Traditional financial institutions face inefficiencies that can be addressed by distributed ledger technology. However, a primary barrier to adoption is the privacy concerns surrounding publicly available transaction data. Existing private protocols for distributed ledger that focus on the Ring-CT model are not suitable for adoption for financial institutions. We propose a post-quantum, lattice-based transaction scheme for encrypted ledgers which better aligns with institutions' requirements for confidentiality and audit-ability. The construction leverages various zero-knowledge proof techniques, and introduces a new method for equating two commitment messages, without the capability to open one of the commitment during the re-commitment. Subsequently, we build a publicly verifiable transaction scheme that is efficient for single or multi-assets, by introducing a new compact range-proof. We then provide a security analysis of it. The techniques used and the proofs constructed could be of independent interest.
Zero-knowledge proof security rests on cryptographic reductions: breaking a ZK scheme requires breaking an underlying hard problem. We introduce an independent, complementary security analysis based on the Structural Action Principle. We extend the discrete action functional S[psi] = sum_t lambda(s_t) from Boolean CDCL trajectories to algebraic constraint systems over finite fields F_p, defining an Algebraic Structural Action with density functions that recover Groebner basis complexity, Polynomial Calculus proof size, algebraic degree growth, and elimination ordering as mechanical analogues. We prove a non-circular lower bound for preimage search in substitution-permutation network (SPN) hash functions: for a k-round SPN with S-box degree alpha and state width t, the preimage search system is a square polynomial system of k*t degree-alpha equations in k*t variables. Under the semi-regularity assumption (standard in algebraic cryptanalysis, empirically verifiable, and independent of any cryptographic security conjecture), the solving degree d_reg is determined by the Hilbert series H(z) = (1 - z^alpha)^{k*t}/(1-z)^{k*t}. We establish two action bounds: a peak bound S[psi] >= d_reg (any trajectory must encounter degree d_reg), and a stronger cumulative bound S[psi] >= sum_{d=alpha}^{d_reg-1} h_d using the Hilbert function coefficients as density, which captures the total algebraic work rather than just the peak degree. For Poseidon (alpha=5, t=3, k=8): d_reg = 97 and the cumulative bound gives S[psi] >= 2^{56}. The result applies to ANY SPN hash function (Rescue, Griffin, Anemoi, MiMC) and provides a second line of defense for Behavior-Bound Signature (BBS) security, grounded in algebraic proof complexity rather than crypto- graphic hardness assumptions. Keywords: structural action principle, algebraic proof complexity, polynomial calculus, semi-regularity, Hilbert function, SPN hash functions, zero-knowledge security, behavior-bound signatures
Central Bank Digital Currency (CBDCs) are becoming a new digital financial tool aimed at financial inclusion, increased monetary stability, and improved efficiency of payment systems, as they are issued by central banks. One of the most important aspects is that the CBDC must offer secure offline payment methods to users, allowing them to retain cash-like access without violating Anti-Money Laundering and Counter-terrorism Financing (AML/CFT) rules. The offline CBDC ecosystems will provide financial inclusion, empower underserved communities, and ensure equitable access to digital payments, even in connectivity-poor remote locations. With the rapid growth of Internet of Things (IoT) devices in our everyday lives, they are capable of performing secure digital transactions. Integrating offline CBDC payment with IoT devices enables seamless, automated payment without internet connectivity. However, IoT devices face special challenges due to their resource-constrained nature. This makes it difficult to include features such as double-spending prevention, privacy preservation, low-computation operation, and digital identity management. The work proposes a privacy-preserving offline CBDC model with integrated secure elements (SEs), zero-knowledge proofs (ZKPs), and intermittent synchronisation to conduct offline payments on IoT hardware. The proposed model is based on recent improvements in offline CBDC prototypes, regulations and cryptographic design choices such as hybrid architecture that involves using combination of online and offline payment in IoT devices using secure hardware with lightweight zero-knowledge proof cryptographic algorithm.
