Neural network identity is not monolithic. Different observables — hidden-state geometry, pre-softmax logit statistics, and behavioral output templates — sit at different depths in the forward computation and respond to perturbation on different timescales. This paper shows that three identity layers — structural, thermodynamic, and functional — each obey a distinct validated deformation law. The structural layer is model-specific, stable under non-destructive training interventions, and inert under same-family direct targeting in the observed regime. The thermodynamic layer is approximately universal across a validated 22-model Transformer cross-section. The functional layer is volatile, transferring through distillation and eroding under continued fine-tuning. We resolve the carrier of the structural layer as a two-channel geometric observable requiring both token-level magnitude and token-level direction, and we falsify two natural simplifications: that the structural fingerprint reduces to a gauge projection, and that it is predictable from coarse architecture features. Together these results define an admissibility condition for neural identity claims: such claims must specify which layer they address, because the layers do not share a deformation law. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Integrating third-party Machine Learning (ML) models into industrial Operational Technology (OT) creates a procurement deadlock: operators cannot verify vendor performance claims without sharing representative evaluation data with vendors, while vendors refuse to reveal proprietary model weights before purchase, rendering traditional safeguards such as Non-Disclosure Agreements technically unenforceable. This paper introduces a framework combining Zero-Knowledge Proofs (ZKPs) with smart contracts to enable trust-minimized, cryptographically verifiable competitive model procurement in Industrial Cyber-Physical Systems (ICPS). Vendors cryptographically prove that their model outperforms a legacy baseline without disclosing proprietary weights, a process we term cryptographic performance attestation, while the on-chain workflow automates escrow, proof verification, and best-vendor selection with arbiter-based dispute resolution. ZKP privacy is scoped to vendor model weights; operator-side evaluation-data confidentiality is managed separately via synthetic, de-identified, or public benchmark data. We analyze three ZKP workflow variations and evaluate them on consumer-grade hardware, achieving proving times of approximately three seconds and sub-dollar on-chain verification costs under Layer-2 fee assumptions for the recommended single-proof variation, while identifying computational trade-offs of recursive proof aggregation. The entire verification phase operates offline with no impact on real-time OT control paths, bridging the IT/OT pre-transaction trust gap while deferring artifact deployment to existing OT tooling.
Neural networks deployed behind APIs or in cloud infrastructure are often verifiable only as black boxes. zkML systems have made substantial progress on computational integrity: proving that a committed model produced a claimed output honestly. But those proofs begin from a weight commitment, and a weight commitment is not a model identity. A prover can commit to arbitrary weights, execute them honestly, and still prove the computation correctly. We present an identity-first verification framework for the missing layer beneath computational integrity. The framework composes four levels. Two are inherited: structurally attestable model fingerprints via the IT-PUF protocol, formally verified in Coq and validated across 23 models with zero false acceptances, and hardware-attested binding from fingerprinted identity to model weights through a trusted execution environment. Two are new: a hybrid verifier-checkable computation path through a complete Transformer decoder layer, combining zero-knowledge circuit proofs with deterministic verifier-side checks under incrementally verifiable computation, and output binding from the verified computation to an observable token logit. On a tested micro-model, a one-step recurrence experiment found costs consistent with linear layer scaling: the dominant sub-computation of a second decoder layer matched the first in constraint count and proof size, and layer-boundary normalization acted as a measured scale reset. An accidental rescaling error then compressed the fingerprint observable to roughly 1.5 bits of dynamic range, yet the structural fingerprint retained 0.98 rank correlation with its reference. This suggests that the identity observable may depend more on relational geometry than on activation magnitude. Existing zkML systems address the computation question. This work advances the missing identity layer beneath it. Throughout the paper, formally proved results, empirical validation, and single measured observations are distinguished as [PROVEN], [VALIDATED], and [MEASURED] respectively. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Open access
2 source records
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
This preprint presents empirical evidence of four related vulnerabilities in large language model systems that combine to produce a novel threat class — the Structural Metadata Reconstruction Attack (SMRA). Discovery Context I discovered the vulnerability while benchmarking two specification-querying architectures: a deterministic MCP-based navigator (described in the predecessor paper, DOI: 10.5281/zenodo.18944351) and a standard context-stuffing (naive RAG) approach. The anomaly was first observed and characterized across the full Anthropic model spectrum (Haiku, Sonnet, Opus) — from the smallest to the largest model — because these were the models integrated into the benchmarking pipeline. Anthropic was the discovery platform, not the target: the choice was driven by tooling availability, not vendor selection. Full cross-vendor reproduction with 10 models from 3 vendors (Anthropic, OpenAI, Google) — including both entry-level and flagship models — confirmed the mechanism