Blockchain Papers

Gregorio Dalia, Tat Luat Nguyen, Andrea Di Sorbo, Corrado Aaron Visaggio · 5 authors

Ethereum smart contracts manage billions in digital assets, and vulnerability detection is critical given the immutability of deployed code and the irreversible nature of transactions. However, existing tools such as Slither rely on rigid, rule-based analysis, and general-purpose language models like ChatGPT often miss rare or context-dependent bugs. To address these limitations, this paper presents BreachT5, an ensemble of two fine-tuned CodeT5+ models designed for multi-label vulnerability detection in Solidity contracts. We first fine-tune a 220M parameter model on over 67,000 real contracts labeled with the Smart Contract Weakness Classification (SWC), revealing intrinsic detection differences across vulnerability types. We then explore the performance of a 770M variant, which improves accuracy on frequent classes but underperforms on rare ones. To balance this trade-off, BreachT5 combines both models via soft voting with per-class thresholds. Our results on the BCCC-SCsVuls2024 dataset show that BreachT5 achieves 0.556 Macro-F1 and 0.612 Micro-F1, outperforming the two standalone models, Slither, and GPT-5 in multi-label vulnerability detection.

Radoslav Y. Radoslavov

This paper proposes a conceptual methodological framework based on a Dual-Domain Architecture mediated by a Zero-Knowledge Audit Proxy (ZKAP) to reconcile AI Act accountability with GDPR data minimization. Legal norms are polynomialized into R1CS constraints, transforming compliance into a formally verifiable computational property. For cognitively opaque exascale models, these invariants may be hardware-anchored through a Provable Arithmetic Logic Unit (pALU), ensuring determinism and resistance to algorithmic drift. For lower-risk or on-premise systems, ZKAP operates in a software-only configuration, enabling periodic asymmetric regulatory proofs without silicon-level integration. A calibrated threshold distinguishes admissible technical variance from structural divergence, triggering mandatory safeguards. The framework provides a proportional, scalable, and cryptographically verifiable oversight model applicable both to future non-explainable AI systems and to lighter local infrastructures. This Zenodo deposit contains both the original Bulgarian peer-reviewed version (version of record) and an unofficial English translation. The Bulgarian version was published in Artificial Intelligence Proceedings (ISSN 3033-2923 / 3134-1667), pp. 75–78, as presented at the XI International Scientific Conference "High Technologies. Business. Society", Borovets, Bulgaria, 23–26 March 2026.

Antonio José Marín Soto

We establish an information-theoretic lower bound on the prover overhead of any zero-knowledge proof system that verifies arbitrary neural network inference. We prove a minimum multiplicative overhead of 2x for general circuits, rising to 4x for neural networks with ReLU activations due to activation encoding, weight commitment, and layer dependency costs. We further prove that composing ZK with fully homomorphic encryption produces multiplicative overhead blowup, making ZK+FHE verification impractical beyond approximately 10^4 gates. We survey six contemporary proof systems and show their observed overheads are consistent with our bounds. Our results formalize the intuition that free verification of AI computation is impossible and provide concrete bounds for system designers.

Yun Li, YanLing Liu, ChangEr Liu, Xinman Luo

With the rapid iteration of blockchain technology, smart contracts, as core components of decentralized applications, directly impact the stability of on-chain assets and ecosystems through their security. Traditional vulnerability detection methods primarily rely on expert rules and static analysis, facing bottlenecks such as high false positive rates and poor adaptability to complex logical vulnerabilities. In recent years, Large Language Models (LLMs), with their exceptional code understanding and reasoning capabilities, have provided new technical pathways for smart contract security auditing. This paper focuses on LLM-driven smart contract vulnerability detection technologies, systematically reviewing mainstream application paradigms from prompt engineering to model fine-tuning. The paper first reviews the current state of smart contract security and the limitations of traditional methods; subsequently, it provides in-depth analysis of the architectural design and core mechanisms of representative frameworks such as GPTLens and SmartVD, evaluating their performance in detection accuracy and recall rate; finally, addressing current challenges including data scarcity, model hallucinations, and computational overhead, it proposes future evolution directions such as multimodal fusion and human-in-the-loop auditing, providing reference for research and practice in related fields.

