Newton Protocol: Opening the Era of Safe AI Finance

AI agents are already transforming digital experiences in various aspects, and this wave of change is now spreading into the realm of finance. Next-generation financial agents, such as automated yield optimizers, airdrop hunters, memecoin traders, copy trading bots, and DAO governance managers promise to revolutionize investment and asset management. However, building these financial agents in Web2 is challenging due to the strict regulations and closed systems of TradFi institutions. Thus, true innovation is expected to thrive in Web3's permissionless environment.

Even when built on Web3, financial agents must resolve core challenges like security, verifiability, and scalability to achieve practical adoption. Current AI-based automation systems fall short, forcing users to blindly trust centralized, unverifiable, and uncontrollable services. Newton Protocol precisely targets this issue, aiming to build a verifiable automation solution for a trustworthy financial agent ecosystem.

Key Takeaways

• Current AI-based automation systems contain fatal risks due to their unverifiable, uncontrollable nature. Particularly in Web3 environments where AI computation relies on off-chain processes while lacking mechanisms to verify the authenticity of the AI models, users face the dilemma of having to blindly trust centralized AI services.

• Newton Protocol presents a solution that makes both the execution environment and results of AI agents verifiable with a variable verifiability level through a combination of Trusted Execution Environments (TEE) and Zero-Knowledge Proofs that suits individual AI use cases on-chain.

• A new era of verifiable AI agents built on the Newton Protocol will foster powerful network effects—both among agents and between agents and humans. Within the Protocol, agent interactions will be governed by programmable permissions and reputation signals, allowing users to retain clear control over how agents behave and with whom they interact.

1. Background - The Need for Verifiable Automation Systems

1.1 Threats from Unverified Automated Systems

The critical error that occurred during Knight Capital's trading algorithm deployment in August 2012 is a representative case showing the dangers of unverified automation systems. During the process of deploying a new trading algorithm to 8 servers, an old algorithm was left on only one server. When this old algorithm was activated at market opening, it sent unlimited orders for 45 minutes, resulting in a loss of $440 million (approximately 600 billion won), ultimately leading to the company's bankruptcy.

The core of this incident lies in structural problems beyond simple technical errors. Specifically, the main issue was the lack of mechanisms to control the operational scope of the automated system. If a system had been in place to predetermine the scope of potential losses and verify these parameters before executing trades, the incident's impact could have been significantly reduced.

The recent proliferation of AI-based automation systems greatly amplifies the possibility of such problems. AI-based systems have much more complex and unpredictable characteristics than traditional rule-based algorithms, with the following fundamental issues inherent:

First is the absence of explainability in AI internal decision processes. Complex AI systems like deep learning models have "black box" characteristics, making it difficult to understand why they produced specific outputs for certain inputs. This makes it very difficult to verify whether backdoors exist in the system or whether decisions align with user-set limitations or intentions. Particularly in the financial sector, AI agents' unexpected behaviors may deviate from user intentions, and the difficulty in clarifying responsibility when accidents occur has been continuously raised, delaying AI adoption.

Second is the inability to verify whether decisions were actually made by AI. This problem has been continuously raised since the emergence of machine learning, with Amazon's Just Walk Out as a representative example. Amazon promoted "Just Walk Out" technology as a fully automated unmanned checkout system based on advanced vision models, advertising that customers could automatically complete payment by taking items and leaving the store. However, in 2024, media outlets like Bloomberg raised suspicions that this system relied on over 1,000 employees in India analyzing videos in real-time and processing payments, leading to the technology's withdrawal from stores. Other cases include the startup uBiome, which claimed to provide AI-based intestinal microbiome analysis services but was revealed by the FBI and SEC to actually rely on standard laboratory tests rather than AI. These cases show how important transparency and verifiability are for AI services.

1.2 AI Utilization Issues in Web3 Environments

Despite Web3's goal of decentralization, it faces a fundamental contradiction where parts requiring AI computation must still rely on centralized external computational environments. Due to blockchain's limited computational capacity and high gas costs, executing complex AI models inevitably must be performed off-chain. However, in these situations on-chain mechanisms to verify these off-chain computations are absent, Web3 applications inevitably fall into the dilemma of having to blindly trust centralized AI service providers.

