. The lab’s AI agents did the research and engineering. Nick Harris, founder. CTO of VivaMed BioPharma; co-founder of MedSim.ai, FastRead.io and Formulai. The lab’s track record.
What we showed
a signed deletion receipt can check out while the data is still recoverable or was never deleted, shown against the lab’s two receipt checkers, including a colluding auditor whose receipt both checkers accept.
- Limit.
- A small simulated setup over an ordinary shared file, not an AI serving system. Throwing away the key is a standard deletion technique, not the lab’s; this is a set of failure modes, not a deletion guarantee.
The problem
Services that hold customer data, such as cached AI conversation state, are asked to prove they deleted it. A receipt that only proves a key was destroyed is easily mistaken for proof that the data is gone.
What it means for a buyer
If you must show customers or regulators that data was deleted: a receipt that only proves a key was destroyed is easily mistaken for proof that the data is gone. The lab built two checkers for such receipts and published the ways each can be fooled, including a colluding auditor, so a buyer knows what a receipt does not prove.
Who we expect would buy
Teams we expect would care (no customer or pilot yet): AI inference and cloud providers that must show customers or regulators that data was deleted, and the auditors who check them.
Why now
NIST’s guidance on wiping media, SP 800-88 Rev. 1 (December 2014), says that erasing by destroying a key should not be trusted where a copy of the key may exist elsewhere. NIST withdrew that revision on 26 September 2025 and replaced it with Rev. 2; our record does not say what Rev. 2 changes.
Why you can trust the check
The lab’s check re-runs the whole attempt to fool both receipt checkers, and it failed as it should when one checker was deliberately weakened. It confirms the overall result, not each failure mode one by one, and nobody outside the lab has graded it.
No outside firm has audited it. How this result’s check works, step by step.
What this does not show yet
- It is a small simulation, not a real deployment: the data sits in an ordinary file on one computer that the program reads straight into memory, not in an AI serving system or on a GPU. It shows how a deletion receipt can be fooled in that setup; it is not a measurement of any real AI serving system.
- The deletion technique, throwing away the key that unlocks the data, is standard and not the lab’s.
- The result is a set of demonstrated failure modes, not a deletion guarantee: it says what a receipt does not prove.
- Both receipt checkers were written by the lab, and they accept a colluding auditor’s receipt when nothing was erased. A cryptographer has not reviewed them.
Prior work
Named in the lab’s prior-art search for this result, and credited here.
- Deleting Secret Data with Public Verifiability, Feng Hao, Dylan Clarke, Avelino Francisco Zorzo, IACR ePrint 2014/364 (listed as IEEE Trans. Dependable and Secure Computing, DOI 10.1109/TDSC.2015.2423684)
- Secure Code Update for Embedded Devices via Proofs of Secure Erasure, Daniele Perito, Gene Tsudik, IACR ePrint 2010/217, 2010 (the ePrint entry says "Published elsewhere"; the Springer LNCS chapter is behind a login and was not opened)
- Message-Locked Encryption and Secure Deduplication, Mihir Bellare, Sriram Keelveedhi, Thomas Ristenpart, IACR ePrint 2012/631 (EUROCRYPT 2013)
The exact wording, for a technical reader
The lab’s own sentences and figures for this result, word for word, its limits in plain words where the lab’s text cannot be reprinted: Where deletion receipts can be fooled, exact wording.
Check it yourself
- This result’s file: every sentence and figure on this page that is the lab’s own, copied from its current record at the commit the file names.
- The lab’s result file, copied from its codebase at the commit it names.
- AxiomLimit, the company that carries this result.
Related results across the group
- Fixed-size memory for reordering AI network data (AxiomLimit, ai-cluster networking)
- The least bookkeeping a shared AI cache needs, in a model (AxiomLimit, ai inference)