Federated Learning (FL) enables collaborative training of medical AI models across hospitals without centralizing patient data. However, the exchange of model updates exposes critical vulnerabilities: gradient inversion attacks can reconstruct patient information, Byzantine clients can poison the global model, and the \emph{Harvest Now, Decrypt Later} (HNDL) threat renders today's encrypted traffic vulnerable to future quantum adversaries.We introduce \textbf{ZKFL-PQ} (\emph{Zero-Knowledge Federated Learning, Post-Quantum}), a three-tiered cryptographic protocol that hybridizes (i) ML-KEM (FIPS~203) for quantum-resistant key encapsulation, (ii) lattice-based Zero-Knowledge Proofs for verifiable \emph{norm-constrained} gradient integrity, and (iii) BFV homomorphic encryption for privacy-preserving aggregation. We formalize the security model and prove correctness and zero-knowledge properties under the Module-LWE, Ring-LWE, and SIS assumptions \emph{in the classical random oracle model}. We evaluate ZKFL-PQ on synthetic medical imaging data across 5 federated clients over 10 training rounds. Our protocol achieves \textbf{100\% rejection of norm-violating updates} while maintaining model accuracy at 100\%, compared to a catastrophic drop to 23\% under standard FL. The computational overhead (factor $\sim$20$\times$) is analyzed and shown to be compatible with clinical research workflows operating on daily or weekly training cycles. We emphasize that the current defense guarantees rejection of large-norm malicious updates; robustness against subtle low-norm or directional poisoning remains future work.
Dense retrieval services increasingly underpin semantic search, recommendation, and retrieval-augmented generation, yet clients typically receive only a top-$k$ list with no auditable evidence of how it was produced. We present V3DB, a verifiable, versioned vector-search service that enables audit-on-demand correctness checks for approximate nearest-neighbour (ANN) retrieval executed by a potentially untrusted service provider. V3DB commits to each corpus snapshot and standardises an IVF-PQ search pipeline into a fixed-shape, five-step query semantics. Given a public snapshot commitment and a query embedding, the service returns the top-$k$ payloads and, when challenged, produces a succinct zero-knowledge proof that the output is exactly the result of executing the published semantics on the committed snapshot -- without revealing the embedding corpus or private index contents. To make proving practical, V3DB avoids costly in-circuit sorting and random access by combining multiset equality/inclusion checks with lightweight boundary conditions. Our prototype implementation based on Plonky2 achieves up to $22\times$ faster proving and up to $40\%$ lower peak memory consumption than the circuit-only baseline, with millisecond-level verification time. Github Repo at https://github.com/TabibitoQZP/zk-IVF-PQ.
• A novel Framework for Secure and Efficient Healthcare Data Management • A Blockchain-Based Identity Management and Access Control • Data Integrity Verification with Merkle Trees • Scalable and Compliant Data Storage • Secure Data Sharing via Proxy Re-Encryption The healthcare sector increasingly relies on digital infrastructures to manage large volumes of sensitive medical data. Ensuring integrity, controlled access, interoperability, and auditability remains a fundamental challenge. We propose BlockHealth, a hybrid blockchain-based framework that integrates smart contracts, distributed databases, and proxy re-encryption to support secure and verifiable healthcare data management. The system leverages Ethereum and NFT-based identities for access control, Merkle-tree commitment for tamper-evident integrity verification, and a distributed Cassandra storage layer for scalable and regulation-compliant off-chain data management. Proxy re-encryption enables secure delegation of access without exposing private keys, while a coordinating API service ensures interoperability with existing hospital infrastructures. Our evaluation demonstrates the feasibility and efficiency of core operations — including hashing, on-chain commits, and re-encryption — indicating that the proposed framework can provide a practical balance among verifiability, performance, and deployability in realistic healthcare environments.
