WaveCommitments: Private and Verifiable Speech-Agent Marketplaces

# WaveCommitments: Private and Verifiable Speech-Agent Marketplaces
Source: [https://arxiv.org/html/2610.26867](https://arxiv.org/html/2610.26867)
Baser Kale Vishwanath Chinchali

KaanSriramSandeep1The University of Texas at Austin2Georgia Institute of Technology[oguzhanbaser@utexas\.edu](mailto:[email protected])

###### Abstract

Modern speech systems are evolving into ecosystems of autonomous speech agents that speak together, negotiate, and trade assets such as embeddings, spectrograms, or raw data\. In such markets, sellers cannot reveal assets for evaluation due to privacy constraints, and buyers cannot price what they cannot test\. Thus, we open\-source WaveCommitments, an end\-to\-end design that pairs confidential asset valuation via Data Shapley inside a trusted execution environment with multivariate polynomial commitments\. It enables selective openings and tamper\-evident provenance to prove that a delivered asset matches the valuation while hiding everything else\. Our extensive experiments across three known datasets and various tasks with state\-of\-the\-art encoders, including Whisper, reveal that we speed up the best benchmarks by up to 20x while reducing their proof sizes by up to 39x\. We also systematically study how a speaker's value shifts across tasks and encoders, revealing agent\-level market prices\.

###### keywords:

agent\-to\-agent interaction, trustworthy AI, commitment schemes, verifiability, privacy, agent marketplaces

## 1Introduction

Modern speech systems shift from standalone models to ecosystems\. Imagine speaker encoders, clinical audio diagnostic tools, and proprietary vocal models are owned, updated, and deployed by different parties, often called asautonomous speech agentsthatspeak togetherand negotiate resources on the fly without humans in the loop\. In this regime, marketplaces for speech knowledge \- utterances, spectrograms, embeddings, and adapters \- become inevitable\. Modern speech foundation models benefit from data at the scale of tens to hundreds of thousands of hours\[whisper,wav2vec2citation\], yetthe data that benefits the most in practice is often the hardest to share\(e\.g\., consented medical audio, copyrighted vocals, and accent\-specific collections under privacy constraints\)\. Even when raw audio cannot move, compute becomes the bottleneck: extracting high\-quality representations from large speech\-language models requires substantial GPU effort\. Consequently, deployments need mechanisms that let agentsbuy, sell, and reuseproprietary or private speech knowledge reliably with incentives for honest data curation\.

![Refer to caption](https://arxiv.org/html/2610.26867v1/systemarchitecture_2.png)Figure 1:WaveCommitment Architecture:Imagine a SAM where autonomous agents trade proprietary speech knowledge\(red\)such as embeddings\. Seller𝐬\\mathbf\{s\}cannot reveal raw utterance𝐮\\mathbf\{u\}, and buyer𝐚\\mathbf\{a\}cannot trust unseen embeddings𝐄𝐬\\mathbf\{E^\{s\}\}or determine their value𝐕\\mathbf\{V\}for its modelHaH^\{a\}\. Hence, they both upload their assets to a secure enclave which computes the valuations for each pair confidentially, seals those and referenced assets into a single digest𝐂\\mathbf\{C\}to publish into a public bulletin\(green\)\. After𝐚\\mathbf\{a\}and𝐬\\mathbf\{s\}handshakes based on𝐕\\mathbf\{V\},𝐚\\mathbf\{a\}buys𝐄𝐬\\mathbf\{E^\{s\}\}and uses𝐂\\mathbf\{C\}to validate the asset without exposing other buyer or seller assets\.Despite this need and the potential of speech agent marketplaces \(SAMs\), acentral open problemistrust under confidentiality: sellers must convince buyers that speech assets are authentic and relevant without exposing the very information that makes them valuable, while buyers must price assets they cannot freely test in their own pipeline\. Existing works fall into three weak categories\. First,reveal\-to\-evaluate workflowsshare utterances or embeddings for trial\[revealtoevaluate,distributedleakage\]\. They undermine privacy and consent for sensitive audio \(e\.g\., clinical acoustic, children’s speech, or proprietary calls\) and for copyrighted content \(e\.g\., audiobooks, vocals\)\[distributedleakage,xvecdeanonymization,embeddingleakage\]\. Second,metadata\-and\-reputation signals\(e\.g\., diversely curated accent, verified speakers\) are too weak for speech as utility is highly model and domain specific\[datahshapley,racialdiversity,augmenteddatasheets\]\. For example, an accent dataset boosting a speaker recognition \(SR\) model is marginal for another; a speaker embedding bank may help diarization but not robustness\. Besides, coarse summaries cannot capture whether samples actually benefits the buyer’s objective\. Third,cryptographic mechanisms\[merkle,chen2024zkml,zkllm\]offer stronger guarantees, but often at high overhead or slow verification, which is challenging when SAMs operate at the granularity of tens of thousands of utterances or embeddings\. Besides, SAMs face uniquely acute integrity risks: synthetic speech and embedding forgeries can look \`\`plausible'' while being low\-diversity or strategically poisoned\[phonemefake\], and even \`\`benign'' embeddings can leak identity or content\[wavshape\]\. What is missing for SAMs is a practical mechanism that jointly provides\(i\)confidential, model\-specific valuation,\(ii\)provenance and authenticity against manipulation, and\(iii\)fast, scalable verification\.

