{"id":"ERC-7007","name":"Verifiable AI-Generated Content Token","status":"Final","chain":"both","category":{"id":"security","name":"Security & Trust","description":"Helping users verify, control, and protect their assets"},"journeyStages":[{"id":"specialized","name":"Specialized Interactions","description":"Physical items, AI, social, gaming"}],"uxImpact":"ERC-7007 extends ERC-721 with AIGC data and verification interfaces. addAigcData binds prompt, aigcData, and proof to a token, while verify checks the combination through a chosen zkML or opML verifier. Model commitments, prompt confidentiality, proof storage, and creator disclosures depend on the implementation and storage design.","officialUrl":"https://ercs.ethereum.org/ERCS/erc-7007","lastReviewed":"2026-09-18","lastUpdated":"2026-09-18","kind":"proposal","hasDetailedContent":true,"content":{"id":"ERC-7007","sources":[{"label":"Official specification","url":"https://ercs.ethereum.org/ERCS/erc-7007","type":"official-spec"}],"lastReviewed":"2026-09-18","specConstraints":[{"id":"aigc-nft-interface-support","constraint":"Every compliant AIGC-NFT contract must implement IERC7007, ERC721, and ERC165.","appliesTo":"account-implementation","normativity":"normative","specQuote":"Every compliant contract must implement the `IERC7007`, [`ERC721`](./eip-721.md), and [`ERC165`](./eip-165.md) interfaces.","specSection":"Specification","specUrl":"https://ercs.ethereum.org/ERCS/erc-7007#specification","designImplication":"Feature-detect the required interfaces before offering AIGC-NFT actions, and keep ordinary ERC-721 ownership and transfer affordances available."},{"id":"aigc-finality-verification","constraint":"verify should return true only when AIGC data is finalized: a zkML proof is verified or the opML challenge period is finalized and data is up to date.","appliesTo":"application","normativity":"rationale","specQuote":"verify should return true if and only if `aigcData` is finalized in both zkML and opML. In zkML, it must verify the ZK proof, i.e. `proof`; in opML, it must make sure that the challenging period is finalized, and that the `aigcData` is up-to-date, i.e. has been updated after finalization.","specSection":"Rationale / verify interface","specUrl":"https://ercs.ethereum.org/ERCS/erc-7007#verify-interface","designImplication":"Label proof verification and opML finalization separately, and do not show AIGC data as final merely because it was minted or because a proof-shaped payload exists."},{"id":"erc721-compatibility","constraint":"The AIGC-NFT standard extends ERC-721 with new interfaces and remains backward compatible with it.","appliesTo":"application","normativity":"backwards-compatibility","specQuote":"This standard is backward compatible with the [ERC-721](./eip-721.md) as it extends the existing functionality with new interfaces.","specSection":"Backwards Compatibility","specUrl":"https://ercs.ethereum.org/ERCS/erc-7007#backwards-compatibility","designImplication":"Present AIGC proof and prompt status as an extension of ordinary NFT ownership, not as a replacement for the ERC-721 asset identity."},{"id":"prompt-claim-protection","constraint":"Minting implementations must protect prompt claiming against frontrunning with a secure mechanism such as a time-lock or commit-reveal flow.","appliesTo":"application","normativity":"security-considerations","specQuote":"To address the risk of frontrunning, where an actor could potentially observe and preemptively claim a prompt during the minting process, implementers of this proposal must incorporate a secure prompt-claiming mechanism.","specSection":"Security Considerations / Frontrunning Risk","specUrl":"https://ercs.ethereum.org/ERCS/erc-7007#frontrunning-risk","designImplication":"Make the claim-protection step visible and do not expose an unprotected prompt-to-mint action when another actor could observe and preempt it."},{"id":"aigc-update-validation","constraint":"AIGC data updates during an opML challenge period are critical state changes and should be validated like initial minting; indexers should watch Update events.","appliesTo":"application","normativity":"security-considerations","specQuote":"Implementations must ensure that updates to `aigcData` are treated as critical state changes that require adherence to the same security and validation protocols as the initial minting process. Indexers should always check for any `Update` event emission.","specSection":"Security Considerations / AIGC Data Change During Challenge Period","specUrl":"https://ercs.ethereum.org/ERCS/erc-7007#aigc-data-change-during-challenge-period","designImplication":"Invalidate or refresh cached previews when Update is emitted, show challenge-period status, and never treat the originally displayed AIGC data as immutable without checking current state."},{"id":"aigc-enumeration-extension","constraint":"The AIGC-NFT enumeration extension is OPTIONAL and can publish the full mapping between tokenId and prompt for discovery.","appliesTo":"application","normativity":"normative","specSection":"Specification > Optional Extension: Enumerable","specUrl":"https://ercs.ethereum.org/ERCS/erc-7007#optional-extension-enumerable","designImplication":"Feature-detect enumeration before offering complete prompt or token discovery, and label missing mappings as unavailable.","specQuote":"The **enumeration extension** is OPTIONAL for [ERC-7007](./eip-7007.md) smart contracts. This allows your contract to publish its full list of mapping between `tokenId` and `prompt` and make them discoverable."