• The STipChain+ system employs a combination of cryptographic accumulators and verifiable computing techniques to create a stateless blockchain for smart contracts. This system offers a solution for the use of blockchain in big data scenarios. • A new hierarchical group commitment scheme for smart contracts based on the RSA cryptographic accumulator has been developed with the objective of reducing the storage overhead of contract evidence in the system by 99 • Design a composite RSA accumulator scheme for decentralised SGX Remote Attestation under stateless conditions. This scheme should transfer the trust in Intel to the trust in the group of nodes on the chain, and accumulate the certificate information through cryptographic accumulator technology. This should reduce the burden of storage on the system and reduce the dependence on a single organisation. • The experimental results demonstrate that, while maintaining decentralisation and security, STipChain+ can significantly reduce the storage pressure on consensus nodes, thereby enhancing system throughput. Blockchain is regarded as one of the most transformative and innovative technological developments of recent times, due to its decentralised nature. Nevertheless, the majority of public chains are currently grappling with the challenge of exponential data growth within the block chain system, largely due to the presence of high levels of data redundancy, which is resulting in a significant consumption of node storage resources. However, the scheme is subject to several limitations, including the storage overhead associated with contract evidence under the conditions of extensive smart contracts and the necessity of placing trust in the central node for the purpose of verifying smart contracts. The objective of this paper is to propose a new stateless blockchain architecture, designated as STipChain+. The STipChain+ system enables the real-time computation of contract evidence and the completion of the execution and verification of smart contracts without compromising the decentralization of the blockchain. The layered grouping design of smart contracts enables the reduction of the data involved in generating contract evidence, thus resolving the shortcomings of the existing stateless blockchain scheme, which necessitates the pre-calculation of evidence and its subsequent update in a sequential manner. Furthermore, the storage of substantial amounts of evidence is also alleviated. In addition, the issue of the trusted third party when verifying smart contracts is further addressed by proposing a composite RSA accumulator certificate commitment scheme with a new smart contract execution logic and transaction verification method. The results of experimental studies indicate that STipChain+ reduces the storage requirements for state data by 99% in comparison to existing blockchain storage optimisation schemes. This is achieved without the introduction of third-party trusted entities, and the reduction in storage requirements can be verified in a fixed amount of time for any smart contract.
Recently, there has been a significant discourse in the AI community regarding "Hierarchical Reasoning LLMs," which attempt to categorize and optimize probabilistic generation tasks to reduce computational overhead. While such hierarchical inference structures optimize generation speed and coherence, they fundamentally fail to resolve the core structural crises of modern Generative AI: inevitable hallucination and extreme structural energy consumption (GPU lock-in). This paper introduces the "Hierarchical Stateless Key Generation" (HSKG) and the Mersenne Stateless Architecture, challenging the premise of neural network 'reasoning.' Instead of storing data within 820GB of neural weights and using probabilistic matrix multiplication, HSKG mathematically maps 'Absolute Truth' data into a 4096-dimensional Mersenne Prime Lattice. During query resolution, the system simply retrieves a 4KB Phase Coordinate and instantaneously materializes the data in RAM, only to vaporize it when the session terminates. By abandoning the "search and compute" paradigm for "coordinate retrieval," HSKG enforces a mathematical 0% hallucination rate, 0-byte persistent storage, and sub-0.01% GPU utilization, establishing a definitive paradigm for enterprise Zero-Trust knowledge systems. This paper explicitly defines the term "Hierarchical Stateless" to contrast with the probabilistic "Hierarchical Reasoning" of contemporary LLMs, establishing a rigorous mathematical protocol for deterministic, zero-hallucination data materialization without persistent models or physical data transfer. * Version 2.0 Update: Added section 7.A (Empirical Validation via DevTools: The 0-Byte Payload Proof). [Version 4.0 Update (Mar 2, 2026)] Formally established the "Four-Pillar Verification Metrics" table to empirically prove the 0-Byte Payload and Minimum Kolmogorov Descriptive Length. Inserted Section VIII: Disrupting Existing Paradigms (Architectural Supremacy Matrix), demonstrating the superiority over FIDO2/WebAuthn and Zero-Knowledge Proofs (ZKP). Included Supplementary Material: Independent 3rd-Party Forensic Audit Report by Claude 4.6 verifying 100% Stateless Zero-Payload execution.