Weobservethat speech \`\`knowledge'' is inherentlymulti\-dimensional tensors\(e\.g\., spectrograms, filter banks, embedding matrices\)\. While current solutions treat it as uni\-dimensional, they create a mismatch: verifying many individual entries is too slow, while blindly analyzing the segments leaks correlated information \(e\.g\., phonetic, prosodic, or speaker cues\)\. Ourkey insightis that verifiability must be*multivariate by design*\. Thus, we propose WaveCommitments \(WC\): a*fingerprint*of a spectrogram or embedding tensor that is published once, then later allows anyone toopenand check only with partial spectrograms or utterance without revealing the rest\. WC commits to speech assets in their native tensor form and supports*selective openings*that prove authenticity and correct speech/embedding derivation only for the queried entries, while keeping all other regions hidden\. WC bases on multivariate polynomials and integrates with a marketplace backed by a trusted execution environment \(TEE\) performing a confidential and model\-specific evaluation as shown in Fig\.[1](https://arxiv.org/html/2610.26867#S1.F1)\. Shortly, WC is an end\-to\-end system for confidential valuation, tamper\-evident verification of speech assets under privacy constraints\. Related workpartially conveys the trust problem but not fully\.TEE/MPC\-based private speech inference\[voiceguard2018,teixeira2022privateasr,chouchane2021antispoofingmpc\]protects audio during compute but produces no checkable record tying a delivered embedding to its agreed valuation\.Watermarking\[securespectra,icmlwatermark\]attributes content but cannot verify that embeddings are from a real speech\.Cryptographic methodsinvolving Merkle/Verkle trees\[merkle,verkle,kzg\]\) and zero\-knowledge proofs\[chen2024zkml,zkllm\]offer integrity guarantees but treat tensors as flat lists\-triggering high size or delayed proofs\. WC bridges all three by performing model\-specific valuation confidentially inside a TEE, and publishinglow\-cost verificationobjects viamultivariate commitmentspreserving the speech asset geometry\. In light of prior work, ourcontributions are four\-fold:

- •We build aconfidential speech\-agent marketplacewhereagents trade speech knowledge\(e\.g\., features or embeddings\) and the market computes model\-aware prices viaData Shapleyinside aTEE, keeping both assets and modelsprivate\.
- •We formulatea multivariate commitmenttailored tospeech agents: a smallpublic digest\`\`seals'' speech and valuations to verify later the match witha short proof hidinganything else\.
- •We build ahierarchical treeon our commitments\. Itorganizeseach speaker's utterance, spectrogram, and embeddings, so agents can verify a chosen neighboring subset \(e\.g\., a speaker's high\-pitched band\) for scalable partial checks\.
- •We release our code to catalyze trustworthy speech markets\.