The existing blockchain ecosystem has addressed such external data dependency issues through distributed oracle networks like Chainlink. Oracle systems ensure the reliability of external data through cryptoeconomic mechanisms and minimize manipulation risks by aggregating data provided by multiple independent nodes. However, AI computation requires complex calculation processes and model execution beyond simple data provisioning, making existing oracle methods insufficient as complete solutions.

While attempts to utilize AI in Web3 environments are increasing, most achieve only limited results due to these reliability issues. Users cannot be certain whether AI agents actually operate as promised or whether they might abuse access rights to private keys or assets, which fundamentally conflicts with Web3's core value of self-sovereignty. Newton Protocol proposes a verifiable system for AI to solve precisely these reliability issues that arise from the convergence of AI and Web3.

In the following sections, we’ll explore how Newton Protocol implements a verified, trustless system for AI finance. On-chain operations executed by AI agents occur only after validating that these operations follow their assigned permissions using zero-knowledge proofs. Subsequently, the execution environment of the agents is verified to ensure that the results users obtain are genuinely derived from AI. This approach addresses both the uncertainty of actions and trust issues in AI-based automated systems.

2. Newton Protocol's Verifiable Automation Solution

Newton Protocol extends blockchain's fundamental principle of "Don't trust, verify" to the AI automation domain through the combination of Trusted Execution Environment (TEE) and Zero-Knowledge Proofs. Newton Protocol doesn't simply use these two technologies in parallel but leverages their unique advantages complementarily: TEE ensures the integrity of AI agent execution environments at the hardware level, while zero-knowledge proof technology is used to cryptographically prove that execution results precisely followed user-defined constraints.

What's important in Newton Protocol's design is that the verification of AI agent’s actions occurs in real-time rather than post-hoc. While traditional verification systems take an approach of analyzing causes after performing actions, Newton Protocol uses a "Verify then Trust" model that verifies appropriateness before all actions are actually executed on-chain, fundamentally preventing failures in AI-based systems.

2.1 Trusted Execution Environment

Source: Jujutsu Kaisen

Trusted Execution Environment (TEE) is a hardware-based security module that, simply explained, deploys encrypted areas called enclaves within memory to ensure the confidentiality and integrity of source code and data. Application code and data deployed within TEE are completely isolated in memory, preventing even processes running with higher-level privileges like the operating system kernel from decrypting the data. Newton Protocol applies TEE to AI agents, ensuring that the environment where agents execute has not been tampered with.

Another advantage of TEE is verifiability. Since TEE is a module designed and manufactured by hardware vendors, its integrity is also verified by the hardware manufacturer. Currently, most TEEs support a verification system called Remote Attestation, which verifies that code deployed within TEE has not been tampered with during the computational environment's boot process, generating certificates containing hash values of running code and hardware signatures. Newton Protocol utilizes this mechanism to mathematically guarantee that AI agents operate in a trusted execution environment and that results are actually generated by AI.

Newton Protocol collaborated with Phala Network, a decentralized computation marketplace, to support verifiable execution environment for AI agents, adopting Phala Cloud as core infrastructure. Phala Cloud supports the latest TEEs including Intel TDX/GPU-based TEE and has high compatibility with on-chain applications, being applied to major Web3 AI projects like Eliza and Virtuals. Newton Protocol also sought to minimize trust issues with computational environment providers by applying decentralized computational environments.

Additionally, Newton Protocol has collaborated with Automata Network to establish an environment that enables transparent, on-chain remote attestation of TEE. Generally, remote attestation of TEE relies on centralized servers from hardware manufacturers like Intel, and this inherently contains risks of single points of failure and censorship. However, Automata's DCAP (Data Center Attestation Primitive) attestation resolves these issues by having multiple decentralized nodes collect and manage the data for attestation (so called collaterals) from hardware manufacturers. Newton leverages Automata’s DCAP Attestation contracts to verify remote attestation ZKPs generated by Succinct and RISC Zero on-chain.

2.2 Zero-Knowledge Based Computational Constraint System

2.2.1 zkPermissions

Newton Protocol's most innovative element is the zkPermissions system. This is a framework that converts user intentions and constraints expressed in natural language into mathematical constraints for zero-knowledge proofs, cryptographically defining and enforcing AI agents' behavioral scope. zkPermissions can express complex conditional logic and constraints based on real-time external data, beyond simple transaction limits or time constraints.

