This document specifies an open standard for verifiable track records: a trading
strategy's performance claim, proven honest by cryptographic proof rather than asserted by
its author. A conforming credential establishes — to any verifier, trusting no issuer — that
a strategy's reported statistics were computed correctly, on committed data, net of a
committed cost floor, deflated for the committed size of the search that produced it, without
revealing the strategy itself. The standard defines three conformance Levels, the exact
requirements of each, the verification procedure, the boundaries it refuses to certify, and
the governance under which it evolves. It is designed to be implemented by parties other than
its author, and to be checkable rather than believed.
The key words MUST, MUST NOT, SHALL, SHOULD, and MAY are used as normative
requirement levels throughout.
Every track record in systematic finance is, today, graded by the party with the greatest
incentive to shade it, and the tools that check it verify only that a number was reported,
not that it is true. This standard exists to close that gap. It defines what it means for a
performance claim to be verifiable: reproducible by an independent party, from committed
inputs, with no trust placed in the issuer.
This standard governs the claim, not the strategy. A conforming credential proves
properties of a track record while the strategy, its parameters, and (at Level III) its data
remain private. It is asset-class agnostic: equities, futures, FX, commodities, crypto, and
rates are all in scope where a canonical, committable price series exists.
Credential. A cryptographic proof object asserting that a strategy's committed statistics
cleared a defined gate on committed data. A credential is PASS or FAIL; both are valid
credentials.
Committed data. A price series bound to a Merkle root that the proof references; the
verifier re-derives the root from its own copy and MUST reject on mismatch.
Committed cost floor. A minimum per-side fee and slippage. The committed costs are charged
in-circuit; the floor itself MUST be checked by the conforming verifier, and SHOULD be enforced in-circuit.
An issuer MAY commit higher costs but MUST NOT commit lower.
Trial ledger. A commitment to the complete set of strategies evaluated in a search. The
trial count N is the leaf count of this commitment, not a value the issuer reports.
Era. The exact proving program, identified by its cryptographic image hash. A credential
names the era that judged it and remains verifiable against that era permanently.
Verifier. Any independent party running the era-pinned verification procedure. The
verifier trusts no issuer and re-derives every asserted property locally.
A credential MUST declare exactly one Level. Higher Levels subsume the requirements of all
lower Levels.
The claim: this performance actually happened, as stated, on real data, net of real costs.
A Level I credential MUST prove, in-circuit:
1. The reported return, Sharpe, drawdown, and worst-bar are the correct results of applying the
committed strategy to the committed data.
2. The committed per-side costs were charged on every transaction; that they meet or exceed the
floor is confirmed by the verifier (§6, step 5), with in-circuit floor enforcement RECOMMENDED.
3. No lookahead: the position at bar t depends only on data through bar t.
4. The annualization basis is consistent with the committed data window (calendar-honest;
over-counting is rejected).
5. The strategy specification is absent from the proof — present only as a sealed commitment.
Level I answers did this happen? It does not address luck.
The claim: this result is not merely real, but unlikely to be luck given how it was found.
A Level II credential MUST, in addition to Level I:
1. Commit the complete trial ledger before evaluation, so that N is the leaf count of the
committed tree and cannot be understated.
2. Force the presented winner, in-circuit, to be the maximum of the committed trials.
3. Recompute the anti-overfitting statistics inside the proof: at minimum the **Deflated Sharpe
Ratio (Bailey & López de Prado) using the committed N; a conforming implementation SHOULD**
also compute the Probability of Backtest Overfitting (CSCV) and MAY compute the
Probabilistic Sharpe Ratio, the Superior Predictive Ability test, and combinatorial purged
cross-validation over the committed set.
4. Report every computed statistic, pass or fail. A credential MUST NOT report a subset that
flatters the result.
Level II answers is it skill or luck, given the search? It is the level at which the standard's
central contribution — the committed trial ledger — binds.
