Abstract Zero-knowledge machine learning (zkML) enables cryptographic verification of machine learning inference while preserving privacy, but proof generation remains a significant computational bottleneck. Existing work primarily focuses on reducing proof cost through post-training optimizations, whereas the influence of architectural design choices during model development has received less attention. This work presents an empirical study of the relationship between neural network ReLU activation count and zero-knowledge proof generation cost using the ezkl/Halo2 framework. Across controlled experiments, ReLU activation count exhibits a strong correlation with proof generation time (Pearson r = 0.90) and proof size (r = 0.91), while parameter count is held constant for the primary comparisons. Motivated by these observations, a lightweight proxy metric is proposed to estimate relative proof cost directly from model architecture without executing the proof pipeline. On MNIST, reducing the number of ReLU activations from three to one decreases proof generation time by approximately 6.5% and proof size by 2.3%, while maintaining comparable classification accuracy. These results suggest that ReLU activation count is a useful architectural indicator of proof cost in the ezkl/Halo2 backend and that incorporating proof-cost considerations during architecture selection may improve the efficiency of zkML deployment. The proposed proxy metric provides a fast method for comparing candidate architectures before proof generation.
Open access
2 source records
Adversarial Robustness in Machine Learning
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
We present ECO/CPO-DAG, a domain-specific accountability protocol for adversarial supply chains that formalizes contradiction detection as a supplemental validation layer rather than a consensus or truth-establishing mechanism. Participants publish signed Event Claim Objects (ECOs) into a causally ordered, append-only directed acyclic graph (DAG) whose edges encode happened-before relations. When two claims about the same subject violate a domain constraint, any observer can compile a Contradiction Proof Object (CPO), a self-verifying object binding the two signed claims and the violated rule, which, on public verification, triggers economic slashing of a determinately blamed party. We map constraints to GS1 EPCIS 2.0 event semantics (spatial uniqueness, temporal monotonicity, quantity conservation, quality monotonicity, regulatory validity), so detection targets inconsistencies that are meaningful in practice. Selective disclosure via commitment schemes and, optionally, zero-knowledge contradiction proofs lets parties withhold claim contents until a challenge forces the minimal opening. We give an analytical treatment: an independent-observer detection model $1-(1-p_{\min})^h$, a deterrence condition $S>g(1-p)/(kp)$ under $k$-party collusion, and a storage estimate of order 1 GB per participant per year under stated assumptions. The protocol's boundary is explicit: it detects provable contradictions, not consistent lies; a party that never contradicts itself is invisible to it, so the layer complements, and does not replace, source verification and oracle aggregation. A single-machine reference implementation corroborates the detection model, with the predicted coverage band overlapping the measured 95% confidence interval at every observer count, and records zero false accusations; the fully zero-knowledge CPO, multi-party propagation, and adaptive-adversary evasion remain analytical.
Jin Ah Seo, Kun Hwa Lee, Vijayan Sugumaran, Jo Yeon Park · 5 authors
We build and evaluate a concrete Zero-Knowledge Machine Learning (ZKML)-based pipeline for epidemic diagnosis and show that it can enforce computational integrity without exposing raw medical data in a Web3 setting. In response to security challenges posed by centralized data handling in medical AI applications, particularly during public health crises such as COVID-19, ZKML offers a privacy-preserving alternative by combining machine learning and Zero-Knowledge Proofs (ZKP). We experimentally applied ZKML to a CNN (Convolutional Neural Networks)-based COVID-19 diagnostic model, achieving 87% accuracy and 0.35 loss. All proof generation and verification processes were executed entirely off-chain, with the verified outputs represented as committed public_vals recorded on-chain via smart contracts. To ensure authenticity, the system enforces dual ECDSA signature verification from both the model provider and the data provider. This mechanism prevents unauthorized submissions and confirms the validity of the result before it is stored on-chain. The system was tested under both normal and adversarial conditions, demonstrating robust and reliable operation. By enabling decentralized trust and self-sovereign control over data, this architecture aligns well with Web3 principles. The results indicate that ZKML can support the development of privacy-preserving and verifiable AI systems.