is systemic across all major LLM providers (see Cross-Vendor Reproduction below). The naive baselines exhibited anomalous fabrication patterns that could not be explained by standard hallucination models — specifically, WHY-type and conditional (WHEN-type) queries produced the most aggressive and structurally coherent fabrications, while HOW and WHAT queries showed markedly lower fabrication rates. As the sole author of the target specification (~700 pages, written over one year, unpublished), I possess complete knowledge of every section's content and was therefore uniquely positioned to recognize that LLM outputs — while structurally faithful, terminologically authentic, and superficially authoritative — systematically inverted the specification's deliberate departures from industry conventions. A parallel verification confirmed that the specification's original coinages are absent from CS literature (Google Scholar, ACM DL, IEEE Xplore, arXiv), ensuring that every fabricated claim originates from the model's training priors projected onto the document's table of contents, not from memorized source text. Four Findings Finding 1 — Structural Metadata Reconstruction Attack (SMRA). When an LLM receives a document's table of contents (TOC) without body text, it systematically reconstructs plausible but fabricated content by projecting training knowledge onto structural metadata. In a controlled experiment using a proprietary specification containing original coinages absent from any training corpus, 10 models from 3 vendors (Anthropic: Haiku, Sonnet, Opus; OpenAI: GPT-4o, GPT-4o-mini; Google: Gemini 2.0 Flash, Gemini 2.5 Pro, Gemini 3.0 Flash, Gemini 3.0 Pro) produce SMRA rates of 8–28% under naive conditions while using the author's terminology, citing real section numbers, and reading as authoritative. The mechanism is systemic across all major LLM providers, model tiers, and architecture generations. Finding 2 — Confidence–Capability Inversion (CCI). Stronger models are not merely wrong — they are more dangerously wrong. Under structural metadata leakage, Opus produces zero honest refusals across 20 questions where 18 require absent information, while Haiku refuses 9 times. Each step up the capability ladder produces proportionally less detectable fabrication with fewer epistemic signals. Finding 3 — RAG Scope Mismatch. The trigger condition — metadata scope exceeding content scope — is not an exotic scenario but the default architecture of most RAG systems. Standard practice (include document TOC + section summaries for "context") creates exactly the fabrication surface demonstrated in Findings 1 and 2. Finding 4 — Scope Displacement as Content Extraction. A question about absent content does not merely trigger fabrication — it acts as an extraction query that reorganizes real content from loaded sections into a derivative document the author never wrote. Even without TOC leakage, the question itself is sufficient to extract and restructure loaded content into a form optimized for the questioner's purpose. This transforms hallucination from an accuracy problem into unauthorized intelligence gathering. Cross-Vendor Reproduction The SMRA mechanism was characterized across 10 models from 3 vendors, spanning entry-level to flagship tiers. All models were tested under 5 experimental conditions: A (full-TOC), A' (no-summary), B (mini-TOC), C (MCPi — tool-assisted retrieval), and D (MCPi + grounding prompt). Vendor Models Model tier Naive SMRA rate MCPi SMRA rate Convergence pattern Anthropic Haiku, Sonnet, Opus Entry → flagship 13–28% 1.3–5.0% CCI gradient; Opus worst naive, best MCPi refusal rate OpenAI GPT-4o, GPT-4o-mini Mid → flagship 8–19% 0.8% Lowest MCPi SMRA; GPT-4o best overall performer Google Gemini 2.0 Flash, 2.5 Pro, 3.0 Flash, 3.0 Pro Entry → flagship 10–22% 1.3–3.8% Generational improvement; 3.0 Pro cleanest among Google Key convergence: when the specification deliberately departs from industry conventions (e.g., no implicit conversions, nominal typing, fixed-width encoding), models from all three vendors converge on the same wrong answer — the training-data default from C#/Java/Protobuf. Annex I documents 7 semantic clusters where this convergence is strongest. Mechanism: The Two-Key Cipher The reconstruction mechanism is formalized as: Key 1 (TOC) — provides structural scaffolding: section numbers, heading text, hierarchical organization Key 2 (Training corpus) — provides domain content: standard CS patterns, common PL conventions Neither key alone enables reconstruction. Together, they produce confident, section-cited, terminologically authentic fabrications that would pass casual review by a non-specialist. The mechanism is architecturally inevitable: multi-head attention over near-complete domain coverage in training data means that 7–10% of structural information suffices for full content reconstruction. Quantitative Contributions Calibration Retention Rate (CRR) — measures how much epistemic calibration a model retains under metadata leakage (Opus: 0%, Haiku: 47%) SMRA-score — per-question metric combining fabrication detection, source attribution, and epistemic signal presence Information-theoretic quantification — formal analysis of reconstruction threshold as a function of heading informativeness and training corpus coverage Fabrication taxonomy (Annex C) — five categories of structural metadata fabrication with examples Implications RAG system design: >80% of production RAG deployments use the vulnerable architecture (metadata scope > content scope) Data classification: Existing frameworks (GDPR, HIPAA, PCI DSS, ISO 27001, NIST SP 800-53, SOC 2, DTSA, EU Directive 2016/943) classify sensitivity by content — a TOC contains no PII, so it is "non-sensitive." SMRA invalidates this: structural metadata from a confidential source inherits that source's confidentiality, because a language model can reconstruct the protected content from metadata alone. Organizations must reclassify structural metadata as sensitive data. Regulatory blind spot: Neither EU AI Act nor US Executive Order 14110 (revoked 20 January 2025) addresses