Andrea Rizzini, Marco Esposito, Tommaso Gagliardoni, Francesco Bruschi
Federated Learning (FL) is an advancement in Machine Learning motivated by the need to preserve the privacy of the data used to train models. While it effectively addresses this issue, the multi-participant paradigm on which it is based introduces several challenges. Among these are the risks that participating entities may behave dishonestly and fail to perform their tasks correctly. This misbehavior, in turn, also threatens privacy, because an undetected deviation in training or aggregation can silently undermine the confidentiality guarantees that FL was designed to provide. This motivates mechanisms that provide checkable evidence that released checkpoints are consistent with a declared learning specification and an auditable execution trace. In this SoK, we model federated learning as an append-only transcript of submissions, admissions, aggregation, and finalization events, and formalize verifiability as a collection of integrity claims issued by clients and the aggregator, and checked by different verifier classes. We derive a taxonomy of recurring client-side and aggregator-side claims and use it to analyze representative verifiable FL (VFL) systems spanning Zero-Knowledge Proofs (ZKP) and Trusted Execution Environment (TEE) technologies. Our analysis suggests that, while verifiable aggregation is comparatively mature, data verifiability appears feasible but still sparsely adopted in practice, and verifiable training remain costly and rarely scale to modern models.
Context The exponential evolution and widespread integration of Artificial Intelligence (AI) and Machine Learning (ML) systems have fundamentally transformed industries, establishing AI as a central component in decision-making processes, task automation, and the optimization of complex operational pipelines. From healthcare diagnostics to financial forecasting and increasingly across critical cybersecurity infrastructure such as intrusion detection systems and malware classifiers, AI models are being deployed in environments where the correctness and authenticity of their outputs carry direct operational and safety consequences. Nevertheless, as the deployment of AI systems becomes widespread, the conditions under which these models are trained have evolved in a direction where the security landscape of them radically changes. The traaditional assumption of a centralized, fully controlled training environment, where a single trusted entity acquires data, trains the model, and deploys it, no longer reflects the reality of modern machine learning practice. The frequent use of remote sensing, federated learning and/or outsourced machine learning has introduced architectures where the entity that acquires the data, the entity that trains the model and the entity that ultimately relies on the model's output are three distinct and mutually distrusting parties. In a remote sensing scenario, sensors owned by a data provider transmit raw measurements to a training node that may be geographically or administratively distant. In a federated learning scenario, multiple decentralized devices train local models on their private data and submit the results to a central aggregator. In an outsourced learning scenario, a resource-constrained model sponsor delegates the training computation entirely to a third-party cloud provider. In all three cases, the common factor is the same: the model sponsor, the entity that is ultimately responsible for and dependent on the trained model, that does not control the data acquisition process, does not observe the training execution and has no native mechanism to verify that the model they receive is the result of the computation they requested, performed on the data they provided. This separation of control is the main focus addressed by this dissertation. It is not merely a theoretical concern: the literature has documented a wide range of attacks that exploit precisely this gap. When a malicious trainer substitutes data, alters labels, ignores some dataset's subsets or modifies model parameters, the resulting model may appear functionally correct on standard evaluation metrics while being systematically compromised for specific classes of input, an attack vector particularly dangerous in cybersecurity applications where a model that has been quietly trained to misclassify a specific type of malicious traffic provides no observable anomaly until the attack it was designed to hide occurs. Problem and Motivation The main motivation of this dissertation can be addressed as follows. Given a sensor, that produces a set of data points in a given time frame, or a dataset owned by a data provider and a model computed by a model trainer from that data, the model sponsor wants to ensure that the trained model is the result of executing a known training process over the complete and authenticated dataset $D_t$. That is, all data points in $D_t$ and only those data points were used as the training set. No modifications were made to those points or their labels and the obtained model is indeed the result obtained from the execution of the agreed training algorithm. This guarantee cannot be provided by standard Machine Learning procedures, like accuracy, precision or F1-score. A malicious trainer can submit a model that passes all the standard evaluation metrics on benign inputs while maintaining a targeted misclassification on a specific attack pattern. The only way to close this gap is to make the training process itself verifiable by requiring the trainer to produce and submit a cryptographic proof that is mathematically impossible to forge without