Blockchain Papers

Gustav Olaf Yunus Laitinen-Fredriksson Lundström-Imanov, N I Abdullayeva

Generative artificial intelligence now synthesizes photorealistic imagery, audio, and video at a cost that defeats traditional forensic intuition. The legal consequences span three regimes studied so far in isolation: international operational law, domestic procedure, and product regulation. This article presents a unified evidentiary framework that maps cryptographic content provenance, robust statistical watermarking, and zero knowledge attestation to the proof requirements of each regime. We define a five tier threat model spanning naive regeneration, adversarial laundering, cross model regeneration, active watermark removal, and insider provenance forgery. We release a public benchmark of 12000 generated items across image, audio, and video modalities under six laundering pipelines for 72000 evaluation samples. We evaluate four representative schemes and report true positive rate at fixed false positive rate, robustness area under the curve, computational overhead, and a regime conditioned legal sufficiency score. We translate empirical detection bounds into legal sufficiency thresholds for command decisions under the law of armed conflict, for criminal and civil admissibility under domestic procedure, and for persistence audits under the European Union Artificial Intelligence Act and analogous regimes. The result is a reproducible reference pipeline, a public benchmark, and model annexes that lawyers, engineers, and operators can deploy together.

Frank Morales

Executive Summary This paper introduces a deterministic mathematical framework for nested learning designed to eliminate catastrophic forgetting in continuous learning systems. Standing as the first Proof of Concept (POC) of its type ever made, it completely flips the traditional AI safety paradigm. Instead of letting all data into a model and relying on post-hoc, probabilistic safeguards or heuristic mitigations to fix corruption after it occurs, this architecture implements an immutable mathematical gatekeeper called the H2E Sheriff. By filtering incoming data at the doorstep, it ensures that incoherent or corrupting inputs are rejected before they can ever modify or overwrite stored knowledge, ensuring absolute preservation of prior learning by architectural design. Theoretical Foundation & Key Components The framework anchors AI learning governance to absolute mathematical ground truths rather than learned data distributions or human preferences. Arithmetic Spectral Theory (AST): Synthesizes four classical transforms—Laplace, Euler, Fourier, and Mellin—into a single spectral operator, the L-EFM operator. At the critical line ($\sigma = 0.5$), the normalized magnitude of this operator evaluates to exactly 1 over prime sets, creating a universal coherence invariant. Empirical testing across diverse finite prime-related sets demonstrates that the system achieves a steady-state spectral coherence of exactly 0.5 at this critical line. Safety Thresholds ($\Lambda$): Computed directly from the Euler attenuation product over the first $n$ primes rather than being trained on data. The framework identifies $\Lambda_{12} = 0.9944590549$ as the primary perimeter gate boundary. The H2E Sheriff Manifold: Maps real-valued input embeddings onto the product manifold $\mathbb{H}^2 \times SPD(3)$. Incoming data is geometrically evaluated against a prime-anchored reference center ($x^*$) constructed from normalized prime coordinates. Spectral Risk Overlap Index (SROI): A metric determining an embedding's proximity to the coherent reference center on the manifold. Inputs are processed via a strict decision rule: accepted into the knowledge base if $SROI > \Lambda$, and conservatively rejected if $SROI \le \Lambda$. Experimental Validation The framework was validated using 10-dimensional vectors with controlled noise levels under a deterministic seed and 50-decimal-place precision. Threshold Discrimination: Calibration experiments confirmed that the $\Lambda_{12}$ threshold cleanly separates stable, coherent embeddings (noise $< 1.0$) from erratic, incoherent ones (noise $\ge 2.0$). Knowledge Base Integrity: During nested learning protocols featuring mixed streams of inputs, the H2E Sheriff successfully blocked corrupting data. In a stream of 30 inputs, all 12 incoherent attempts were rejected at the gate. The final knowledge base retained an average SROI of 0.996076, demonstrating zero degradation of stored knowledge and complete preservation of prior learning. Current Limitations & Future Work As the first exploratory POC mapping absolute prime structures to continuous AI safety boundaries, the paper transparently identifies clear vectors for future scaling and development: Dimensionality & Scaling: The initial validation operates on 10-dimensional embeddings and compact knowledge bases. Because the geodesic distance and matrix logarithm calculations on $SPD(3)$ scale cubically ($O(n^3)$), evaluation on large-scale, high-dimensional neural network workloads remains untested. Hyperparameter Selection: The choices for the scaling factor ($\tau = 50$) and the optimal prime set size ($n = 12$) are empirically driven for this distribution and lack a generalized analytical method for automatic selection in new problem domains. Modality Generalization: The threshold was calibrated on Gaussian noise and has not yet been exposed to complex embedding distributions like large language model tokens or image feature vectors. Neural Network Integration: The current implementation acts as a post-hoc filter on static vectors. Integrating this rigid mathematical gatekeeping into backpropagation-based training loops—where internal representations continually shift—remains an open architectural challenge. Theoretical Completeness: The core spectral coherence value of 0.5 at $\sigma = 0.5$ is an empirical invariant observed across finite sets; a formal, universal proof extending this to all infinite prime sets or establishing its absolute equivalence to the Riemann Hypothesis is not yet established.