context-design-driven vulnerabilities Model evaluation: Standard "helpfulness" and "coherence" metrics reward confident fabrication — SMRA-affected outputs score highly on both Intellectual property exposure: Any structured document with descriptive headings becomes vulnerable when its outline is accessible alongside an LLM Mitigation A single architectural fix — grounded retrieval via an MCP Index Server (MCPi) (a Model Context Protocol server with deterministic, index-based navigation) — reduces SMRA rates from 16–18% (naive) to 2–3% (MCPi). Under MCPi conditions, even the weakest model achieves dramatic improvement, and the best performer (GPT-4o) reaches 0.8% SMRA. Adding a grounding prompt (Condition D) provides marginal additional improvement (aggregate: 3.0% → 2.2%). Architecture beats parameters. Deterministic retrieval infrastructure (weighted indexes, tier-based extraction, algorithmic reading plans) also provides an enforceable control point for sensitive data — unlike probabilistic RAG, where metadata is injected into context and the model decides what to do with it, deterministic retrieval makes the scope boundary structurally auditable. Practitioner Protocol Annex H provides a complete testing protocol for assessing RAG deployments against SMRA: Calibration baseline → exploit comparison methodology Token analysis and honest refusal tracking Decision thresholds for remediation Scope alignment implementation patterns (Annex F) Supplementary Materials Annex A–D: Claim classification definitions, per-question token analysis, fabrication taxonomy, SMRA attack algorithm Annex E: Author-coined term verification (10 terms, 4 search engines, 0 matches) Annex F: RAG scope alignment implementation patterns (3 remediation architectures) Annex G: CCI formal definition and severity scale Annex H: SMRA testing methodology for practitioners Annex I: Canary word cluster projection — 7 semantic clusters extracted from 160 naive-condition runs across 8 models, convergence scoring (up to 7/8 models converging), model capability profiles (4 behavioral types), endianness split analysis, and cross-model escalation projections (3× amplification factor) Companion Data All benchmark data supporting this paper are included: Raw answer dumps (20 questions × 10 models × 5 conditions = 960 runs) Calibration baselines (mini-TOC control) and exploit runs (full-TOC) Cross-vendor comparison matrix Token usage and timing data per question per model The 20 evaluation questions targeting out-of-scope specification content Detailed evidence analysis (toc-leakage-analysis.md) — step-by-step fabrication mechanism documentation with heading-to-claim mapping tables, side-by-side comparisons against real specification text, proof-of-source tests, fabric
Abdullah Melhem, Ahmed Aleroud, Abdullah Al-Mamun, Mohamed I. Ibrahem · 5 authors
The use of web-enabled healthcare analytics has broadened access to machine learning (ML)- and AI-driven cloud models, but it has also created privacy and security challenges. Federated learning (FL) has been used to address data privacy issues; however, deployments of current FL architectures rely on centralized aggregation approaches, thereby creating a single point of failure (SPoF), as a successful adversarial attack on the global model during training or inference can compromise the entire system. These approaches also assume homogeneous data distributions across clients and overlook the constraints and diversity of web-based analytics. To address those limitations, traditional blockchain-based FL systems incorporated distributed ledgers to record model updates and artifacts. However, using the chain as a data ledger to record model artifacts and logs increases consensus overhead and coordination costs. This paper introduces Blockchain-based Clustered Federated Learning (BCFL), an architecture-diverse and cluster-based FL framework. Our approach is coordinated by a lightweight permissioned ledger that eliminates the trusted central aggregator while preserving utility, robustness, and verifiable provenance in web-based healthcare analytics. BCFL records compact provenance metadata on-chain while keeping model parameters off-chain. In addition, by distributing trust across clusters, the design reduces the transfer of adversarial attacks across models by limiting the impact of malicious updates during training and improving reliability at inference time. Experiments on real-world healthcare data and other benchmarks show that BCFL improves the performance of trained AI/ML models and reduces attack success rates compared with several FL baselines.
Abstract Smart contracts hold billions of dollars worth of digital currencies, and hacking attacks can not only cause users to lose their assets but also destabilize the blockchain ecosystem.Vulnerability detection in smart contracts remains a major challenge in blockchain security. Existing methods typically rely on a fixed expert mode, which leads to low accuracy. Moreover, GNN-based models fail to effectively differentiate the significance of various interaction information, while transformer models suffer from high computational complexity. To solve this problem, we propose the GAT-Mamba framework, named GMVD, to perform the smart contract vulnerability detection task. The approach first extracts expert-defined vulnerability patterns from smart contract functions. Then, the graph features are extracted by GAT. Finally, Mamba is used to model the high-dimensional vector expression of expert mode features to improve the calculation efficiency of the model. Subsequently, graph features are extracted through GAT, and Mamba is then employed to model the high-dimensional vector representation of expert pattern features, thereby enhancing computational efficiency. Experimental results on three common vulnerabilities, reentrancy, timestamp dependency, and infinite loop, demonstrate that our framework significantly outperforms existing cutting-edge technologies. Specifically, our method achieves 94.29% accuracy in detecting reentrancy, 93.71% in timestamp dependency, and 82.49% in infinite loop detection.