## 2Methodology

Imagine a*SAM*where speech agents under confidentiality constraints trade*speech knowledge*involving utterances, spectrograms, embeddings, and LoRA\-like adapters\.Four entitiesexist in the marketplace\.Sellers,s∈𝒮s\\in\\mathcal\{S\}, who own private speech corpora or derived representations,Buyersa∈𝒜a\\in\\mathcal\{A\}, who own proprietary downstream models and seek data to improve task performance \(e\.g\., SR, clinical acoustic prediction\), aTrusted Marketplacerunning inside aTEEand executes a valuation pipeline over confidential seller and buyer assets, and aPublic Bulletinstoring the valuations and a small verification digest\. Problem Formulation:Each sellersshasnSn\_\{S\}private utteranceui,ju\_\{i,j\}of the speakerSjS\_\{j\}amongmsm\_\{s\}other speakers the seller has, wherei∈\[nS\]i\\in\[n\_\{S\}\]andj∈\[ms\]j\\in\[m\_\{s\}\]\. The seller transforms the assetui,ju\_\{i,j\}as:Mi,j=f​\(ui,j\),Ei,j=g​\(ui,j\)M\_\{i,j\}=f\(u\_\{i,j\}\),E\_\{i,j\}=g\(u\_\{i,j\}\), whereMi,jM\_\{i,j\}denotes features \(e\.g\., MFCC/filterbank\) andEi,j∈ℝdE\_\{i,j\}\\in\\mathbb\{R\}^\{d\}denotes an embedding or spectrogram tensors of degreedd\. Then,ssuploadsEi,jsE\_\{i,j\}^\{s\}\(or its derivatives\) to the TEE\. Each buyeraahas several prediction or mixture of expert headsHka​\(⋅\)H^\{a\}\_\{k\}\(\\cdot\)amongk∈\[ha\]k\\in\[h\_\{a\}\]heads and uploads those to the TEE such that the model parameters remain hidden outside the enclave\. Then, the TEE computes a valuation tensorV∈ℝ∑a∈𝒜ha×∑s∈𝒮ms×nSsV\\in\\mathbb\{R\}^\{\\sum\_\{a\\in\\mathcal\{A\}\}h\_\{a\}\\times\\sum\_\{s\\in\\mathcal\{S\}\}m\_\{s\}\\times n\_\{S\}^\{s\}\}by Data Shapley given in Eq\.[1](https://arxiv.org/html/2610.26867#S2.E1)and tabulatesVVindexed by asset identifiers\(s,j,i,a,k\)\(s,j,i,a,k\)\. Finally, it sealsVVand the assets by committing to a compact digestCCand releasesCCandVV\. The buyeraathen selects the entries to purchase based on the values onVVand receives the corresponding representations \(typicallyEi,jsE\_\{i,j\}^\{s\}, notui,jsu\_\{i,j\}^\{s\}\) Later, buyeraarequests short proofs that the deliveredEi,jsE\_\{i,j\}^\{s\}is exactly the committed representation without seeing any other assets in non\-purchased regions\. Threat Model:SAMs without WCs face sharp integrity and privacy attacks\. Sellers cansubstitutea post\-bid embedding orforgeplausible synthetic assets lacking provenance or diversity\. Buyers canfree\-ridevia evaluation access,adaptivelypoisonseen assets reversing their own model to harm competitors, orleakspeaker cues from small but repeated disclosures\. Assumptions:We assume the TEE correctly runs the agreed code and enforces confidentiality against the outside host at the software boundary; our cryptographic layer provides*non\-equivocation*and*tamper\-evidence*once a public digest is posted \(i\.e\., a committed entry cannot later be opened to a different value\), matching the standard binding intuition for commitment schemes\. Side\-channel and physical compromise defenses are orthogonal and treated as platform\-level mitigations\. Data Shapley \(DS\):For each buyer agenta∈𝒜a\\in\\mathcal\{A\}, the market must assign a*model\-specific*value to each candidate asset \(e\.g\., embeddingEEor a tensor\) without revealing the buyer weights or the seller’s raw speech\. We use DS as the valuation primitive\. Let𝒟=\{z1,…,zN\}\\mathcal\{D\}=\\\{z\_\{1\},\\dots,z\_\{N\}\\\}denote the set of tradable data items \(e\.g\.,zl=Ei,jz\_\{l\}=E\_\{i,j\}or\(Mi,j,Ei,j\)\(M\_\{i,j\},E\_\{i,j\}\)\)\. For buyer agentaa, letψ​\(a,𝒵\)\\psi\(a,\\mathcal\{Z\}\)be a light\-weight fine\-tuning protocol producing modelθa,𝒵∗\\theta\_\{a,\\mathcal\{Z\}\}^\{\*\}from subset𝒵⊆𝒟\\mathcal\{Z\}\\subseteq\\mathcal\{D\}\. Letε​\(θa,𝒵∗,𝒵\)\\varepsilon\(\\theta\_\{a,\\mathcal\{Z\}\}^\{\*\},\\mathcal\{Z\}\)be the evaluation metric \(e\.g\., task loss on a private set\)\. We let the buyer utilityUUof a subset𝒵\\mathcal\{Z\}asUa​\(𝒵\):=ε​\(θa,𝒵∗,𝒵\)U\_\{a\}\(\\mathcal\{Z\}\):=\\varepsilon\(\\theta\_\{a,\\mathcal\{Z\}\}^\{\*\},\\mathcal\{Z\}\)and define DS as follows\.