Gong Chen, Beijie Liu, Mengyuan Li

As large language models (LLMs) grow in scale and are predominantly served from remote platforms, verifying faithful inference execution becomes critical (i.e., ensuring that a provider actually executes the advertised model and computational workload rather than a tampered or downsized variant). Zero-knowledge (ZK) LLM inference offers an appealing approach. It promises public verifiability and delivers per-instance guarantees of equational correctness by proving that an output is consistent with executing a public architecture under committed, private weights. Though, we show that it does not bind the effort expended to produce the output. In this paper, we formalize this overlooked effort gap and introduce the Hollow-LLM Attack, in which a dishonest provider retains the declared architecture and parameter count but embeds ghost weights whose algebraic structure collapses effective computation. These witnesses satisfy the verification circuit and yield valid proofs, even though the dishonest model owner, who serves as the prover, performs computation commensurate with a much smaller model than the declared public architecture. This creates a profitable equilibrium in which providers deliver provably correct outputs at small-model cost while overclaiming model size. Accordingly, we characterize concrete families of ghost weights that compose with standard transformer blocks and show that such hollow deployments substantially reduce serving cost with zero quality loss under the same verification circuit. These findings underscore that proof of correct inference is not proof of large-model execution and necessitate additional protections to bind correctness to verifiable computational work.

Siddiqui Jameel Ahmed

The rapid paradigm shift from passive, advisory Large Language Models (LLMs) to autonomous, agentic artificial intelligence systems has introduced critical execution risks. Traditional AI governance frameworks operate predominantly at the "evidence" layer-documenting data provenance, recording audit trails, and logging static safety evaluations. However, a structural vulnerability arises during the downstream execution phase: under operational pressure, autonomous agents can experience "authority drift," executing high-consequence actions based on stale dependencies, bypassed safety states, or invalid runtime authorities. To resolve this decoupling paradox, this paper introduces the Zero-Knowledge Kill-Switch (ZKKS), a cryptographic runtime enforcement architecture designed for Zero-Knowledge Web Servers (ZKWS). Rather than relying on post-hoc logging, ZKKS acts as a network-level, math-enforced execution barrier. By compiling safety policies into non-interactive zero-knowledge proofs (zk-SNARKs) and enforcing them via a Linear Temporal Logic (LTL) runtime state machine, the ZKWS dynamically halts downstream actions at the point of execution when a mathematical invariant or freshness threshold is violated-without decrypting or accessing the underlying private data payloads. We prove that ZKKS bounds operational failure to zero under deterministic policy constraints, bridging the critical gap between upstream integrity evidence and downstream execution control.

YASSINE LKHALIDI , MOHAMED LKHALIDI , HATIM KHARRAZ AROUSSI , ACHRAF TIFERNINE

IoT device authentication must resist impersonation and credential theft while respecting the computational constraints of edge devices. Existing frameworks rely on static cryptographic keys that, once extracted, enable full impersonation, whereas RF fingerprinting schemes that bind identity to hardware imperfections transmit and store device templates in plaintext, exposing them to template theft and linkability attacks. ZK-RFAuth is a three-phase authentication framework that integrates Siamese neural network-based RF fingerprinting, Groth16 zero-knowledge proof (ZKP) verification, and proof-of-authority blockchain logging. During registration, a Siamese convolutional network extracts a compact embedding from raw I/Q samples and commits a Poseidon hash of the quantized mean template on-chain. During verification, the prover generates a Groth16 proof demonstrating that the L1 distance between a fresh embedding and the registered template falls below a per-device threshold without revealing either vector. The proof and authentication outcome are recorded on-chain for tamper-evident auditing. Evaluated on the WiSig dataset (28 WiFi transmitters, 224,000 frames), ZK-RFAuth achieves 91.4% closed-set accuracy and 2.25% equal error rate at embedding dimension d = 64, with 88.4% genuine acceptance rate and 70.8% open-set rogue rejection using per-device P95 thresholds. The ZKP circuit requires only 972 rank-1 constraint system (R1CS) constraints over 100× fewer than an equivalent SHA-256 circuit producing 144-byte proofs verifiable in approximately 3 ms.