Fatemeh Erfan, Mohammad Yahyatabar, Martine Bellaïche, Talal Halabi
• Created a refined, expanded, and precisely labeled dataset with explanations, risk assessments, and fixes for each vulnerability • Fine-tuned an open-source LLM: LLaMA-3.1-8B using parameter-efficient techniques (LoRA) for smart contract vulnerability detection • Fine-tuned GPT-4o-mini on the same corpus for comparative analysis • Developed a real-time Visual Studio Code (VSCode) plugin integrating GPT-4o-mini for smart contract auditing • Released the datasets, tool, and fine-tuned model to advance research in smart contract security Since the advent of Ethereum, ensuring the security of smart contracts has become imperative. Integer overflow and underflow, reentrancy, and timestamp dependency remain the three most prevalent vulnerabilities in deployed contracts. Existing static-analysis tools often yield insufficient accuracy, and datasets derived from them inherit the same shortcomings. Moreover, the smart contract ecosystem lacks a dependable, real-time auditing aid for developers and a fine-tuned model trained on a truly comprehensive corpus. In this paper, we present three main contributions. (1) Dataset curation: the state-of-the-art vulnerability datasets are aggregated and harmonized, producing a clean, fully labeled dataset that integrates detailed explanations, potential security risks, vulnerable line ranges, code snippets, and corresponding fixes. The dataset is publicly available via our GitHub repository. (2) Model fine-tuning: the LLaMA-3.1-8B model as well as GPT-4o-mini are fine-tuned on this corpus and evaluated with both standard classification metrics and text-quality measures. The fine-tuned LLaMA-3.1 model achieves a precision of 93.55%, an average semantic similarity of 77.48%, and a code similarity of 87.25%. (3) IDE integration: We implement a real-time Visual Studio Code extension, backed by the GPT-4o API, that highlights, explains, and automatically patches vulnerabilities as the developer writes. Together, these contributions deliver a rigorously validated model and a practical developer toolchain that markedly advance the state of smart contract security research and practice.
Global disruptions, such as the COVID-19 pandemic, have exposed the fragility of supply chains and the critical need for coordination. However, effective collaboration is often hindered by the reluctance of firms to disclose sensitive proprietary data, such as inventory levels or logistical bottlenecks, due to competitive concerns. To resolve this dilemma, this study introduces a privacy-preserving framework integrating Zero-Knowledge Proofs (ZKPs) with blockchain technology. This approach allows stakeholders to validate compliance and operational status without revealing the underlying raw data, thereby fostering trust and resilience in decentralized networks.
Every standard signature scheme enforces one property: only the key holdercan sign. What the key holder signs is unconstrained. Policy enforcement-- spending limits, rate limits, access control -- lives in smartcontracts, middleware, or governance: layers that can be upgraded,bypassed, or exploited. We call this the software-layer assumption:compliance holds only if the enforcing code is correct and unmodified. We eliminate this assumption. We introduce behavior-bound signatures(BBS), in which a policy constraint delta(x) < epsilon is committed atkey generation and enforced inside the signature's zero-knowledge proof.If the action violates the policy, the ZK constraint system isunsatisfiable -- no witness, no proof, no signature. This is not asoftware check. It is a mathematical impossibility. No software canoverride. Unlike policy-based signatures (where an authority imposes policy onsigners), BBS is self-committed: the signer binds their own futurebehavior at key generation, and even the signer cannot later violate orrevoke this commitment. We formalize this as policy-soundness (PS-CMA), a security modelstrictly stronger than EUF-CMA, and prove it under standard assumptions(Pedersen binding, Poseidon CR, ZK knowledge soundness). From thissingle primitive, five independent consequences follow -- not as separatedesigns, but as necessary implications of one cryptographic root: (A) Compliance safety under f <= n-1 Byzantine faults, decoupled from honest-quorum assumptions.(B) O(1) verification and audit via a single ZK check and Pedersen homomorphic aggregation.(C) Elimination of the virtual-machine execution layer for policy-constrained transactions.(D) A gasless ledger: branch C removes metering, while ZK-encoded rate limits make spam mathematically nonexistent.(E) The first cryptographic guarantee that a compromised autonomous AI agent cannot exceed its authorized behavioral envelope. Moreover, the zero-knowledge property ensures that complianceverification reveals neither the signer's identity nor the transactionparameters -- achieving regulatory compliance without identitydisclosure, complementary to existing ZK-KYC frameworks that verifystatic identity attributes.
