A deployed AI system can be interrogated for its identity in several distinct ways, and the answers do not interchange. This note concerns one of them — which neural network is producing this output at inference time? — and a popular method for answering it: behavioral fingerprinting, which samples an endpoint under a fixed prompt battery and flags it when the output distribution shifts beyond a statistical threshold. The note argues that behavioral fingerprinting, while a legitimate and valuable instrument for one task, does not establish model identity. It develops two measured failure modes. First, a behavioral signature is not durable: ordinary continued training erases the behavioral provenance trace — more effectively, in fact, than an informed adversary trains directly to suppress it — so the same model after a benign fine-tune presents as behaviorally distinct and triggers a false alarm. Second, a behavioral signature is reproducible by a different model: knowledge distillation converges a substitute toward a target's behavioral template by construction, so a behavior-matched substitute passes the check and produces a false acceptance. Both failures follow from a single fact about the layering of neural identity — behavior is the transient layer, which transfers under distillation and washes out under benign training, while the structural layer (the geometry of internal computation during a forward pass) does neither. The two methods answer different questions and compose rather than compete: behavioral monitoring is a continuous, low-cost tripwire that flags something moved; structural verification is a deterministic resolver that answers is it still the enrolled model. A system that ships only the tripwire has shipped drift detection and labeled it identity. The note documents the structural layer's direct test against the failure mode that defeats behavioral methods — behavior-preserving substitution — and situates the argument alongside independent work on intrinsic parameter-level fingerprints and cryptographic verifiable inference, both of which bind identity to the model rather than infer it from outputs. This is a category statement, not a product comparison: no specific system or vendor is named, and the argument rests on published, reproducible measurements. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note:: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
This paper argues that universal, cross-domain trust scores — from credit ratings and ESG scores to AI-generated trust metrics — face structural limits that better data or better models do not remove. The claim is not that scoring is never useful, but that compressing trust into a single comparable number, used for high-stakes allocation across contexts, recurrently fails. Trust is treated here not as a scalar quantity but as a contextual, relational, and time-dependent state. The paper identifies five recurring failure modes (context collapse, Goodhart's Law, epistemic centralization, irreversibility, and metric substitution for truth), illustrated through documented institutional failures (Enron, Wirecard, Volkswagen Dieselgate, the 2008 subprime crisis, and ESG rating practice). An informal impossibility argument — analogous in form to Arrow's theorem, not a formal mathematical proof — suggests that no single universal trust score can jointly satisfy context-independence, temporal stability, observer-neutrality, and manipulation-resistance. The paper then discusses proof-based verification as a complementary paradigm: for a bounded class of objective, checkable claims, the need for trust is reduced through local verification rather than measurement. Examples include Bitcoin proof-of-work, zero-knowledge proofs, and blockchain-based supply chain traceability. The limits of this approach are discussed explicitly, including the oracle problem and the irreducibly judgmental claims that proof cannot settle. This is version 2.0, a substantial revision repositioning the work from a position paper toward a conceptual analysis: the central thesis is qualified, an explicit scope-and-limitations section is added, the impossibility argument is reframed as informal, and the limits of proof-based verification are addressed directly.
Abstract Law firms and corporate legal departments hold large volumes of privileged text that could train superior legal AI models, but attorney-client privilege sharply constrains data sharing across organizational boundaries. Standard federated learning frameworks target statistical privacy rather than the stricter operational requirement that privileged communication content remain inaccessible to non-privileged parties. We present a federated learning architecture designed for multi-firm collaborative model training under explicit privilege constraints. The architecture integrates six components: a privilege classification engine that categorizes documents by privilege type before training; privilege-calibrated differential privacy where noise scales with sensitivity; homomorphic encryption of sanitized gradients with zero-knowledge sanitization proofs; trusted execution environment (TEE)-enclosed aggregation that combines encrypted updates without exposing individual contributions; a privilege boundary graph that models joint defense agreements with dynamic conflict detection and model rollback; and cryptographic audit trails designed for later judicial review. We evaluate the design through formal privacy analysis with composed R\'{e}nyi differential privacy budget bounds, a worked four-entity deployment scenario with conflict detection, and comparative security analysis against baseline federated configurations.