Definition 1: The Shapley Valueϕa,l\\phi\_\{a,l\}for datazlz\_\{l\}\(with respect to an agentaa\) is the expected marginal utilityUUof addingzlz\_\{l\}to a uniformly random ordering of all items, estimated as:

ϕa,l:=1\|ζ\|\!​∑p∈ζ\(Ua​\(Plp∪\{zl\}\)−Ua​\(Plp\)\),\\phi\_\{a,l\}:=\\frac\{1\}\{\|\\zeta\|\!\}\\sum\_\{p\\in\\zeta\}\\Big\(U\_\{a\}\(P^\{p\}\_\{l\}\\cup\\\{z\_\{l\}\\\}\)\-U\_\{a\}\(P^\{p\}\_\{l\}\)\\Big\),\(1\)wherePlp:=\{zp​\(1\),…,zp​\(l−1\)\}P^\{p\}\_\{l\}:=\\\{z\_\{p\(1\)\},\\dots,z\_\{p\(l\-1\)\}\\\}is the set of items precedingzlz\_\{l\}in permutationppandζ\\zetais all the permutation set of𝒵\\mathcal\{Z\}\. In WC, the market publishes the valuation tensorVVwith entriesVa,l:=ϕa,lV\_\{a,l\}:=\\phi\_\{a,l\}, or a normalized version if desired by the market rule, together with a commitment root that binds all\(a,l,Va,l\)\(a,l,V\_\{a,l\}\)\. Monte\-Carlo Estimation of DS:Exact computation of Eq\.[1](https://arxiv.org/html/2610.26867#S2.E1)isO​\(\|ζ\|\!\)O\(\|\\zeta\|\!\)\. We estimateϕa,l\\phi\_\{a,l\}by samplingKKrandom permutationsp\(1\),…,p\(K\)p^\{\(1\)\},\\dots,p^\{\(K\)\}and averaging marginal contributions, given by:

ϕ^a,l:=1K​∑k=1KUa​\(Plp\(k\)∪\{zl\}\)−Ua​\(Plp\(k\)\)\.\\hat\{\\phi\}\_\{a,l\}:=\\frac\{1\}\{K\}\\sum\_\{k=1\}^\{K\}U\_\{a\}\\big\(P^\{p^\{\(k\)\}\}\_\{l\}\\cup\\\{z\_\{l\}\\\}\\big\)\-U\_\{a\}\\big\(P^\{p^\{\(k\)\}\}\_\{l\}\\big\)\.\(2\)For each permutation in Eq\.[2](https://arxiv.org/html/2610.26867#S2.E2), the TEE builds the prefix set incrementally and evaluatesUa​\(⋅\)U\_\{a\}\(\\cdot\)along the prefix\. Practically, The TEE can*warm\-start*training between successive prefixes and apply*truncation*when the incremental gain becomes negligible for long stretches, reducing the number of expensiveψa,εa\\psi\_\{a\},\\varepsilon\_\{a\}calls while preserving an accurate estimate of DS\. WaveCommitments:We work over a finite field𝔽\\mathbb\{F\}and pairing\-friendly groups𝒢,𝒢T\\mathcal\{G\},\\mathcal\{G\}\_\{T\}of prime order equipped with a bilinear mape:𝒢×𝒢→𝒢Te:\\mathcal\{G\}\\times\\mathcal\{G\}\\to\\mathcal\{G\}\_\{T\}and generatorG∈𝒢G\\in\\mathcal\{G\}\[bls\]\. A WC binds an order\-mmtensorT∈𝔽d1×⋯×dmT\\in\\mathbb\{F\}^\{d\_\{1\}\\times\\cdots\\times d\_\{m\}\}to a single group elementCT∈𝒢C\_\{T\}\\in\\mathcal\{G\}while enabling succinct openings of individual tensor entries indexed byω=\(ω1,…,ωm\)\\omega=\(\\omega\_\{1\},\\dots,\\omega\_\{m\}\)\. Given tensor shaped=\(d1,…,dm\)d=\(d\_\{1\},\\dots,d\_\{m\}\), WC samples independent trapdoorsτ1,…,τm∈𝔽\\tau\_\{1\},\\dots,\\tau\_\{m\}\\in\\mathbb\{F\}and publishes a structured reference string \(SRS\) containing group elements for all terms up to degreedj−1d\_\{j\}\-1along each axisjj\. For a multi\-degreei=\(i1,…,im\)\\textbf\{i\}=\(i\_\{1\},\\dots,i\_\{m\}\)with0≤ij≤dj−10\\leq i\_\{j\}\\leq d\_\{j\}\-1, defineτi:=τ1i1​⋯​τmim\\tau^\{\\textbf\{i\}\}:=\\tau\_\{1\}^\{i\_\{1\}\}\\cdots\\tau\_\{m\}^\{i\_\{m\}\}andgi:=gτig\_\{\\textbf\{i\}\}:=g^\{\\tau^\{\\textbf\{i\}\}\}\. The public SRS is\{gi\}i∈I\\\{g\_\{i\}\\\}\_\{i\\in I\}whereI:=\{0,…,d1−1\}×⋯×\{0,…,dm−1\}I:=\\\{0,\\dots,d\_\{1\}\-1\\\}\\times\\cdots\\times\\\{0,\\dots,d\_\{m\}\-1\\\}\. Given tensor valuesT​\[ω\]T\[\\omega\]on gridΩ\\Omega, the TEE interpolates a multivariate polynomialFT∈𝔽​\[X1,…,Xm\]F\_\{T\}\\in\\mathbb\{F\}\[X\_\{1\},\\dots,X\_\{m\}\]with per\-variable degree bounddj−1d\_\{j\}\-1so thatFT​\(ω\)=T​\[ω\]F\_\{T\}\(\\omega\)=T\[\\omega\]for allω∈Ω\\omega\\in\\Omega\. It writesFTF\_\{T\}in the monomial basis, shown by:

