Zero-knowledge proofs prove statements without revealing why they are true. Private membership tests answer a narrower question: is this element in that set? Each is useful alone, but many real problems need both at once — proving, privately, that a hidden value is or is not a member of some set. Is this credential on the revocation list? Is this user not on the sanctions list? Without revealing the value or scanning the list in the open.

US12395341B2, “Augmented zero-knowledge proof with private membership test,” granted to NEC Corporation on August 19, 2025, fuses the two. Classified under H04L 9/3218 (zero-knowledge protocols) with H04L 9/0618 and H04L 9/0656, it claims a proof augmented with a membership test that stays private.

“A method for performing a privacy-preserving membership test includes performing an oblivious pseudo-random function (OPRF) protocol to determine a pseudo-random function (PRF) result based on an input from a proving device and a PRF key.”— U.S. Patent No. 12,395,341 source

The independent claim is spare, and the substance is in what an OPRF buys you. Claim 1 has two steps: perform an “oblivious pseudo-random function (OPRF) protocol to determine a PRF result based on an input from a proving device and a PRF key,” where the input “indicates a user identity”; then determine “whether the user belongs to a verifier list… based on testing membership of the user using the verifier list and the PRF result.” The obliviousness is the whole trick: in an OPRF, the prover learns the PRF output on its own input but not the key, and the keyholder learns neither the input nor the output. So the membership test runs on a pseudo-random value derived from the user's identity, never on the identity itself.

The dependent claims show how the list side stays private too. Claim 3 has the verifier “perform a PRF evaluation on individuals indicated by the verifier list using the PRF key” to produce a “representation of the verifier list indicating a plurality of pseudo-random values,” and membership is decided “by comparing the PRF result with the plurality of pseudo-random values.” In other words, both the queried identity and every entry on the list are mapped through the same keyed PRF, and the test is a comparison of pseudo-random tokens — neither side has to expose its plaintext. Claim 4 keeps the PRF key inside the verifier device; claim 5 instead places it in a “third-party server that is separate from the verifier device and the proving device,” a different trust split for cases where neither party should hold the key alone.

The deepest claims spell out a homomorphic, proof-checked OPRF that is genuinely a composition rather than a slogan. Claim 8 has the prover's input be “a first ciphertext that is based on homomorphically encrypting credentials of the user,” accompanied by “a zero-knowledge proof of the input” that the verifier checks for correctness before proceeding. Claim 9 then has the verifier encrypt the PRF key under the prover's public key, and generate “a second ciphertext based on the encrypted PRF key, the first ciphertext, and a randomly chosen blinding value” — claim 10 making explicit that this means “multiplying the encrypted PRF key with the first ciphertext” and then blinding the product. Claim 11 closes the loop: the prover returns “a partial PRF result” by decrypting that second ciphertext and “hiding the decrypted second ciphertext by moving the decrypted second ciphertext into an exponent,” plus a zero-knowledge proof that it did so honestly; claim 12 finishes by “removing the randomly chosen blinding value from the exponent.” That is a real protocol — homomorphic multiply, blind, partial-decrypt-into-an-exponent, unblind — with zero-knowledge proofs guarding each side's honesty.

The word “augmented” is the substance. A plain zero-knowledge proof attests to a statement; augmenting it with this private membership test lets the same interaction also establish a relationship between a secret value and a set — without leaking the value, and without the verifier having to learn or hold the set in a way that breaks its privacy. Claim 7 makes the augmentation explicit: once membership is established, the verifier “obtains a zero-knowledge proof of possession of credentials for the input from the proving device” and verifies it. Composing primitives cleanly, so the combination still proves what you want and leaks nothing extra, is genuinely hard, which is why it is worth a claim.

The applications are concrete and current. Privacy-preserving compliance — proving you are not on a blocklist — anonymous credentials with revocation, and private set intersection all want this exact shape: a verifiable statement about membership that reveals neither the member nor more of the set than intended. The inventor team includes Karame and Marson, names tied to applied cryptography research, which supports reading this as a real composition rather than a buzzword stack.

Per the desk's discipline: issued grant (B2), not an application; a protocol-method claim, not a deployed product. The composition of two well-studied primitives — an OPRF-driven private membership test and a zero-knowledge proof of credentials, glued with homomorphic encryption and blinding — is the contribution.

For the reader following the zero-knowledge frontier, the 2025 grants increasingly read like this — not new proof systems from scratch, but careful compositions of zero-knowledge with membership tests, query verification, and set operations. That compositional phase is how a cryptographic primitive becomes a toolkit: once the pieces are sound, the value moves to combining them correctly for real problems.