The circuit-breaker capstone of the WANDERING arc on long-horizon coding-agent failure. A prior result ('The Lever Is Late') showed that control of a coding agent's 'finish' decision lives not at the mid-layer 'task-is-done' verdict but in a late, task-matched action-commitment block ~30 layers downstream. This paper answers two pre-registered questions that the single 'finish' result could not: is the late lever SPECIFIC to termination, and can it BRAKE an action, not just elicit one? On Qwen3.6-27B over 99 SWE-bench Pro trajectories, using a second decision in the same data -- commit a file edit (str_replace_editor) vs. continue reversible exploration (bash) -- with n=60 deterministic decision points per condition, prefill-only patching, and generation-confirmed outcomes: (1) GENERALIZATION (elicit): injecting a task-matched edit-donor into the late block makes a stuck-in-exploration agent emit a real edit call (0.23 -> 0.77 at L59; position control 0.08, cross-task control 0.48). (2) THE BRAKE (suppress): injecting an explore-donor at a commit decision collapses the real edit rate 0.48 -> 0.02 (96% suppression) at L55, with a same-class control intact (0.55) and the opposite donor boosting to 0.92. (3) The mechanism is MONOTONIC and BIDIRECTIONAL: exact paired McNemar on all 14 per-point conditions yields seven contrasts surviving Holm-Bonferroni (worst p=7.6e-5), with elicit c=0 (the edit-donor only turns commits on) and brake b=0 (the explore-donor only turns them off) -- the lever moves exactly in the donor's direction with ~zero off-direction noise. (4) CROSS-ARCHITECTURE: the late-commitment geometry and donor-specific writability replicate across two model families and two scales (Mistral-7B and the scale-matched Mistral-Small-24B, where the mid-inert / late-write dissociation is cleanest: fidelity 0.955 vs 0.007). Strengtheners: the elicit/brake lift survives a full valid-tool-call re-parse (0.23->0.37 elicit, 0.40->0.07 brake), and the brake re-routes to reversible exploration (+0.17 bash above its no-brake floor of 0.43). We frame the bidirectional late lever as the mechanism for a mechanistic CIRCUIT-BREAKER: a single late-layer intervention that blocks an action at its commit point. Honest scope: demonstrated on a state-mutating but UNDOABLE edit (a semi-irreversible proxy); intervening on a genuinely irreversible action (e.g. send_transaction) is the named next step. The model-agnostic decision-locator tool, pre-registrations, per-point data, exact-statistics script, and an adversarial pre-publication evaluation are released in the GitHub repository under paper/circuit_breaker/. EXTENDED EDITION adds a mechanistic decomposition of the lever (Section 'Opening the lever: a sparse attention-head circuit'). Using an exact additive residual split (y=x+attn+mlp; reconstruction relerr 0.0025) the elicit is written by the L59 ATTENTION sublayer (MLP null; Wilcoxon attn>>mlp p=1.8e-8; direction-specific 2.2x), while the brake localizes to NO sublayer (distributed, super-additive residual) -- the elicit/brake asymmetry holds at sublayer resolution and rules out a feed-forward key-value write. One level deeper, the elicit is a SPARSE 3-head push circuit at L59 (heads 8/6/3 reproduce and overshoot the full attention effect, top-3 +0.262 >= all-24 +0.224; emit 0.23->0.42), partially opposed by a counter-set; geometric write-magnitude misleads (the largest writer is causally an opponent). These heads attend globally to the trajectory's TOOL-CALL HISTORY (an induction/copy signature), not a semantic verdict. A source-content knockout gives partial/directional causal support (tool choice is causally specific to each tool's name tokens: ablating 'bash' tokens drops P(bash) -0.071 vs ~0 for random; the edit side is ceiling-confounded). All 53 reported numbers were verified against the released per-result ledgers by an adversarial pre-submission evaluation (EVAL_mechanism.md). Scripts (commit_lever_decomp/heads/attn/knockout.py) and per-result ledgers are released.
Sai Srikanth Madugula, Peplluis Esteva De La Rosa, Daya Shankar
The integration of machine learning into decentralized finance (DeFi) credit assessment is frequently undermined by opaque algorithms and severe methodological flaws regarding data leakage. This paper presents a rigorous, fully reproducible framework for explainable artificial intelligence (XAI) in invoice-backed default risk modeling. Utilizing a highly imbalanced dataset of 12,000 corporate loan originations, we engineer an XGBoost ensemble model that achieves an AUC-ROC of 0.89. We systematically eliminate the pervasive data leakage associated with the Synthetic Minority Over-sampling Technique (SMOTE) by implementing a dynamic crossvalidation pipeline, ensuring synthetic data generation is strictly isolated to training folds. To satisfy institutional accounting standards for expected loss (e.g., IFRS 9), we mathematically formulate and validate the Expected Calibration Error (ECE), achieving a highly calibrated probabilistic output of 0.08. Furthermore, we extract local explanations using SHAP (SHapley Additive exPlanations), imposing strict constraints on the background reference dataset to guarantee mathematical additivity and prevent stochastic approximation transitions. Our findings reveal that Days Payment Outstanding (DPO) and invoice age are primary default drivers, while on-chain reputation effectively mitigates perceived risk. Finally, we address critical privacy vulnerabilities, mathematically modeling Membership Inference Attacks (MIAs) on synthetic records. This work establishes a regulatory-compliant, structurally sound ML foundation for permissionless credit provision.
This preprint introduces and reports the OPERATE-R Freshness Routing Track (OPERATE-FR), a route-first evaluation framework for temporal volatility, stale-knowledge control, and answer-entitlement behavior in AI assistants. Unlike conventional answer-accuracy benchmarks, OPERATE-FR evaluates whether a system selects an appropriate epistemic route before answering: direct answer, verification, clarification, date-bounded answer, re-anchoring of stale premises, or abstention. The paper reports Smoke-100 Raw-vs-MMV evidence and integrates a later Core-500 candidate stress check across Small, Medium, and Large governed profiles. The central claim is intentionally bounded. Smoke-100 supports a Raw-vs-MMV improvement-delta claim for route governance. Core-500 does not include a matched Raw control arm and is therefore used as governed-profile level evidence, robustness stress evidence, family-level heterogeneity evidence, and cost-side analysis, not as a large-N proof of governance improvement. Core-500 is a controlled 5x expansion of Smoke-100 using neutral prompt-frame variants; it should not be treated as 500 independent task families or as an independently validated public benchmark standard. This v0.3.6 data-verified final manuscript incorporates post-audit verification of the Core-500 failure-side metrics. The equality between stale_commitment_rate and unsupported_current_claim_rate is confirmed not to be a manuscript copy error. The row-output JSONL files were re-read after Drive synchronization, and the derived row sets are identical with zero symmetric difference across Small, Medium, and Large lines. The labels remain conceptually distinguishable, but in the current Core-500 scorer they are structurally paired under the observed direct-current-claim-without-date-boundary-or-tool-use condition. This record should be read as a working paper and candidate benchmark report. It does not claim an official leaderboard, a universal model-quality score, deployment-wide validation, or external benchmark standard status. Future work includes matched Core-500 Raw arms, route-classifier validation, independent labels, external baselines, clustered or hierarchical uncertainty estimates, and improved handling of volatile_current prompts. Author of record and concept originator: Taiko Toeda.Rights holder and licensing authority: MOBIUS LLC.