FT​\(X1,…,Xm\)=∑k1=0d1−1⋯​∑km=0dm−1ck1,…,km​X1k1​⋯​Xmkm,F\_\{T\}\(X\_\{1\},\\dots,X\_\{m\}\)=\\sum\_\{k\_\{1\}=0\}^\{d\_\{1\}\-1\}\\cdots\\sum\_\{k\_\{m\}=0\}^\{d\_\{m\}\-1\}c\_\{k\_\{1\},\\dots,k\_\{m\}\}X\_\{1\}^\{k\_\{1\}\}\\cdots X\_\{m\}^\{k\_\{m\}\},and commits by evaluatingCT:=GFT​\(τ1,…,τm\)C\_\{T\}:=G^\{F\_\{T\}\(\\tau\_\{1\},\\dots,\\tau\_\{m\}\)\}, shown as:

GFT​\(τ1,…,τm\)=∏k1=0d1−1⋯​∏km=0dm−1\(Gτ1k1​⋯​τmkm\)ck1,…,km∈𝒢\.G^\{F\_\{T\}\(\\tau\_\{1\},\\dots,\\tau\_\{m\}\)\}=\\prod\_\{k\_\{1\}=0\}^\{d\_\{1\}\-1\}\\cdots\\prod\_\{k\_\{m\}=0\}^\{d\_\{m\}\-1\}\\left\(G^\{\\tau\_\{1\}^\{k\_\{1\}\}\\cdots\\tau\_\{m\}^\{k\_\{m\}\}\}\\right\)^\{c\_\{k\_\{1\},\\dots,k\_\{m\}\}\}\\in\\mathcal\{G\}\.We compute it using public SRS via linearity in the exponent\. To open entryω=\(ω1,…,ωm\)\\omega=\(\\omega\_\{1\},\\dots,\\omega\_\{m\}\), the prover outputs the claimy:=FT​\(ω1,…,ωm\)y:=F\_\{T\}\(\\omega\_\{1\},\\dots,\\omega\_\{m\}\)and constructs an opening proof by iteratively \`\`peeling off'' variables using univariate polynomial division along each coordinate\. Letr0\(\.\):=FT\(\.\)r\_\{0\}\(\.\):=F\_\{T\}\(\.\)\. Fori=\[m\]i=\[m\], the quotientqiq\_\{i\}and remainderrir\_\{i\}polynomials are shown as:

ri−1\\displaystyle r\_\{i\-1\}\(Xi,…,Xm\)=\\displaystyle\(X\_\{i\},\\dots,X\_\{m\}\)=qi​\(Xi,…,Xm\)​\(Xi−ωi\)\+ri​\(Xi\+1,…,Xm\),\\displaystyle q\_\{i\}\(X\_\{i\},\\dots,X\_\{m\}\)\(X\_\{i\}\-\\omega\_\{i\}\)\+r\_\{i\}\(X\_\{i\+1\},\\dots,X\_\{m\}\),\(3\)so that aftermmsteps the final remainder is the scalarrm=yr\_\{m\}=y\. The prover commits to each quotient at the trapdoor point by:

πωi:=Gqi​\(τ1,…,τm\)∈𝒢,πω:=\(πω1,…,πωm\)\.\\pi\_\{\\omega\_\{i\}\}:=G^\{q\_\{i\}\(\\tau\_\{1\},\\dots,\\tau\_\{m\}\)\}\\in\\mathcal\{G\},\\qquad\\pi\_\{\\omega\}:=\(\\pi\_\{\\omega\_\{1\}\},\\dots,\\pi\_\{\\omega\_\{m\}\}\)\.\(4\)Eq\.[4](https://arxiv.org/html/2610.26867#S2.E4)yields a proofπω\\pi\_\{\\omega\}without revealingFTF\_\{T\}or the rest ofTT\. The opening procedure can be implemented by representing coefficients ofFTF\_\{T\}in a lexicographic array and running a division for eachi∈\[m\]i\\in\[m\]with overall costO​\(dm⋅d\)O\(d^\{m\}\\cdot d\)field operations under uniform per\-axis boundd−1d\-1\. Given\(CT,ω,Ei,js,πω\)\(C\_\{T\},\\omega,E^\{s\}\_\{i,j\},\\pi\_\{\\omega\}\), buyer agentsaachecks whether acquired assetEi,jsE^\{s\}\_\{i,j\}satisfies the pairing equation of the form:

e​\(CT⋅G−y,G\)=?e​\(πω,G∏j=1m\(τj−ωj\)\)\.e\(C\_\{T\}\\cdot G^\{\-y\},\\,G\)\\stackrel\{\{\\scriptstyle?\}\}\{\{=\}\}e\\left\(\\pi\_\{\\omega\},G^\{\\prod\_\{j=1\}^\{m\}\(\\tau\_\{j\}\-\\omega\_\{j\}\)\}\\right\)\.\(5\)Eq\.[5](https://arxiv.org/html/2610.26867#S2.E5)holds when the quotient identity implied by Eq\.[3](https://arxiv.org/html/2610.26867#S2.E3)is satisfied at the trapdoor points\. Notably, full committed data or polynomial is not necessary as public SRS enables this check\. Also, onceCCis fixed, an adversary cannot produce two distinct valid proofs at the sameω\\omega, known as positionally binding\. WaveTrees:To scale the verification across many assets and support/utilize*hierarchical*organization of speech database \(e\.g\., seller→\\rightarrowspeaker→\\rightarrowutterance→\\rightarrowband→\\rightarrowembeddings\), we use a tensor\-native authenticated tree,*WaveTrees*\(WT\)\. A WT over payloadXXwith ordermmand shaped=\(d1,…,dm\)d=\(d\_\{1\},\\dots,d\_\{m\}\)is aBB\-ary tree withB=∏t=1mdtB=\\prod\_\{t=1\}^\{m\}d\_\{t\}, where each internal nodeη\\etaat levelℓ\\ellhas children indexed by a multi\-indexkℓ=\(kℓ,1,…,kℓ,m\)∈∏t=1m\[dt\]\\textbf\{k\}\_\{\\ell\}=\(k\_\{\\ell,1\},\\dots,k\_\{\\ell,m\}\)\\in\\prod\_\{t=1\}^\{m\}\[d\_\{t\}\]\. The node gathers its children into a tensorZηℓ\\textbf\{Z\}\_\{\\eta\_\{\\ell\}\}whose entries are payloads or child commitments, and stores the commitmentCηℓ:=GFZηℓ​\(τ1,…,τm\)C\_\{\\eta\_\{\\ell\}\}:=G^\{F\_\{Z\_\{\\eta\_\{\\ell\}\}\}\(\\tau\_\{1\},\\dots,\\tau\_\{m\}\)\}where the root digest isCη0\.C\_\{\\eta\_\{0\}\}\.For a leaf indexed byiiwith root\-to\-leaf path\(η0,…,ηL\)\(\\eta\_\{0\},\\dots,\\eta\_\{L\}\)and per\-level child multi\-indices𝐤ℓ\\mathbf\{k\}\_\{\\ell\}such thatηℓ\+1=ηℓ​\[𝐤ℓ\]\\eta\_\{\\ell\+1\}=\\eta\_\{\\ell\}\[\\mathbf\{k\}\_\{\\ell\}\], the WT proof sequence is denoted as:

πT,i:=\(πη0,…,πηL\)\.πηℓ:=\(πkℓ,1,…,πkℓ,m\),\\pi^\{T,i\}:=\(\\pi\_\{\\eta\_\{0\}\},\\dots,\\pi\_\{\\eta\_\{L\}\}\)\.\\qquad\\pi\_\{\\eta\_\{\\ell\}\}:=\(\\pi\_\{k\_\{\\ell,1\}\},\\dots,\\pi\_\{k\_\{\\ell,m\}\}\),\(6\)Then, the buyer agent verifies at each level from bottom to top until it reaches the root digestCη0C\_\{\\eta\_\{0\}\}\. With arityB=dmB=d^\{m\}and depthL=⌈logB⁡n⌉L=\\lceil\\log\_\{B\}n\\rceil, a WT proof contains one tensor opening per level, yielding\|πT,i\|=O​\(1m​logB⁡n\)\|\\pi^\{T,i\}\|=O\(\\tfrac\{1\}\{m\}\\log\_\{B\}n\)proof size\. This meansΘ​\(1/m\)\\Theta\(1/m\)fewer levels than univariate trees at comparable arity and reduced per\-node prover work compared to flattening\.

We apply WC to commit speech knowledge tensors \(e\.g\., spectrogram blocks, embedding matrices\) and the released valuation tensor/table\{V\}\\\{V\\\}, and use WT to mirror the natural hierarchy of speech assets\. The public bulletin stores only the root commitments, while buyers obtain short WC/WT openings only for purchased entry identifiers and queried tensor regions\.