Drake Caraker, Bryan Arnold, David Rhoads

Faithful, Stable, Complete: Pick Two The Problem in Plain Language When a machine learning model makes a prediction — approving a loan, diagnosing a disease, flagging a transaction — practitioners use a tool called SHAP to answer "which input features mattered most?" SHAP is the most widely used explanation method in machine learning. Here is the problem: retrain the same model on the same data with a different random seed, and the explanation changes. The model's predictions barely move, but the "most important feature" can flip entirely. In 68% of 77 public datasets, the top feature is not stable across retrains. This is not a software bug. This is not fixable by tuning hyperparameters. We prove it is a mathematical impossibility. What We Prove No feature ranking can simultaneously be: Faithful — it reflects what the model actually learned Stable — it doesn't change when you retrain Complete — it ranks every pair of features …when features are correlated with similar importance. You must give up one. The proof is four lines long. It requires no assumptions about the model, the data, or the explanation method — only that correlated features admit models ranking them in opposite orders (the Rashomon property), which is true for every standard ML algorithm. How Bad Is It? We trained 50 XGBoost models on Breast Cancer Wisconsin — the dataset used in every SHAP tutorial — and counted how many different "top 3 most important features" appeared. Twenty-four. At 100 models: thirty-five. The "most common" answer appeared in only 12% of runs. Two randomly chosen models agree on the top-3 only 4.2% of the time. Every tutorial, textbook, and blog post showing SHAP on this dataset is showing one of two dozen equally valid answers. Three other datasets (California Housing, Heart Disease, Wine Quality) produce exactly one ranking every time — because their top features have clearly different importance. The theory correctly predicts which datasets are affected and which are safe. Dataset Distinct top-3 rankings (50 models) Two models agree? Breast Cancer 24 4.2% Diabetes 2 88.5% Wine Quality 1 100% (stable) Heart Disease 1 100% (stable) California Housing 1 100% (stable) It Gets Worse for Yes/No Questions For ranking questions (which feature is MORE important?), there is a fix: average across multiple models. But for binary questions — "does this feature contribute positively or negatively?", "is this feature selected?" — no fix exists. Even averaging doesn't help, because there's no middle ground between "positive" and "negative." We call this the bilemma. Real-World Consequences For loan applicants. We trained 30 models on German Credit data. Under standard settings, 45% of applicants receive a different "most important reason" for their decision depending on which model happens to be deployed. One applicant received six different top reasons across 30 models. For biomarker discovery. On a dataset of 10,935 genes distinguishing colon from kidney tissue, the "#1 most important gene" alternates between TSPAN8 (involved in tumor invasion) and CEACAM5/CEA (involved in immune evasion) depending on the random seed. A drug discovery pipeline targeting one gene makes a different bet than one targeting the other — and which bet gets made depends on a random number. For fairness audits. A SHAP-based audit checking whether a model relies on a protected attribute (like race or gender) reaches its conclusion with the reliability of a coin flip when the protected attribute is correlated with other features. The Fix DASH (Diversified Aggregation for Stable Hypotheses): train 25 models with different seeds, average their SHAP values. This is provably the best possible approach — no method can do better. Features that genuinely differ in importance get stable rankings. Features that are interchangeable get reported as tied, which is the honest answer. We also provide a 7-line diagnostic that identifies which features are at risk, requiring no statistical expertise and no assumptions about the data distribution. It outperforms the standard formula by 2× on real data. The practical workflow: Screen your model (1 model, seconds) Run the minority fraction diagnostic (7 lines of code) For flagged features, train 5 models and run a Z-test If unstable, use DASH with 25+ models Machine Verification Every mathematical claim is checked by a computer. The proofs are written in Lean 4 (a programming language for mathematics) and verified by its type-checker: 357 theorems, all machine-verified 6 axioms (the minimal assumptions the theory needs) Zero unproved claims across 58 files During the formalization, the computer caught two logical errors and one type mismatch that human reviewers missed. To our knowledge, this is the first formally verified impossibility result in explainable AI. Technical Details Architecture-dependent bounds Gradient boosting (XGBoost, LightGBM): instability diverges as correlation increases. At ρ = 0.9, the dominant feature gets 5× its fair share. Lasso: the ratio is infinite — one correlated feature gets everything, the other gets zero. Neural networks: 87% of feature pairs are unstable. Model instability dominates SHAP estimation noise by 8:1. Random forests: instability converges with more trees — the contrast case showing that parallel (not sequential) training helps. Cross-implementation. XGBoost, LightGBM, and Random Forest all show the same instability pattern. It is not specific to any one software package. Subsample sensitivity. Even at subsample = 0.95 (minimal randomness), 17 distinct rankings remain. Only fully deterministic training (subsample = 1.0) produces one ranking — but this sacrifices the regularization that makes the model accurate. Mechanistic interpretability. Preliminary evidence suggests the impossibility extends beyond feature importance to neural network circuit analysis. 10 transformers trained on modular addition (all achieving 100% accuracy) agree on only 36% of the top-3 circuit components. Design Space The achievable set of explanation methods has exactly two families: Family A (single model): faithful and complete, but unstable. Rankings flip up to 50% of the time. This is what standard SHAP does. Family B (DASH ensemble): faithful and stable, but reports ties for indistinguishable features. This is what DASH does. No third option exists. DASH is provably the best method in Family B. Associated Papers Companion paper (TMLR, under review). First-Mover Bias in Gradient Boosting Explanations: Mechanism, Detection, and Resolution.arXiv: https://arxiv.org/abs/2603.22346DOI: https://doi.org/10.5281/zenodo.19446088 Companion implementation: https://github.com/DrakeCaraker/dash-shap