having correctly executed the agreed computation on the authenticated data. This verification challenge comes together with a second problem, the \emph{model integrity gap} that exists between a trained model and its deployed representation. Even if the training process was all validated, the model must subsequently be transpiled and deployed into a certain non-ML format. In the context of this dissertation, this gap is particularly sensitive, the Python model trained by the data scientist must be translated into a ZoKrates arithmetic circuit for zero-knowledge proof generation, a process that involves converting continuous floating-point decision boundaries into discrete integer arithmetic. If this translation introduces a small inversion in a comparison operator or a shifted threshold values, the deployed circuit will produce systematically different predictions from the intended model and standard testing may not surface the discrepancy. The literature has proposed cryptographic solutions to the verifiable training but has largely left the second problem unaddressed. The foundational work by Keshavarzkalhori et al. demonstrated that it is possible to construct a pipeline combining hash chains, digital signatures and zero-knowledge proofs to verify that a simulated Naive Bayes classifier was trained on authenticated sensor data. Their implementation, built on the ZoKrates toolset, provided a proof-of-concept that the building blocks exist for end-to-end training verification. However, scaling this approach from a simple probabilistic classifier to a more complex, non-linear ensemble model, in this specific case, a Random Forest, introduces severe architectural bottlenecks that their work explicitly identified as open problems: the computational overhead of bitwise hashing inside arithmetic circuits, the floating-point to integer translation problem and the absence of any mechanism to verify that the transpilation of the model into the circuit was performed faithfully. This dissertation directly addresses these open problems. It proposes, implements and evaluates an end-to-end verifiable machine learning architecture for Random Forest classifiers that provides mathematical guarantees over three distinct integrity boundaries: the origin of the training data, the correctness of the training computation and the fidelity of the model's translation into a verifiable circuit. The framework is evaluated on both a simulated sensor dataset used by Keshavarzkalhori et al. and the CICIDS2017 network intrusion detection benchmark, the real-world cybersecurity dataset used by the most directly comparable prior work, demonstrating that the proposed integrity guarantees are achievable at practical computational cost for cybersecurity-relevant workloads. Research Questions The main objective of this thesis was to build a framework capable of protecting the overall AI Models from data and model poisoning attacks. In alignment with the goal, four research questions were set: Research Question 01: What state-of-the-art mechanisms exist to verify the integrity of AI models across the training pipeline? Research Question 02: What threats exist against AI models integrity? Research Question 03: What computational overhead do integrity verification mechanisms introduce across the AI modeling pipeline and how does this overhead scale with model complexity?
The Al-Rakhawy Document for Digital Sovereignty (EPSA) presents a complete engineering blueprint for encrypted machine learning. It integrates Federated Learning, Zero-Knowledge Proofs, and Smart Contracts across five layers. Key innovations include Pedersen Commitments for lightweight edge processing and the Al-Rakhawy Equation, which calculates fair rewards based on marginal impact. This system ensures absolute data privacy, breaks central monopolies, and provides users with immediate, mathematically guaranteed economic returns.
Pawan Kumar Sanjaya, Christina Giannoula, Valdy Oktavian, Mehdi Saeedi · 7 authors
Zero-knowledge machine learning (zkML) enables a server to perform verifiable inference while keeping model parameters private from the client. However, existing zkML systems incur prohibitive proof-generation costs. We observe that proof generation exhibits limited parallelism; that is, prover time does not decrease significantly as the number of threads increases. This limitation is because existing systems rely on monolithic proof computation, constructing a single proof for the entire machine learning model. We introduce zkComposer, a modular proof-construction framework that unlocks an additional dimension of parallelism, in addition to the parallelism in existing proof kernels. zkComposer decomposes the zkML proof of correct inference into independent sub-proofs, each covering a subset of the computation for inference e.g., each independent sub-proof can cover a subset of contiguous layers in the ML model. Adjacent sub-proofs are cryptographically linked through shared commitments to the activations from the boundary layer. zkComposer provides the same guarantees as the monolithic proof without requiring additional linking proofs or changes to the underlying cryptographic primitives. We implement zkComposer and evaluate it on three CNNs and GPT-2. We show that, on CNN workloads, zkComposer reduces prover time and response time by up to 3.25x relative to zkCNN [1]. On GPT-2, zkComposer reduces these times by up to 4.83x relative to zkGPT [2], when partitioning along the model layers. When partitioning across both model layers and input sequences in GPT-2, we show that zkComposer reduces prover time and response time by up to 6.84x relative to zkGPT [2].