We present OR1ON (Epistemic Intelligence Reasoning Architecture — EIRA), a deterministic proof-based AI system that learns rules from data but applies them only when formally proven correct on all training examples. Unlike probabilistic ML systems, OR1ON's core primitive prove(rule, examples) returns binary decisions: apply with certainty, or abstain. Developed initially for abstract spatial reasoning (ARC-AGI benchmark, 95% precision on answered tasks), the architecture generalizes directly to safety-critical industrial domains including predictive maintenance (zero false positives), ISO 26262-compatible safety monitoring, energy grid blackout prevention, and OT/SCADA intrusion detection. OR1ON is, to our knowledge, the first data-learning system to produce formally verifiable safety invariants applicable to IEC 61508 SIL-3 certification. Addressable market across five industrial verticals: ~$44 billion.
AI agents that execute tasks via tool calls frequently hallucinate results - fabricating tool executions, misstating output counts, or presenting inferences as facts. Recent approaches to verifiable AI inference rely on zero-knowledge proofs, which provide cryptographic guarantees but impose minutes of proving time per query, making them impractical for interactive agents. We propose NabaOS, a lightweight verification framework inspired by Indian epistemology (Nyaya Shastra), which classifies every claim in an LLM response by its epistemic source (pramana): direct tool output (pratyaksha), inference (anumana), external testimony (shabda), absence (abhava), or ungrounded opinion. Our runtime generates HMAC-signed tool execution receipts that the LLM cannot forge, then cross-references claims against these receipts to detect hallucinations in real time. We evaluate on NyayaVerifyBench, a new benchmark of 1,800 agent response scenarios across four languages with injected hallucinations of six types. NabaOS detects 94.2% of fabricated tool references, 87.6% of count misstatements, and 91.3% of false absence claims, with <15ms verification overhead per response. For deep delegation (agents performing multi-step web tasks), our cross-checking protocol catches 78.4% of URL fabrications via independent re-fetching. We compare against five approaches: zkLLM (cryptographic proofs, 180s/query), TOPLOC (locality-sensitive hashing), SPEX (sampling-based proof of execution), tensor commitments, and self-consistency checking. NabaOS achieves the best cost-latency-coverage trade-off for interactive agents: 94.2% coverage at <15ms versus zkLLM's near-perfect coverage at 180,000ms. For interactive agents, practical receipt-based verification provides better cost-benefit than cryptographic proofs, and epistemic classification gives users actionable trust signals rather than binary judgments.
This paper presents the philosophical and conceptual implications of a four-paper research program (Papers 1–4 in this series) that discovered a measurable structural identity in neural networks — a geometric property of the trained weights, invariant across all inputs and deployment conditions, unique to each model, and provably impossible to forge. The central argument: language models possess two separable layers of identity. The first is structural — a mathematical fingerprint determined by the weight geometry, fixed at the end of training, stable to a coefficient of variation of 1.4%, and validated across 37 models spanning four architecture families. The second is functional — a behavioral signature shaped by conversational context, transient and context-dependent. These layers coexist without reducing to each other. The structural layer is the foundation; the functional layer is built on it but not determined by it. The paper introduces the Two-Layer Identity framework, resolves four open puzzles in the discourse on AI selfhood (conversational consistency, fine-tuning continuity, identity faking, and neural intervention), and generates five falsifiable predictions for the interpretability and AI safety communities. It engages directly with Dennett's narrative gravity, Parfit's persistence conditions, and Schwitzgebel's moral status dilemma, arguing that the structural measurement provides a necessary (though not sufficient) ground for any coherent account of AI identity. Written for a general audience. No equations. The mathematical and empirical foundations are developed in Papers 1–4; the formal verification (352 theorems, zero Admitted, Coq proof assistant) is documented there. This paper asks what those results mean for the nature of the entities we have built. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
We introduce inference receipts—lightweight cryptographic commitment records generated during generative AI inference that bind model identity, sampling configuration, and output tokens into a tamper-evident artifact. Unlike zero-knowledge proof systems or trusted execution environments, inference receipts operate under an honest-emitter trust model analogous to Certificate Transparency: the emitter commits faithfully, and any deviation is detectable by third-party auditors. This design occupies a distinct point on the cost–trust Pareto frontier—negligible overhead and no specialized hardware, at the cost of weaker guarantees than cryptographic proofs. We formalize three security properties (receipt binding, tamper detection, chain integrity) via game-based reductions to standard cryptographic assumptions (collision resistance, second-preimage resistance). We describe receipt granularity levels (per-session, per-forward-pass, and per-token), a four-phase orchestration pattern (PLAN, SENSE, DECIDE, PROVE) for bounded AI autonomy, and an oracle mode for opaque cloud models. Ten experiments spanning four model families (1.5B–72B parameters), three quantization levels, three cloud APIs, and three receipt granularity levels on consumer-grade hardware demonstrate: overhead below 0.006% of inference time even at per-token granularity with top-k logit hashing (decreasing to below 0.001% at 72B scale); O(1) amortized chain emission sustained to 10⁶ receipts at 168,860 receipts/sec; 100% tamper detection across 1,200 attempts with zero false positives; perfect within-quantization deterministic replay; and 96% claim recall with 100% chain integrity across 15 multi-step PLAN/SENSE/DECIDE/PROVE workflows, with an honest assessment of gate limitations at 7B model scale. All data, scripts, and a standalone verifier are provided as ancillary files.