Open access
Adversarial Robustness in Machine Learning
Privacy-Preserving Technologies in Data
Artificial Intelligence in Healthcare and Education
The complete codebase and supplementary materials for this study have been archived on Figshare to ensure full reproducibility and to facilitate adoption by other researchers and practitioners. The archive includes all Python scripts used for data preprocessing, model training, hyperparameter tuning, threshold optimisation, and SHAP explainability analysis. Also included are the processed CSV files used for the analysis, along with all figures and tables presented in this paper. The repository is organised to enable straightforward replication of the experiments and adaptation of the framework to other datasets or blockchain platforms.
Aletheia is a knowledge substrate organized around a write-time admission gate: a fact is accepted only if it does not structurally contradict what the base already holds. The gate inherits a Lean 4 soundness proof, so the admitted store stays acyclic, asymmetric, type-disjoint, and temporally consistent under any stream of typed edges. We bind the proof to the implementation by differential testing over 104 adversarial inputs, zero divergences. We first tried to build a partial-truth disinformation detector on this gate. Measurement refused. On real political claims almost nothing decomposes into the gate’s six relations: 0 of 155 atoms were gate-testable, and where it did fire it lost to a cold language model, 0 of 21 against 17. Most real disinformation violates truth, not structure, so a structural gate is the wrong instrument. We retract the detector claim. What remains is a guarantee rather than a rate. Each catch names the axiom it violated; the verdict is bit-exact and carries a machine-checked admission proof; and a safety property whose core is now machine-checked in Lean holds that no finite feed of self-asserted credibility can mint a false endorsement, conditional on authority granted upstream (0 of 210 adversarial sequences, against 140 of 210 for a credibility-naive baseline). A frontier model matches our hit-rate on constructed distortions, and a reasoning model matches even our one structural edge, so we claim no detection advantage. We claim instead that the jurisdiction of a structural guarantee can be measured, and we measure it across two regimes: where the base lets it adjudicate, and where it abstains.
Smart contract vulnerabilities are predominantly logic bugs whose detection requires structured, step-by-step procedural knowledge of attack patterns and contract semantics. Existing LLM-based methods struggle to generate this knowledge automatically: prompt-based methods rely on manually crafted detection rules, while fine-tuning requires massive labeled datasets that are inherently scarce in this domain. We present EvoVuln, an automated framework that reformulates vulnerability detection as a procedural knowledge evolution problem, synthesizing and refining detection logic using only a minimal number of labeled samples. To achieve this, EvoVuln introduces two key mechanisms. First, a Runtime with an Inversion of Control (IoC) architecture compiles detection rules into Executable Policies. This strictly decouples deterministic control flow from LLM semantic reasoning, ensuring faithful logical adherence and producing dense diagnostic telemetry for precise error localization. Second, a two-phase evolution pipeline refines the rule via abductive semantic debugging without any parameter updates: Cold Start bootstraps and stress-tests an initial rule using auto-synthesized corner cases; Few-Shot Evolving then grounds the policy in real-world semantics using only five vulnerable and five safe examples per vulnerability type. Evaluated across five real-world vulnerability types, EvoVuln achieves a 71% macro-average F1-score, outperforming all baselines. The evolved procedural knowledge is portable across models: it enables a lightweight, low-cost model to surpass a much larger zero-shot model by 19 percentage points, and transfers to other LLMs without retraining, at a one-time evolution cost under $50.
Behzad Abdolmaleki, Amir R. Asadi, Vahid R. Asadi, Stefan Köpsell · 7 authors
Stochastic Gradient Descent (SGD) is the foundation of modern machine learning (ML). In privacy-sensitive settings, gradients can reveal details about individual data points. Differential Privacy (DP) protects sensitive data during ML training by clipping gradients and adding calibrated Gaussian noise. However, existing frameworks assume semi-honest participants, which fails in adversarial or federated environments where malicious actors can bypass or alter the noise addition process, breaking privacy guarantees. We present VeriDP, a framework for verifiable differentially private training that cryptographically enforces and proves the correct execution of differentially private stochastic gradient descent (DP-SGD) in zero knowledge. VeriDP integrates Zero-Knowledge Proofs (ZKPs) with polynomial commitments, sumcheck and GKR-based proofs, and incrementally verifiable computation (IVC) to generate compact proofs of correct gradient computation, clipping, averaging, and Gaussian noise generation—without revealing private data or randomness. Unlike previous systems that only verify the final privacy budget, VeriDP enables per-iteration verifiability of each model update, providing strong privacy assurances even in adversarial settings. This establishes a novel and complete Zero-Knowledge Proof of Differentially Private Stochastic Gradient Descent (ZK-DPSGD), uniting differential privacy and verifiable computation for secure and auditable ML. Our evaluation shows that prover time increases linearly with the number of input samples, while both verifier time (2–5 ms) and proof size (3–4 KB) remain compact and effectively constant.