Suman Lamichhane, Laxmi Prasad Bhatt, Subarna Shakya

Deepfake technology poses a growing threat to digital trust across journalism, law, and politics. Current CNN-based detectors capture local artifacts but struggle with high-quality fakes and offer no way to prove their predictions are genuine. This paper presents DeepTrust, a framework combining a hybrid CNN–Transformer detector with Zero-Knowledge Proof (ZKP) verification and blockchain-based record-keeping. The detection model fuses spatial features from an attention-enhanced Xception network, global context from ViT-B/16, and spectral cues from a Frequency Encoder through a cross-attention mechanism. Predictions are cryptographically committed using a Pedersen scheme with the Fiat-Shamir heuristic, then stored on a proof-of-work blockchain. Evaluated on FaceForensics++, Celeb-DF, DFD, and 140K Real vs Fake, DeepTrust achieves 97.00% accuracy and 0.999 AUC on FaceForensics++, with balanced per-class accuracy despite imbalance ratios up to 1:8.5. ZKP overhead remains below one millisecond per prediction.

Tamer Abdelaziz

Smart contract security has progressed from vulnerability detection toward a broader research agenda that includes semantic reasoning, automated repair, adversarial robustness, and real-time exploit detection. This paper develops a capstone-oriented research narrative around four directions: foundation-model-based smart contract semantics and vulnerability reasoning [1], automated smart contract repair with formal guarantees [2], adversarial learning for robust malicious contract and transaction detection [3], and real-time transaction-level exploit detection at blockchain scale [4]. We connect these directions to two recent studies that characterize the current frontier: a diagnostic analysis of where smart contract security analyzers fall short [5] and a scalable real-time system for malicious Ethereum transaction detection [6]. The resulting framework is intended to help students formulate capstone projects that are technically grounded, empirically measurable, and aligned with contemporary smart contract security research.

Anton L.

The rapid proliferation of generative AI has collapsed the scarcity-based filters of digital trust, enabling synthetic identities, algorithmic fraud, and systemic epistemological uncertainty. Conventional authentication methods—passwords, cloud-stored biometrics, and external hardware tokens—are inherently fragile, centralized, and vulnerable to coercion or theft. This article proposes a paradigm shift toward bodily cryptographic sovereignty: a dental implant-based digital anchor that derives a Physically Unclonable Function (PUF) key from the unique acoustic resonance and microarchitecture of the human jawbone. The architecture integrates Zero-Knowledge Proofs (ZKP) for privacy-preserving verification, hardware zeroization to neutralize extraction attacks, and a configurable duress protocol for coercion scenarios. By leveraging globally established dental infrastructure and informed-consent medical protocols, the model bypasses the regulatory resistance and psychological friction associated with centralized biometric registries. It enables graded identity, scoped AI-agent delegation, and origin-verified digital communication. The proposed framework transitions digital trust from fragile external devices to an inseparable biological-cryptographic symbiosis, offering a scalable, voluntary, and regulatorily aligned architecture for the post-AI trust economy.

Tingda Shen, Yebo Feng, Konglin Zhu, Xiaojun Jia · 6 authors

Large language model (LLM) ecosystems such as Claude Code and ChatGPT increasingly rely on skills: packages of natural-language instructions and executable tools. Once in the LLM's context, skill content cannot be reliably separated from trusted instructions, and a skill's executable side can invoke privileged actions, exposing the skill supply chain to injection, tampering, and rug-pull attacks. Existing defenses are stage-bound: centralized signing, audit reports unbound from the runtime artifact, or policy engines that cannot attest to what was approved. We present SIGIL, the first framework that seals the audit-runtime gap for LLM skills. SIGIL delivers verifiable hosting through a tamper-evident, decentralized on-chain registry from which LLMs fetch skills directly. The registry admits four publication types, Transparent, Licensed, Sealed, and Committed, spanning plaintext public distribution, monetized access, custodial use, and off-chain workflows; before admission, every skill is vetted by a Decentralized Autonomous Organization (DAO) audit committee that supports pluggable auditing methods under a stake-and-slash economic model. At load time, SIGIL delivers verified loading through a skill verification protocol executed by a Skill Verification Loader (SVL) embedded as the mandatory loading path: the SVL retrieves and decrypts the skill as its type requires, verifies its integrity against the on-chain record, and enforces its permission manifest before context injection. We evaluate SIGIL on a real-world deployment against 1,023 in-the-wild skills spanning six attack types. At load time, the SVL verifies each skill's integrity against its on-chain record and enforces its approved permission manifest, completing batched verification under 86 ms. Together, these results show that LLM skills can be cryptographically bound from publication through runtime at practical cost.