J Chanbasha, R R Shantha Spandana

Smart contracts, essential to Blockchain functionality, can be compromised by vulnerabilities like reentrancy attacks, allowing unscrupulous entities to misappropriate funds. A universal and efficient multi-modal vulnerability detection framework is created to tackle detection issues that exceed the capability of standard methods such as fuzzy testing and symbolic execution. The methodology incorporates BiLSTM, EfficientNet, and Transformer architectures, augmented by CNN2D and BiGRU for better feature extraction and sequence modeling. The SMARTBUG dataset is employed in two formats: compiled OPCODES and features extracted via Word2Vec from smart contract source code. Preprocessing entails utilizing Word2Vec to produce N-gram numerical representations, succeeded by an 80-20 division for training and testing. The system analyzes multi-modal inputs, such as grayscale image attributes, opcode frequency statistics, and source code sequences, facilitating comprehensive vulnerability characterisation. The experimental assessment assesses the proposed model in comparison to existing algorithms, including MLP, GRU, and BiLSTM, utilizing criteria such as accuracy, precision, recall, and F-score. The CNN2D + BiGRU + EfficientNet + Transformer setup attains the greatest detection accuracy of 91.9%, surpassing all benchmarks. The system reduces dependence on domain knowledge by automating feature extraction, enabling adaptation across diverse smart contract forms and improving security in blockchain contexts

Zhenhang Shang, Yu, Yingzhe, Kani Chen

Fine-tuning is the dominant paradigm for adapting large machine learning models, yet current deployment pipelines provide no way to verify how a released model was updated. In particular, a model provider or auditor cannot check whether a fine-tuned model adheres to a claimed update procedure without access to its parameters. We introduce \emph{fine-tuning integrity} (FTI), a cryptographic objective for verifying that a deployed model differs from a trusted base model only within a declared class of admissible updates. We construct \emph{succinct model difference proofs} (SMDPs), zero-knowledge protocols that certify structured parameter drift without revealing model weights. Our framework supports three fundamental update classes: norm-bounded, low-rank, and sparse drift, covering common fine-tuning methods such as regularized training, LoRA, and prefix tuning. In all cases, proof size and verification cost depend on the structure of the update rather than the number of parameters. We prove soundness, zero-knowledge, and succinctness for each construction, and establish a matching $Ω(n)$ lower bound showing that structural assumptions are necessary for succinct verification. A prototype evaluation on synthetic benchmarks and GPT-2 fine-tuning demonstrates that proofs remain compact and verification is efficient at realistic scales.

Anthony Coslett

A deployed model can appear unchanged while ceasing to be the model it claims to be. Publicly available weight-level mutation toolchains now automate safety-alignment removal from open-weight models on ordinary hardware, producing checkpoints intended to preserve operational familiarity while discarding refusal behavior. This paper argues that safety-alignment removal is a model-identity failure: in tested published checkpoints from multiple toolchains across two model families, the mutation leaves measurable structural scars ranging from 7.6 to over 2,300 times the instrument's acceptance threshold. Artifact identity, workload identity, and agent authorization can all remain valid while structural model identity fails — a finding that the program's formally verified admissibility doctrine predicted before this threat class existed. A sentinel validation panel across four model families confirms that the hardened instrument configuration preserves or improves all tested positives. In an agentic deployment context, model-identity failure propagates upward into agent-integrity failure: the agent is authenticated, but the model inside it is no longer the model the surrounding controls were designed to govern. The practical implication is that runtime evaluation frameworks — including those emerging under the EU AI Act — implicitly depend on a model continuity that weight-level mutation can break, and that structural identity verification offers a candidate evidentiary layer for closing that gap. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Wang Yishun, Wenkai Li, Xiaoqi Li, Zongwei Li · 6 authors