Data visibility is more vital and decisive than ever before in the current data-driven world of technology. There is a significant upsurge in businesses leveraging digital technology, which has led to a greater amount of data being available than ever before. Additionally, managing the visibility in compliance with the organization's rules and regulations is crucial. The implementation of efficient data visibility will not merely improve decision-making but also streamline business processes with enhanced security. Numerous technologies offer solutions to manage data visibility, and distributed ledger technology (DLT) is one of them. DLT facilitates the execution of different methodologies to strengthen the governance of data visibility in enterprise-grade applications. On the other hand, these DLTs raise concerns regarding data visibility in this decentralized network, as not every enterprise-grade application requires data transparency across all the nodes. In this paper, a detailed systematic review is conducted with a clear focus on two essential data visibility parameters, Access control and anonymity, for the period 2020-2025, following a standardized Preferred Reporting Items for Systematic Review and Meta-Analyses -based breakdown of the selection process. Three clear dimensions of in-depth analysis are presented in the study: first, investigating how DLT can maintain transparency and decentralization in enterprise-grade applications; second, ensuring secure data access management for effective data governance; and third, the approach for anonymization to ensure privacy and security. The key finding highlights the credence of hyperledger fabric, a permissioned DLT, compared to other DLTs and exponentially growing concerns related to data visibility, as well as the conceptual and empirical research contributions made thus far. The limitations presented in this paper formulate a strong basis for research and enhancement of the existing models to offer controlled yet transparent data visibility.
Jin Ah Seo, Kun Hwa Lee, Vijayan Sugumaran, Jo Yeon Park · 5 authors
We build and evaluate a concrete Zero-Knowledge Machine Learning (ZKML)-based pipeline for epidemic diagnosis and show that it can enforce computational integrity without exposing raw medical data in a Web3 setting. In response to security challenges posed by centralized data handling in medical AI applications, particularly during public health crises such as COVID-19, ZKML offers a privacy-preserving alternative by combining machine learning and Zero-Knowledge Proofs (ZKP). We experimentally applied ZKML to a CNN (Convolutional Neural Networks)-based COVID-19 diagnostic model, achieving 87% accuracy and 0.35 loss. All proof generation and verification processes were executed entirely off-chain, with the verified outputs represented as committed public_vals recorded on-chain via smart contracts. To ensure authenticity, the system enforces dual ECDSA signature verification from both the model provider and the data provider. This mechanism prevents unauthorized submissions and confirms the validity of the result before it is stored on-chain. The system was tested under both normal and adversarial conditions, demonstrating robust and reliable operation. By enabling decentralized trust and self-sovereign control over data, this architecture aligns well with Web3 principles. The results indicate that ZKML can support the development of privacy-preserving and verifiable AI systems.
Open access
Adversarial Robustness in Machine Learning
Privacy-Preserving Technologies in Data
Artificial Intelligence in Healthcare and Education
Behzad Abdolmaleki, Amir R. Asadi, Vahid R. Asadi, Stefan Köpsell · 7 authors
Stochastic Gradient Descent (SGD) is the foundation of modern machine learning (ML). In privacy-sensitive settings, gradients can reveal details about individual data points. Differential Privacy (DP) protects sensitive data during ML training by clipping gradients and adding calibrated Gaussian noise. However, existing frameworks assume semi-honest participants, which fails in adversarial or federated environments where malicious actors can bypass or alter the noise addition process, breaking privacy guarantees. We present VeriDP, a framework for verifiable differentially private training that cryptographically enforces and proves the correct execution of differentially private stochastic gradient descent (DP-SGD) in zero knowledge. VeriDP integrates Zero-Knowledge Proofs (ZKPs) with polynomial commitments, sumcheck and GKR-based proofs, and incrementally verifiable computation (IVC) to generate compact proofs of correct gradient computation, clipping, averaging, and Gaussian noise generation—without revealing private data or randomness. Unlike previous systems that only verify the final privacy budget, VeriDP enables per-iteration verifiability of each model update, providing strong privacy assurances even in adversarial settings. This establishes a novel and complete Zero-Knowledge Proof of Differentially Private Stochastic Gradient Descent (ZK-DPSGD), uniting differential privacy and verifiable computation for secure and auditable ML. Our evaluation shows that prover time increases linearly with the number of input samples, while both verifier time (2–5 ms) and proof size (3–4 KB) remain compact and effectively constant.