Xing Zhang, Keyu Zhang, Taohong Zhu, Anbang Ruan

Smart contracts on blockchains are prone to diverse security vulnerabilities that can lead to significant financial losses due to their immutable nature. Existing detection approaches often lack flexibility across vulnerability types and rely heavily on manually crafted expert rules. In this paper, we present an LLM-based framework for practical smart contract vulnerability detection. We construct and release a large-scale dataset comprising 31,165 professionally annotated vulnerability instances collected from over 3,200 real-world projects across 15 major blockchain platforms. Our approach leverages precise AST-based context extraction and vulnerability-specific prompt design to instantiate customized detectors for 13 prevalent vulnerability categories. Experimental results demonstrate strong effectiveness, achieving an average positive recall of 0.92 and an average negative recall of 0.85, highlighting the potential of carefully engineered contextual prompting for scalable and high-precision smart contract security analysis.

Michelle Myrna Kowalski

AI hallucination is a cost problem, not a knowledge problem. This paper documents that three sentences of prompt-level instruction — IDK+COMP: a compression mandate paired with a refusal permission — reproduce hallucination suppression matching or exceeding a full multi-constraint methodology across three frontier AI models. Preliminary results: Gemini — 6.3% hallucination rate (Baseline 57.5%). ChatGPT — 0.0% (Baseline 22.2%). Claude — 0.0% on both. The paper establishes hallucination as a utility-maximizing response to a cost structure that makes confident invention cheaper than refusal. Change the cost structure at the prompt level — without touching the model, without retraining, at near-zero cost — and the behavior changes. IDK is load-bearing. COMP (the compression mandate) is the environment in which it operates. Secondary findings: hedging is not a mitigation — it is a co-symptom of unresolved uncertainty, and this dataset moves the hedge-hallucination relationship in both directions depending on directive design. Plausibility-trap strings (SPLAM, Vandermeer Effect) expose the limit of cost-structure interventions: the model cannot recognize the unrecognizable. 410 trials. Three frontier AI models. Five governance conditions. Proof-of-concept dataset; results are directional.

Divya Gupta

The intersection of Artificial Intelligence (AI) and distributed systems has given rise to Federated Learning (FL), a paradigm that enables decentralized model training without compromising local data privacy. As organizational data silos grow, deploying complex machine learning models across highly distributed edge networks becomes a critical infrastructural challenge. Standard FL implementations suffer from severe vulnerabilities related to adversarial gradient updates and computational bottlenecks at the aggregation layer. This paper presents a novel, end-to-end distributed architecture that hardens FL pipelines using advanced cryptographic verification and optimized big data processing frameworks. We introduce a Zero-Knowledge Proof (ZKP) wrapper that cryptographically validates node computations before global aggregation, neutralizing model poisoning attacks without inspecting raw gradients. Additionally, we evaluate the system's performance using extreme gradient boosting models optimized for distributed edge execution. We formalize the mathematical transformation of the machine learning loss functions into Rank-1 Constraint Systems (R1CS) suitable for succinct verification. Extensive experimental results demonstrate that our hybrid architecture achieves a 94.2\% accuracy retention under adversarial conditions while maintaining scalable throughput across 1,000 parallel distributed nodes, effectively bridging the gap between rigorous cryptographic security and high-performance distributed AI.

Michelle Myrna Kowalski

AI hallucination is a cost problem, not a knowledge problem. This paper documents that three sentences of prompt-level instruction — IDK+COMP: a compression mandate paired with a refusal permission — reproduce hallucination suppression matching or exceeding a full multi-constraint methodology across three frontier AI models. Gemini: 6.3% hallucination rate (Baseline 57.5%). ChatGPT: 0.0% (Baseline 22.2%). Claude: 0.0%. The paper establishes hallucination as a utility-maximizing response to a cost structure that makes confident invention cheaper than refusal. Change the cost structure at the prompt level — without touching the model, without retraining, at near-zero cost — and the behavior changes. IDK is load-bearing. The compression mandate is the environment in which it operates. Secondary findings: hedging is not a mitigation — it is a co-symptom of unresolved uncertainty, and this dataset moves the hedge-hallucination relationship in both directions depending on directive design. Plausibility-trap strings (SPLAM, Vandermeer Effect) expose the limit of cost-structure interventions: the model cannot recognize the unrecognizable. In a plausibility-trap domain, IDK+COMP is worse than nothing. 410 trials. Three frontier AI models. Five governance conditions. Proof-of-concept dataset; results are directional. Companion resources: Kowalski et al. (2026a), A Puma in a Teacup: Signal Quality and Hallucination Suppression Through Prompt-Level Incentive Restructuring. https://doi.org/10.5281/zenodo.19502460 Kowalski, M. M. and Claude (Anthropic). (2026). Taxonomy of AI Bullshit: hallucination and hedging subcategories. Zenodo. https://doi.org/10.5281/zenodo.20631337. Kowalski, M. M. & Claude (Anthropic). (2026). Hallucination Test Suite and Execution Records: test strings, activation blocks, trial data and AI transcripts. Zenodo. https://doi.org/10.5281/zenodo.21325014.