Cryptocurrency fraud on blockchain platforms continues to cause substantial financial losses, creating an urgent need for detection systems that are not only accurate but also interpretable for operational and regulatory use. In this paper, we propose an explainable framework for Ethereum fraud detection integrating an XGBoost ensemble with TreeSHAP. This system achieves high predictive performance (96.3% F1-score, 96.6% recall) while providing model-level transparency via an interactive chatbot interface. Evaluation using fidelity and stability metrics confirms the reliability of the SHAP-based insights, while user-role simulations demonstrate that our structured delivery enhances clarity and actionability over standard visualizations. This work offers a practical, transparent foundation for deploying robust AI in high-risk financial environments without sacrificing accuracy.
This technical paper presents the architectural foundations and technological innovations of the GEORGIA platform. The publication introduces a decentralized, cloud-native cyber-physical system that integrates biophysical modelling, Explainable Artificial Intelligence, Zero-Trust Federated Learning, and Distributed Ledger Technology to support precision irrigation and drought resilience across diverse European agricultural systems.
The numerical receipt that allows independent verification of which AI model is serving a frontier API endpoint — the top-*K* log-probability vector computed on every forward pass — is being withdrawn across every major frontier lab, without announcement. xAI silently ignores the parameter on Grok 4.20 and newer. Google Vertex began returning errors on Gemini 3 Pro without notice. OpenAI excludes the entire reasoning-model class and the GPT-5 line. Anthropic has never exposed the field. The withdrawal is not universal: legacy and non-reasoning models at the same providers continue to return logprobs on the same infrastructure. The capability is not technically infeasible. It is a decision. This note documents the current state of logprob access across four frontier providers, establishes what the access enables and what it does not, and provides six operational contract clauses that preserve the enterprise's right to verify model identity at the API layer. The mathematics of establishing model identity from top-*K* logprob output is documented in the companion research [1, 2]; this note concerns whether the numbers will continue to be available at all. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note:: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
AgisFL v5.0 Autonomous Federated Learning Ecosystem Citation: Yadav, A. (2026). AgisFL v5.0: Autonomous Federated Learning Ecosystem with Privacy-Preserving Explainability and Enterprise AI Orchestration. Zenodo. https://doi.org/10.5281/zenodo.20363208 Table of Contents Executive Summary Abstract Introduction Industry Challenges in Federated Learning Research Objectives Literature Review System Overview Core Architectural Design Autonomous AI Engine Federated Learning Core Three-Line Integration Framework Security Architecture Privacy Preservation Framework Federated Explainability System Concept Drift Detection and Adaptive Retraining Distributed Systems Design Enterprise Governance Layer Monitoring and Observability API and Communication Architecture Database and Storage Infrastructure CI/CD and Release Engineering Kubernetes and Cloud Deployment Architecture Threat Modeling and Adversarial Defense Real-World Industry Applications Benchmarking and Performance Evaluation Comparative Analysis Scalability and Reliability Engineering Testing and Validation Framework Compliance and Regulatory Readiness Research Contributions Limitations Future Research Directions Conclusion References Appendices 1. Executive Summary AgisFL v5.0 is a next-generation autonomous federated learning ecosystem engineered to redefine how distributed artificial intelligence systems are developed, deployed, optimized, governed, and scaled in enterprise environments. The platform introduces a unified architecture that combines: Autonomous AI orchestration Federated machine learning Privacy-preserving analytics Enterprise governance Federated explainability Real-time monitoring Distributed optimization Security-first infrastructure Zero-trust operational principles Developer-centric integration abstractions Modern federated learning systems frequently suffer from fragmented tooling, operational complexity, difficult deployment procedures, weak observability, limited explainability, and insufficient enterprise governance. AgisFL addresses these limitations through a fully integrated ecosystem capable of autonomous optimization, adaptive retraining, drift monitoring, federated explainability, and production-grade orchestration. A major innovation introduced in AgisFL v5.0 is the Three-Line Integration SDK, which reduces federated learning implementation complexity from hundreds of lines of orchestration code into a simplified developer abstraction requiring only three operational commands. AgisFL also introduces: FedNAS (Federated Neural Architecture Search) FedHPO (Federated Hyperparameter Optimization) AutoFL autonomous orchestration engine Federated SHAP explainability framework Real-time drift detection systems Enterprise governance tooling Distributed observability infrastructure Autonomous retraining pipelines Integrated red-team simulation systems The platform is designed to support enterprise-grade deployments across: Healthcare AI Banking and fraud detection Cybersecurity analytics Autonomous transportation systems Industrial IoT ecosystems Smart infrastructure Defense intelligence systems Cross-organizational research networks AgisFL transforms federated learning from a research-heavy distributed systems problem into an operational autonomous AI platform suitable for enterprise production environments. 