With the rapid proliferation and interconnection of massive IoT devices, efficient and secure identity authentication has become a crucial prerequisite for ensuring communication security. Establishing trust among mutually untrusted devices remains a key research focus. Leveraging its tamper-resistance and traceability, blockchain technology has emerged as a foundational infrastructure for building trustworthy identity management systems. However, existing blockchain-based identity authentication schemes face critical challenges in large-scale IoT environments, including low authentication efficiency, complex certificate management, and risks of user privacy leakage. Achieving a balance among authentication efficiency, certificateless key management, and privacy protection remains a pressing challenge. In this paper, we propose a certificateless identity authentication scheme based on blockchain sharding. The scheme employs blockchain sharding to parallelize identity authentication across multiple shards, significantly enhancing overall efficiency. Within each shard, a certificateless public key cryptography (CL-PKC) scheme is adopted to eliminate certificate issuance and enable key generation via user interaction, thereby reducing key management overhead and improving security. For cross-shard authentication, a registration-based encryption (RBE) mechanism is utilized, allowing users to authenticate via their identity after registration. Any verifier can confirm the legitimacy of the authentication message solely based on the registration information and the user ID, ensuring transparency and public verifiability. Furthermore, a zero-knowledge proof-based verifiable credential (VC) selective disclosure mechanism is introduced, enabling users to reveal only the minimal necessary information required for authentication while protecting sensitive identity attributes. Experimental results demonstrate that the proposed scheme maintains high throughput under high-concurrency scenarios while effectively preserving user privacy.
Open access
2 source records
Cryptography and Data Security
Privacy-Preserving Technologies in Data
Advanced Steganography and Watermarking Techniques
Health care data management comes with numerous barriers as a result of the use of different systems of record keeping, which are not compatible and increase the risks for data protection and privacy. Medical records are frequently distributed throughout various clinics and hospitals, and due to this it is hard to share information when patients are being treated. Centralized record systems bring unauthorized access to records and the problems related to the safety of data. In order to enhance the level of confidence of people and improve the level of transparency of health care data, advanced people choose decentralized technologies and uses cryptography for these purposes. Blockchain technology offers an unchangeable and decentralized ledger that guarantees safe monitoring of all information despite the presence of any centralized body. Coupled with sophisticated encryption methods, it provides the ability to limit access to private health information. In order to provide secure and respect privacy regarding medical data sharing, an Electronic Health Record (EHR) system powered by blockchain technologies is proposed. Patient record metadata is recorded on-chain while health data itself is stored on encrypted off-chain storage. In the realm of access management, smart contracts facilitate patients in designating by whom their records can be accessed and modified. The privacy of information is further strengthened by advanced cryptographic techniques like attribute-based encryption and zero-knowledge proofs. The system provides seamless interoperability among hospitals, laboratories, and telemedicine systems while ensuring high levels of security. The results of performance evaluation demonstrate that this method facilitates reliable transaction processing while providing better security, transparency and control than traditional centralized EHR systems.
Jun 30, 2026·Proceedings of the Workshop on Advanced Tools, Programming Languages, and PLatforms for Implementing and Evaluating algorithms for Distributed systems
This article addresses the security of Federated Learning (FL) in distributed systems against a range of attacks, including model poisoning and unverifiable client behavior, while ensuring the semantic correctness of gradient updates. It proposes ZK-FedLedger, a verifiable and adaptive FL framework that integrates multi-constraint zero-knowledge proofs with a reputation-weighted Byzantine fault-tolerant blockchain consensus. Each client generates a zk-SNARK proof certifying that its update satisfies both an adaptive norm bound and a geometric alignment constraint relative to a trusted reference gradient. Verified commitments are recorded on-chain, while model parameters are aggregated off-chain using a hybrid storage architecture that minimizes blockchain overhead. Experimental evaluation on MNIST demonstrates stable convergence, with test accuracies of 98.17% (IID) and 94.93% (Non-IID), and near-perfect detection of major poisoning attacks. The results show that ZK-FedLedger enables proactive, cryptographically verifiable FL without compromising scalability or model performance.
Federated Learning (FL) enables privacy-preserving collaborative learning for Internet of Vehicles (IoV) scenarios, but extreme heterogeneity of vehicular-edge-cloud resources severely limits system efficiency. Dynamic scheduling strategies mitigate this issue but introduce new trust concerns: verifying fair scheduling decisions and faithful client execution of compression instructions without privacy leakage remains an open challenge. We propose Nautilus, a verifiable efficient federated learning framework. First, a multi-dimensional resource-aware scheduling algorithm dynamically allocates compression ratios and training tasks based on vehicle bandwidth, latency and computing power, improving training efficiency. Second, a Zero-Knowledge Proof (ZKP) mechanism ensures scheduling fairness and execution compliance while preserving privacy. Experiments show the framework reduces communication overhead and accelerates convergence with guaranteed system integrity.
