What the Verifier Gets to See (Public vs Private Signals)

Why this matters

Every Circom circuit has two groups of signals: private (inputs the prover knows, verifier never sees) and public (inputs both sides know, plus the outputs). Getting this boundary right IS the zero-knowledge property. Accidentally making a secret public exposes your user's balance; accidentally making a public input private means the verifier can't check against external data. In Circom, public inputs are declared at the component main line. This is easy to get wrong and there's no compiler warning.

Demo

A preimage verifier: prove 'I know x such that Poseidon(x) = hash' where hash is PUBLIC and x is PRIVATE. Declaring which is which lives in the component main line: component main { public [hash] } = PreimageCheck();. Anything not listed is implicitly private.

pragma circom 2.1.6;
include "circomlib/circuits/poseidon.circom";
 
template PreimageCheck() {
    signal input x;          // private — the preimage
    signal input hash;       // PUBLIC — the commitment
    component poseidon = Poseidon(1);
    poseidon.inputs[0] <== x;
    poseidon.out === hash;   // the ZK statement: x hashes to the known value
}
 
component main { public [hash] } = PreimageCheck();
 
// Generate proof:
//   input.json = { "x": 42, "hash": <Poseidon(42)> }
// Verifier sees only 'hash' — never 'x'.

Try it yourself

1. Compile, generate a witness with a known Poseidon preimage, prove, verify. Confirm snarkjs asks for 'public signals' = [hash] only.
2. Swap the public declaration to [x] instead of [hash]. Now the verifier sees x and the SNARK is meaningless — you've leaked the witness. This is how real protocols have lost user privacy.
3. Add a second private signal (signal input r) representing a blinding factor. Observe that it doesn't appear in the public-signals list unless you explicitly declare it.
4. Read a real Circom project's main components (e.g., Tornado Cash's Withdraw.circom). Identify every public signal. Trace what each reveals on-chain.
5. Experiment: what happens if you forget to constrain a public input? The verifier can claim any value for that public signal and the proof still verifies. This is another under-constrained bug category.

References

• Circom 2 Documentation — Getting Started
• iden3 — snarkjs README
• 0xPARC — Circom Workshop (Ya-Wen Jeng)
• Vitalik — QAPs from Zero to Hero