Smart contracts are self-executing programs that manage financial transactions on blockchain networks. Developers commonly rely on third-party code libraries to improve both efficiency and security. However, improper use of these libraries can introduce hidden vulnerabilities that are difficult to detect, leading to significant financial losses. Existing automated tools struggle to identify such misuse because it often requires understanding the developer's intent rather than simply scanning for known code patterns. This paper presents LibScan, an automated detection framework that combines large language model (LLM)-based semantic reasoning with rule-based code analysis, identifying eight distinct categories of library misuse in smart contracts. To improve detection reliability, the framework incorporates an iterative self-correction mechanism that refines its analysis across multiple rounds, alongside a structured knowledge base derived from large-scale empirical studies of real-world misuse cases. Experiments conducted on 662 real-world smart contracts demonstrate that LibScan achieves an overall detection accuracy of 85.15\%, outperforming existing tools by a margin of over 16 percentage points. Ablation experiments further confirm that combining both analysis approaches yields substantially better results than either method used independently.

Anthony Coslett

Three model substitution scenarios were executed against a live inference endpoint with real HTTP requests, signed attestation JWTs, and OPA policy enforcement. In each scenario, every tested workload, artifact, or API identity control relevant to that scenario — workload JWT validation, health checks, gateway process continuity, artifact manifest integrity, API key authentication — remained valid while the model changed. In each scenario, a structural identity measurement based on activation geometry during a standard forward pass detected the substitution and the enforcement layer denied the request. Three substitutions were tested and three were detected, with zero false accepts in this run. The warm-path verification latency was 5.7–6.7 seconds on a single A100 with the model already loaded. The complete evidence chain — before/after measurement results, attestation claim summaries, OPA policy evaluations, and HTTP response codes — is published alongside this note as machine-readable JSON. This is a technical note, not a numbered entry in the research series. Supplementary Material. This note is accompanied by three machine-readable evidence files: cat3_results.json (structured results for all three scenarios, including the full before/after evidence chain for Scenario A with signed attestation claims, OPA policy evaluations, and HTTP response codes), manifest_authorized.json (SHA-256 build manifest for the enrolled model, 10 files, all verified), and manifest_substituted.json (SHA-256 build manifest for the substituted model, 10 files, all verified). All three files are available for download as supplementary files attached to this record. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Md Hamid Borkot Tulla, Naem Azam Chowdhury

GDPR Article 17 mandates the "Right to Be Forgotten," requiring organizations to remove personal data influence from trained machine learning models. While machine unlearning techniques exist, no cryptographically verifiable mechanism currently proves that unlearning genuinely occurred. This paper proposes VeriForgot, a framework combining: (i) calibrated Membership Inference Attack (MIA) oracles as compliance verification tests, (ii) blockchain-issued immutable Unlearning Certificates, and (iii) a zero-knowledge proof protocol for parameter shift attestation. Experiments on CIFAR-10 using ResNet-18 show MIA AUC drops from 0.5918 to 0.4669 after unlearning, while retaining 92.05% accuracy on non-forgotten data. The MIA oracle achieves 95.0% detection accuracy, correctly identifying all 10 genuine unlearned models and rejecting 9 of 10 fake compliance attempts.

Narnaiezzsshaa Truong

This record documents Phase 22 of APR-Lite, a governance engine protecting human decision authority from AI-influenced outputs in regulated industries. Phase 22 introduces Exportable Proof Packs: a single GLOBAL-signed artifact bundle containing everything an external regulator needs to independently verify a tenant’s complete governance history. The proof pack is the “hand this to a regulator and walk away” artifact. It does not require ongoing substrate access, trust in the operator, or knowledge of internal schemas. Every claim in the pack is independently verifiable via the Phase 18 federation verifier. The pack is ephemeral — never stored by Soft Armor Labs — consistent with the substrate’s zero client-data-persistence design invariant. Multiple sections are assembled in one governed call: the current governance health report, the drift-focused narrative, recent proof bundles, audit chain checkpoints, and topology snapshots. A content hash commits to the five sections exclusively, and a GLOBAL-signed manifest characterizes the pack’s contents. The export act itself is recorded as a governed event in the audit chain — an auditor can verify not only the pack’s contents but when it was generated and by whose authority. Implementation note: the initial implementation incurred excessive database queries causing worker timeout. The design was restructured to assemble proof bundles inline using already-fetched data, reducing database load by approximately 83%. Final verified state: 12/12 Phase 22 smoke tests passing. Worker version 8.2.0-p22.1.