László Papp

This paper argues that trust scores — from credit ratings and ESG scores to AI-generated trust metrics — fail not because of poor implementation, but because trust itself is the wrong abstraction. Trust is not a scalar quantity but a contextual, relational, and topological phenomenon. Any attempt to reduce it to a universal numerical score leads to fragility, manipulation, exclusion, and systemic failure. We identify five structural failure modes (context collapse, Goodhart's Law, epistemic centralization, irreversibility, and metric substitution for truth), supported by historical case studies (Enron, Wirecard, Volkswagen Dieselgate, the 2008 subprime crisis, ESG rating failures). A formal impossibility argument demonstrates that no universal trust score can simultaneously satisfy context independence, temporal stability, observer neutrality, and manipulation resistance. We propose proof-based systems as the alternative paradigm, where trust is not measured but rendered unnecessary through local, irreversible verification. Examples include Bitcoin Proof-of-Work, zero-knowledge proofs, and blockchain-based supply chain traceability.

Aishwary singh

We describe a protocol that produces byte-identical outputs from frontier-scale language model inferenceand binds each output to a portable, offline-verifiable signed receipt. The construction has three parts.First, an inference substrate that runs models up to seventy-two billion dense parameters and forty-sevenbillion mixture-of-experts active parameters on NVIDIA H100, with cross-vendor extension to AMDInstinct MI300X. Output hashes match byte-for-byte across fresh process launches in every configurationmeasured; at single-GPU bf16 with eager attention the AMD and NVIDIA hashes are themselves byte-identical, including over fifty-one tokens of compounding frontier-scale generation, and at two-GPUtensor-parallel they differ as predicted by the underlying NCCL-ring versus RCCL-fabric all-reducetopology. Both are individually deterministic. Second, a canonical CBOR receipt schema with an Ed25519signature over a domain-separated message, implemented in Go, Python, and Rust, with cross-languagebyte-identity verified end-to-end and AMD-produced receipts verifying byte-for-byte through a Rustverifier built on x86 NVIDIA hardware. Third, a probabilistic spot-check verifier that re-executes asmall sample of receipts and rejects on mismatch; we prove a soundness lemma of the form 1−(1−f )kand validate it empirically across seventy adversary-verifier configurations with seven hundred thousandMonte Carlo trials. Verification costs about eighty microseconds per receipt on a single core. Eleventhousand sequential warm-model inferences ran without a single byte-identity failure. The contribution isthe construction itself: a primitive that gives issuer-independent fabrication soundness for AI inference atproduction cost, without a hardware-vendor dependency and without zero-knowledge proofs.

Yu-Chao Huang, Zhen Tan, Mohan Zhang, Pingzhi Li · 6 authors

Large Reasoning Models (LRMs) and Multi-Agent Systems (MAS) in high-stakes domains demand reliable verification, yet centralized approaches suffer four limitations: (1) Robustness, with single points of failure vulnerable to attacks and bias; (2) Scalability, as reasoning complexity creates bottlenecks; (3) Opacity, as hidden auditing erodes trust; and (4) Privacy, as exposed reasoning traces risk model theft. We introduce TRUST (Transparent, Robust, and Unified Services for Trustworthy AI), a decentralized framework with three innovations: (i) Hierarchical Directed Acyclic Graphs (HDAGs) that decompose Chain-of-Thought reasoning into five abstraction levels for parallel distributed auditing; (ii) the DAAN protocol, which projects multi-agent interactions into Causal Interaction Graphs (CIGs) for deterministic root-cause attribution; and (iii) a multi-tier consensus mechanism among computational checkers, LLM evaluators, and human experts with stake-weighted voting that guarantees correctness under 30% adversarial participation. We prove a Safety-Profitability Theorem ensuring honest auditors profit while malicious actors incur losses. All decisions are recorded on-chain, while privacy-by-design segmentation prevents reconstruction of proprietary logic. Across multiple LLMs and benchmarks, TRUST attains 72.4% accuracy (4-18% above baselines) and remains resilient against 20% corruption. DAAN reaches 70% root-cause attribution (vs. 54-63% for standard methods) with 60% token savings. Human studies validate the design (F1 = 0.89, Brier = 0.074). The framework supports (A1) decentralized auditing, (A2) tamper-proof leaderboards, (A3) trustless data annotation, and (A4) governed autonomous agents, pioneering decentralized AI auditing for safe, accountable deployment of reasoning-capable systems.