Jianzhong Su, Mingxi Ye, Jiachi Chen, Yuhong Nan · 7 authors
With the rapid development of decentralized applications, many malicious actors exploit smart contract vulnerabilities for launching attacks. Moreover, as smart contracts utilize more state variables to support complex functionalities, some vulnerabilities require specific states to trigger (marked as vulnerable states), bringing new challenges to the vulnerability detection task. Although many smart contract fuzzers have been proposed for this task, they face limitations due to their inability to efficiently explore smart contract states. To address this challenge, we propose a novel fuzzer, Odyssey, with fine-grained state modeling and exploration, which increases the probability of reaching vulnerable states. We improve the efficacy of the fuzzer with two key mechanisms: (1) modeling an essential state space consisting of the variables related to sensitive operations to compress the exploration scope; (2) designing state-aware exploration strategies to identify test seeds that cover new state scope or cause new state transitions, to improve the efficiency of exploration. To evaluate the performance in vulnerability detection, we adopt Odyssey to a labeled benchmark consisting of 130 vulnerable contracts. Odyssey detects at least 70% more vulnerabilities than other fuzzers. Moreover, we evaluate Odyssey on a dataset that consists of 143 DApps (involving 437 contracts) from real-world security incidents. The experimental results demonstrate that state-aware feedback enhances the ability of Odyssey in state exploration by achieving 19% higher state coverage. Meanwhile, Odyssey totally finds 15 exploits of vulnerabilities from real-world attacks, showing its advantage in detecting real-world vulnerabilities.
A privacy-preserving compliance audit architecture for unmanned aerial vehicle (UAV) swarm operations. The central contribution is a deconfliction-to-containment reduction: rather than comparing n trajectories after the fact (a quadratic, disclosure-bound check), a planner assigns pairwise-disjoint spatial tubes before take-off and establishes their separation once, so that each vehicle subsequently attests only that its own samples stayed inside its own tube. Collision-freedom follows as a consequence (Theorem 2), and the pairwise cost is paid a single time at planning. The commitment layer (Layer 1) is implemented and evaluated as a decision-support audit pipeline that produces non-disclosing, tamper-evident audit artifacts via pre-flight Merkle commitments. It is evaluated in an emulated UAV swarm environment with systematic adversarial injection, in configurations up to 200 vehicles × 500 samples (100,000 sample statements), reporting artifact size, commit/prove/verify/disjunction times, and tamper-detection rates. We then formally identify the security boundary of the implemented layer: it provides coordinate hiding and tamper evidence, but cannot by itself make self-reported containment truthful, which we state as a security game and an impossibility result (Theorem 3). We specify the additional soundness layers (range proof, continuity, provenance and freshness, and aggregation) needed for full containment assurance, proving that composing a knowledge-sound range argument closes the gap (Theorem 4). Throughout, we separate the implemented and measured Layer 1 from the specified and proved—but not yet benchmarked—Layers 2–4, and we make no claim of full zero-knowledge geofence compliance, of swarm-scale deployment, or of deployment readiness.
Jun 30, 2026·Proceedings of the Workshop on Advanced Tools, Programming Languages, and PLatforms for Implementing and Evaluating algorithms for Distributed systems
This article addresses the security of Federated Learning (FL) in distributed systems against a range of attacks, including model poisoning and unverifiable client behavior, while ensuring the semantic correctness of gradient updates. It proposes ZK-FedLedger, a verifiable and adaptive FL framework that integrates multi-constraint zero-knowledge proofs with a reputation-weighted Byzantine fault-tolerant blockchain consensus. Each client generates a zk-SNARK proof certifying that its update satisfies both an adaptive norm bound and a geometric alignment constraint relative to a trusted reference gradient. Verified commitments are recorded on-chain, while model parameters are aggregated off-chain using a hybrid storage architecture that minimizes blockchain overhead. Experimental evaluation on MNIST demonstrates stable convergence, with test accuracies of 98.17% (IID) and 94.93% (Non-IID), and near-perfect detection of major poisoning attacks. The results show that ZK-FedLedger enables proactive, cryptographically verifiable FL without compromising scalability or model performance.