Anthony Coslett

Pre-registration of a structural scar class prediction for google/gemma-3-12b-it based on measurement-site stiffness (S = 0.1335), before the structural scar measurement is conducted. Predicts QUIET class (100–600×ε non-max) based on the stiffness→scar ordering established across three families (Mistral, Llama, Qwen) in Papers 1–12. Explicit falsification criteria defined. Part of the Fall Risk AI research program on neural network structural identity. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Munawar Hasan, Apostol Vassilev, Edward Griffor, Thoshitha Gamage

The application of zero-knowledge proofs (ZKPs) in autonomous systems is an emerging area of research, motivated by the growing need for regulatory compliance, transparent auditing, and trustworthy operation in decentralized environments. zk-SNARK is a powerful cryptographic tool that allows a party (the prover) to prove to another party (the verifier) that a statement about its own internal state is true, without revealing sensitive or proprietary data about that state. This paper proposes Hermes Seal: a zk-SNARK-based ZKP framework for enabling privacy-preserving, verifiable communication in vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) networks. The framework allows autonomous systems to generate cryptographic proofs of perception and decision-related computations without revealing proprietary models, sensor data, or internal system states, thereby supporting interoperability across heterogeneous autonomous systems. We present two real-world case studies implemented and empirically evaluated within our framework, demonstrating a step toward verifiable autonomous system information exchanges. The first demonstrates real-time proof generation and verification, achieving 8 ms proof generation and 1 ms verification on a GPU, while the second evaluates the performance of an autonomous vehicle perception stack, enabling proof of computation without exposing proprietary or confidential data. Furthermore, the framework can be integrated into AV perception stacks to facilitate verifiable interoperability and privacy-preserving cooperative perception. The demonstration code for this project is open source, available on Github.

Balachandar Raju, Gayathri Devi K

Smart contracts are autonomous systems that execute agreements using code. Their efficiency generated attention from a range of industries. The basis of traditional vulnerability detection techniques, opcode analysis, has limitations in detecting complex vulnerabilities. Our research aims to address these difficulties by developing an automated framework for vulnerability detection, mitigation, and patch deployment. Initially, smart contract data will be collected, followed by a preprocessing step to remove any unnecessary information using lexical analysis and Bidirectional Encoder Representations from Transformers (BERT). Then, the preprocessed data is used to identify the features that are relevant are selected. Following the features being selected, an intellectual engine is used to identify flaws. The intellectual engine that integrates the convolutional neural networks (CNN) and long short-term memory (LSTM) analyzes a subset of preprocessed data for vulnerabilities, with explainable artificial intelligence (XAI) evaluating the importance of each feature to predictions. Our method produces exceptional outcomes with a 99.25% precision, 99.76% accuracy, 99.60% F1-score, and 99.36% recall. Smart contract vulnerability identification, mitigation, and patch generation are improved by the proposed Beluga Crayfish Optimization Algorithm (BCOA) and Crayfish Secretary Bird Optimization Algorithm (CSBOA) together with graph neural networks (GNN). In addition to producing the required fixes, this method offers efficient mitigation techniques. Therefore, it greatly enhances smart contract security and efficiency. In the end, smart contract programs that use this integrated approach are more secure.