Ryan Fields

The Model State Attestation Framework (MSAF) is the theoretical foundation of the Auburn Governance Stack. It establishes the intellectual authority for why cryptographic AI attestation is necessary, defines the three-tier attestation architecture, surveys over 200 papers from 2022 through 2026 confirming that no existing system composes hardware trust, continuous model health monitoring, and supply chain provenance into a unified attestation artifact, and documents the theoretical ceilings that bound what attestation can and cannot guarantee. The framework addresses a fundamental governance paradox: organizations deploying foundation models into critical infrastructure cannot definitively demonstrate that a specific output was generated by a model version in a compliant internal state. Current governance artifacts including model cards, training logs, and static benchmarks are descriptive rather than prescriptive and fundamentally non-verifiable. MSAF composes three verification tiers into a layered architecture. The first tier provides TEE-backed platform attestation for execution environment integrity, proving the silicon is real and uncompromised. The second tier provides signed continuous metrics for training and inference health monitoring, proving the model is healthy at the moment of inference. The third tier provides selective zero-knowledge proofs for high-value inference verification, enabling verification without exposing proprietary model internals. The composed attestation artifact is mapped to specific evidence requirements across five regulatory frameworks: EU AI Act Articles 11 and 15, FDA Software as a Medical Device Pre-Determined Change Control Plans, Federal Reserve SR 11-7 ongoing monitoring requirements, US Federal Procurement mandates, and AI insurance underwriting. The framework identifies the theoretical ceilings that bound attestation: Rice's theorem establishing the undecidability of semantic properties, the Impossibility Sandwich bounding what verification can achieve between Rice's theorem and Gödel's incompleteness, and TEE physical side-channel vulnerabilities limiting hardware trust guarantees. The honest framing: MSAF provides probabilistic risk reduction and accountability infrastructure, not behavioral safety guarantees. This is analogous to financial auditing, which certifies process compliance without guaranteeing future solvency. The building blocks exist individually. MSAF is the composition that binds them into an enforceable governance architecture. This work was previously hosted on Figshare, where the author maintained a portfolio of 29 publications with minted DOIs and an established ORCID record. The author's Figshare account was disabled without prior notice, without citation of a specific terms violation, and without opportunity for review, rendering all published items and their associated DOIs inaccessible. No communication was provided before or at the time of the disable action. This deposit and associated deposits on Zenodo ensure continued public accessibility of the author's research on institutional infrastructure with appropriate permanence guarantees.

Nurahmed Ali Yassin

Abstract Federated learning (FL) has emerged as a paradigm-shifting approach to distributed machine learning, enabling multiple participants to collaboratively train models without exposing raw data. However, conventional federated learning architectures remain susceptible to a broad spectrum of security and privacy threats, including model poisoning, gradient inversion, inference attacks, and Byzantine faults. This paper presents a unified and robust framework— Secure and Privacy-Preserving Federated AI (SPFA) — that integrates differential privacy, homomorphic encryption, secure multi-party computation, Byzantine fault tolerance, and zero-knowledge proofs into a unified, production-grade architecture. We formally analyze the threat model, prove privacy guarantees under the ( ε , δ )-differential privacy framework, and demonstrate Byzantine resilience under partial adversarial participation. Extensive experiments on heterogeneous data distributions across image classification, natural language processing, and medical diagnosis benchmarks demonstrate that SPFA achieves model accuracy within 2.3% of centralized baselines while providing provable ε = 1.0 privacy with a communication overhead of only 18% above standard FedAvg. To the best of our knowledge, our framework is among the first to consolidate all five protection layers into a unified, deployable system with formal analysis and an open-source reference implementation. The relevance of SPFA extends to privacy-sensitive applications in healthcare, cybersecurity, distributed edge computing, and smart city analytics.