![Refer to caption](https://arxiv.org/html/2610.26867v1/wavetree2.png)Figure 2:How to selectively verify speech tensors?WaveTrees organize the assets in their native time\-frequency geometry and return a short proof for the region of interest \(red box\) unlike others with larger overheads \(red outline\)\. WTs can verify whether a speaker says a phrase in a time window while the copyrighted music on background frequencies remains hidden\.
## 3Experimental Setup

Here, we present our metrics, datasets, encoders, and baselines\. Evaluation Metrics:We monitor three market\-critical metrics\.\(i\) Data Shapley:We compare the buyer utility gains by Eq\.[2](https://arxiv.org/html/2610.26867#S2.E2)\.\(ii\) Latency:We time the committing and verifying an asset\.\(iii\) Proof Size:We measure the network cost as bytes per proof\. Datasets:We use three datasets for diverse knowledge regimes\.TIMIT\[timit\]targets speaker ID with controlled read speech and broad phonetic coverage for clean analysis of∼\\sim5h recordings from 630 speakers, each with 10 utterance\.IEMOCAP\[iemocap\]focuses on emotion recognition in more natural dialogs with∼\\sim12 hours of recordings from 5 sessions involving 10 speakers totaling 10,039 utterances labeled in emotions\.Speech Commands\(SC\)\[speechcommandsv2\]targets keyword spotting with 105,829 short clips from 2,618 speakers over 35 keywords, yielding frame\-level frequent openings where size and latency matter most\. Baselines:We compare three authenticated substrates for sealing and selective opening of speech marketplace objects\.Merkle Trees \(MT\)commits to a flat list and opens entries via a log\-depth hash path \(strong integrity, no tensor structure\)\[merkle\]\.Univariate Commitment Tree \(UCT\)flattens tensors and commits in 1D, increasing depth and losing structure\-aware partial openings, highlighting the need for a multivariate design\[verkle\]\.WaveCommitments \(WC\)commit assets and valuation tables in native tensor form, yielding fewer levels for the same fanout and cheaper selective openings of structured speech regions\. Feature Extractors:To model heterogeneous speech agents, sellers extract embeddings with three foundation models:Whisper\-large\[whisper\],HuBERT\-large\[hubertcitation\],wav2vec 2\.0\-base\[wav2vec2citation\]with embeddings of sizes 1280, 1024, and 768 respectively\. This mix forces the market to value and verify*representation\-dependent*assets \(e\.g\., content/prosody\-focused vs speech\-to\-text centric features\)\. For each utterance, we computewindow\-levelembeddings, average them toutterance\-level, and further average per speaker to obtain aspeaker\-levelvoice\-biometry\. Prediction Heads:Each buyer agent confidentially uploads its lightweight headsHka​\(⋅\)H\_\{k\}^\{a\}\(\\cdot\)into the TEE, which defines its private utilityUa​\(⋅\)U\_\{a\}\(\\cdot\):Speaker Identification\(SI\),Emotion Recognition\(ER\), andKeyword Spotting\(KS\) heads\. This diversity makes usefulness inherently head\-dependent, ruling out metadata\-only pricing and motivating confidential, model\-specific valuation\. Implementation Details:All experiments run on anNVIDIA H100 \(80GB\)withconfidential TEE computingenabled, so Shapley valuation and verification run on protected seller assets and confidential buyer heads\. We freeze the extractors and fine\-tune only thelast two layersof each buyer head\. Shapley usesKKrandom permutations \(defaultK=64K\{=\}64\) with prefix warm\-starting inside the TEE\. For verification, we openq∈\{1,8,32,128\}q\\in\\\{1,8,32,128\\\}entries and report prover time, verifier time, and proof bytes for both valuation\-table and asset openings\.

![Refer to caption](https://arxiv.org/html/2610.26867v1/speaker_shapley_boxplot.png)Figure 3:Per\-Speaker Data Shapley for SAM Pricing:For each speaker, we show DS distributions over*utterance\-level*embeddings across three buyer heads \(color\) and three extractors \(hatch\), computed confidentially in the TEE\. This reveals*who*to buy from and*which embedding space*best serves each task\.
## 4Results

Our empirical analysis in Fig\.[3](https://arxiv.org/html/2610.26867#S3.F3)shows thatvalue is not a property of the dataset alone: the same speaker’s utterances can be highly useful or nearly irrelevant depending on thebuyer headand theseller's embedding space\. This head\- and speaker\-specific variation motivates agent\-level valuation before any seller–buyer handshake\. Table[1](https://arxiv.org/html/2610.26867#S4.T1)then shows thatverification must also be practical: WaveCommitments is the only baseline that keeps*both*proof bytes and time low enough to support markets proving and verifying hundreds of entries per trade\.