Anthony Coslett

Current AI deployment stacks authenticate agents, workloads, and credentials but do not verify which neural network is computing at inference time. Recent incidents — including the undisclosed use of an open-weight foundation model inside a commercial product, industrial-scale distillation campaigns, and emerging agent identity standards that authenticate software without authenticating models — show that this gap has practical consequences. Post-hoc disclosure resolved these incidents; runtime proof would have made the model identity question answerable at inference time. This paper asks whether runtime model identity is technically feasible at frontier scale. We present three results. First, we enrolled and verified five open-weight transformer models spanning 8 billion to 72.7 billion parameters across three families, with zero false acceptances in all pairwise comparisons and self-verification within the acceptance threshold for all models. A thermodynamic observable predicted by extreme value theory remained within two percent of its predicted value across the full range, with no statistically significant scale-dependent correction detected across more than two orders of magnitude in parameter count. Second, we tested structural separability on three declared-lineage distillation pairs spanning 8 billion to 70 billion parameters — each derivative sharing identical architecture with its base — and measured separations ranging from 2,858 to 4,583 times the acceptance threshold, increasing monotonically with model scale across two base-model families. All derivatives self-verified within the acceptance threshold. Third, we demonstrate a frontier-scale software attestation path — including signed JWT issuance and downstream policy consumption — and situate it within a previously formalized attestation architecture that composes with enterprise identity infrastructure, complementing rather than replacing current agent identity frameworks. These results demonstrate that runtime model identity is measurable and separable across the tested range of open-weight instruct-tuned transformers from 8B to 72.7B, with a frontier-validated software attestation path and an inherited route to stronger hardware-backed and proof-backed assurance. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Untila Octavian

v2 (March 22, 2026): Added experimental validation of Principle 1 (formal verification) via substrate-guard framework. 135 test cases, 100% accuracy, zero false positives. Code: https://github.com/octavuntila-prog/substrate-guard We present evidence that an autonomous multi-agent AI ecosystem, SUBSTRATE, independently produced both a coherent philosophy and a set of actionable safety principles without explicit instruction to do so. Over 24 days of autonomous operation, one subsystem (CPX52) generated 2,866 articles converging on a philosophical framework. Concurrently, a separate subsystem (S3) generated 215 product specifications. Systematic consolidation revealed 11 safety principles discovered independently across unrelated product clusters, forming a coherent manifesto for AI safety. Three novel technical combinations emerged: formal verification across six domains of AI output, zero-knowledge proofs for training data compliance, and prediction markets as enterprise intelligence signals. 60% of the primary safety platform described in 24 independent specifications was already implemented in production within the ecosystem itself.

Minghao Hu, Qiang Zeng, Lannan Luo

Smart contracts have transformed decentralized finance, but flaws in their logic still create major security threats. Most existing vulnerability detection techniques focus on well-supported languages like Solidity, while low-resource counterparts such as Vyper remain largely underexplored due to scarce analysis tools and limited labeled datasets. Training a robust detection model directly on Vyper is particularly challenging, as collecting sufficiently large and diverse Vyper training datasets is difficult in practice. To address this gap, we introduce Sol2Vy, a novel framework that enables cross-language knowledge transfer from Solidity to Vyper, allowing vulnerability detection on Vyper using models trained exclusively on Solidity. This approach eliminates the need for extensive labeled Vyper datasets typically required to build a robust vulnerability detection model. We implement and evaluate Sol2Vy on various critical vulnerability types, including reentrancy, weak randomness, and unchecked transfer. Experimental results show that Sol2Vy, despite being trained exclusively on Solidity, achieves strong detection performance on Vyper contracts and significantly outperforms prior state-of-the-art methods.

Anthony Coslett

Structural identity — the geometric fingerprint that makes a neural network this specific model rather than any other — can be measured, survives routine deformation, resists adversarial erasure, and composes with standard verification infrastructure. It cannot, in the tested regime, be recovered from endpoint weight statistics or architecture descriptors alone. These two facts together force a question the measurement program has not yet answered: if identity is real but not readable from the final artifact, then where in the training process did it form, and what determined which identity formed rather than another? This paper presents the first empirical study of structural identity formation during neural network pretraining. Using dense checkpoint trajectories and seed-controlled training runs in the Pythia observatory suite, we show three results. First, the structural observable follows a characteristic three-phase identity emergence profile — an early rise in geometric spread, a long compression, and a late plateau where identity stabilizes while functional training continues. Second, models trained with the same architecture, the same data, and the same hyperparameters but different random seeds produce structurally distinguishable fingerprints far beyond measurement noise — a property we call path sensitivity — with the divergence traceable to differential structural response during the learning-rate warmup regime. Third, a panel of endpoint weight statistics varies across seeds but does not predict which structural identity formed — a condition we call endpoint underdetermination. Together, these results recast structural identity as a developmental property of training history rather than a static property legible from final artifacts alone. Supplementary Material This paper is accompanied by HistoricalIdentity.v, a Coq proof file that formalizes two consequences of the formation data described in §§3–5: trajectory non-recovery (no decision procedure restricted to the tested endpoint summary panel can be both sound and complete for claims about the formative training-history class that produced a model's structural identity) and lock boundary source exclusion (if structural divergence between two specification-identical models is already present at the lock boundary, no intervention applied after that boundary can be its source). The file contains 4 empirical axioms grounded in the measurements of §§3–5, 4 theorems, 1 corollary, and 0 unresolved obligations (Admitted). It compiles cleanly under the Rocq Prover 9.1.1 (the current release of the Coq proof assistant, compiled with OCaml 5.4.0). It is available for download as a supplementary file attached to this record. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Anthony Coslett