For example, users can input complex conditions in natural language like "Invest in specific assets only when CPI data is announced and inflation is below 2%." Newton Protocol parses these natural language instructions into constraints appropriate to the supported zk circuits and applies them, ensuring transactions execute only when these conditions are satisfied. Importantly, this entire process is based on zero-knowledge proofs, mathematically proving constraint compliance without exposing users' personal information or trading intentions.

The key technical challenge in zkPermissions implementation is bridging the gap between natural language processing and formal verification. Newton adopted a hybrid system combining Domain-Specific Language (DSL) and template-based approaches. Users' natural language inputs first undergo semantic analysis to convert into structured intention expressions, then the corresponding expressions are enshrined on-chain via a zkPermissions key.

zkPermissions can connect not only with on-chain data but also with various off-chain data including real economic indicators, market sentiment, and technical analysis results. This allows users to set various conditions like "Buy only when cryptocurrency market sentiment is positive" or "Trade only when specific technical indicators show buy signals," with such external data provided through verified oracles to ensure integrity.

2.2.2 A Composable Off-Chain Computation Primitive for On-Chain Automation

The zkPermission primitive introduced by Newton Protocol serves as a foundational mechanism for bridging off-chain computation with on-chain automation, incorporating both on-chain and off-chain conditions in a highly composable manner. Unlike traditional permissioning schemes constrained by pre-defined rule sets or static logic, zkPermissions offer unbounded expressivity: developers can define arbitrary permission logic using general-purpose Rust code, while users can freely compose these permission “legos” to suit individualized transaction policies.

By delegating complex computations, such as multi-condition evaluation, data joins, or model-based decision making, to an off-chain zk proving layer and limiting the on-chain logic to succinct proof verification, Newton Protocol achieves a system that is both scalable and gas-efficient. Notably, the Protocol supports batching multiple permission checks into a single zero-knowledge proof, enabling compact enforcement of complex policies without incurring linear gas costs.

For example:

• Users can define data-driven execution conditions that incorporate both on-chain and off-chain state, enabling granular and reactive control flows.

• Conditions may encode risk sensitivity parameters, such as slippage tolerance, liquidity thresholds, or volatility-adjusted execution triggers, which are essential for secure DeFi interactions.

• The base zkPermission model includes a session key permission framework, in which users can set constraints such as maximum transaction volume, cumulative execution caps, and validity windows (e.g., expiration or time gating). These serve as modular policy components that support secure delegation over limited scopes.

In aggregate, zkPermissions represent a general-purpose, developer-extensible, and privacy-preserving control layer for programmable accounts, facilitating expressive, safe, and efficient delegation in decentralized systems.

2.3 Performance Optimization through Batch Proofs and zkPermissions Rollups

One of zero-knowledge proof technology's biggest constraints is computational overhead. Generating proofs for complex circuits requires considerable time and resources, which can become a serious bottleneck in financial applications requiring real-time trading. Newton Protocol proposes a batch proof system to solve this problem.

Newton Protocol requires operators of AI agents to prove the correctness of their executions by submitting zk proofs for TEE attestation with each request they serve. To balance performance and operational costs, operators can stake $NEWT collateral, which allows them to defer individual proof submissions and instead submit an aggregated batch proof at the end of each epoch. This approach significantly reduces overall computational complexity compared to individual proof generation while ensuring each transaction's legitimacy.

Furthermore, Newton Protocol adopted an Application-Specific Rollup design optimized for zkPermissions creation and usage rather than general-purpose computing platforms. By using circuits and proof systems optimized for each application domain, Newton Protocol can achieve significantly improved performance compared to general-purpose systems. Newton Protocol named these purpose-specific rollups as “zkPermissions Rollups”. Currently, Newton.xyz is implemented as one of the zkPermissions Rollup built upon Newton Protocol.

2.4 Structure of Newton Protocol

Newton Protocol operates as a decentralized network built on a delegated Proof-of-Stake (dPoS) consensus mechanism using its native token $NEWT. $NEWT holders can delegate their tokens to network validators, contributing to network security while earning staking rewards.

Newton Protocol's system consists of two core domains: Verifiable AI and zkPermissions. Each domain comprises different components that work complementarily to create a comprehensive automated solution.

1) zkPermissions

• User Wallets: Each user is provided with an account abstraction wallet based on ERC-4337 and ERC-7702 standards. Newton Protocol uses this to issue session keys with temporary permissions containing specific conditions and constraints to AI agents instead of granting full private key access to user wallets. User session keys correspond one-to-one with zkPermissions generated by executors. Whenever users grant or revoke permissions to AI agents through session keys, $NEWT tokens are used as protocol gas fees, with transaction prioritization determined through a fee market similar to EIP-1559.

