Public vs private signals — the ZK boundary

Why this matters

Every Circom circuit has two groups of signals: private (inputs the prover knows, verifier never sees) and public (inputs both sides know, plus the outputs). Getting this boundary right IS the zero-knowledge property. Accidentally making a secret public exposes your user's balance; accidentally making a public input private means the verifier can't check against external data. In Circom, public inputs are declared at the component main line. This is easy to get wrong and there's no compiler warning.

Demo

A preimage verifier: prove 'I know x such that Poseidon(x) = hash' where hash is PUBLIC and x is PRIVATE. Declaring which is which lives in the component main line: component main { public [hash] } = PreimageCheck();. Anything not listed is implicitly private.

pragma circom 2.1.6;
include "circomlib/circuits/poseidon.circom";
 
template PreimageCheck() {
    signal input x;          // private — the preimage
    signal input hash;       // PUBLIC — the commitment
    component poseidon = Poseidon(1);
    poseidon.inputs[0] <== x;
    poseidon.out === hash;   // the ZK statement: x hashes to the known value
}
 
component main { public [hash] } = PreimageCheck();
 
// Generate proof:
//   input.json = { "x": 42, "hash": <Poseidon(42)> }
// Verifier sees only 'hash' — never 'x'.

Try it yourself

1. Compile, generate a witness with a known Poseidon preimage, prove, verify. Confirm snarkjs asks for 'public signals' = [hash] only.
2. Swap the public declaration to [x] instead of [hash]. Now the verifier sees x and the SNARK is meaningless — you've leaked the witness. This is how real protocols have lost user privacy.
3. Add a second private signal (signal input r) representing a blinding factor. Observe that it doesn't appear in the public-signals list unless you explicitly declare it.
4. Read a real Circom project's main components (e.g., Tornado Cash's Withdraw.circom). Identify every public signal. Trace what each reveals on-chain.
5. Experiment: what happens if you forget to constrain a public input? The verifier can claim any value for that public signal and the proof still verifies. This is another under-constrained bug category.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain the public-vs-private signal boundary in Circom — what each means, how you declare them, and why this IS the zero-knowledge property.

2. Why it works (the mechanism)

Walk me through what the snarkjs verifier actually does: which signals are hashed into the Fiat-Shamir challenge, how does the public-input vector get used, and what would an attacker gain from leaking a 'private' signal?

3. Advanced — application & what's next

I'm building an anonymous voting circuit where voters prove 'I'm eligible AND my vote is yes/no AND I haven't voted before.' Walk me through: which signals must be public (for on-chain checks), which private (for anonymity), and which nullifier derivation pattern prevents double-voting.

References

• Circom 2 Documentation — Getting Started
• iden3 — snarkjs README
• 0xPARC — Circom Workshop (Ya-Wen Jeng)
• Vitalik — QAPs from Zero to Hero