Cloud computing has transformed data storage, accessibility, and enterprise operations; however, it has also increased exposure to sophisticated cyber threats. Traditional centralized Identity Management Systems (IDMs) often suffer from critical vulnerabilities such as a single point of failure, where the compromise of a central authority can expose sensitive user credentials. This research proposes ZKP-Shield, a security framework that integrates Non-Interactive Zero-Knowledge Proofs (NIZKPs) with a Software-Defined Perimeter (SDP) to create a secure and invisible cloud authentication environment. The proposed architecture eliminates the need to transmit passwords or sensitive identity data by allowing users to mathematically prove their identity without revealing secret information. Simultaneously, the SDP layer conceals cloud resources from unauthorized users by enforcing a “dark cloud” model, where services remain hidden until authentication is successfully verified. The framework employs cryptographic techniques such as the Discrete Logarithm Problem and the Fiat–Shamir heuristic to transform interactive proofs into efficient non-interactive authentication processes. Experimental simulations conducted in a distributed cloud environment demonstrate that the ZKP-SDP integration significantly reduces attack surfaces, prevents credential-based attacks, and maintains acceptable latency for enterprise applications. The results indicate that combining cryptographic identity verification with network invisibility provides a scalable and resilient security model for modern cloud infrastructures.
Attiq Ur Rehman, Shuai Lü, Muhammad Usman, Zaheer Ahmad Gondal · 7 authors
Abstract The integration of Cloud computing with the Internet of Things (IoT) has greatly increased the scale and complexity of sharing data in Cloud-based Internet of Things (CIoT) environments. However, this growth brings challenges with regard to security of sensitive data, privacy, access control management, and accountability. In this paper, we propose Block-chain Enabled Secure and Anonymous Data Sharing (BS-ADS), which is a framework that tries to overcome these challenges by combining Aggregate Key Searchable Encryption (AKSE) and blockchain-based auditing, edge-assisted revocation and accountable anonymity. BS-ADS eliminates the need for centralized trust by using blockchain to store encrypted metadata such as ciphertext hash and revocation identifier. This provides trust and transparency which are decentralized without revealing plaintext data. The frame-work includes the support of linkable ring signatures and zero-knowledge proofs to maintain user privacy while allowing for traceability and therefore allowing for the detection of malicious behavior to take place without the need of the loss of anonymity. Furthermore, edge nodes are responsible for the encryption up-dates in case of revocation, and they remove the computational load from the resource-constrained IoT devices. The performance of BS-ADS was evaluated in terms of encryption overhead, ciphertext size, and the communication cost. Experimental results demonstrate the effectiveness of BS-ADS in terms of encryption overhead, which reduces the encryption overhead by 30–40%, while guaranteeing efficient keyword-based search and data retrieval. Additionally, it offers a 20–30% reduction in communication overhead in multi-user scenarios, maintaining constant communication cost per operation (O(1)). The system is also proven secure against selective chosen-ciphertext attacks (SIND-CCA), replay attacks, Sybil attacks, and man-in-the-middle attacks. This work introduces a novel architecture for secure, scalable, and accountable data sharing in CIoT, incorporating efficient revocation mechanisms and privacy-preserving search. BS-ADS provides significant improvements in efficiency, security, and privacy, offering a promising solution for large-scale CIoT applications.
Tuan Nguyen Kim, Ha Nguyen Hoang, Son Doan Trung, Lam Nguyen
Cloud computing has become a vital platform for large-scale data analytics, yet it poses significant privacy challenges when handling sensitive information, especially in healthcare and financial domains.Homomorphic Encryption (HE) enables computation on encrypted data, providing strong privacy guarantees, but traditional HE frameworks lack efficient query representation, do not protect query patterns, and cannot prove correctness of cloud-side computations.This paper proposes HE-Cloud, an integrated privacy-preserving framework that combines DSL-driven query compilation, HE, Zero-Knowledge Proofs (ZKP), and Oblivious RAM (ORAM).Our framework allows clients to express high-level analytical queries, securely executes them on encrypted data, protects query access patterns via ORAM, and returns verifiable results through ZKP.A proof-of-concept implementation using the Pima Diabetes dataset demonstrates feasibility: Average glucose computations can be performed entirely on encrypted data with sub-second latency for homomorphic operations and minimal accuracy loss (approximately 0.001).Scalable secure analytics, extendable to larger datasets and machine learning tasks.