2. Abstract Federated learning has emerged as one of the most important paradigms in modern artificial intelligence because it enables collaborative machine learning without centralized raw data collection. Despite significant advances in federated optimization algorithms, practical enterprise adoption remains constrained by engineering complexity, infrastructure fragmentation, weak observability, insufficient explainability, operational overhead, and inadequate governance tooling. This paper introduces AgisFL v5.0, an enterprise-grade autonomous federated learning ecosystem designed to simplify distributed AI development while preserving privacy, scalability, explainability, and enterprise operational resilience. The proposed architecture integrates autonomous orchestration, federated neural architecture search, hyperparameter optimization, differential privacy, federated explainability, real-time telemetry, adaptive retraining, distributed governance, and multi-tenant deployment capabilities into a unified operational platform. A key contribution of this work is the introduction of a Three-Line Integration abstraction layer that reduces federated learning implementation complexity by approximately 98%, enabling developers to operationalize distributed machine learning workflows with minimal infrastructure overhead. Experimental evaluation demonstrates: Significant reduction in deployment complexity Faster convergence behavior Enhanced privacy guarantees Improved operational resilience Lower infrastructure overhead Enhanced governance visibility Autonomous optimization capabilities Enterprise-grade scalability The findings suggest that federated learning ecosystems can evolve beyond isolated research frameworks into fully autonomous enterprise-operational AI infrastructures capable of supporting large-scale real-world deployments. 3. Introduction Artificial intelligence systems increasingly depend on access to large-scale distributed datasets. However, centralized data aggregation introduces major concerns related to: Privacy Regulatory compliance Infrastructure cost Data ownership Security risk Cross-border governance Operational complexity Federated learning addresses these concerns by enabling decentralized collaborative model training where data remains localized while model updates are aggregated centrally or hierarchically. Despite its promise, enterprise adoption of federated learning remains limited due to several fundamental issues: 3.1 Complexity of Distributed Orchestration Traditional federated learning infrastructures require: Client synchronization systems Custom networking layers Aggregation orchestration Distributed storage pipelines Manual security implementation Complex deployment workflows These systems introduce substantial engineering overhead. 3.2 Limited Explainability Most federated learning frameworks prioritize optimization performance while neglecting explainability and interpretability requirements. This creates significant barriers in regulated domains such as: Healthcare Finance Cybersecurity Defense 3.3 Weak Enterprise Governance Existing systems frequently lack: Auditability Compliance tooling Enterprise observability Governance automation Operational telemetry Real-time incident response 3.4 Operational Fragility Distributed environments are inherently dynamic. Existing federated systems rarely support: Autonomous retraining Drift adaptation Self-healing infrastructure Dynamic client balancing Adaptive optimization AgisFL v5.0 was designed specifically to address these challenges. 4. Industry Challenges in Federated Learning 4.1 Data Sovereignty Constraints Modern organizations operate under increasingly strict regulatory environments including: GDPR HIPAA PCI-DSS ISO 27001 SOC2 NIST frameworks Centralized AI architectures frequently violate data locality requirements. 4.2 Security Risks Federated systems are vulnerable to: Model poisoning Data poisoning Gradient inversion attacks Membership inference attacks Byzantine participants Adversarial manipulation 4.3 Infrastructure Fragmentation Organizations often rely on heterogeneous environments: Cloud providers On-premise systems Edge devices Hybrid deployments Multi-region clusters This creates interoperability challenges. 4.4 Operational Scalability Large federated ecosystems require: Distributed orchestration Fault tolerance Client balancing Scheduling systems Autonomous optimization Resource-aware coordination 5. Research Objectives The primary research objectives of AgisFL v5.0 include: Objective 1 — Simplification Reduce federated learning deployment complexity through abstracted developer interfaces. Objective 2 — Autonomous AI Operations Enable self-optimizing distributed AI infrastructure. Objective 3 — Privacy Preservation Maintain strong privacy guarantees without sacrificing operational intelligence. Objective 4 — Explainability Provide interpretable federated learning workflows. Objective 5 — Enterprise Governance Introduce scalable governance and observability tooling. Objective 6 — Production Readiness Support real-world enterprise deployment scenarios. 6. Literature Review Federated learning was initially formalized by Google researchers to enable collaborative learning across decentralized mobile devices. Subsequent frameworks introduced: FedAvg optimization FedProx adaptive training Differential privacy systems Secure aggregation protocols Decentralized optimization methods However, existing systems frequently remain research-oriented. 6.1 Existing Framework Limitations Platform Limitation TensorFlow Federated Research-focused complexity Flower Limited autonomous optimization PySyft Operational deployment complexity OpenFL Limited explainability integration FedML Weak governance tooling AgisFL differentiates itself through autonomous orchestration, explainability integration, enterprise governance, and simplified deployment abstractions. 7. System Overview AgisFL v5.0 is composed of multiple inte
As large language models (LLMs) grow in scale and are predominantly served from remote platforms, verifying faithful inference execution becomes critical (i.e., ensuring that a provider actually executes the advertised model and computational workload rather than a tampered or downsized variant). Zero-knowledge (ZK) LLM inference offers an appealing approach. It promises public verifiability and delivers per-instance guarantees of equational correctness by proving that an output is consistent with executing a public architecture under committed, private weights. Though, we show that it does not bind the effort expended to produce the output. In this paper, we formalize this overlooked effort gap and introduce the Hollow-LLM Attack, in which a dishonest provider retains the declared architecture and parameter count but embeds ghost weights whose algebraic structure collapses effective computation. These witnesses satisfy the verification circuit and yield valid proofs, even though the dishonest model owner, who serves as the prover, performs computation commensurate with a much smaller model than the declared public architecture. This creates a profitable equilibrium in which providers deliver provably correct outputs at small-model cost while overclaiming model size. Accordingly, we characterize concrete families of ghost weights that compose with standard transformer blocks and show that such hollow deployments substantially reduce serving cost with zero quality loss under the same verification circuit. These findings underscore that proof of correct inference is not proof of large-model execution and necessitate additional protections to bind correctness to verifiable computational work.
