Predicate Family Unforgeability

• Predicate Family Unforgeability is a cryptographic property ensuring that only legitimate owners can satisfy ownership predicates required for secure token state transitions.
• It employs a pair of PPT algorithms to generate and solve predicates, with security quantified by adversary advantage and hash collision resistance.
• Its role in atomic swap protocols guarantees a no-blocking execution layer where both parties must strictly fulfill predicate conditions to complete transactions.

Predicate family unforgeability is a cryptographic property formalized to ensure that programmable spending conditions, called predicates, can underpin secure, off-chain state transitions in modern token systems. This property is central to the robustness of the Unicity execution layer, generalizing token ownership to broader classes of ownership predicates and providing a foundation for advanced applications such as trustless atomic swaps. Predicate family unforgeability guarantees that only legitimate owners can satisfy specific state-changing predicates, precluding illicit state spends and related adversarial behaviors (Buldas et al., 1 Jun 2026).

1. Definition of Predicate Families and Unforgeability

A predicate family is formally defined as a pair of probabilistic polynomial-time (PPT) algorithms $(G, S)$ with prescribed interfaces:

• $G(1^\lambda) \to (sk, \pi)$: The generator samples a private key $sk$ and a corresponding public predicate $\pi$ for security parameter $\lambda$.
• $S(sk, m) \to$ either $\perp$ or a witness $u$ with $\pi(m, u) = 1$: The solver, given the secret $sk$ and a message $G(1^\lambda) \to (sk, \pi)$0, outputs a witness $G(1^\lambda) \to (sk, \pi)$1 that satisfies the predicate, or returns failure.

The ownership predicate $G(1^\lambda) \to (sk, \pi)$2 defines the condition required for state transitions (e.g., token spend). Unforgeability for predicate families is captured through a UF–CMA-style game:

• The adversary $G(1^\lambda) \to (sk, \pi)$3 has oracle access to new predicate generations and to solve queries on known predicates and messages.
• $G(1^\lambda) \to (sk, \pi)$4 wins if it outputs $G(1^\lambda) \to (sk, \pi)$5 such that the predicate $G(1^\lambda) \to (sk, \pi)$6, $G(1^\lambda) \to (sk, \pi)$7 was previously generated, and $G(1^\lambda) \to (sk, \pi)$8 has not queried the solver on $G(1^\lambda) \to (sk, \pi)$9 (or only received $sk$0 when it did).

The adversarial advantage is denoted as

$sk$1

A predicate family $sk$2 is $sk$3–UF-secure if no $sk$4-time adversary making $sk$5 oracle calls achieves advantage $sk$6 (Buldas et al., 1 Jun 2026).

2. Relation to Execution-Layer Security in the Unicity Model

Within Unicity, predicate family unforgeability underpins the no-blocking security property: only a party able to satisfy the current ownership predicate may alter or "spend" a token state. This is formalized as a game between a blocking adversary $sk$7, the Unicity Service (US), and a TS oracle implementing $sk$8. The core result (Theorem 2) demonstrates that if:

• $sk$9 is $\pi$0–UF-secure,
• The hash function $\pi$1 is $\pi$2–collision-resistant,

then the Unicity Service is $\pi$3–secure against blocking, where $\pi$4 and the admissible time and query bounds follow polynomially from those for $\pi$5 and $\pi$6. In effect, if an adversary $\pi$7 can successfully block a token with probability $\pi$8, then either $\pi$9 can be converted into a collision-finder for $\lambda$0 or a predicate family UF-forger for $\lambda$1 with at least half that probability (Buldas et al., 1 Jun 2026).

3. Key Lemmas Underlying Predicate-Family Unforgeability

The security reduction for the execution layer is built around two combinatorial observations:

• Blocking Implies Collision or Predicate Solve: If adversary $\lambda$2 blocks state $\lambda$3 by submitting $\lambda$4, then either $\lambda$5 does not correspond to any previously registered predicate (so $\lambda$6 finds a collision in $\lambda$7), or $\lambda$8 for some $\lambda$9 and $S(sk, m) \to$0 did not query $S(sk, m) \to$1 for $S(sk, m) \to$2 (yielding a fresh predicate solve).
• Extraction of a UF Forgery: In the second case, observing $S(sk, m) \to$3's transcript allows extraction of a triple $S(sk, m) \to$4 that constitutes a successful predicate family UF-forgery: $S(sk, m) \to$5 and $S(sk, m) \to$6 never queried that instance to $S(sk, m) \to$7.