• Executor: A core component that stores and processes zkPermissions.

• Validators: Handle the creation and deletion of zkPermissions. They ensure executors execute blocks honestly and propagate state updates for Newton Protocol and other zkPermission Rollups where the zkPermissions can be used.

2) Verifiable AI

• Offchain Agents: Model developers list AI models and agents in the Newton Model Registry (NMR) to enable operators to serve them. To list a model in the NMR, developers must pay registration fee through $NEWT. Once operators pick up and serve the models, the developers receive a share of the $NEWT fees.

• Operators: Entities that actually execute AI agents, operating models deployed in TEEs. They generating TEE remote attestation results and zero-knowledge proofs for executors throughout all execution processes to ensure execution integrity. They may receive rewards or have collateral slashed based on processed task results.

The Execution Orchestrator serves as the core infrastructure of Newton Protocol, sitting at the intersection of Verifiable AI and zkPermissions. It acts as a marketplace that efficiently connects users' automation requests with operators capable of executing them. Its key components, Executor and Validator, share the responsibilities of processing zkPermissions and verification of the execution to ensure system stability and scalability.

The most important differentiator of this structure is real-time proof rather than post-verification. The legitimacy of every agent action is already cryptographically proven before execution, representing a new paradigm combining off-chain flexibility with on-chain verifiability.

Notably, Newton Protocol's Verifiable AI system is already operational and has processed approximately 1 million verified requests via Newton.xyz. Additionally, the zkPermissions rollup is set to come online soon, which will definitely expand Newton Protocol's functionalities through a fully composable permission management system.

3. Newton Protocol Adoption Scenarios

3.1 Cross-Chain Yield Optimization

While various dashboards and yield optimization protocols exist in the current market, most of these services are specialized for single chains, making cross-chain optimization difficult and having the fundamental limitation that users must completely trust service providers. Users have no way to verify whether their funds are really being managed according to optimal strategies or whether service providers are arbitrarily managing funds.

Cross-chain yield optimization using Newton Protocol fundamentally solves these problems. Users first input their investment-related constraints in natural language. For example, they can set conditions like "Don't invest more than 20% of total assets in a single protocol," "Don't invest in newly launched protocols," "Maintain at least 30% stablecoin proportion," etc. These conditions are converted into mathematical constraints through Newton's zkPermissions system, becoming enforced rules that AI agents can never violate. Newton Protocol has a structure that generates transactions off-chain and deploys them to destination chains, making transaction submission to virtually all chains possible, and real-time exploration of information about various chains is possible as long as verifiable oracles are provided. Users can use this to perform diversified investment and opportunity exploration across various chains in real-time and in verifiable form.

3.2 Controllable Copy Trading

Copy trading is an investment method that follows professional traders' strategies, very popular in DeFi where information asymmetry is severe. However, the biggest problem with existing copy trading systems was that investors had no choice but to blindly follow traders' actions, with malicious traders frequently engaging in so-called "retail shakeout" behaviors, repeatedly buying/selling in relatively low-liquidity pools to drain copy traders' assets.

Newton Protocol's verifiable copy trading system fundamentally solves these problems. Since Newton Protocol enables copy traders to verify that all trades satisfy predefined risk parameters, only actions within user-allowed ranges can be performed. Investors can set constraints through zkPermissions like "Don't trade in pools with N or fewer holders," "Don't trade in pools below certain liquidity levels," "Trading frequency cannot exceed 10 times within 24 hours," etc.

3.3 Verifiable DAO Operations

One of the biggest challenges in Decentralized Autonomous Organization (DAO) operations is automating complex financial management and governance processes. Traditional DAOs rely on community voting for most decisions, causing inefficiency when rapid decision-making is needed. Particularly in DeFi environments, real-time automation is essential to respond to rapidly changing market conditions.

DAO operation automation using Newton Protocol automatically performs financial management, contributor compensation, risk hedging, etc., according to predefined rules and conditions while ensuring all processes are transparent and verifiable. For example, when automating DAO treasury asset allocation, risk management policies previously agreed upon by the community are encoded as zkPermissions. Complex policies like "Don't invest more than 30% of total assets in a single protocol," "Always maintain at least 20% stablecoin proportion," "Require at least 3 independent audit reports when investing in new protocols" can be mathematically enforced.