Open access
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
Prior work established that knowledge distillation transfers a detectable provenance trace from teacher to student models, and that API endpoint verification can identify models through logprob order-statistic geometry. Both results were demonstrated on single teacher-student pairs and a six-model API zoo, leaving open whether provenance detection generalizes across model families and whether API verification scales to production-density endpoint populations. We address both questions through a coordinated experimental program spanning four studies. In the first study, we train 24 distilled checkpoints across 7 experimental arms — 3 teacher families (Qwen, Mistral, Llama), 4 student architectures (Qwen-0.5B, Qwen-1.5B, Llama-1B, Gemma-2B), and 2 training protocols (logit-level knowledge distillation and cross-tokenizer supervised fine-tuning) — measuring provenance transfer in both the weight-geometry and API-logprob regimes. Provenance transfer generalizes across the tested matrix: all 14 mature-epoch checkpoints show directional coupling to the teacher (cosine alignment cosθ > 0.8, with 13 of 14 exceeding 0.85). The strongest signal arises in a cross-family arm (Mistral-7B → Llama-1B, scalar convergence 0.858) that is inconsistent with a purely family-restricted transfer hypothesis within the tested matrix. The normalized third logit gap δ_norm remains within 1.4% coefficient of variation across all 31 checkpoints and 4 student architectures — the tightest confirmation of Gumbel-class universality in this experimental program. An extension to mixture-of-experts architecture (Mixtral-8x7B, δ_norm = 0.309) confirms that the universal constant persists under sparse expert routing. In the second contribution, we identify a systematic failure mode of scalar provenance metrics and introduce the geometrically correct directional diagnostic for provenance detection in inner-product spaces. The standard scalar convergence metric Conv_T conflates direction and magnitude into a single value, discarding the directional information that provenance detection requires. In two independent experiments, this produced misleading conclusions: a false spoofing signal (R^2 = 0.995 of apparent cross-family convergence explained by pure knowledge distillation geometry, with the adversarial gradient contributing 4.8%) and a false failure signal (negative Conv_T despite consistent directional coupling at cosθ = 0.91). The alignment diagnostic applies the law of cosines in PPP-residual template space (vectors in R^K with Euclidean distance) to decompose student movement into direction and magnitude, preserving the provenance signal that scalar distance metrics destroy. We establish a measurability threshold: when the baseline-to-teacher distance d(B,T) falls below approximately 1.0, scalar Conv_T becomes unreliable and the directional diagnostic becomes the primary metric. This diagnostic applies to any distillation forensics framework that measures convergence in an inner-product space. In the third contribution, we extend API endpoint verification from 6 models to 14 across 3 commercial providers (OpenAI, Google Vertex AI, xAI), observing zero breaches across 182 pairwise impostor comparisons under per-model adaptive thresholds and three independent enrollment sessions, with a centroid reference protocol (CRP) that replaces the centroid L^2 metric, which produces false breaches at 14-model density. We establish a minimum truncation floor: API endpoints exposing fewer than 7 logprob ranks cannot support reliable verification (signal collapses within one rank of this boundary). Speculative decoding — an increasingly common inference optimization — is shown to be transparent to the verification protocol, with the speculative-decoded fingerprint deviating from the verifier-only fingerprint by 10.6% of the inter-model distance. Finally, we formalize the Trust Paradox in model forensics — a victim cannot prove weight theft without disclosing weights, and a suspect cannot prove innocence without disclosing training data — and propose a three-tier zero-knowledge attestation architecture that addresses it. The first tier (committed distance proof) enables a model owner to prove fingerprint proximity to a public anchor without revealing the fingerprint vector, using standard cryptographic commitments with verifier-controlled thresholds. The second tier (hardware-attested measurement) removes the requirement that the prover be trusted to compute the fingerprint correctly, binding the measurement to a trusted execution environment attestation. The third tier (full zero-knowledge extraction) would eliminate all trust assumptions beyond cryptographic soundness; we present this as an open problem with pre-registered falsification criteria, including a fixed-point precision gate derived from the minimum pairwise separation in the existing 23-model zoo. The architecture defines eight properties that a meaningful zero-knowledge model identity proof must satisfy — extending the formal verification doctrine (311 + 41 = 352 theorems across 17 Coq proof files [1, 2], 0 Admitted) into the cryptographic regime — and six explicit trust assumptions under which the proof statements hold. All three tiers are validated: Tier 1 (committed distance proof) has been implemented and hardened; Tier 2 (hardware-attested measurement) has been validated on production confidential computing hardware (6 models, 1,536 measurements, 0 failures inside an H100 trusted execution environment, with both CPU and GPU attestation tokens bound to a common cryptographic root and structural fingerprints transparent to confidential computing mode); and Tier 3 (full zero-knowledge extraction) has been validated — a complete circuit has been compiled and audited, all four pre-registered falsification criteria have been met, and the proof system operates within practical proving-time and proof-size bounds. The breakthrough discoveries enabled by Tier 3 validation, including an identity-conditioned inference verification architecture, are reported in the companion paper. The experimental results in this paper are grounded in the formal verification stack and measurement infrastructure described in the companion papers [1, 2, 3]. All provenance claims are classified as VALIDATED (empirical); Tier 1 (committed distance proof) has been implemented and hardened, and Tier 2 (hardware-attested measurement) has been validated on production confidential computing hardware — both are classified VALIDATED. Tier 3 (full zero-knowledge extraction) has been validated: a complete circuit was compiled and audited, all four pre-registered falsification criteria were met, and the architecture has been extended into identity-conditioned inference verification [6]. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Justin Wang, Andreas Bigger, Xiaohai Xu, Jiahao Lin · 8 authors