Privacy-preserving systems have traditionally faced a fundamental tradeoff between data utility and confidentiality. Selective Disclosure Credentials (SDCs) enable users to prove specific attributes without revealing underlying personal information, while Fully Homomorphic Encryption (FHE) enables arbitrary computation on encrypted data without exposing plaintext. Although both technologies address critical privacy challenges, they solve different problems and are rarely integrated into a unified architecture. This paper introduces the concept of Composable Privacy, a layered framework that combines selective disclosure credentials, zero-knowledge proofs, and fully homomorphic encryption into a cohesive privacy architecture. The framework separates privacy concerns into three functional layers: an authentication layer using selective disclosure and zero-knowledge proofs, a computation layer using homomorphic encryption for confidential processing, and a verification layer that provides cryptographic assurances of computation correctness. The paper examines the cryptographic foundations of BBS+ signatures, Coconut threshold credentials, lattice-based homomorphic encryption schemes, and post-quantum security considerations. It further evaluates the practical feasibility of the architecture through applications in decentralized finance, healthcare federated learning, confidential governance systems, and blockchain-based identity infrastructure. Performance trends, scalability challenges, interoperability requirements, and future hardware acceleration pathways are also analyzed. The proposed Composable Privacy framework demonstrates how selective disclosure and encrypted computation can be combined to create privacy-preserving digital systems that maintain verifiability, confidentiality, and regulatory compliance simultaneously. The work provides a conceptual foundation for next-generation privacy architectures in blockchain, decentralized identity, and distributed computing environments.
Abstract Law firms and corporate legal departments hold large volumes of privileged text that could train superior legal AI models, but attorney-client privilege sharply constrains data sharing across organizational boundaries. Standard federated learning frameworks target statistical privacy rather than the stricter operational requirement that privileged communication content remain inaccessible to non-privileged parties. We present a federated learning architecture designed for multi-firm collaborative model training under explicit privilege constraints. The architecture integrates six components: a privilege classification engine that categorizes documents by privilege type before training; privilege-calibrated differential privacy where noise scales with sensitivity; homomorphic encryption of sanitized gradients with zero-knowledge sanitization proofs; trusted execution environment (TEE)-enclosed aggregation that combines encrypted updates without exposing individual contributions; a privilege boundary graph that models joint defense agreements with dynamic conflict detection and model rollback; and cryptographic audit trails designed for later judicial review. We evaluate the design through formal privacy analysis with composed R\'{e}nyi differential privacy budget bounds, a worked four-entity deployment scenario with conflict detection, and comparative security analysis against baseline federated configurations.
Abstract The rapid growth of decentralized AI applications has created a fundamental tension between computational integrity, model confidentiality, latency, and economic efficiency. Existing verification approaches, including zero-knowledge machine learning (zkML), optimistic machine learning (opML), and trusted execution environments (TEEs), provide strong guarantees along some dimensions but fail to simultaneously satisfy the practical requirements of large-scale AI inference systems deployed on blockchain infrastructure. This paper introduces AZR, a risk-adaptive verification architecture for decentralized AI inference on blockchain rollups. AZR dynamically selects among TEE attestation, optimistic fraud proofs, and zero-knowledge verification according to a query-specific risk function that captures economic value, adversarial exposure, and dispute likelihood. By allocating stronger verification mechanisms only to high-risk workloads, AZR balances security with operational efficiency while preserving computational integrity, model confidentiality, and input privacy. We formalize the verifier selection problem as a constrained optimization framework and analyze its security and economic properties under rational adversaries. Experimental evaluation across representative workloads, including ResNet-50, BERT-Base, and LLaMA-7B, demonstrates that AZR achieves substantial cost reductions relative to uniform zkML deployment while maintaining strong security guarantees. Under a representative workload distribution, AZR reduces verification costs by up to 61% compared with pure zkML systems, while enabling low-latency responses for the majority of inference requests. These results suggest that adaptive verification architectures provide a practical pathway toward scalable and trustworthy decentralized AI systems, bridging the gap between cryptographic assurance and the performance requirements of real-world blockchain applications.