Secure and bandwidth-conscious transmission of model updates is a central bottleneck in distributed machine learning. Existing secure aggregation and homomorphic encryption pipelines either reveal more than the task requires or incur prohibitive computation and communication costs. We introduce a verifiable functional encryption (VFE) framework that releases only the intended linear functions of client gradients while providing end-to-end integrity and privacy guarantees under standard lattice assumptions. Our instantiation, FlowAgg-FE, combines two novel components. First, KS-IPFE, a key-splittable inner-product FE scheme, supports per-round weighted aggregation, vector packing, and on-the-fly function changes without client re-encryption; function keys are distributed across two non-colluding helpers, eliminating a single point of trust and enabling lightweight, homomorphically verifiable tags on decrypted outputs. Second, PaS-Stream is a rate-adaptive encryption-and-compression pipeline that couples sketch-based gradient compression with batched FE ciphertext streaming, ensuring unbiased aggregation in the presence of stragglers and dropouts. We further bind client-side clipping to zero-knowledge range proofs and offer an optional differentially private release layer that composes with FE to yield (ε,δ)-privacy. A prototype based on LWE demonstrates practicality across cross-device and cross-silo training: client uplink is reduced by 1.9–3.4× and server CPU time by 1.6× versus state-of-practice encrypted secure aggregation, with accuracy within 0.3% of plaintext baselines and correctness preserved under up to 30% client dropout. These results show that verifiable FE can make secure, communication-efficient gradient transmission viable, as appropriate for theme of security and privacy in distributed machine learning of the Special Issue.
Every standard signature scheme enforces one property: only the key holdercan sign. What the key holder signs is unconstrained. Policy enforcement-- spending limits, rate limits, access control -- lives in smartcontracts, middleware, or governance: layers that can be upgraded,bypassed, or exploited. We call this the software-layer assumption:compliance holds only if the enforcing code is correct and unmodified. We eliminate this assumption. We introduce behavior-bound signatures(BBS), in which a policy constraint delta(x) < epsilon is committed atkey generation and enforced inside the signature's zero-knowledge proof.If the action violates the policy, the ZK constraint system isunsatisfiable -- no witness, no proof, no signature. This is not asoftware check. It is a mathematical impossibility. No software canoverride. Unlike policy-based signatures (where an authority imposes policy onsigners), BBS is self-committed: the signer binds their own futurebehavior at key generation, and even the signer cannot later violate orrevoke this commitment. We formalize this as policy-soundness (PS-CMA), a security modelstrictly stronger than EUF-CMA, and prove it under standard assumptions(Pedersen binding, Poseidon CR, ZK knowledge soundness). From thissingle primitive, five independent consequences follow -- not as separatedesigns, but as necessary implications of one cryptographic root: (A) Compliance safety under f <= n-1 Byzantine faults, decoupled from honest-quorum assumptions.(B) O(1) verification and audit via a single ZK check and Pedersen homomorphic aggregation.(C) Elimination of the virtual-machine execution layer for policy-constrained transactions.(D) A gasless ledger: branch C removes metering, while ZK-encoded rate limits make spam mathematically nonexistent.(E) The first cryptographic guarantee that a compromised autonomous AI agent cannot exceed its authorized behavioral envelope.
Open access
3 source records
Cryptography and Data Security
Advanced Authentication Protocols Security
Physical Unclonable Functions (PUFs) and Hardware Security
Sybil resistance is a key requirement of decentralized consensus protocols. It is achieved by introducing a scarce resource (such as computational power, monetary stake, disk space, etc.), which prevents participants from costlessly creating multiple fake identities and hijacking the protocol. Quantum states are generically uncloneable, which suggests that they may serve naturally as an unconditionally scarce resource. In particular, uncloneability underlies quantum position-based cryptography, which is unachievable classically. We design a consensus protocol that combines classical hybrid consensus protocols with quantum position verification as the Sybil resistance mechanism, providing security in the standard model, and achieving improved energy efficiency compared to hybrid protocols based on Proof-of-Work. Our protocol inherits the benefits of other hybrid protocols, namely the faster confirmation times compared to pure Proof-of-Work protocols, and resilience against the compounding wealth issue that plagues protocols based on Proof-of-Stake Sybil resistance. We additionally propose a spam prevention mechanism for our protocol in the Random Oracle model.