},{"id":"model-commitment-verification","constraint":"Publishing a model commitment before addAigcData is recommended, and the commitment should be checked inside verify.","appliesTo":"application","normativity":"normative","specSection":"Specification > ML Model Publication","specUrl":"https://ercs.ethereum.org/ERCS/erc-7007#ml-model-publication","designImplication":"Show model commitment and verification status as provenance signals, preserving the source's recommendation and lowercase should rather than presenting them as unconditional requirements.","specQuote":"While this standard does not describe the Machine Learning model publication stage, it is natural and recommended to publish the commitment of the Model to Ethereum separately, before any actual `addAigcData` actions. The model commitment schema choice lies on the AIGC-NFT project issuer party. The commitment should be checked inside the implementation of the `verify` function."}],"lastUpdated":"2026-09-18","summary":"ERC-7007 extends ERC-721 with AIGC data and verification interfaces. addAigcData binds prompt, aigcData, and proof to a token, while verify checks the combination through a chosen zkML or opML verifier. Model commitments, prompt confidentiality, proof storage, and creator disclosures depend on the implementation and storage design.","designerTakeaways":["Show AIGC data, proof type, configured verifier, and model commitment when the implementation exposes them.","Disclose prompt publication or protection as a storage policy; a collapsed prompt is not automatically private.","Offer provenance filters only with labels that reflect the configured proof and disclosure state."],"applicability":{"whenToUse":["The collection implements ERC-721 plus IERC7007 and a configured zkML/opML verifier.","The product can disclose prompt, AIGC data, proof type, model commitment, and storage policy.","The UI distinguishes proof verification from creator identity and prompt privacy claims."],"whenToAvoid":["Collection is exclusively human-made with no AI pipeline.","Proof infrastructure is not wired to your indexer.","The deployed implementation cannot provide or verify the proof needed for the claim."]},"prototypeFirst":[{"screen":"AI provenance detail panel","why":"Collectors need to inspect what the configured proof and verifier establish at the item page.","covers":["Verified proof","Missing proof","Tampered proof"],"include":["Model name or commitment when exposed","Prompt disclosure or privacy state","Verify button","Proof status chip"]},{"screen":"Gallery with AI filter","why":"Browsers need to discover or avoid AI content intentionally.","covers":["Filter on","Filter off","Mixed grid"],"include":["AI-Generated chip","Filter toggle","Empty filter state"]},{"screen":"Mint disclosure step","why":"Creators may need a disclosure step, but the standard does not require creator attestation or a particular model publication flow.","covers":["AI mint","Non-AI mint"],"include":["Optional model commitment","Optional prompt disclosure","Configured verifier and proof type","Clear implementation policy"]},{"screen":"Verify proof result","why":"Users need to know what the configured verifier checked and what remains unverified.","covers":["Valid","Invalid","Unavailable"],"include":["Green verified or red failed","Plain explanation","Link to spec"]}],"mentalModel":[{"label":"Generation record","description":"Model + prompt + parameters produce an output that gets hashed and linked to the token."},{"label":"On-chain proof","description":"addAigcData emits prompt, aigcData, and proof bytes. Storage and retrieval beyond the event depend on the implementation."},{"label":"Verification","description":"A verify result is evidence under the configured proof/verifier model, not a universal creator or model-identity claim."},{"label":"Disclosure","description":"AI-Generated is a transparency label, not a quality judgment."},{"label":"Creator attestation","description":"Creators and apps may disclose model or prompt information, but publication and privacy are outside the required interface."}],"statesToDesign":[{"state":"Verified AI provenance","trigger":"Proof checks pass.","userNeed":"Understand the proof result and the model/prompt fields the implementation publishes.","designResponse":"Show the configured proof result and model/prompt details only when the implementation exposes them."},{"state":"Unverified or missing proof","trigger":"Token lacks valid proof.","userNeed":"Not be misled about origin.","designResponse":"No AI badge; optional Unknown provenance warning for claimed AI pieces."},{"state":"Proof verification failed","trigger":"Hash or model mismatch.","userNeed":"Understand label is unreliable.","designResponse":"Verification failed banner; do not show verified AI chip."