These observations yield a tight reduction that bounds adversarial blocking probability in Unicity to the sum of the predicate family UF bound and the collision resistance of $S(sk, m) \to$8 (Buldas et al., 1 Jun 2026).

4. Role in Atomic Swap Protocols

Predicate family unforgeability is critical for the security of trustless atomic swaps built upon Unicity. The atomic swap mechanism leverages programmatic predicates—the preparation predicate $S(sk, m) \to$9 and the swap predicate $\perp$0—specifically constructed so that only the honest owner can satisfy the respective predicates within prescribed parameters (e.g., commitment inclusion, timeouts, and fresh signatures).

Preparation Predicate $\perp$1

$\perp$2 if:

1. $\perp$3 ($\perp$4 is a valid signature under key $\perp$5 for message $\perp$6),
2. $\perp$7,
3. If $\perp$8 describes a swap, then $\perp$9.

Swap Predicate $u$0

$u$1 is satisfied if:

1. There exists a valid inclusion proof $u$2 for the value $u$3 at key $u$4 in US,
2. $u$5 and either:
   • (a) $u$6 and $u$7, or
   • (b) $u$8, $u$9, and time $\pi(m, u) = 1$0.

Atomicity and correctness are guaranteed because either party can complete the swap only by presenting genuine inclusion proofs and freshly signed messages, or else a timeout branch is triggered. Any deviation by an adversary reduces to predicate forging or hash collision, both precluded under the stated security assumptions (Buldas et al., 1 Jun 2026).

5. Protocol Outline and Security Properties

The atomic swap protocol operates as follows:

1. Prepare: Both parties shift token control to the preparation predicate, binding token state to future swap logic.
2. Exchange ledgers: Parties verify each other's prepared commitments and agree on swap timing parameters.
3. Commit: Each executes a $\pi(m, u) = 1$1 request, yielding an inclusion proof and setting the requisite state in the Unicity Service.
4. Finish: If the other party’s swap-commit is present, the original party completes the swap using $\pi(m, u) = 1$2; otherwise, a timeout resolves withdrawal.

Correctness and atomicity rely on two principal lemmas:

• Rollback: If, after timeout, the swap-commit is absent, no valid swap occurred—enforced by the append-only and collision-resistant ledger.
• Success: Existence of the swap-commit implies that the corresponding party necessarily performed a valid commit within the designated window.

This protocol ensures that swaps are atomic—either both sides complete or both can recover—because no party can forge satisfaction of the predicates or inclusion proofs (Buldas et al., 1 Jun 2026).

6. Cryptographic Assumptions and Model Idealizations

The security arguments for predicate family unforgeability, its reduction to execution-layer security, and the atomic swap construction are all predicated on the following cryptographic assumptions:

• The hash function $\pi(m, u) = 1$3 is collision-resistant (and where necessary, one-way).
• The commitment scheme $\pi(m, u) = 1$4 is perfectly binding (for double-spending prevention) or perfectly hiding (for association proofs).
• The signature scheme $\pi(m, u) = 1$5 is existentially unforgeable under chosen-message attack (EUF-CMA).
• The Unicity Service maintains an append-only ledger, consistent and monotonic time $\pi(m, u) = 1$6, and produces publicly verifiable inclusion proofs.
• Adversaries are granted full control of network scheduling and access to all relevant oracles.
• The model assumes ideal synchrony or bounded drift between service and participant clocks for time-based predicates.

Consequently, the reduction demonstrated in the Unicity model establishes that the no-blocking property of the execution layer is exactly characterized by the conjunction of predicate-family unforgeability and standard hash collision resistance (Buldas et al., 1 Jun 2026).