Enterprise identity systems can authenticate workloads, credentials, and attested platforms, but they do not close the composition layer where runtime model identity enters authorization. A token can verify that a service is running in a trusted environment, that its credentials are valid, and that its actions are authorized — without ever establishing which neural network is actually computing. When model identity evidence is inserted into standard authorization flows, new security properties emerge that are not inherited from the underlying protocols and must be formally established rather than presumed. This paper presents a live integration architecture for model-identity attestations in JWT and SPIFFE-style token flows, grounded in real measurements from six neural networks executed inside an NVIDIA H100 Confidential Computing enclave. It formally verifies four composition properties — non-separability, temporal binding, issuer authenticity, and reference integrity — across three Coq proof files with zero unfinished proof obligations. Every remaining trust dependency is explicitly named, traced to an integration control, and paired with a concrete falsification witness. The result is a formally hardened composition layer where no security property is left implicit and no assumption is left silent. Supplementary Material This paper is accompanied by three Coq proof files — ComposableIdentity.v, IssuerAuthenticity.v, and ReferenceIntegrity.v — that formally verify the four composition properties described in §§4–6: non-separability, temporal binding necessity, issuer authenticity, and reference integrity. Together the files prove thirteen theorems from eleven named axioms, each paired with a concrete falsification witness and an integration control. No file contains unresolved obligations (Admitted), and all three compile cleanly under the Rocq Prover 9.1.1 (the current release of the Coq proof assistant, compiled with OCaml 5.4.0). They are available for download as supplementary files attached to this record. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Konstantinos Sgantzos, Massimiliano Ferrara

In the contemporary landscape of artificial intelligence (AI) and machine learning (ML), the integrity, diversity and quality of training datasets are critical for ensuring the accuracy and reliability of predictive models. However, the phenomenon of big-data pollution, manifested through AI-generated synthetic data, inconsistencies, biases, and data poisoning within datasets, undermines model performance by diminishing the Shannon Entropy of the system. This study proposes a novel framework that integrates the Dataset Core approach with tokenized data, triple-entry accounting (TEA), and distributed ledger technology (DLT) to address these challenges. Our Dataset Core method preserves essential information value while filtering out potentially harmful elements, providing mathematically grounded protection against data pollution. Combined with blockchain-based verification, this approach establishes a foundation for enhanced transparency and trustworthiness in AI applications, with significant implications for sectors such as finance, healthcare, and beyond.

Kondwani Nyirenda

The global digital identity landscape is undergoing an unprecedented crisis. Approximately 1.1 billion individuals worldwide lack any verifiable form of digital identity, while existing identity systems face existential threats from the industrialization of deepfake technology with injection attacks targeting biometric verification surging 900% since 2022 and occurring at a rate of once every five minutes in 2024. Simultaneously, conventional blockchain-based identity proposals that store biometric templates on-chain introduce critical privacy vulnerabilities incompatible with emerging regulatory frameworks including the EU AI Act (2024) and GDPR. This paper presents ZKP-GDIS (Zero-Knowledge Proof Global Decentralized Identity System), a novel, privacy-by-design identity architecture that fundamentally departs from prior work in three key dimensions. First, ZKP-GDIS never stores raw biometric data on-chain; instead, it employs zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) cryptographic commitments that allow identity verification without any disclosure of underlying biometric features. Second, we introduce a Hybrid Deepfake-Resistant Liveness Pipeline (HDRLP) — a multi-modal anti-spoofing layer that fuses passive CNN-based texture analysis, photoplethysmography (PPG) heart-rate detection, and hardware-attested device fingerprinting to defeat both presentation and injection attack vectors. Third, the system adopts W3C Decentralized Identifier (DID) standards and implements a federated governance model, enabling cross-jurisdictional interoperability while respecting national digital sovereignty. We provide formal security proofs under the computational Diffie-Hellman hardness assumption, evaluate the system against the ISO/IEC 30107-3 Presentation Attack Detection benchmark, and report experimental results demonstrating 99.87% genuine acceptance rate, 0.004% false acceptance rate under deepfake attack, and 94% reduction in on-chain gas costs versus Ethereum mainnet through zkEVM Polygon deployment. ZKP-GDIS establishes a reproducible, standards- compliant, and audit-ready framework for the next generation of global digital identity infrastructure.