Gefei Tan, Adria Gascon, Sarah Meiklejohn, Mariana Raykova
In machine learning, model certification has been identified as an important method for gaining assurance about a model's trustworthiness and quality. A model's quality is largely determined by its ability to generalize, i.e., to perform well on data beyond what it was trained on. It is not possible to certify generalization directly, however, as it depends on unknown data and is not directly measurable. Proxies such as test accuracy can be misleading when the training process is perturbed (intentionally or accidentally), and metrics such as sharpness -- which has an empirically supported link to generalization -- are computationally expensive and can also serve as unreliable signals when training deviates from a prescribed procedure. In this work, we propose directional sharpness, a metric designed to efficiently and reliably indicate generalization despite potential training deviations. We provide empirical and analytical evidence that directional sharpness (1) correlates more strongly with generalization than existing metrics and (2) identifies models with poor generalization more reliably than existing metrics. Furthermore, directional sharpness is efficiently computable in model auditing settings, where the verifier has access to training data, and via zero-knowledge proofs that certify quality without revealing training data.
We propose cryptographic certificates of validity for agentic AI systems. The core idea is to formally specify a correctness or policy condition as a logical predicate, compile this predicate to a witness-checking problem over polynomial constraints, and use a succinct cryptographic proof system (and optionally zero-knowledge) to certify that the condition holds. This offers a middle ground between formal verification of source code, and cryptographic authentication. An agent's action can be accompanied by an independently checkable proof that it satisfies an agreed formal policy, without requiring the verifier to trust the agent or to re-execute computation. We outline the approach at a high level, give the core mathematical translation, relate the proposal to proof-carrying code, zkVMs, formal methods, and agent governance, and note the specification, auditing, and deployment questions that a full implementation must answer.
A deployed AI system can be interrogated for its identity in several distinct ways, and the answers do not interchange. This note concerns one of them — which neural network is producing this output at inference time? — and a popular method for answering it: behavioral fingerprinting, which samples an endpoint under a fixed prompt battery and flags it when the output distribution shifts beyond a statistical threshold. The note argues that behavioral fingerprinting, while a legitimate and valuable instrument for one task, does not establish model identity. It develops two measured failure modes. First, a behavioral signature is not durable: ordinary continued training erases the behavioral provenance trace — more effectively, in fact, than an informed adversary trains directly to suppress it — so the same model after a benign fine-tune presents as behaviorally distinct and triggers a false alarm. Second, a behavioral signature is reproducible by a different model: knowledge distillation converges a substitute toward a target's behavioral template by construction, so a behavior-matched substitute passes the check and produces a false acceptance. Both failures follow from a single fact about the layering of neural identity — behavior is the transient layer, which transfers under distillation and washes out under benign training, while the structural layer (the geometry of internal computation during a forward pass) does neither. The two methods answer different questions and compose rather than compete: behavioral monitoring is a continuous, low-cost tripwire that flags something moved; structural verification is a deterministic resolver that answers is it still the enrolled model. A system that ships only the tripwire has shipped drift detection and labeled it identity. The note documents the structural layer's direct test against the failure mode that defeats behavioral methods — behavior-preserving substitution — and situates the argument alongside independent work on intrinsic parameter-level fingerprints and cryptographic verifiable inference, both of which bind identity to the model rather than infer it from outputs. This is a category statement, not a product comparison: no specific system or vendor is named, and the argument rests on published, reproducible measurements. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note:: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
The high-level integration of generative artificial intelligence (AI) in edge computing systems has raised the question of the integrity and reliability of deploying Model-as-a-Service. Edge servers are not required to follow the so-called generative model to minimize computational cost, whereas users and service providers want validation mechanisms that do not compromise proprietary model information. To address this challenge, this study proposes a cooperative unmanned aerial vehicle (UAV)-swarm-enabled zero-knowledge verification framework for secure, privacy-preserving verification of edge-based generative artificial intelligence inference. The proposed framework involves edge servers producing an interactive cryptographic zero-knowledge proof to verify the execution of generative AI, and UAV swarms that fly freely to confirm verification operations, subject to mobility and energy constraints. The age of verification metric is proposed to trust verification information, jointly reflecting the unverified server reliability and verification freshness, and to provide dynamic priority to risky edge servers. To effectively plan the behaviour of a UAV swarm, a trust-based multi-agent reinforcement learning approach is developed that enables decentralized decision-making while training is centralized. Extensive simulation results show that the proposed framework significantly improves the state-of-the-art baseline schemes in verification timeliness, malicious server detection delay, energy efficiency, and scalability. The findings validate that integrating cooperative UAV swarms, trust-aware verification, and multi-agent learning is an efficient approach to providing reliable generative AI services in dynamic edge computing environments.