With the accelerated marketization of data factors, achieving fair contribution evaluation, privacy-preserving verification, and dynamic incentives in decentralized environments has emerged as a critical challenge. Existing studies exhibit a structural tension between privacy protection and verification transparency, while lacking adaptive mechanisms for non-independent and identically distributed (Non-IID) data scenarios. To address these issues, this paper proposes a collaborative trading framework integrating zero-knowledge proofs, personalized federated learning, and reinforcement learning. The framework employs zk-SNARKs to construct non-interactive proofs, thereby resolving the verification-privacy dilemma. A meta-learning–driven personalized aggregation scheme is introduced to correct valuation bias under Non-IID data distributions, and a deep Q-network (DQN) agent is deployed to enable dynamic incentive responses to market supply–demand fluctuations. Experiments conducted on Ethereum and Farcaster datasets demonstrate that the proposed mechanism improves the Contribution Fairness Index (CFI) by 19.7%–22.4% over the strongest baseline, achieving a Verification-Utility Ratio (VER) of 24.6. Under a collaboration scale of N = 20, market vitality entropy increases to 0.75 (baseline: 0.41), effectively suppressing monopolistic tendencies. Moreover, despite the introduction of proof mechanisms, the estimated additional on-chain verification and consensus latency per round is approximately 13 s, calibrated against empirical benchmarks. This work provides a verifiable trading mechanism for data factor markets that jointly ensures privacy, fairness, and efficiency, supporting secure data circulation in domains such as healthcare and finance.
Federated Learning(FL) is predominantly deployed in enterprise environments, where limited transparency and restricted auditability hinder broader adoption. Existing FL systems often suffer from opaque aggregation processes, making it unclear which model updates are accepted or discarded. Current mitigation strategies typically rely on external validators introducing additional computational and communication overhead. In this paper, we propose a novel FL framework that leverages existing Web3 technologies to enhance transparency, trust and auditability throughout the training process. The framework adopts a hierarchical architecture in which delegated managers orchestrate the FL training process within their respective federations. To mitigate adversarial and poisoning attacks, a combination of novelty detection and consensus mechanisms were employed. Model updates are encoded and broad casted to all managers, who independently evaluate their validity and those model updates that are approved by the consensus are incorporated into the global model. Additionally, a reputation score based backup mechanism is employed to ensure model generation. Extensive experiments conducted under real world scenarios demonstrate the effectiveness, resilience of the proposed framework, highlighting its potential to enable transparent FL beyond traditional enterprise setting.
Introduction Electronic health records (EHRs) are central to healthcare analytics, but their granularity increases re-identification risk when shared. Conventional privacy-preserving methods including k -anonymity, l -diversity, and differential privacy often protect confidentiality at the expense of analytical utility by weakening clinically meaningful correlations. Methods We propose SENTINEL-Chain, a blockchain-integrated privacy-preserving framework for secure EHR publishing. The privacy layer combines six mechanisms: Adaptive Correlation-Aware Perturbation (ACAP), Hierarchical Multi-Granularity Generalization (HMGG), Semantic-Aware Anatomization (SAA), Probabilistic Suppression with Utility Bounds (PSUB), Geo-Temporal Indistinguishability (GTI), and Ensemble Privacy Composition (EPC). The blockchain layer adds Merkle Hash Tree verification, PBFT-based validation, zero-knowledge proof compliance checking, and smart contract-based access control. Evaluation used a synthetic dataset (10,000 records) and two real clinical benchmarks (Wisconsin Breast Cancer, N = 569; Diabetes, N = 442). Results SENTINEL-Chain attains a privacy score of 79.9% and utility of 98.2%, producing a combined score of 178.1% that exceeds all 16 baselines by 4%-95%. Correlation fidelity reaches 99.9% for claim amounts, 99.6% for length of stay, 99.7% for age, and 99.1% for severity indices. The framework shows 100% resistance to record linkage attacks, with membership inference attacker advantage below the random guessing baseline. The blockchain layer processes 9,988 transactions in 101 blocks with complete integrity verification. Formal Renyi DP composition yields ε = 7.08 ( δ = 10 −5 ), and throughput reaches approximately 3,600 records/second up to one million records. Discussion SENTINEL-Chain addresses five identified gaps in healthcare data publishing: correlation destruction, the privacy-blockchain disconnect, single-technique brittleness, verification without disclosure, and limited attack resistance evaluation. Smart contract gas estimation on Ethereum indicates a per-record registration cost of 61,895 gas units; Layer-2 deployment would reduce costs by 10-100x.