*The claim: everything above, provable by a manager who reveals nothing, to an allocator who
trusts no one.*
A Level III credential MUST, in addition to Level II:
1. Prove the track record while the strategy or model runs entirely on the submitter's own
machine, submitting only committed decisions (the sealed path). The model MUST NOT be
recoverable from the credential.
2. Bind an owner key so the credential's holder is provable.
3. Be extensible as a chained track: the same committed strategy re-proven over a growing
data window, each link cryptographically bound to its parent, so that bars arriving after a
commitment carry forward-evidence weight.
Level III is the allocatable credential: a manager proves an edge to an allocator without
disclosure, and the allocator verifies it without trust.
A conforming verifier MUST, given a credential and the verifier's own copy of the data:
1. Confirm the proof's guest image hash equals the era the credential names.
2. Verify the cryptographic proof.
3. Re-derive the data root from the verifier's own data and confirm it matches the committed root.
4. Confirm the gate policy in the proof is the canonical policy for the declared Level.
5. Confirm costs meet or exceed the floor and the annualization basis is bound to the data.
6. Confirm the trial count is the committed leaf count (Level II+) and the winner is its maximum.
7. Emit the verdict. The verifier MUST return a failure indication on any check that does not
pass, and MUST NOT require trust in the issuer at any step.
A verification implementation SHOULD be distributable and runnable offline. The reference
verifier completes in milliseconds and is available under an open license.
Stated normatively, because the boundary is the standard's integrity:
- A credential is a seal on history, not a forecast. It MUST NOT be represented as
predicting future returns.
- It does not model capacity, market impact, or fill quality beyond the committed cost
floor, and MUST NOT be represented as doing so.
High-frequency and fill-dependent strategies are out of scope, permanently. Bar data
cannot honestly establish counterfactual fills; a proof of a fill that did not happen is a
proof of fiction. A conforming implementation MUST refuse them.
- The trial ledger binds the committed search. Trials run off-ledger are not covered; closing
that residual requires forward pre-registration (an anchored ledger timestamped before the
out-of-sample bars exist). A credential MUST disclose whether it is a sealed backtest or a
pre-registered forward record.
The engine that issues credentials evolves; the standard governs that evolution so no issuer —
including the standard's author — can retroactively change what a past credential means.
1. A credential names its judge. It commits the image hash of the era that produced it.
2. Eras are superseded, never revoked. A changed engine is a new era with a new hash; old
credentials verify against their own era permanently.
3. A changed judge is a new judge. Any change reaching the compiled proving program is, by
definition, a new era.
4. Weakness is disclosed, not rewritten. A soundness gap in a frozen era is published as
status, with the credential remaining checkable; the reader, not the issuer, decides its worth.
This specification is itself versioned under the same discipline. This is Version 1.0;
future versions supersede but never invalidate credentials issued under prior versions.
Anyone MAY implement this standard. A party claiming conformance MUST publish, for each
credential: its declared Level, the era hash, the committed data root, and a re-verifiable proof
object. A party MUST NOT describe a credential as conforming to a Level whose requirements it
does not meet.
The reference implementation, a public registry of conforming credentials — including the
issuer's own published failures — and an open verifier are maintained at mizan.market. To the
authors' knowledge, it is the first production system to enforce both the deflation program and
the multiple-testing program of backtest honesty inside a zero-knowledge proof. That claim is
falsifiable; a conforming competing implementation would falsify it, and the standard exists in
part to make that possible.
This standard implements published statistical and cryptographic work; the full citation lineage
is maintained at mizan.market/research/lineage. None of the cited authors has endorsed this
standard; the citations run one direction — we implement their work and take responsibility for
the implementation.
Corrections to this specification are invited and will be published, with attribution, under the
same discipline applied to the reference implementation's own numbers: [email protected].
The MIZAN Standard, Version 1.0 · Mizan Verification, Inc. · CC BY 4.0 · Prove the edge. Never reveal the strategy.