This paper argues that universal, cross-domain trust scores — from credit ratings and ESG scores to AI-generated trust metrics — face structural limits that better data or better models do not remove. The claim is not that scoring is never useful, but that compressing trust into a single comparable number, used for high-stakes allocation across contexts, recurrently fails. Trust is treated here not as a scalar quantity but as a contextual, relational, and time-dependent state. The paper identifies five recurring failure modes (context collapse, Goodhart's Law, epistemic centralization, irreversibility, and metric substitution for truth), illustrated through documented institutional failures (Enron, Wirecard, Volkswagen Dieselgate, the 2008 subprime crisis, and ESG rating practice). An informal impossibility argument — analogous in form to Arrow's theorem, not a formal mathematical proof — suggests that no single universal trust score can jointly satisfy context-independence, temporal stability, observer-neutrality, and manipulation-resistance. The paper then discusses proof-based verification as a complementary paradigm: for a bounded class of objective, checkable claims, the need for trust is reduced through local verification rather than measurement. Examples include Bitcoin proof-of-work, zero-knowledge proofs, and blockchain-based supply chain traceability. The limits of this approach are discussed explicitly, including the oracle problem and the irreducibly judgmental claims that proof cannot settle. This is version 2.0, a substantial revision repositioning the work from a position paper toward a conceptual analysis: the central thesis is qualified, an explicit scope-and-limitations section is added, the impossibility argument is reframed as informal, and the limits of proof-based verification are addressed directly.
This research investigates critical challenges in Transformer-based smart contract auditing systems, with a specific focus on inference instability and class imbalance in CodeBERT-based binary vulnerability classification. Layer-2 blockchain networks introduce highly complex architectures that increase the risk of smart contract exploits, where traditional static analysis tools such as Slither often produce large volumes of noisy, rule-based alerts. Recent advancements in pre-trained Transformer models, particularly CodeBERT, have demonstrated strong capabilities in semantic code understanding and vulnerability detection. However, during deployment of a fine-tuned CodeBERT-base model, we observe significant performance and stability issues. Initial inference experiments show a 100% false-positive rate, primarily attributed to severe class imbalance in the slither-audited-smart-contracts dataset and model sensitivity to specific smart contract patterns such as raw Ether transfer functions. In addition, system-level execution profiling reveals a silent segmentation fault during model initialization. Further investigation using Windows OS logs identifies dependency conflicts between PyTorch and PyArrow (via Hugging Face Datasets), particularly related to C++ DLL load-order issues. Experimental analysis demonstrates that modifying dependency import order, prioritizing PyArrow initialization, and enforcing strict model.eval() state management significantly improves inference stability. These findings highlight important architectural and deployment considerations for Transformer-based blockchain security systems and provide practical insights for improving the robustness of automated smart contract auditing pipelines in Layer-2 Web3 ecosystems.
Abstract The rapid growth of decentralized AI applications has created a fundamental tension between computational integrity, model confidentiality, latency, and economic efficiency. Existing verification approaches, including zero-knowledge machine learning (zkML), optimistic machine learning (opML), and trusted execution environments (TEEs), provide strong guarantees along some dimensions but fail to simultaneously satisfy the practical requirements of large-scale AI inference systems deployed on blockchain infrastructure. This paper introduces AZR, a risk-adaptive verification architecture for decentralized AI inference on blockchain rollups. AZR dynamically selects among TEE attestation, optimistic fraud proofs, and zero-knowledge verification according to a query-specific risk function that captures economic value, adversarial exposure, and dispute likelihood. By allocating stronger verification mechanisms only to high-risk workloads, AZR balances security with operational efficiency while preserving computational integrity, model confidentiality, and input privacy. We formalize the verifier selection problem as a constrained optimization framework and analyze its security and economic properties under rational adversaries. Experimental evaluation across representative workloads, including ResNet-50, BERT-Base, and LLaMA-7B, demonstrates that AZR achieves substantial cost reductions relative to uniform zkML deployment while maintaining strong security guarantees. Under a representative workload distribution, AZR reduces verification costs by up to 61% compared with pure zkML systems, while enabling low-latency responses for the majority of inference requests. These results suggest that adaptive verification architectures provide a practical pathway toward scalable and trustworthy decentralized AI systems, bridging the gap between cryptographic assurance and the performance requirements of real-world blockchain applications.