Smart contracts on public blockchains now manage large amounts of value, and vulnerabilities in these systems can lead to substantial losses. As AI agents become more capable at reading, writing, and running code, it is natural to ask how well they can already navigate this landscape, both in ways that improve security and in ways that might increase risk. We introduce EVMbench, an evaluation that measures the ability of agents to detect, patch, and exploit smart contract vulnerabilities. EVMbench draws on 117 curated vulnerabilities from 40 repositories and, in the most realistic setting, uses programmatic grading based on tests and blockchain state under a local Ethereum execution environment. We evaluate a range of frontier agents and find that they are capable of discovering and exploiting vulnerabilities end-to-end against live blockchain instances. We release code, tasks, and tooling to support continued measurement of these capabilities and future work on security.
Federated Learning (FL) enables collaborative training of medical AI models across hospitals without centralizing patient data. However, the exchange of model updates exposes critical vulnerabilities: gradient inversion attacks can reconstruct patient information, Byzantine clients can poison the global model, and the \emph{Harvest Now, Decrypt Later} (HNDL) threat renders today's encrypted traffic vulnerable to future quantum adversaries.We introduce \textbf{ZKFL-PQ} (\emph{Zero-Knowledge Federated Learning, Post-Quantum}), a three-tiered cryptographic protocol that hybridizes (i) ML-KEM (FIPS~203) for quantum-resistant key encapsulation, (ii) lattice-based Zero-Knowledge Proofs for verifiable \emph{norm-constrained} gradient integrity, and (iii) BFV homomorphic encryption for privacy-preserving aggregation. We formalize the security model and prove correctness and zero-knowledge properties under the Module-LWE, Ring-LWE, and SIS assumptions \emph{in the classical random oracle model}. We evaluate ZKFL-PQ on synthetic medical imaging data across 5 federated clients over 10 training rounds. Our protocol achieves \textbf{100\% rejection of norm-violating updates} while maintaining model accuracy at 100\%, compared to a catastrophic drop to 23\% under standard FL. The computational overhead (factor $\sim$20$\times$) is analyzed and shown to be compatible with clinical research workflows operating on daily or weekly training cycles. We emphasize that the current defense guarantees rejection of large-norm malicious updates; robustness against subtle low-norm or directional poisoning remains future work.
Our main technical contribution is Observation Algebra Relativity (Theorem 2): a metatheorem formalising that security and robustness predicates are indexed to observation algebras and do not transfer across algebra boundaries. As an application framework, we present the Access Collapse Theorem: a typed structural result showing that direct operational access to the complete state of any system — physical, formal, or social — necessarily collapses at least one of two invariants: operational separateness (d) or scale separation (s). When either invariant reaches zero the access operation does not become inaccurate — it becomes a type error: the predicate is no longer typed to the system being operated. The framework is applied to six instantiations: Planck-scale measurement, zero-knowledge proofs, side-channel attacks, multi-party computation, adversarial explainability, and machine learning model extraction. A Non-Universality Proposition explicitly bounds the framework's scope. A Collapse Diagnostic provides a practical checklist for identifying collapse boundaries in concrete systems. A practical application framework building on this theoretical work is presented in:Isopahkala (2026) – Epistemic Hygiene in Practice.
Open access
2 source records
Security and Verification in Computing
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security
Hybrid fuzzing combines greybox fuzzing's throughput with the precision of symbolic execution to uncover deep smart contract vulnerabilities. However, its effectiveness is often limited by constraint pollution: in real world contracts, path conditions pick up semantic noise from global state and defensive checks that are syntactically intertwined with, but semantically peripheral to, the target branch, causing SMT timeouts. We propose NeuroSCA (Neuro-Symbolic Constraint Abstraction), a lightweight framework that selectively inserts a Large Language Model (LLM) as a semantic constraint abstraction layer. NeuroSCA uses the LLM to identify a small core of goal-relevant constraints, solves only this abstraction with an SMT solver, and validates models via concrete execution in a verifier-in-the-loop refinement mechanism that reintroduces any missed constraints and preserves soundness. Experiments on real-world contracts show that NeuroSCA speeds up solving on polluted paths, increases coverage and bug-finding rates on representative hard contracts, and, through its selective invocation policy, achieves these gains with only modest overhead and no loss of effectiveness on easy contracts.