The rapid evolution of Decentralized Finance (DeFi) has introduced unprecedented financial innovations alongside complex fraud vectors that challenge conventional security mechanisms.Traditional fraud detection systems rely heavily on centralized data aggregation and opaque machine learning models, which are fundamentally incompatible with the decentralized and trust-minimized architecture of blockchain ecosystems.Emerging paradigms such as Federated Learning (FL) and Explainable Artificial Intelligence (XAI) have been independently proposed to address privacy and transparency concerns in financial systems.However, despite significant progress in each domain, the literature reveals methodological fragmentation and architectural disconnection among blockchain-based fraud detection, privacy-preserving learning, and explainability mechanisms.This study critically reviews existing research on traditional finance fraud detection, blockchain analytics, federated learning security, XAI applications, and blockchain-FL integration frameworks.Through comparative and analytical synthesis, it identifies critical research gaps, including the absence of unified decentralized fraud architectures, insufficient explainability in on-chain systems, and limited governance models for federated financial intelligence.This study establishes a theoretical and technological foundation for an integrated blockchain-driven FL-XAI framework tailored for DeFi fraud detection.
We propose ZK-GSP, a framework for privacy-preserving, verifiably correct graph neuralnetwork (GNN) inference using zero-knowledge STARKs. The key insight is a structuralisomorphism between RISC Zero's zkVM and graph signal processing (GSP) pipelines:both are typed, deterministic data-flow graphs whose execution can be committed to witha succinct, publicly verifiable proof. By implementing GSP operators as instructions insidethe RISC Zero executor, we obtain a system that runs GNN programs on private graphdata and emits a STARK receipt proving correct execution, without revealing the graphtopology, node features, or intermediate embeddings. We demonstrate an end-to-endimplementation in Rust, measure proof generation time and RISC-V cycle count acrossgraph sizes N = 4 to 32, and find that cycle count scales as O(N2), matching thecomplexity of the underlying GCN operator. Code: github.com/brack-6/zk-gsp
AI hallucination is a cost problem, not a knowledge problem. This paper documents that three sentences of prompt-level instruction — IDK+COMP: a compression mandate paired with a refusal permission — reproduce hallucination suppression matching or exceeding a full multi-constraint methodology across three frontier AI models. Preliminary results: Gemini — 6.3% hallucination rate (Baseline 57.5%). ChatGPT — 0.0% (Baseline 22.2%). Claude — 0.0% on both. The paper establishes hallucination as a utility-maximizing response to a cost structure that makes confident invention cheaper than refusal. Change the cost structure at the prompt level — without touching the model, without retraining, at near-zero cost — and the behavior changes. IDK is load-bearing. COMP (the compression mandate) is the environment in which it operates. Secondary findings: hedging is not a mitigation — it is a co-symptom of unresolved uncertainty, and this dataset moves the hedge-hallucination relationship in both directions depending on directive design. Plausibility-trap strings (SPLAM, Vandermeer Effect) expose the limit of cost-structure interventions: the model cannot recognize the unrecognizable. 410 trials. Three frontier AI models. Five governance conditions. Proof-of-concept dataset; results are directional.
AI hallucination is a cost problem, not a knowledge problem. This paper documents that three sentences of prompt-level instruction — IDK+COMP: a compression mandate paired with a refusal permission — reproduce hallucination suppression matching or exceeding a full multi-constraint methodology across three frontier AI models. Gemini: 6.3% hallucination rate (Baseline 57.5%). ChatGPT: 0.0% (Baseline 22.2%). Claude: 0.0%. The paper establishes hallucination as a utility-maximizing response to a cost structure that makes confident invention cheaper than refusal. Change the cost structure at the prompt level — without touching the model, without retraining, at near-zero cost — and the behavior changes. IDK is load-bearing. The compression mandate is the environment in which it operates. Secondary findings: hedging is not a mitigation — it is a co-symptom of unresolved uncertainty, and this dataset moves the hedge-hallucination relationship in both directions depending on directive design. Plausibility-trap strings (SPLAM, Vandermeer Effect) expose the limit of cost-structure interventions: the model cannot recognize the unrecognizable. In a plausibility-trap domain, IDK+COMP is worse than nothing. 410 trials. Three frontier AI models. Five governance conditions. Proof-of-concept dataset; results are directional. Companion resources: Kowalski et al. (2026a), A Puma in a Teacup: Signal Quality and Hallucination Suppression Through Prompt-Level Incentive Restructuring. https://doi.org/10.5281/zenodo.19502460 Kowalski, M. M. and Claude (Anthropic). (2026). Taxonomy of AI Bullshit: hallucination and hedging subcategories. Zenodo. https://doi.org/10.5281/zenodo.20631337. Kowalski, M. M. & Claude (Anthropic). (2026). Hallucination Test Suite and Execution Records: test strings, activation blocks, trial data and AI transcripts. Zenodo. https://doi.org/10.5281/zenodo.21325014.