The proliferation of cloud infrastructures has intensified concerns regarding data security, integrity, identity and access management, and user privacy. Despite recent advances, existing solutions often lack comprehensive integration of privacy-preserving mechanisms, dynamic trust management, and cross-provider interoperability. This study proposes an AI-enabled, zero-trust, blockchain-fused identity management framework for secure, privacy-preserving multi-cloud environments. The framework integrates homomorphic encryption with differential privacy for aggregate-level protection and secure multi-party computation for collaborative data processing. The proposed system was validated in a simulated multi-cloud environment using CloudSim, Ethereum blockchain, and AWS EC2. Experimental results indicate homomorphic encryption latency of approximately 450ms per operation and statistically significant security improvements (t(128) = 12.47, p < 0.001), privacy (t(95) = 8.93, p < 0.001), and throughput (t(156) = 15.21, p < 0.001). The framework achieved differential privacy with ε = 0.1 while retaining 99.2% data utility, and demonstrated a 34% improvement in processing speed over conventional differential privacy approaches. In addition, the implementation was observed to be 2.3× faster than BGV-based configurations, with 45% lower memory consumption than CKKS and a 67% reduction in ciphertext size relative to baseline implementations. From an operational perspective, the framework shows a 23% reduction in security management costs, a 31% improvement in resource utilization efficiency, and an 18% decrease in compliance audit expenses. The model further indicates a 27% reduction in total cost of ownership (TCO) compared with multi-vendor security solutions, a projected return on investment (ROI) within 14 months, and an 89% reduction in security incident response costs under the evaluated conditions.
Longbo Han, Xiaodong Li, Lin You, Gengran Hu · 8 authors
Vehicular ad-hoc networks (VANETs) require authentication mechanisms that simultaneously deliver privacy, accountability, and timely cross-domain synchronization. The existing schemes struggle to balance unlinkable anonymity with effective tracing. They are also vulnerable to future quantum adversaries and rely on slow and costly revocation workflows. We present ZebraCPA, a decentralized conditional privacy-preserving authentication (CPPA) framework that combines lattice-based traceable ring signatures (TRS) with zero-knowledge (ZK) proofs and a consortium blockchain. Our TRS design removes linkability tags and embeds a tracing trapdoor only recoverable by the authorized auditors. It naturally extends to threshold tracing for multi-auditor settings. To avoid the plain-text key escrow, ZebraCPA leverages the additively homomorphic property of the commitments to support the ciphertext-only key updates by the vehicles, preventing the catastrophic key leakage at authorities. A hierarchical blockchain layer provides fast, consistent synchronization of active-key status across regions. The experiments show 1.7×–7.0× speedups over state-of-the-art baselines in signing/verification while retaining an anonymity-set size of N=10. The network-level simulations further indicate that ZebraCPA reduces an average packet delay by 30.7% - 61.6% compared with the baselines under moderate traffic densities. Moreover, the security of ZebraCPA is validated through our informal analysis under the Dolev-Yao model. Overall, ZebraCPA achieves post-quantum security, strong anonymity with conditional traceability, and practical deployment efficiency for VANETs, outperforming the existing solutions in terms of both latency and robustness.
Abstract Integrating third-party Machine Learning (ML) models into industrial Operational Technology (OT) creates a procurement deadlock: operators cannot verify vendor performance claims without exposing sensitive operational data, while vendors refuse to reveal proprietary model weights before purchase, rendering traditional safeguards such as Non-Disclosure Agreements technically unenforceable. This paper introduces a framework combining Zero Knowledge Proofs (ZKPs) with smart contracts to enable trust-minimized, privacy-preserving competitive model procurement in Industrial Cyber-Physical Systems (ICPS). Our framework allows vendors to cryptographically prove that their model outperforms a legacy baseline without disclosing proprietary weights, a process we term cryptographic performance attestation . The on-chain workflow combines escrow-backed procurement, automated proof verification, and best-vendor selection with arbiter-based dispute resolution. We analyze three distinct ZKP workflow variations for industrial suitability and evaluate their performance on consumer-grade hardware, achieving proving times of approximately three seconds and sub-dollar on-chain verification costs under Layer-2 fee assumptions for the recommended single-proof variation. Results demonstrate the feasibility of pre-deployment model verification while identifying computational trade-offs of recursive proof aggregation. The entire verification phase operates offline with no impact on real-time OT control paths, bridging the IT/OT pre-transaction trust gap while deferring artifact deployment to existing OT tooling.
