The linkable ring-signature construction used by current standard Monero transaction inputs. It proves the required signing relationships while keeping the real input ambiguous within its ring.
Also called: Concise Linkable Spontaneous Anonymous Group.
Spending authority without a public signer label
CLSAG means Concise Linkable Spontaneous Anonymous Group. It combines the signing relationships required for a confidential Monero input into a compact ring signature. A verifier can check the signature without learning which member is real.
The ring contains the real output and other existing outputs used as decoys. Their owners do not join a signing session. The spending wallet already has the secret information for its real output and constructs the signature locally.
References: CLSAG paper, IACR 2019/654 · Monero source: ringct/rctSigs.cpp
Reading a ring in an explorer
An explorer can list the outputs referenced by an input. In current standard transactions, the ring has 16 members: the real output and 15 decoys. A listed output might belong to someone who had no involvement in that payment.
A node also checks the input key image against accepted spends and rejects a reused image even if the signature verifies. This is how linkability supports double-spend detection without making the signature identify the real ring member.
References: Monero source: cryptonote_core/blockchain.cpp · Monero source: ringct/rctSigs.cpp
CLSAG and the rest of RingCT
CLSAG replaced MLSAG for the current standard input format. It reduces signature size and verification work, but it is not the range proof for output amounts. Bulletproofs+ handles that separate part of RingCT.
The signature binds the input to the transaction it authorizes. Copying a signature into a different payment does not grant authority to spend the original output. Nodes verify it against the transaction and its referenced ring data.
References: Monero source: ringct/rctSigs.cpp · CLSAG paper, IACR 2019/654
A ring is not a guarantee of equal likelihood
Sixteen members does not mean every observer must assign exactly a one-in-sixteen chance to each one. Output ages, outside records and weaknesses in decoy selection can affect an observer's inference.
CLSAG is a cryptographic construction. Its security properties do not cover an unlocked wallet, disclosure of spending secrets or an observer learning the sender from a separate network connection.
References: CLSAG paper, IACR 2019/654 · Monero source: wallet/wallet2.cpp
Related glossary terms
Practical guides
Technical baseline: v0.18.5.4. Reviewed 2026-11-08 UTC.