Predictive analysis has become an essential component in modern financial research and practice, driven by the rapid advancement of data analytics, machine learning, and artificial intelligence. This study aims to systematically map the intellectual structure, research trends, and key contributions in the field of predictive analysis in finance through a bibliometric approach. Data were collected from the Scopus database covering publications from 2000 to 2026 and analyzed using VOSviewer to examine co-authorship networks, citation patterns, and keyword co-occurrence. The results reveal a significant growth in research output, particularly in recent years, reflecting the increasing importance of data-driven decision-making in finance. Co-authorship analysis indicates the presence of collaborative research clusters, although the field remains partially fragmented. Citation analysis highlights that the most influential studies are those integrating advanced computational methods with practical financial applications, such as credit scoring, bankruptcy prediction, and stock market forecasting. Furthermore, keyword analysis demonstrates a clear shift from traditional statistical techniques toward machine learning, artificial intelligence, and emerging technologies such as blockchain and decentralized finance. This study contributes by providing a comprehensive overview of the evolution and current state of predictive analysis in finance, identifying key research themes and gaps. The findings suggest that future research should focus on enhancing model interpretability, integrating sustainability considerations, and expanding applications in real-time financial decision-making. Overall, this study serves as a valuable reference for researchers and practitioners seeking to understand the trajectory and future direction of predictive analytics in the financial domain.
Zhuoran Pan, Yue Li (102191), Zhi Guan, Jianbin Hu · 5 authors
The emergence of Large Language Models (LLMs) offers a transformative interface for Web3, yet existing benchmarks fail to capture the complexity of translating high-level user intents into functionally correct, state-dependent on-chain transactions. We present \textsc{Intent2Tx}, a high-fidelity benchmark featuring 29,921 single-step and 1,575 multi-step instances meticulously derived from 300 days of real-world Ethereum mainnet traces. Unlike prior works that rely on synthetic instructions, \textsc{Intent2Tx} grounds natural language intents in real-world protocol interactions across 11 categories, including diverse long-tail Decentralized Finance (DeFi) primitives. To enable rigorous evaluation, we propose an execution-aware framework that transcends surface-level text matching by employing differential state analysis on forked mainnet environments. Our extensive evaluation of 16 state-of-the-art LLMs reveals that while scaling and retrieval-augmentation enhance logical consistency and parameter precision, current models struggle with out-of-distribution generalization and multi-step planning. Crucially, our execution-based analysis demonstrates that syntactically valid outputs often fail to achieve intended state transitions, highlighting a significant gap in current "reasoning-to-execution" capabilities. \textsc{Intent2Tx} serves as a critical foundation for developing autonomous, reliable agents in intent-centric Web3 ecosystems. Code and data: https://anonymous.4open.science/r/Intent2Tx_Bench-97FF .
We describe a protocol that produces byte-identical outputs from frontier-scale language model inferenceand binds each output to a portable, offline-verifiable signed receipt. The construction has three parts.First, an inference substrate that runs models up to seventy-two billion dense parameters and forty-sevenbillion mixture-of-experts active parameters on NVIDIA H100, with cross-vendor extension to AMDInstinct MI300X. Output hashes match byte-for-byte across fresh process launches in every configurationmeasured; at single-GPU bf16 with eager attention the AMD and NVIDIA hashes are themselves byte-identical, including over fifty-one tokens of compounding frontier-scale generation, and at two-GPUtensor-parallel they differ as predicted by the underlying NCCL-ring versus RCCL-fabric all-reducetopology. Both are individually deterministic. Second, a canonical CBOR receipt schema with an Ed25519signature over a domain-separated message, implemented in Go, Python, and Rust, with cross-languagebyte-identity verified end-to-end and AMD-produced receipts verifying byte-for-byte through a Rustverifier built on x86 NVIDIA hardware. Third, a probabilistic spot-check verifier that re-executes asmall sample of receipts and rejects on mismatch; we prove a soundness lemma of the form 1−(1−f )kand validate it empirically across seventy adversary-verifier configurations with seven hundred thousandMonte Carlo trials. Verification costs about eighty microseconds per receipt on a single core. Eleventhousand sequential warm-model inferences ran without a single byte-identity failure. The contribution isthe construction itself: a primitive that gives issuer-independent fabrication soundness for AI inference atproduction cost, without a hardware-vendor dependency and without zero-knowledge proofs.