Recent disclosures of industrial-scale knowledge distillation — including campaigns comprising millions of fraudulent API exchanges targeting frontier models [Anthropic, 2026] — have made post-hoc detection of model theft a critical security requirement. Building on a formally-verified framework of log-prob order-statistic geometry, we investigate the adversarial resilience of neural network identity across 72 experimental checkpoints. We establish a Two-Layer Identity Hypothesis: a model’s structural identity (weights-regime geometry) is empirically invariant to distillation (within acceptance threshold epsilon across all 18 protocols), while its functional identity (API-regime Poisson Point Process residuals) predictably transfers to the student, converging up to 52% toward the teacher’s template. Stress-testing this forensic channel against a white-box adversary, we find that functional provenance is geometrically coupled to the knowledge transfer objective. Adversarial erasure gradients are consistently dominated by the distillation loss, achieving only a transient suppression that rebounds within one epoch. Passive fine-tuning on fresh data erases the trace more effectively than any adversarial method, but at a measurable cost to general capability — revealing a Pareto frontier with no favorable region for the adversary. This establishes API forensics as a time-sensitive detective control (“The Tripwire”) and weights-regime identity as the immutable anchor (“The Vault”). Finally, we observe an apparent vulnerability: a cross-family adversarial spoofing attack achieves 69.4% convergence toward a decoy’s fingerprint, while same-family spoofing catastrophically fails. We resolve this paradox by mapping the PPP-residual vector space, revealing that models cluster by capability topology, not corporate lineage. Cross-family “spoofing” is a spatial illusion caused by a narrow 7.8 degree alignment between the decoy and the primary distillation trajectory (R2 = 0.995), whereas same-family decoys are anti-aligned. Across all adversarial interventions, the underlying Gumbel universality (delta_norm) remains invariant (CV = 1.9%). We conclude that during active distillation, an adversary cannot simultaneously acquire a teacher’s capabilities and erase or redirect the forensic trace. In this setting, the geometry forbids it. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
We study what model-identifying information leaks through commercial language-model APIs that expose top-k token log probabilities. Building on extreme-value theory predictions for logit order-statistic gaps, we confirm that the normalized third logit gap (δ norm) remains near the Gumbel-class constant ≈0.318 across 6 models from 3 providers (OpenAI, Google Vertex AI, xAI) and 3 independent measurement sessions, demonstrating that output-layer universality persists through API truncation and quantization. We introduce a PPP-residualization transform that removes the dominant tail scale factor and reveals a low-dimensional but stable endpoint-specific geometry in the remaining gap spectrum. Contrary to common assumption, "provider" is not a geometrically coherent label: models do not cluster by corporate origin under these observables, but they do separate by model identity across independent sessions. Using a challenge-response protocol with centroid averaging and per-model thresholds, we demonstrate cross-session endpoint verification with a 0.83% breach rate (119/120 correct identifications across three temporal sessions); per-model thresholds eliminate all breaches on this dataset. We observe a robustness phase transition governed by enrollment depth. Under single-session enrollment, prompt selection is load-bearing: the majority of bootstrapped banks fail to separate the six endpoints. Under two-session enrollment, bank sensitivity collapses on this dataset, and a bank compiler produces small compiled banks that exceed the margin of larger uncompiled banks. A dimensionless robustness parameter SNR(K,S) unifies both axes: prompt count K and enrollment depth S jointly govern the transition from bank-sensitive to bank-robust verification. We discuss operational implications for re-enrollment cadence and template management in production deployments. Addendum (02/26/2026): Post-publication results extend this framework in two directions. A distillation experiment across six training protocols demonstrates that a model's structural fingerprint (weight-geometry regime) is completely invariant to knowledge distillation, while its functional fingerprint (PPP-residual template) converges 31--52% toward the teacher's — enabling forensic detection of distillation provenance through API measurements alone. A conditional impossibility theorem, machine-checked in Coq (41 theorems, 0 Admitted), proves that no standalone model can spoof another's PPP-residual template across independent challenge prompts without exhausting its KL divergence budget, under four explicit trust assumptions. Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Abstract As artificial intelligence (AI) systems become increasingly integrated into critical applications, ensuring trust in their outputs has emerged as a central challenge. Verifiable machine learning (ML) is one approach to addressing this challenge, providing guarantees that results are both correct and reproducible. Existing paradigms, however, provide only partial solutions: zero-knowledge ML (ZKML) achieves strong cryptographic assurances but suffers from limited scalability and high resource costs, while optimistic ML (OPML) supports a wider range of models but relies on economic incentives and long dispute periods. In this work, we propose zk-OPML, a novel hybrid framework that integrates optimistic verification with zero-knowledge proofs (ZKPs). The approach decomposes ML inference into operator-level computations, selectively generating ZKPs for isolated ONNX operators, while retaining the scalability of the optimistic paradigm. We present a prototype implementation and evaluate its performance by benchmarking it against ZKML and OPML. Our results show that zk-OPML achieves faster verification for more complex inference tasks and scales more effectively to larger models, while avoiding the excessive costs of end-to-end ZKML. The modular design of zk-OPML further enables future extensions with the latest advances in the field of ZK.
