Verify without revealing: pooled pricing for illiquid fixed income

Why the data stays home

Evaluated pricing in thin markets works from what it can see: a few trades, some quotes, and comparable bonds. The parties with the most information have good reasons to hold it back. A dealer’s inventory and axes reveal positioning. A manager’s marks reveal holdings and valuation practice. However trustworthy the aggregator, every copy of sensitive data is one more thing to protect. Contributor agreements reduce that exposure; they do not remove it.

Pooling without disclosure

Each contributor submits inputs identified by a content digest. An approved, deterministic pricing engine runs in a Trusted Execution Environment (TEE), and its software measurement is checked before any input is released to it. Only the agreed outputs leave: the consensus price, dispersion statistics, and, for each contributor, a private report of its own distance from consensus.

The path is always: committed inputs → approved engine → attested execution → released outputs only → evidence.

• A contributing dealer or manager sees the consensus price and its own distance from it. It never sees another contributor’s inputs.
• The data provider running the service sees released outputs, dispersion, and evidence. Raw contributor inputs stay sealed unless the contributor agreement says otherwise.
• A subscriber, auditor, or central bank sees the price, the method version and its digest, approvals, and the execution receipt. It does not need contributor inputs or the provider’s proprietary methodology to check the result.

Prices that carry their own proof

The same run emits an Evidence Pack for every published price: input digests, the method version, any expert-judgment overrides and who approved them, and a signed execution receipt. A subscriber can confirm the approved method ran on the stated inputs. The provider keeps its methodology private. Benchmark governance gets its record at publication instead of rebuilding it for an audit.

The value continues downstream. When a bank’s valuation control team references a committed price snapshot in its independent price verification, the consensus becomes an audited input to the bank’s control, not just a feed.

Designed for hardware that can fail

Confidential computing rests on trusted hardware, and trusted hardware has had flaws. The design starts from that assumption. Inputs are released only to a runtime whose measurement has been verified. Outputs stay non-authoritative until their receipt checks out. If attestation or key release is lost, the run fails closed rather than falling back to a clear-text path.

Two peer-reviewed papers co-authored by OpenBITS CTO Chen Feng address the same problem from different sides: one keeps a recovery path when the trusted component becomes unavailable, and the other avoids resting integrity on a single hardware vendor. Mercury & TeeRollup covers both.

Where to start

A first engagement can be small enough to approve quickly: one illiquid segment, three simulated contributors on synthetic or public data, and no connection to production systems. It succeeds if results reproduce exactly from committed inputs, no contributor can see another’s inputs, a reviewer can verify method and approvals from the evidence alone, and the operating cost per run is known.