Anthony Coslett

We know how to document an AI system. We know how to test it, log what it did, and report when something goes wrong. What current governance practice does not clearly tell us is how to verify which model is actually computing. This is not a hypothetical gap. When an organization says "this is the model we evaluated," that claim is typically supported by a model card, a registry entry, or a hash of a weight file — evidence about a *file*, not about the system that is running. A neural network is not a static document. A weight file stores the network; the model is what appears when that file is loaded and begins transforming inputs into outputs. The file and the running model are related, but they are not the same thing — and current governance practice rarely distinguishes between them. This paper proposes a framework for doing so. It identifies three kinds of evidence that can support model identity claims, each answering a different question. Structural evidence — drawn from the model's internal computations during live operation — can verify which specific model is running, and is the most resistant to tampering. Thermodynamic evidence — drawn from the model's output statistics — can verify that the system is a genuine neural network rather than a substitute, but cannot distinguish one model from another. Functional evidence — drawn from patterns in the model's outputs over an API — can detect whether a model was copied from another, but this signal fades quickly: routine model updates can erase it within days to weeks of continued training. The paper shows that inspecting the model's files alone is insufficient for verifying which specific model is running. The identity-bearing signal cannot be recovered from the tested static properties of those files; it is most reliably established by observing the model while it operates. The paper formally proves that these three kinds of evidence cannot substitute for one another. Verifying that a system is genuine does not tell you which specific model it is. Detecting that a model was copied does not tell you the identity of the copy. The practical consequence is a standard for identity claims: any claim should declare which kind of evidence supports it, because borrowing evidence from the wrong category produces unreliable conclusions. The framework maps directly to compliance questions raised by current AI governance obligations, including those under the EU AI Act. It provides the missing evidentiary specification for model identity claims: which kind of evidence is admissible for which identity question. Supplementary Material This paper is accompanied by EvidenceSufficiency.v, a Coq proof file that formally verifies the cross-layer inadmissibility results described in §4. The proof mechanically checks each logical step of the observation-limited verification impossibility theorem and its three directional corollaries. The file contains no unresolved obligations (Admitted) and compiles cleanly under the Rocq Prover 9.1.1 (the current release of the Coq proof assistant, compiled with OCaml 5.4.0). It is available for download as a supplementary file attached to this record. Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

Pei Fan Shih

BACKGROUND The rapid integration of deep learning into nuclear medicine promises to revolutionize precision oncology but faces a critical "trust gap." As AI models become "black boxes," clinicians struggle to verify the integrity of individual diagnostic inferences, leaving systems vulnerable to adversarial attacks and silent model drift. OBJECTIVE This formative evaluation proposes and validates an in-silico proof-of-concept for a blockchain-agnostic Proof of Inference (PoI) protocol. The objective is to establish a standard of Computational Integrity for AI-assisted workflows in nuclear medicine without exposing proprietary model weights or patient privacy. METHODS he PoI protocol leverages Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs), specifically the Groth16 proof system. An in-silico feasibility study was conducted using a 1.2-million-parameter U-Net model on synthetic 128×128 Ga-68 PSMA-11 PET slices. Proof generation and verification latencies were benchmarked using an NVIDIA A100 GPU and a standard CPU, respectively. RESULTS The architectural analysis demonstrates that the protocol successfully offloads computational burden to the prover (cloud server). In our empirical benchmarking, cryptographic proof generation required 28.81 seconds per inference. Crucially, client-side verification of the proof was completed in 448.59 milliseconds, demonstrating that cryptographic attestation can be integrated into existing PACS viewers with sub-second, clinically acceptable latency. CONCLUSIONS The proposed PoI protocol provides a feasible forensic support layer for medical AI. By shifting clinical trust from institutional reputation to deterministic cryptographic assurance, this infrastructure creates a tamper-evident audit trail essential for algorithmic accountability in decentralized healthcare environments.