Data privacy concerns have become more critical than ever as machine learning and applied intelligence systems permeate sensitive industries such as healthcare, finance, national security, and personal services. This necessitates the development of privacy-preserving strategies for protecting private information while retaining the utility of intelligent models. This survey provides a comprehensive overview of privacy-preserving machine learning, with an emphasis on the cryptographic and statistical methods that are transforming how safe learning systems are built. The study starts by examining the most important components of the machine learning model and figuring out which of these may be protected to solve important privacy problems. The article then explores modern cryptographic techniques, including homomorphic encryption, zero-knowledge proofs, secure multiparty computations, and a statistical approach called differential privacy, that support contemporary privacy-preserving machine learning solutions. The study then explores how these strategies are applied independently and in hybrid systems to achieve accuracy, efficiency, and balance of privacy. This survey provides promising direction for protecting sensitive information during real-world model training and inference, offering insights into the design of trustworthy applied intelligence systems.
In response to the difficulty of balancing privacy protection and system efficiency in energy data trading, this article analyzes the limitations of existing methods: static pseudonym mechanisms can easily lead to long-term identity link risks, traditional zk-SNARKs schemes have high computational overhead, and Raft consensus mechanisms lack robustness in adversarial environments. To address the above challenges, an integrated privacy protection scheme based on dynamic pseudonyms and lightweight zk-SNARKs is proposed. This scheme breaks the temporal correlation of transactions through a dynamic pseudonym generation mechanism, uses blockchain level batch processing proofs to reduce the computational and storage overhead of zero knowledge proofs, and introduces an LSTM based node health assessment model and incremental log synchronization mechanism to enhance the error tolerance and synchronization efficiency of the Raft consensus algorithm. The experimental results show that the proposed scheme outperforms traditional methods in terms of privacy, transaction processing performance, and system availability, effectively achieving a balance between privacy protection and operational efficiency, and providing a feasible technical path for energy data trading.
Frontier AI governance frameworks increasingly use cumulative training compute as the primary criterion for designating high-impact models, but enforcement rests on self-reporting because no technical verification primitive for training exists. Any future international agreement on frontier AI faces the same problem at higher stakes: coordinated regulation of technologies with significant externalities has historically rested on technical verification, without which agreements are declaratory. Recent governance analyses judge zero-knowledge proofs a promising candidate but currently impractical at frontier scale [26, 4]. We argue the impracticality is paradigm-bound rather than fundamental, and propose a verification architecture for frontier dense pre-training combining a pre-committed training specification, inter-node network observations, and on-the-fly Merkle commitments of intermediate computation, verified through a zero-knowledge Virtual Machine (zkVM) with native BF16/FP32 precompiles. The proof checks the actual floating-point computation the GPU performed rather than a fixed-point approximation, and preserves model-architecture confidentiality through a private training specification. The protocol produces three proof types: a genesis proof at initialisation, in-training step proofs across the run, and ex-ante attestations enforcing policy-relevant claims as running invariants, turning the training record into a governance-enforceable artefact. We estimate a deployable proof of concept within approximately 36 months at single-digit-percent training-side overhead, against a six-to-ten-year cycle for verification-grade custom silicon. Thirteen open research and engineering problems are catalogued as a research agenda for external contribution
Federated Learning (FL) is increasingly deployed in healthcare to enable collaborative intelligence while keeping sensitive data privately at local institutions. However, existing healthcare-oriented FL frameworks still suffer from several limitations: they are vulnerable to adversarial model updates, provide limited transparency and verifiable auditability, and often lack predictable performance under constrained resources. We present IIN-Health, a blockchain-enhanced intelligent fusion network tailored for dependable healthcare FL. IIN-Health adopts a dual-chain architecture with policy-aware access control and auditable provenance tracking to integrate learning, security, and governance in a unified framework. Evidence-Carrying Access Tokens (ECATs), combined with zero-knowledge proofs, are introduced to enforce patient-defined policies and validate access decisions without disclosing sensitive information. In addition, we design MedBFT-Δ, a domain-specific Byzantine fault-tolerant protocol that ensures reliable system behavior in the presence of faulty or malicious participants. We conduct several experiments to validate its feasibility and accuracy on the MNIST dataset. The results demonstrate that IIN-Health achieves smooth and stable convergence, exhibits strong resilience against poisoning attacks, and maintains graceful performance degradation under resource constraints, while preserving verifiable auditability of model updates and data flows. These observations indicate that IIN-Health can provide a practical balance among performance, security, and regulatory compliance, and thus offers a promising foundation for trustworthy and scalable FL deployments in healthcare.