},{"state":"Proof valid, prompt disclosure limited","trigger":"The implementation verifies the proof but the product withholds or encrypts prompt details.","userNeed":"Know what was verified and what remains private.","designResponse":"Show the proof result and the implementation's storage/privacy policy; do not label a hidden prompt private merely because it is collapsed."},{"state":"Provenance filter active","trigger":"User filters by declared AIGC status.","userNeed":"Understand which provenance claims the filter includes and excludes.","designResponse":"Separate verified AIGC claims, self-declared labels, and unknown provenance. Absence of a proof is not proof of human authorship."}],"designDecisions":[{"question":"How prominent should AI labels be?","recommendation":"Chip on thumbnail plus detail panel; avoid full-overlay warnings on art.","rationale":"Disclosure must be visible without vandalizing the artwork."},{"question":"Show prompt by default?","recommendation":"Collapsed behind View prompt; never auto-expand on gallery cards.","rationale":"Prompts can be long, personal, or spoil the piece."},{"question":"Filter AI content separately?","recommendation":"Offer optional filter and sort, default to show all with labels.","rationale":"Hiding by default angers creators; unlabeled browsing hides disclosure."}],"problemsSolved":[{"problem":"AIGC data needs a standard binding to an NFT","oldWay":"Projects use incompatible prompt and output records","newWay":"addAigcData emits prompt, aigcData, and proof for a token","impact":"high"},{"problem":"Collectors need a verifier result","oldWay":"A marketplace displays an uncheckable claim","newWay":"verify returns a result under the selected zkML or opML verifier","impact":"high"},{"problem":"Optimistic proofs may change during challenge","oldWay":"The UI assumes initial AIGC data is final","newWay":"An optional updatable extension and Update events can expose implementation changes","impact":"medium"}],"uxPatterns":[{"name":"AIGC Verification Panel","description":"Show prompt/data/proof fields and the configured verifier result.","components":["AIGCChip","ProofStatus","VerifyButton","DataDisclosure"],"userFlow":["User opens NFT","App reads AIGC data","User taps Verify","Shows verifier result and proof type","Explains model/prompt details only when the implementation publishes them"]},{"name":"AIGC Content Filter","description":"Filter by an implementation-provided AIGC label without implying universal provenance.","components":["FilterToggle","AIGCLabel","EmptyState"],"userFlow":["User opens gallery","Toggles AIGC filter","Grid updates","Each item retains its proof and disclosure state"]}],"antiPatterns":[{"pattern":"Calling a hidden prompt private by default","why":"The standard emits prompt and AIGC data bytes; hiding a field in the UI does not protect it.","instead":"Show the chosen storage and encryption policy before labeling prompt data private.","severity":"critical"},{"pattern":"Treating verify as creator or model identity proof","why":"The verifier and model commitment are implementation choices.","instead":"Name the verifier, proof type, model commitment, and checked inputs.","severity":"high"},{"pattern":"Assuming creator attestation or marketplace inheritance","why":"ERC-7007 does not require those product policies.","instead":"Show them only when the target project provides and verifies them.","severity":"high"}],"vocabulary":[{"use":"AI-generated","avoid":"Synthetic token mint","why":"Plain disclosure language."},{"use":"Verify proof","avoid":"Validate zk attestation","why":"User action, not cryptography lecture."},{"use":"Model claimed or committed","avoid":"Inference pipeline ID","why":"Separates a published model claim from the verifier/model commitment actually checked."}],"technicalNotes":"ERC-7007 requires ERC-721, ERC-165, and IERC7007 with addAigcData(tokenId, prompt, aigcData, proof), the AigcData event, and verify(prompt, aigcData, proof). Enumerable and Updatable extensions are optional. zkML/opML verifier, model commitment, prompt publication, encryption, and creator disclosure are implementation choices; an opML implementation may update data during a challenge period.","relatedStandards":[{"id":"ERC-721","relationship":"NFT base extended with AI provenance fields"},{"id":"ERC-4906","relationship":"Metadata updates when proof is amended"}],"partialDeployment":{"body":"This guide describes an interface-specific integration. A live deployment has not been verified here. Confirm the target contract, network, and client support before offering these actions; Final describes the specification, not product availability."}},"sources":[{"label":"Official specification","url":"https://ercs.ethereum.org/ERCS/erc-7007","type":"official-spec"},{"label":"Discussion search","url":"https://ethereum-magicians.org/search?q=ERC-7007","type":"discussion"}],"urls":{"canonical":"https://www.eipsfordesigners.com/standards/ERC-7007","markdown":"https://www.eipsfordesigners.com/standards/ERC-7007/content.md","agent":"https://www.eipsfordesigners.com/standards/ERC-7007/agent.md","api":"https://www.eipsfordesigners.com/api/standards/ERC-7007","official":"https://ercs.ethereum.org/ERCS/erc-7007","discussion":"https://ethereum-magicians.org/search?q=ERC-7007"},"freshness":{"lastReviewed":"2026-09-18","lastUpdated":"2026-09-18"}}