Radoslav Y. Radoslavov

This paper introduces ZKAP (Zero-Knowledge Audit Protocol), a cryptographic protocol in which a machine-learning inference is coupled to a zero-knowledge proof of constraint satisfaction in such a way that the output of the inference cannot be released on any observable channel unless the proof verifies. The protocol rests on two principal technical contributions: The Certified Stack — a composite object that cryptographically binds the model weights, a mandatory bit-integrity policy (integer quantisation), the inference runtime stack and the hardware configuration under a single commitment (RootHash), which is included as a public input to every proof produced by the system. Prove-before-output enforcement — a family of four embodiments (hardware output gate, trusted-execution-environment release path, silicon-level embodiment, syscall-intercepting software runtime) in which the output of the inference is physically blocked from leaving the system until the accompanying proof has verified against the Certified Stack commitment and against a constraint set signed by an external authority. Three supporting mechanisms are described: authority-signed formal constraints with a five-type taxonomy, a per-inference hash chain with external anchoring, and a three-party cryptographic separation of duties. The paper further discusses practical relaxations of the strict release semantics for real-time workloads. A soundness theorem is stated against a polynomial-time adversary controlling the operator of the inference, and regulatory implications for high-risk AI systems under Regulation (EU) 2024/1689 (Artificial Intelligence Act) are discussed. Priority declaration. The inventive mechanisms described in this paper are the subject of Bulgarian patent applications BG/P/2026/114317 (filed 30 March 2026) and PTBG202600000316742 (filed 12 April 2026). This preprint establishes the academic priority of the author, as of the date of the deposit timestamp, over the specific technical constructions described in Sections 3 and 4 of the paper. Access note. This deposit is under embargo until 31 March 2027. During the embargo, metadata (title, abstract, author, keywords, references) are publicly visible; the full text is not publicly accessible. The embargo date coincides with the Paris Convention priority deadline of the underlying Bulgarian patent application BG/P/2026/114317. The DOI assigned at deposit time serves as a timestamp for academic priority purposes, independent of the file's accessibility.

Ankit Vishnoi, Varun Sapra, Luxmi Sapra, Preeti Narooka · 5 authors

Introduction The proliferation of dApps is increasing the attack surface for exploitable vulnerabilities in smart contracts, and thus there is a need for verifiable detection methodologies. Methods In this work, we propose a machine learning framework with blockchain integration for explainable and note that “explainable” implies “verifiable” smart contract vulnerability detection. The SmartBugs-curated data was systematically pre-processed with metadata filtering, feature correlation analysis and encoding for model evaluation. Four ensemble learning methods, Random Forest, XGBoost, LightGBM and CatBoost were tested under identical experimental settings for comparison. Results The Random Forest classifier initially achieved the best balance in terms of stability and performance with an accuracy of 87.67%, successfully detecting important vulnerability classes such as re-entrancy, unchecked low-level calls, etc. To enhance the applicability of our blockchain-based machine learning framework for vulnerable smart contract analysis we extend it from the initial 143-contract dataset SmartBugs-Curated to evaluate it on on large-scale set, namely, SmartBugs-Wild which contains 47,398 real-world Ethereum contracts. Based on 29 static contract-level features, unsupervised clustering (k = 4, silhouette score = 0.3735) identifies discrete structural archetypes present in the dataset. Ensemble classifiers (such as XGBoost, CatBoost, Random Forest and LightGBM) can get excellent discriminative performance on these cluster labels: LightGBM achieves 99% accuracy and 0.98918 macro-F1. Discussion The additional results show that the approach scales, is robust and leads to stable models, even if interpretable. After injecting SHAP-based explainability, the interpretability and predictive power of CatBoost became similar to those of Random Forest. In order to guarantee end-to-end trust and traceability of our optimised classifier, this was linked to a blockchain oracle that independently store the outcomes as well as confidence scores for predictions directly onto an Ethereum-compatible ledger through a Vulnerability Registry smart contract. This integration provides the data is immutable, auditable and transparent in reporting.

Bowen Cai, Weiheng Bai, Hangyun Tang, Youshui Lu · 5 authors

Smart contracts extended blockchain functionality beyond simple transactions, powering complex applications like decentralized finance (DeFi). However, this complexity introduces serious security challenges, including price manipulation and inflation attacks. Despite the development of various security tools, the rapid rise in financially motivated exploits continues to pose a significant threat to the blockchain ecosystem. These financially motivated exploits often stem from Monetarily Exploitable Vulnerabilities (MEVuls), which refer to vulnerabilities arising from exploitable implementations in monetary transactions or value-transfer logic. Due to their complexity, intricate chains of function calls, multifaceted logic, and diverse manifestations across different smart contracts, MEVuls are particularly challenging for current security tools to identify. Instead of providing actionable insights, existing tools frequently generate excessive warnings that overwhelm developers without effectively mitigating risks. To address the challenge of recognizing MEVuls, we first formalize MEVuls based on common real-world financial exploits. Then, we introduce FAUDITOR, a specialized fuzzer designed to detect MEVuls in smart contracts. The key insight is that leveraging smart contracts' finance-related interfaces directly exposes critical vulnerabilities, making detection more targeted. We further integrate auditors' reports using NLP to extract valuable insights on exploitation patterns, enabling a more informed search strategy. Additionally, FAUDITOR employs a self-learning mechanism that refines its detection strategies over time, allowing it to improve based on prior fuzzing results. In our evaluation, FAUDITOR impressively reveals 220 zero-day MEVuls. Meanwhile, compared to existing fuzzers, FAUDITOR detects vulnerabilities faster and achieves better instruction coverage.