*Which speakers and extractors are worth buying for which task?*Fig\.[3](https://arxiv.org/html/2610.26867#S3.F3)shows speaker value is buyer and extractor dependent\. Two trends stand out\.\(i\)Representation choice dominates ER and KS:Whisperhas the highest mean DS \(ER: 0\.364 vs\. 0\.324/0\.249; KS: 0\.370 vs\. 0\.197/0\.200\) and is best in ER and in KS\. SI is less extractor\-sensitive: means are closer \(0\.305 vs\. 0\.291/0\.285\) and the best extractor varies by speaker\.\(ii\)Whisperyields no negative\-valued utterances 0% vs\. 0\.5% and 5\.5%\), reducing the risk of paying for neutral or harmful data\.

How costly is to verify in time*and*size at marketplace scale?Table[1](https://arxiv.org/html/2610.26867#S4.T1)answers the practical question for SAMs\. All methods commit a 32B digest, but the other costs differ sharply across the datasets\. MTs pay a≈\\approx5\.33KB proof per query, which becomes bandwidth\-heavy when verifying many embeddings\. UCTs compress the proof to≈\\approx578B but areprohibitively slow to commit\(≈\\approx9\.8s per opening\), making large\-scale settlement infeasible\. We hit the regime SAMs need:small proofs\(≈\\approx138B, a39×\\timesreduction vs\. MT\) withfast commits\(≈\\approx0\.5s, a19\.6×\\timesspeedup vs\. UCT\), while keeping verification5×\\timesfaster \(≈\\approx5\.6ms\)\. Overall, WT is the only design that jointly achieves*low communication*and*low latency*per opened entry, enabling high\-throughput verification of hundreds of traded embeddings\.

MetricMTUCTWT\(Ours\)TIMITCommit Size \(↓\\downarrow\)32B32B32BProof Size \(↓\\downarrow\)4280B480B128BCommit Time \(↓\\downarrow\)12\.2±\\pm2\.6ms409±\\pm8\.7ms*32\.6±\\pm2\.8ms*Verify Time \(↓\\downarrow\)≈\\approx1ms25\.2±\\pm2\.2ms*5\.6±\\pm1\.1ms*IEMOCAPCommit Size \(↓\\downarrow\)32B32B32BProof Size \(↓\\downarrow\)6480B672B157BCommit Time \(↓\\downarrow\)617±\\pm49ms24544±\\pm324ms1358±\\pm281msVerify Time \(↓\\downarrow\)≈\\approx1ms32\.3±\\pm1\.4ms5\.6±\\pm1\.6msSCCommit Size \(↓\\downarrow\)32B32B32BProof Size \(↓\\downarrow\)5612B582B130BCommit Time \(↓\\downarrow\)116±\\pm27\.7ms4429±\\pm5454ms293±\\pm48\.4msVerify Time \(↓\\downarrow\)≈\\approx1ms28\.7±\\pm1\.0ms5\.6±\\pm0\.9msTable 1:Can SAMs validate/transfer the assets fast enough to trade at scale?We list per\-speaker overheads to verify a sealed item across the benchmarks\. Only we deliverthe smallest proofsand fairlylow latencysimultaneously, which is critical as agents verify thousands of embeddings before settlement\.
## 5Conclusion

We introduce WaveCommitments to make speech\-agent marketplaces practical under confidentiality by unifying*confidential, model\-specific valuation*with*public, selective verifiability*\. Our key insight is that speech knowledge is tensor\-structured, so integrity must be*multivariate by design*\. We commit speech\-related tensors once, then open only queried regions with short proofs while hiding everything else\. A TEE computes Data Shapley values for each buyer head, and WaveTrees bind these values to the delivered assets to prevent substitution and plausible forgeries\. Empirically, we show that value is strongly head and extractor dependent, motivating agent\-level pricing rather than metadata\-only signals\. On average, we achieve138Bproofs with0\.5scommitting and5\.6msverification times, a39×\\timesproof reduction vs\. fastest method and a19\.6×\\timescommit speedup vs\. the previous method with the smallest overhead, enabling settlement across thousands of assets\. Looking ahead, we work towards \(i\) strengthening provenance against advanced synthetic speech via integrated anti\-spoofing signals and auditing, \(ii\) reducing reliance on TEE trust through hybrid cryptographic designs while keeping throughput, and \(iii\) extending the market to dynamic inventories \(updates, revocations\) with formal leakage quantification\. More broadly, we view WC as infrastructure for agents to*speaking together*safely: exchange knowledge with privacy, provenance, and incentives aligned\. We released our code to catalyze the trustworthy\-AI research\.

## 6Generative AI Use Disclosure

Generative AI tools were used for the grammatical proofreading and stylistic editing of this paper\. They were also used to simulate the reviewer feedbacks to help identify and address potential weaknesses prior to submission\. No AI tools were used to generate scientific content, experimental results, or claims\.

## References