Federated Learning(FL) is predominantly deployed in enterprise environments, where limited transparency and restricted auditability hinder broader adoption. Existing FL systems often suffer from opaque aggregation processes, making it unclear which model updates are accepted or discarded. Current mitigation strategies typically rely on external validators introducing additional computational and communication overhead. In this paper, we propose a novel FL framework that leverages existing Web3 technologies to enhance transparency, trust and auditability throughout the training process. The framework adopts a hierarchical architecture in which delegated managers orchestrate the FL training process within their respective federations. To mitigate adversarial and poisoning attacks, a combination of novelty detection and consensus mechanisms were employed. Model updates are encoded and broad casted to all managers, who independently evaluate their validity and those model updates that are approved by the consensus are incorporated into the global model. Additionally, a reputation score based backup mechanism is employed to ensure model generation. Extensive experiments conducted under real world scenarios demonstrate the effectiveness, resilience of the proposed framework, highlighting its potential to enable transparent FL beyond traditional enterprise setting.
Frontier AI governance frameworks increasingly use cumulative training compute as the primary criterion for designating high-impact models, but enforcement rests on self-reporting because no technical verification primitive for training exists. Any future international agreement on frontier AI faces the same problem at higher stakes: coordinated regulation of technologies with significant externalities has historically rested on technical verification, without which agreements are declaratory. Recent governance analyses judge zero-knowledge proofs a promising candidate but currently impractical at frontier scale [26, 4]. We argue the impracticality is paradigm-bound rather than fundamental, and propose a verification architecture for frontier dense pre-training combining a pre-committed training specification, inter-node network observations, and on-the-fly Merkle commitments of intermediate computation, verified through a zero-knowledge Virtual Machine (zkVM) with native BF16/FP32 precompiles. The proof checks the actual floating-point computation the GPU performed rather than a fixed-point approximation, and preserves model-architecture confidentiality through a private training specification. The protocol produces three proof types: a genesis proof at initialisation, in-training step proofs across the run, and ex-ante attestations enforcing policy-relevant claims as running invariants, turning the training record into a governance-enforceable artefact. We estimate a deployable proof of concept within approximately 36 months at single-digit-percent training-side overhead, against a six-to-ten-year cycle for verification-grade custom silicon. Thirteen open research and engineering problems are catalogued as a research agenda for external contribution
Decentralized verifiable credential systems have seen limited deployment in practice. Existing constructions, built on zero-knowledge proofs, are complex, application-specific, and largely restricted to predicates over structured data. We present Privately Inferred Credentials ($Ï€$Creds): privacy-preserving, legacy-compatible, decentralized verifiable credentials generated by trusted LLM inference over authenticated data. LLMs' ability to semantically reason over unstructured data substantially expands the range of claims $Ï€$Creds can certify over existing credential systems. The use of LLMs also introduces new application-level threats, which we formalize through two problems: the Source-Constrained Adversarial Example (SCAE) problem, which captures robustness against adversaries that manipulate authenticated data to obtain misleading credentials, and the Authenticated Covert Predicate Poisoning (ACPP) problem, which captures privacy leakage through adversarial model selection. We characterize applications of $Ï€$Creds over user data, and a novel class of credentials over proprietary software that certifies properties of a service without revealing its source code. Our prototype supports issuing credentials over live financial, health, email, and code sources, and we empirically study the SCAE and ACPP threats on a product expertise credential over real financial data.