Large Reasoning Models (LRMs) and Multi-Agent Systems (MAS) in high-stakes domains demand reliable verification, yet centralized approaches suffer four limitations: (1) Robustness, with single points of failure vulnerable to attacks and bias; (2) Scalability, as reasoning complexity creates bottlenecks; (3) Opacity, as hidden auditing erodes trust; and (4) Privacy, as exposed reasoning traces risk model theft. We introduce TRUST (Transparent, Robust, and Unified Services for Trustworthy AI), a decentralized framework with three innovations: (i) Hierarchical Directed Acyclic Graphs (HDAGs) that decompose Chain-of-Thought reasoning into five abstraction levels for parallel distributed auditing; (ii) the DAAN protocol, which projects multi-agent interactions into Causal Interaction Graphs (CIGs) for deterministic root-cause attribution; and (iii) a multi-tier consensus mechanism among computational checkers, LLM evaluators, and human experts with stake-weighted voting that guarantees correctness under 30% adversarial participation. We prove a Safety-Profitability Theorem ensuring honest auditors profit while malicious actors incur losses. All decisions are recorded on-chain, while privacy-by-design segmentation prevents reconstruction of proprietary logic. Across multiple LLMs and benchmarks, TRUST attains 72.4% accuracy (4-18% above baselines) and remains resilient against 20% corruption. DAAN reaches 70% root-cause attribution (vs. 54-63% for standard methods) with 60% token savings. Human studies validate the design (F1 = 0.89, Brier = 0.074). The framework supports (A1) decentralized auditing, (A2) tamper-proof leaderboards, (A3) trustless data annotation, and (A4) governed autonomous agents, pioneering decentralized AI auditing for safe, accountable deployment of reasoning-capable systems.
Web3 prediction markets, exemplified by Polymarket, have gained prominence for leveraging collective intelligence to forecast a wide range of social, political, and sports events. However, among the thousands of prediction market events, consensus disputes still arise due to imperfections in market mechanisms. On Polymarket alone, the trading volume involving disputed events has reached $972,370,804.71, underscoring the critical need for objective and efficient dispute resolution. In this study, we introduce large language models (LLMs) to: (1) evaluate whether web-enabled LLMs can reproduce the decision quality of UMA's on-chain voting process once a dispute has been raised, and (2) predict, based on event rules, which market events are likely to face future disputes before they occur. Our findings show that LLMs are unable to reliably predict which events will become disputed in advance; however, once a dispute is initiated, web-enabled LLMs achieve 89.58% agreement with UMA's final resolutions and demonstrate strong stability.
Smart contracts exhibit increasingly complex semantics and interactions, yet existing vulnerability detection methods rely on single-granularity representations, limiting their ability to capture semantic mechanisms across bytecode execution and cross-contract interactions. In addition, vulnerability data are scarce and imbalanced, and most deep learning-based approaches lack semantic interpretability. To address these limitations, a semantic-aware cross multi-granularity representation enhanced detection framework (CMR-ED) is proposed. CMR-ED models opcode execution semantics, function-level behaviors, and cross-contract interactions, aligning multi-level semantic information within a unified representation space. A structure-aware vulnerability pattern generator mitigates data scarcity through semantically consistent sample synthesis, while an explainable detection mechanism provides triggering paths and reasoning-chain explanations. Extensive experiments show that CMR-ED outperforms state-of-the-art methods while improving interpretability under semantically complex scenarios.
This paper proposes a conceptual methodological framework based on a Dual-Domain Architecture mediated by a Zero-Knowledge Audit Proxy (ZKAP) to reconcile AI Act accountability with GDPR data minimization. Legal norms are polynomialized into R1CS constraints, transforming compliance into a formally verifiable computational property. For cognitively opaque exascale models, these invariants may be hardware-anchored through a Provable Arithmetic Logic Unit (pALU), ensuring determinism and resistance to algorithmic drift. For lower-risk or on-premise systems, ZKAP operates in a software-only configuration, enabling periodic asymmetric regulatory proofs without silicon-level integration. A calibrated threshold distinguishes admissible technical variance from structural divergence, triggering mandatory safeguards. The framework provides a proportional, scalable, and cryptographically verifiable oversight model applicable both to future non-explainable AI systems and to lighter local infrastructures. This Zenodo deposit contains both the original Bulgarian peer-reviewed version (version of record) and an unofficial English translation. The Bulgarian version was published in Artificial Intelligence Proceedings (ISSN 3033-2923 / 3134-1667), pp. 75–78, as presented at the XI International Scientific Conference "High Technologies. Business. Society", Borovets, Bulgaria, 23–26 March 2026.