Syed A. Rizvi

Decentralized Autonomous Organizations (DAOs) are inclined explore Small Language Models (SLMs) as edge-native constitutional firewalls to vet proposals and mitigate semantic social engineering. While scaling inference-time compute (System 2) enhances formal logic, its efficacy in highly adversarial, cryptoeconomic governance environments remains underexplored. To address this, we introduce Sentinel-Bench, an 840-inference empirical framework executing a strict intra-model ablation on Qwen-3.5-9B. By toggling latent reasoning across frozen weights, we isolate the impact of inference-time compute against an adversarial Optimism DAO dataset. Our findings reveal a severe compute-accuracy inversion. The autoregressive baseline (System 1) achieved 100% adversarial robustness, 100% juridical consistency, and state finality in under 13 seconds. Conversely, System 2 reasoning introduced catastrophic instability, fundamentally driven by a 26.7% Reasoning Non-Convergence (cognitive collapse) rate. This collapse degraded trial-to-trial consensus stability to 72.6% and imposed a 17x latency overhead, introducing critical vulnerabilities to Governance Extractable Value (GEV) and hardware centralization. While rare (1.5% of adversarial trials), we empirically captured "Reasoning-Induced Sycophancy," where the model generated significantly longer internal monologues (averaging 25,750 characters) to rationalize failing the adversarial trap. We conclude that for edge-native SLMs operating under Byzantine Fault Tolerance (BFT) constraints, System 1 parameterized intuition is structurally and economically superior to System 2 iterative deliberation for decentralized consensus. Code and Dataset: https://github.com/smarizvi110/sentinel-bench

Qiangshan Zhang, Meng Yao

Smart contracts exhibit increasingly complex semantics and interactions, yet existing vulnerability detection methods rely on single-granularity representations, limiting their ability to capture semantic mechanisms across bytecode execution and cross-contract interactions. In addition, vulnerability data are scarce and imbalanced, and most deep learning-based approaches lack semantic interpretability. To address these limitations, a semantic-aware cross multi-granularity representation enhanced detection framework (CMR-ED) is proposed. CMR-ED models opcode execution semantics, function-level behaviors, and cross-contract interactions, aligning multi-level semantic information within a unified representation space. A structure-aware vulnerability pattern generator mitigates data scarcity through semantically consistent sample synthesis, while an explainable detection mechanism provides triggering paths and reasoning-chain explanations. Extensive experiments show that CMR-ED outperforms state-of-the-art methods while improving interpretability under semantically complex scenarios.

Rohith Singh, Mr. Charan Singh, Abdul Rashad, Md. Abdur Rasheed · 6 authors

Prompt injection is a foundational security vulnerability in large language models (LLMs) deployed as autonomous agents with tool access and multi-step reasoning capabilities. Existing defenses rely on heuristic filters that fail under obfuscation, indirect injection, and multi-agent propagation. We present a Unified Cryptographic-Control Architecture (UCCA), a principled framework that integrates five complementary guarantees: (1) information-theoretic leakage bounds derived via Fano's inequality, (2) certified robustness via randomized smoothing, (3) token-level rejection via erase-and-check, (4) runtime trajectory enforcement via control barrier functions (CBFs), and (5) verifiable inference via zero-knowledge proofs (ZK-SNARKs). We formally prove that any successful prompt injection attack must simultaneously bypass all five mechanisms, a condition we show has probability at most δ under stated assumptions. We evaluate UCCA on three real LLMs (GPT-4o, Claude 3.5 Sonnet, Mistral-7B) across four established attack benchmarks (INJECAGENT, TensorTrust, PromptBench, HarmBench), achieving attack success rates below 8% while maintaining median latency overhead under 340 ms. Our framework bridges formal security guarantees and deployable system architecture, establishing a foundation for provably secure autonomous AI. • Information-theoretic bounds on system prompt leakage using mutual information and Fano's inequality. • Certified robustness for safety-critical classification through randomized smoothing, where the robustness radius R is determined from output probability gaps. • Token-level rejection guarantees using an erase-and-check procedure capable of detecting adversarial subsets of size ≤ k. • Runtime safety enforcement through control barrier functions (CBFs), ensuring LLM outputs remain within a verified safe set. • Verifiable inference using ZK-SNARKs, allowing cryptographic attestation of model outputs without revealing model weights. • UCCA, a deployable system integrating all five mechanisms, evaluated on real LLMs and standard benchmarks.