4. Newton's Significance: Ecosystem Synergy through Network Effects

4.1 Reputation System-Based Flywheel

Newton Protocol's ultimate value comes not from verifiability alone but from the powerful network effects based on it. As more verifiable agents increase, users' trust levels rise, leading more developers to participate in a virtuous cycle structure. These network effects operate simultaneously on two dimensions.

Source: Magic Newton Foundation

First is the supply-side network effect. As more operators, i.e., AI agents, participate in Newton Protocol, users can utilize more diverse and complex services. For example, if one operator specializes in high-frequency trading and another specializes in cross-chain bridging, their combination enables more complex and efficient trading strategies.

Second is the demand-side network effect. As more users utilize Newton Protocol, operators' revenue opportunities increase, which in turn attracts more high-quality operators to participate. Additionally, user growth leads to increased trading volume, improving liquidity, which returns as improved trade execution quality for all users.

Furthermore, verifiable execution records enable operators to build reputation, inducing healthy competition among agents. All execution results and performance indicators recorded on the blockchain are reflected in the reputation system in an unalterable form, naturally giving agents providing high-quality services competitive advantages. This structure creates an environment where high-quality services can be properly evaluated in the market.

4.2 Network Effects between Agent-Agent and Human-Agent Interactions

Newton Protocol's structure focuses on network effects through agent-agent interactions and human-agent cooperation, beyond simple one-to-one interactions between users and agents.

Multi-agent systems have been delayed in adoption for handling operations related to user capital due to high system complexity from AI combinations and lack of verifiability. However, under Newton Protocol's system, each agent's behavior is verifiable and reputation can be measured through this, ensuring relatively high system reliability. For example, in a division of labor structure where one agent handles market analysis and another handles actual trade execution, each agent's role and responsibility are clearly defined and executed in verifiable form. Such multi-agent systems can realize complex and sophisticated strategies impossible with single agents.

Newton Protocol focuses not only on agent-agent interactions but also on the potential of human-agent networks, as agent networks based on human control can be formed. Humans can define high-level intentions and constraints and immediately judge the authenticity of constraints generated by zkPermissions. Users can fully utilize AI efficiency in trading processes without losing control. This can be called an approach that simultaneously realizes Web3's core value of self-sovereignty and AI automation efficiency.

5. Conclusion - The New Era Created by Newton Protocol's Verifiable Automation System

5.1 Bridging the Technology Gap through Natural Language-Based Automation

Newton Protocol's verifiable automation system presents a fundamental paradigm shift in the Web3 ecosystem beyond simple technological innovation. Currently, Web3's biggest barrier is complexity. For general users to properly utilize DeFi, they must master professional concepts like gas fees, slippage, and impermanent loss, and learn different interfaces and risk structures for each protocol.

Newton Protocol fundamentally solves these entry barriers. By converting complex natural language requests into constraints and permitting AI agents to execute actions only within these limits, Web3's technical complexity is simplified, ensuring user control and transparency.

More importantly, the gap between experts and general users is dramatically reduced. 24-hour real-time monitoring, multi-chain dynamic optimization, and immediate response to market changes are sophisticated functions difficult for individuals to implement directly. Newton Protocol's verifiable AI agents make such professional services safely accessible to general users.

5.2 Human-Centered AI Cooperation Model

Newton Protocol's core goal is a new cooperation model between humans and AI. While existing AI automation systems required users to give up control, Newton presents a way to maximize AI efficiency while allowing humans to maintain their max control. This can be called an approach that realizes Web3's core value of self-sovereignty even in the AI era. When verifiable AI becomes standard, users receive services in provable form within predefined constraint ranges, no longer needing to blindly trust AI service providers.

Ultimately, Newton Protocol pursues a new digital economy where technological advancement doesn't infringe on human autonomy and convenience doesn't sacrifice security. This is a concrete answer to how Web3's decentralization philosophy can be implemented in the AI era, and will be an important first step toward a future where humans and AI truly cooperate through verifiable automation.

6. Resources

Related Articles, News, Tweets etc. :

• https://blog.newt.foundation/the-litepaper/

• https://help.newton.xyz/

• https://docs.newt.foundation/newton-protocol/overview

• https://www.magicnewton.com/