// This code is PUBLICLY VISIBLE on Etherscan
function withdraw(bytes32 _password) external {
    if (keccak256(_password) == duressHash) {
        // Decoy branch — ATTACKER CAN SEE THIS EXISTS
        transferDecoy(msg.sender);
    } else if (keccak256(_password) == realHash) {
        // Real branch — ATTACKER CAN DEMAND BOTH
        transferReal(msg.sender);
    }
}

── Definition 5: Dual-Nullifier Generation ────────────────
Given secret s ∈ F_p and Poseidon hash H:
  N_real  = H(s, 0)
  N_decoy = H(s, 1)

Lemma 1 (Nullifier Independence): N_real and N_decoy are
computationally independent. Given one, computing the other
requires knowledge of s. (Poseidon PRF under Sponge assumption)

── Commitment Structure ───────────────────────────────────
  C = H(s, N_real, N_decoy, H_frase)
  → inserted into on-chain Merkle tree

── Definition 6: Arithmetic Selector ──────────────────────
  a = ia_inference × frase_correcta

  N_output = a · H(N_real) + (1 − a) · H(N_decoy)

Lemma 2: Expression expands to N_output = H(N_decoy) + a · (H(N_real) − H(N_decoy))
→ exactly 2 R1CS constraints regardless of a ∈ {0,1}
→ same gas, same proof size, same verification time

── Definition 7: Shadow Passphrase (Canary Phrase) ────────
A secondary phrase that deliberately triggers decoy mode
without generating any observable indicator.

  frase_correcta = frase_real × (1 − frase_shadow)

Where:
  frase_real   = (frase_hash == frase_esperada)
  frase_shadow = (frase_hash == frase_shadow_hash)

"Canary" — sings (activates protection) before danger materializes.

// COMMITMENT: Poseidon₄(secret, η_real, η_decoy, H_frase)
component commitmentHasher = Poseidon(4);
commitmentHasher.inputs[0] <== secret;
commitmentHasher.inputs[1] <== nullifier_real;
commitmentHasher.inputs[2] <== nullifier_decoy;
commitmentHasher.inputs[3] <== frase_hash_stored;

// PASSPHRASE VERIFICATION
component fraseHasher = Poseidon(1);
fraseHasher.inputs[0] <== frase_input;
component fraseComparator = IsEqual();
fraseComparator.in[0] <== fraseHasher.out;
fraseComparator.in[1] <== frase_hash_stored;
signal frase_correcta;
frase_correcta <== fraseComparator.out;  // 1 si coincide, 0 si no

// DUAL LOGIC — acceso_real = ia_inference AND frase_correcta
// ia_inference: 1 = normal, 0 = estrés (from ZKML model)
signal acceso_real;
acceso_real <== ia_inference * frase_correcta;
ia_inference * (1 - ia_inference) === 0;  // binary constraint

// NULLIFIER HASHES — both computed, one selected
component nullifierRealHasher = Poseidon(2);
nullifierRealHasher.inputs[0] <== nullifier_real;
nullifierRealHasher.inputs[1] <== secret;
signal nullifier_hash_real;
nullifier_hash_real <== nullifierRealHasher.out;

component nullifierDecoyHasher = Poseidon(2);
nullifierDecoyHasher.inputs[0] <== nullifier_decoy;
nullifierDecoyHasher.inputs[1] <== secret;
signal nullifier_hash_decoy;
nullifier_hash_decoy <== nullifierDecoyHasher.out;

// ARITHMETIC SELECTOR — no branching, proof reveals nothing
signal selectedNullifier;
selectedNullifier <== acceso_real * (nullifier_hash_real - nullifier_hash_decoy)
                    + nullifier_hash_decoy;

// On-chain: both nullifiers are valid → indistinguishable
nullifierHash === selectedNullifier;

Theorem 2: Given only public outputs (root, nullifierHash, recipient,
relayer, fee, π), no PPT adversary can determine the value of private
selector a with probability significantly greater than 1/2.

Proof via sequence of games:

Game 0: Real protocol execution.
  Adversary observes (root, N_out, recipient, relayer, fee, π)

Game 1: Replace Poseidon hash outputs with truly random values.
  |Pr[A wins G1] − Pr[A wins G0]| ≤ negl(λ)
  (by PRF security of Poseidon under Sponge assumption)

Game 2: Replace Groth16 proof π with simulated proof π*.
  |Pr[A wins G2] − Pr[A wins G1]| ≤ negl(λ)
  (by zero-knowledge property of Groth16)

In Game 2, adversary's view:
  • root:     independent of a
  • N_out:    random value (by Game 1)
  • recipient, relayer, fee:  chosen by user, independent of a
  • π*:       simulated, no witness information

All components independent of a ⟹ Pr[A guesses a] = 1/2  □

Corollary 1 (Coercion Resistance): Under coercion, decoy nullifier
produces valid funds. Attacker CANNOT determine:
  (1) Whether user has additional real funds
  (2) Whether coercion resistance was activated
  (3) What triggered the decoy path