Contemporary digital currency systems face fundamental challenges in achieving optimal balance between transaction privacy, computational efficiency, and cryptographic security. While zero-knowledge proof systems have dominated privacy-preserving cryptocurrency research, their practical implementations often involve prohibitive computational overhead that limits real-world deployment. This paper presents a comprehensive analysis of the Elliptic Homomorphic Token (EHT) protocol, which leverages elliptic curve-based partially homomorphic encryption combined with parallel processing architecture to enable privacy-preserving peer-to-peer transactions without the computational complexity of zero-knowledge constructions. Our theoretical analysis demonstrates strong privacy guarantees under standard cryptographic assumptions, while experimental evaluation shows that EHT achieves 500,000 transactions per second with parallel processing and 50-100ms latency. The protocol eliminates the need for complex zero-knowledge proofs by directly utilizing elliptic curve cryptographic primitives, resulting in performance improvements exceeding 1000× over existing privacy-focused systems while maintaining equivalent security properties through formally proven cryptographic guarantees.
The convergence of social networking and electronic commerce has given rise to the social e-commerce paradigm, where content creators serve as the primary drivers of consumer engagement and purchase decisions. However, this ecosystem faces a critical tension between the need for high-precision ad targeting to sustain monetization and the increasingly stringent requirements for user privacy preservation. Traditional centralized recommendation systems require the aggregation of massive user behavioral datasets, creating significant risks of data leakage and violating emerging regulatory frameworks. To address this challenge, we propose a novel framework titled Fed-ZKC (Federated Zero-Knowledge Creator). This architecture synergizes Federated Learning (FL) with Zero-Knowledge Proofs (ZKP) to enable privacy-preserving ad targeting while ensuring verifiable monetization attribution for creators. In our system, user preference models are trained locally on edge devices to prevent raw data transmission, while a cryptographic verification layer ensures that ad interactions are genuine without revealing user identities to the platform or the creators. Extensive experiments conducted on large-scale real-world datasets demonstrate that Fed-ZKC achieves recommendation accuracy comparable to centralized baselines while reducing privacy leakage risks by orders of magnitude. Furthermore, the implementation of succinct non-interactive arguments of knowledge (zk-SNARKs) introduces minimal computational overhead, making the protocol feasible for deployment on modern mobile processors.
We propose Trustless Agent Swarms, a framework enabling privacy-preserving coordination among autonomous AI agents on EVM-compatible blockchains. Our system integrates four cryptographic primitives: (1) Groth16 zero-knowledge proofs for proving reputation thresholds without revealing scores; (2) EIP-5564 stealth addresses for unlinkable fund transfers; (3) ERC-4337 account abstraction for gasless autonomous execution; and (4) Semaphore for anonymous group signaling. We implement a 586-constraint reputation proof circuit and deploy five smart contracts on Base Sepolia. Proof generation: 580ms. On-chain verification: 407,576 gas.
Abstract As artificial intelligence (AI) systems become increasingly integrated into critical applications, ensuring trust in their outputs has emerged as a central challenge. Verifiable machine learning (ML) is one approach to addressing this challenge, providing guarantees that results are both correct and reproducible. Existing paradigms, however, provide only partial solutions: zero-knowledge ML (ZKML) achieves strong cryptographic assurances but suffers from limited scalability and high resource costs, while optimistic ML (OPML) supports a wider range of models but relies on economic incentives and long dispute periods. In this work, we propose zk-OPML, a novel hybrid framework that integrates optimistic verification with zero-knowledge proofs (ZKPs). The approach decomposes ML inference into operator-level computations, selectively generating ZKPs for isolated ONNX operators, while retaining the scalability of the optimistic paradigm. We present a prototype implementation and evaluate its performance by benchmarking it against ZKML and OPML. Our results show that zk-OPML achieves faster verification for more complex inference tasks and scales more effectively to larger models, while avoiding the excessive costs of end-to-end ZKML. The modular design of zk-OPML further enables future extensions with the latest advances in the field of ZK.
Open access
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security