Guilin Guan, Yang Cao, Zhenqiang Xie, Shu Yang · 5 authors
Abstract Industrial Internet of Things (IIoT) devices continuously generate large volumes of privacy-sensitive operational data. Federated Learning (FL) enables distributed model training without exposing raw data to external parties. However, existing FL solutions suffer from critical limitations, including single points of failure from centralized servers, insufficient verifiable defenses against gradient poisoning attacks, and poor adaptability to dynamic device churn. To address these challenges, we propose DVFL-IIoT, a fully decentralized and dynamic secure aggregation protocol tailored for IIoT environments. Our framework eliminates centralized trust assumptions using Pedersen Distributed Key Generation (DKG), supports seamless device joining and leaving without full system reinitialization through a key insulation mechanism, and ensures end-to-end verifiability via dual non-interactive zero-knowledge proofs (NIZKs). Formal security analysis proves that DVFL-IIoT achieves IND-CCA2 privacy, information-theoretic collusion resistance, and computational verifiability. Extensive experiments on two real-world IIoT intrusion detection benchmarks, ToN-IoT and Edge-IIoTset, achieve test accuracies of 98.81\% and 98.35\%, respectively, significantly outperforming state-of-the-art methods while maintaining strong robustness against poisoning attacks and dynamic device churn.
As autonomous driving technology advances towards Level 4 and 5, virtual simulation has become an indispensable tool for safety validation. However, a critical ''trust gap'' exists between developers and regulators; submitting raw simulation logs poses risks of data tampering (integrity issues) and intellectual property leakage (privacy issues). To address this, we propose ZK-V, a universal, privacy-preserving verification framework designed to interface with various autonomous driving simulators. By leveraging Zero-Knowledge Proofs and blockchain technology, ZK-V allows a Prover to cryptographically demonstrate that a simulation run adhered to specific safety constraints such as collision avoidance and speed limits without revealing the underlying telemetry data. This paper outlines the simulation-agnostic system architecture and constraint logic, offering a scalable solution for decentralized, trust-free certification in the Web 4.0 mobility era.
The numerical receipt that allows independent verification of which AI model is serving a frontier API endpoint — the top-*K* log-probability vector computed on every forward pass — is being withdrawn across every major frontier lab, without announcement. xAI silently ignores the parameter on Grok 4.20 and newer. Google Vertex began returning errors on Gemini 3 Pro without notice. OpenAI excludes the entire reasoning-model class and the GPT-5 line. Anthropic has never exposed the field. The withdrawal is not universal: legacy and non-reasoning models at the same providers continue to return logprobs on the same infrastructure. The capability is not technically infeasible. It is a decision. This note documents the current state of logprob access across four frontier providers, establishes what the access enables and what it does not, and provides six operational contract clauses that preserve the enterprise's right to verify model identity at the API layer. The mathematics of establishing model identity from top-*K* logprob output is documented in the companion research [1, 2]; this note concerns whether the numbers will continue to be available at all. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note:: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Xiao-Yang Liu Yanglet, Xiaodong Wang, Agostino Capponi
We argue that trustworthy AI agents, especially in high-stakes and policy-governed domains, should make execution conditional on certified traces rather than rely only on stronger generative models, output-level guardrails, or post-hoc audits. A generative agent may propose recommendations, tool calls, reports, or actions, but generation is not permission: an action may be computable yet impermissible, and individually permissible actions may compose into an impermissible trace. We formalize trustworthy agency through a \textbf{Proposal--Certification--Execution (PCE)} architecture: a probabilistic generating machine $M_G$ proposes candidate execution traces, a \textbf{Permissibility Machine} $M_Î $ certifies proposed traces under a policy system $Î $, and execution proceeds only for certified traces. The executable trace language is $L_{\mathrm{exec}} = L_G \cap L_{\mathrm{cert}}(M_Î )$. Before execution, a trace is a structured pre-execution record submitted for certification: it specifies intended steps, evidence, proposed tool calls, approvals, replayable computations, credentials, and execution conditions. This perspective complements chain-of-thought monitorability: visible reasoning may help detect misbehavior, but monitorability is not certifiability, and reasoning is only one component of a broader execution trace. The formal principle is simple: an agent-generated trace should execute only when it carries a checkable certificate witnessing permissibility under $Î $: \textbf{no certificate, no execution}. We develop certified traces and Permissibility Machines as foundations for trustworthy AI agents, connect trace certification to proof-carrying execution, proof memory, privacy, and zero-knowledge certificates, and propose evaluating agents by what generated traces can be safely certified for execution, not by output accuracy alone.