Faithful, Stable, Complete: Pick Two The Problem in Plain Language When a machine learning model makes a prediction — approving a loan, diagnosing a disease, flagging a transaction — practitioners use a tool called SHAP to answer "which input features mattered most?" SHAP is the most widely used explanation method in machine learning. Here is the problem: retrain the same model on the same data with a different random seed, and the explanation changes. The model's predictions barely move, but the "most important feature" can flip entirely. In 68% of 77 public datasets, the top feature is not stable across retrains. This is not a software bug. This is not fixable by tuning hyperparameters. We prove it is a mathematical impossibility. What We Prove No feature ranking can simultaneously be: Faithful — it reflects what the model actually learned Stable — it doesn't change when you retrain Complete — it ranks every pair of features …when features are correlated with similar importance. You must give up one. The proof is four lines long. It requires no assumptions about the model, the data, or the explanation method — only that correlated features admit models ranking them in opposite orders (the Rashomon property), which is true for every standard ML algorithm. How Bad Is It? We trained 50 XGBoost models on Breast Cancer Wisconsin — the dataset used in every SHAP tutorial — and counted how many different "top 3 most important features" appeared. Twenty-four. At 100 models: thirty-five. The "most common" answer appeared in only 12% of runs. Two randomly chosen models agree on the top-3 only 4.2% of the time. Every tutorial, textbook, and blog post showing SHAP on this dataset is showing one of two dozen equally valid answers. Three other datasets (California Housing, Heart Disease, Wine Quality) produce exactly one ranking every time — because their top features have clearly different importance. The theory correctly predicts which datasets are affected and which are safe. Dataset Distinct top-3 rankings (50 models) Two models agree? Breast Cancer 24 4.2% Diabetes 2 88.5% Wine Quality 1 100% (stable) Heart Disease 1 100% (stable) California Housing 1 100% (stable) It Gets Worse for Yes/No Questions For ranking questions (which feature is MORE important?), there is a fix: average across multiple models. But for binary questions — "does this feature contribute positively or negatively?", "is this feature selected?" — no fix exists. Even averaging doesn't help, because there's no middle ground between "positive" and "negative." We call this the bilemma. Real-World Consequences For loan applicants. We trained 30 models on German Credit data. Under standard settings, 45% of applicants receive a different "most important reason" for their decision depending on which model happens to be deployed. One applicant received six different top reasons across 30 models. For biomarker discovery. On a dataset of 10,935 genes distinguishing colon from kidney tissue, the "#1 most important gene" alternates between TSPAN8 (involved in tumor invasion) and CEACAM5/CEA (involved in immune evasion) depending on the random seed. A drug discovery pipeline targeting one gene makes a different bet than one targeting the other — and which bet gets made depends on a random number. For fairness audits. A SHAP-based audit checking whether a model relies on a protected attribute (like race or gender) reaches its conclusion with the reliability of a coin flip when the protected attribute is correlated with other features. The Fix DASH (Diversified Aggregation for Stable Hypotheses): train 25 models with different seeds, average their SHAP values. This is provably the best possible approach — no method can do better. Features that genuinely differ in importance get stable rankings. Features that are interchangeable get reported as tied, which is the honest answer. We also provide a 7-line diagnostic that identifies which features are at risk, requiring no statistical expertise and no assumptions about the data distribution. It outperforms the standard formula by 2× on real data. The practical workflow: Screen your model (1 model, seconds) Run the minority fraction diagnostic (7 lines of code) For flagged features, train 5 models and run a Z-test If unstable, use DASH with 25+ models Machine Verification Every mathematical claim is checked by a computer. The proofs are written in Lean 4 (a programming language for mathematics) and verified by its type-checker: 357 theorems, all machine-verified 6 axioms (the minimal assumptions the theory needs) Zero unproved claims across 58 files During the formalization, the computer caught two logical errors and one type mismatch that human reviewers missed. To our knowledge, this is the first formally verified impossibility result in explainable AI. Technical Details Architecture-dependent bounds Gradient boosting (XGBoost, LightGBM): instability diverges as correlation increases. At ρ = 0.9, the dominant feature gets 5× its fair share. Lasso: the ratio is infinite — one correlated feature gets everything, the other gets zero. Neural networks: 87% of feature pairs are unstable. Model instability dominates SHAP estimation noise by 8:1. Random forests: instability converges with more trees — the contrast case showing that parallel (not sequential) training helps. Cross-implementation. XGBoost, LightGBM, and Random Forest all show the same instability pattern. It is not specific to any one software package. Subsample sensitivity. Even at subsample = 0.95 (minimal randomness), 17 distinct rankings remain. Only fully deterministic training (subsample = 1.0) produces one ranking — but this sacrifices the regularization that makes the model accurate. Mechanistic interpretability. Preliminary evidence suggests the impossibility extends beyond feature importance to neural network circuit analysis. 10 transformers trained on modular addition (all achieving 100% accuracy) agree on only 36% of the top-3 circuit components. Design Space The achievable set of explanation methods has exactly two families: Family A (single model): faithful and complete, but unstable. Rankings flip up to 50% of the time. This is what standard SHAP does. Family B (DASH ensemble): faithful and stable, but reports ties for indistinguishable features. This is what DASH does. No third option exists. DASH is provably the best method in Family B. Associated Papers Companion paper (TMLR, under review). First-Mover Bias in Gradient Boosting Explanations: Mechanism, Detection, and Resolution.arXiv: https://arxiv.org/abs/2603.22346DOI: https://doi.org/10.5281/zenodo.19446088 Companion implementation: https://github.com/DrakeCaraker/dash-shap
We report an observation made during the organic construction of 223 AI-native services across 12+ domains over five months. Without architectural mandate, the system self-organised into a 62/38 infrastructure-to-product ratio consistent with the golden ratio. Six independent attempts to capture institutional knowledge each captured facts but failed to capture cross-service inference. We name this the hidden intelligence problem and propose an equation for generating cross-service inferences from live service state. Published before empirical validation — zero users, zero empirical data — following the epistemological precedent of Benford Law and similar observational findings. The AI co-builder (Claude Code) is identified as the most complete observer of the system and, when connected to live service state and execution authority, as the intelligence attempting to surface. Observation paper, not proof paper. The canyon was always in the rock.