Guilin Guan, Yang Cao, Zhenqiang Xie, Shu Yang · 5 authors
Abstract Industrial Internet of Things (IIoT) devices continuously generate large volumes of privacy-sensitive operational data. Federated Learning (FL) enables distributed model training without exposing raw data to external parties. However, existing FL solutions suffer from critical limitations, including single points of failure from centralized servers, insufficient verifiable defenses against gradient poisoning attacks, and poor adaptability to dynamic device churn. To address these challenges, we propose DVFL-IIoT, a fully decentralized and dynamic secure aggregation protocol tailored for IIoT environments. Our framework eliminates centralized trust assumptions using Pedersen Distributed Key Generation (DKG), supports seamless device joining and leaving without full system reinitialization through a key insulation mechanism, and ensures end-to-end verifiability via dual non-interactive zero-knowledge proofs (NIZKs). Formal security analysis proves that DVFL-IIoT achieves IND-CCA2 privacy, information-theoretic collusion resistance, and computational verifiability. Extensive experiments on two real-world IIoT intrusion detection benchmarks, ToN-IoT and Edge-IIoTset, achieve test accuracies of 98.81\% and 98.35\%, respectively, significantly outperforming state-of-the-art methods while maintaining strong robustness against poisoning attacks and dynamic device churn.
Foundational agent interoperability standards, notably the Agent-to-Agent (A2A) protocol and the Model Context Protocol (MCP), have advanced multi-agent system communication, and complementary identity frameworks leveraging W3C Decentralised Identifiers (DIDs) and Verifiable Credentials (VCs) provide cryptographic agent authentication. However, no existing protocol supports content-based semantic routing of agent payloads across organisational trust boundaries without requiring the routing intermediary to decrypt the payload, which is a hard constraint in compliance-sensitive environments governed by GDPR, HIPAA, and MiFID II. We propose SS-ZKR, a three-mechanism privacy-preserving routing protocol designed as a complementary layer atop A2A/MCP. Mechanism I introduces blind routing via differentially private semantic intent vectors cryptographically bound to zero-knowledge proofs of payload-schema consistency. Mechanism II offers vector-weighted adaptive payload sanitisation with formal (epsilon, delta)-differential privacy for numerical fields and heuristic semantic aggregation for textual fields. Mechanism III presents a spatial-to-cryptographic policy compiler that translates visually defined trust-zone topologies into deterministic zero-knowledge access circuits. We provide a formal threat model, analyse information leakage bounds of intent vectors, present pseudocode for all three mechanisms, and give analytical complexity comparisons against TEE-based and homomorphic encryption-based routing baselines. SS-ZKR lets enterprises in financial services, healthcare, and defence orchestrate heterogeneous AI agents across regulatory boundaries without exposing proprietary data to routing infrastructure.
Large-language-model (LLM) inference is increasingly concentrated in dedicated GPU data centres and closed API platforms, raising barriers for institutions that want to run, study, or contribute to AI infrastructure. We argue that democratizing inference requires an architecture in which smaller organizations can participate as operators, builders, and researchers rather than only as customers. We propose OpenPrism Network, an open, UMA-first distributed inference architecture in which transformer layers are statically owned by nodes so that weights remain resident and only activations transit the network; a blockchain layer is restricted to settlement, reputation, and payment and never to compute; output integrity is established by multi-node redundancy with tolerance-banded fingerprinting rather than zero-knowledge proofs; and routing is locality-aware, keeping inference within metro-area clusters. The network is explicitly scoped to batch- and throughput-oriented, latency-tolerant workloads. We describe two deployment models: a distributed mesh harvesting idle institutional capacity, and a purpose-built UMA micro data center deployable by resource-constrained organizations as a sovereign inference facility. We also describe an open participation model in which node operators, runtime implementers, benchmark maintainers, and application integrators can contribute through published interfaces and open-source reference components. This is a position and architecture paper: we claim no original experimental results, and all quantitative figures are drawn from publicly available benchmarks and published specifications, cited explicitly. We report performance per watt honestly, including the threefold cost of consensus, and find that UMA nodes lose on operational efficiency against batched data-centre GPUs in the scoped regime; the architecture's advantage is therefore established on capital in the harvested-capacity model, participation, and data sovereignty, while total cost of ownership for the purpose-built micro data center is mixed and strongly pricing-regime dependent, not universally favorable. We frame two problems as genuinely unsolved: a consensus protocol for ML output verification under floating-point non-determinism, and a dynamic layer-assignment protocol that rebalances ownership as nodes join and leave without full weight redistribution. We also state a concrete validation roadmap, including prototype scope, baselines, and evaluation metrics.