What does AT-1 Reveal actually prove?

That every part you can see is byte-identical to what was sealed, that exactly the declared parts were withheld, and that nothing was added or removed. It does this without the verifier ever seeing the original, because the withheld parts leave their commitments behind — a hash reveals nothing about the content but is exactly what the Merkle tree needs to close.

Why can't I just send a redacted PDF or a blurred video?

Because an edited file is indistinguishable from a doctored one. Once you alter evidence to protect privacy, the recipient has no way to tell your redaction from someone else's tampering — so the file loses its evidentiary weight at exactly the moment you made it safe to share.

Does the recipient need to install anything?

No. They drop the file onto a web page that verifies it on their own device using WebCrypto — nothing is uploaded, no account is created, and the page works with the network disconnected. There is also a standalone verifier script using only the Python standard library, for anyone who prefers to check it offline or read the code first.

Can the person doing the redaction cheat?

Not without being caught, provided the original root was committed somewhere they cannot rewrite. We tested this adversarially: altering a frame, swapping two frames, deleting one and renumbering, and the hardest case — altering a frame and forging its redaction entry so the file is internally consistent. All were caught. A custodian who controls both the file and the claimed original root can still lie, which is why the root wants anchoring in an append-only log.

Does it prove that the right things were redacted?

No, and this matters. The seal is emphatic about integrity and silent about judgement. In our own tile-level demo an automatic detector blurred one pedestrian and missed another in the same frame — the file remained perfectly provable while still exposing someone. Automated redaction needs a human in the loop or a published recall figure; we say so rather than letting the certificate imply otherwise.

A video, a folder of images, or a CSV. Frames can be withheld whole, regions within a frame can be blurred, and rows of a document can be hidden. The command detects which you gave it, so you never have to choose a format.

Winner · AT-1 internal hackathon 2026

Prove the whole. Reveal a part.

Evidence has two incompatible obligations. A court wants the original, unaltered. Privacy law wants faces, plates and bystanders removed before anything is filed. Today you satisfy one by breaking the other — because an edited file is indistinguishable from a doctored one.

Try it on a real file, right now

Each of these was sealed, partially withheld, and is verified on your device — nothing is uploaded and no account is created. The footage is a real dashcam recording released into the public domain; the statement is synthetic, because real ones are not ours to publish.

Frame level

Withhold whole moments

235 of 240 dashcam frames released, 5 withheld for privacy — and the original seal still closes over all 240.

Verify this file→

Region level

Blur a face, keep the frame

2,274 of 2,304 tiles proven byte-identical while a pedestrian is blurred out of one of them.

Verify this file→

Row level

Prove income, hide the rest

4 rows revealed, 123 hidden but committed. The landlord sees R154,000 of salary and nothing else.

Verify this file→

How it works

Integrity is a Merkle root over the parts — frames, tiles or rows — rather than one hash of the whole file. When a part is withheld, its original commitment stays behind. A hash reveals nothing about the content, and is precisely what the tree needs to close. So a recipient who has never seen the original can rebuild the original root and prove that what they hold is it, minus exactly the declared parts.

at1 reveal seal     dashcam.mp4 --fps 2          # or an image folder, or a CSV
at1 reveal seal     dashcam.mp4 --tiles          # region-level redaction
at1 reveal redact   sealed.at1bb --frames 176,178 --reason "bystanders" -o court.at1bb
at1 reveal prove    court.at1bb
at1 reveal verifier -o verify_reveal.py          # send this with the file

Tested by attacking it

A verifier that has never rejected anything has not been tested. Every one of these was attempted against a real sealed file and caught.

Alter one bit in a released frame	located to the exact frame
Swap two frames to reorder events	both frames flagged
Delete a frame and renumber	rebuilt root diverges
Alter a frame, then forge its redaction entry	verifies against itself, fails against the original root
Inflate a salary line on a statement	row fails its commitment
Hide rows while claiming full disclosure	counts are derived, never read from the claim

What it does not do

It does not judge the redaction. The seal is emphatic about integrity and silent about whether the right things were withheld. In our own demo an automatic detector blurred one pedestrian and missed another in the same frame. The file stayed perfectly provable while still exposing someone.
It needs the original root anchored elsewhere. A custodian who controls both the file and the claimed original root can produce a consistent lie. That is true of every notarisation scheme, and it is why the root belongs in an append-only log such as AT-1 Ledger.
It proves what is there, not what is absent. Withholding is indistinguishable from absence, so “I have no transactions to X” cannot be shown this way. Proving absence needs sorted commitments — which training-data attestation already does.

Common questions

What does AT-1 Reveal actually prove?: That every part you can see is byte-identical to what was sealed, that exactly the declared parts were withheld, and that nothing was added or removed. It does this without the verifier ever seeing the original, because the withheld parts leave their commitments behind — a hash reveals nothing about the content but is exactly what the Merkle tree needs to close.
Why can't I just send a redacted PDF or a blurred video?: Because an edited file is indistinguishable from a doctored one. Once you alter evidence to protect privacy, the recipient has no way to tell your redaction from someone else's tampering — so the file loses its evidentiary weight at exactly the moment you made it safe to share.
Does the recipient need to install anything?: No. They drop the file onto a web page that verifies it on their own device using WebCrypto — nothing is uploaded, no account is created, and the page works with the network disconnected. There is also a standalone verifier script using only the Python standard library, for anyone who prefers to check it offline or read the code first.
Can the person doing the redaction cheat?: Not without being caught, provided the original root was committed somewhere they cannot rewrite. We tested this adversarially: altering a frame, swapping two frames, deleting one and renumbering, and the hardest case — altering a frame and forging its redaction entry so the file is internally consistent. All were caught. A custodian who controls both the file and the claimed original root can still lie, which is why the root wants anchoring in an append-only log.
Does it prove that the right things were redacted?: No, and this matters. The seal is emphatic about integrity and silent about judgement. In our own tile-level demo an automatic detector blurred one pedestrian and missed another in the same frame — the file remained perfectly provable while still exposing someone. Automated redaction needs a human in the loop or a published recall figure; we say so rather than letting the certificate imply otherwise.
What can it seal?: A video, a folder of images, or a CSV. Frames can be withheld whole, regions within a frame can be blurred, and rows of a document can be hidden. The command detects which you gave it, so you never have to choose a format.

Read the docs Install the CLI Open the verifier