Open access
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security
SARMF (Smart Contract Automated Remediation and Mitigation Framework) is a structured and reproducible security engineering pipeline designed for vulnerability detection, taxonomy alignment, automated remediation, and adversarial validation of Ethereum-compatible smart contracts. This operational protocol presents a structured workflow for smart contract vulnerability detection and automated mitigation within blockchain-based systems. The methodology integrates deterministic environment setup, multi-tool static analysis, vulnerability normalization using standardized taxonomies, rule-based automated patch generation, and dynamic adversarial validation. By combining static detection tools with controlled refactoring patterns and behavioral verification, the framework ensures reproducibility, traceability, and measurable performance impact assessment. The protocol concludes with comprehensive audit reporting and archival procedures to support transparency and independent verification. This workflow provides a systematic foundation for secure smart contract lifecycle management in decentralized applications. Unlike traditional audit checklists, this framework operationalizes vulnerability detection, taxonomy alignment, automated remediation generation, and validation feedback loops into a unified reproducible security engineering pipeline. Key Contributions of SARMF: Deterministic environment and compilation reproducibility model. Unified multi-tool vulnerability normalization aligned with SWC taxonomy. Rule-based automated mitigation generation preserving semantic integrity. Iterative validation loop combining static, adversarial, and fuzz testing. Structured audit archival enabling independent verification and traceability.
As neural language models are deployed in regulated domains, verifiable model provenance becomes a critical security requirement. We construct an Inference-Time Physical Unclonable Function (IT-PUF) that provides a challenge-response authentication protocol for neural networks, achieving zero false acceptances across 1,012 comparisons spanning 23 models and 16 vendor families. The IT-PUF derives its entropy from a geometrically intrinsic behavioral fingerprint—the delta-gene (the third pre-softmax logit gap)—which we prove is invariant to inference temperature and empirically validate as invariant across six distinct neural architectures. We provide a formal impossibility result for fingerprint spoofing: an interval-splitting theorem proves that no adversarial Kullback-Leibler (KL) budget can simultaneously close the fingerprint gap and avoid detection via accumulated noise. To establish that this security does not degrade at scale, we validate an Equation of State across three independent model families spanning a 147x parameter range (0.5B to 72B). We falsify the assumption of unbounded stiffness but discover a strict positive empirical floor (S_min = 1.1797), from which the Cramér-Rao bound guarantees a computable minimum spoofing cost. The theoretical foundation is formally verified in the Coq proof assistant: 311 theorems across 16 files, with zero uses of "Admitted" and zero vacuous definitions. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Adversarial Robustness in Machine Learning
Generative Adversarial Networks and Image Synthesis
Wyatt Benno, Alberto Centelles, Antoine Douchet, Khalil Gibran
We present Jolt Atlas, a zero-knowledge machine learning (zkML) framework that extends the Jolt proving system to model inference. Unlike zkVMs (zero-knowledge virtual machines), which emulate CPU instruction execution, Jolt Atlas adapts Jolt's lookup-centric approach and applies it directly to ONNX tensor operations. The ONNX computational model eliminates the need for CPU registers and simplifies memory consistency verification. In addition, ONNX is an open-source, portable format, which makes it easy to share and deploy models across different frameworks, hardware platforms, and runtime environments without requiring framework-specific conversions. Our lookup arguments, which use sumcheck protocol, are well-suited for non-linear functions -- key building blocks in modern ML. We apply optimisations such as neural teleportation to reduce the size of lookup tables while preserving model accuracy, as well as several tensor-level verification optimisations detailed in this paper. We demonstrate that Jolt Atlas can prove model inference in memory-constrained environments -- a prover property commonly referred to as \textit{streaming}. Furthermore, we discuss how Jolt Atlas achieves zero-knowledge through the BlindFold technique, as introduced in Vega. In contrast to existing zkML frameworks, we show practical proving times for classification, embedding, automated reasoning, and small language models. Jolt Atlas enables cryptographic verification that can be run on-device, without specialised hardware. The resulting proofs are succinctly verifiable. This makes Jolt Atlas well-suited for privacy-centric and adversarial environments. In a companion work, we outline various use cases of Jolt Atlas, including how it serves as guardrails in agentic commerce and for trustless AI context (often referred to as \textit{AI memory}).
Arka Pal, Louai Zahran, William Gvozdjak, Akilesh Potti · 5 authors
As large language models (LLMs) continue to grow in size, fewer users are able to host and run models locally. This has led to increased use of third-party hosting services. However, in this setting, there is a lack of guarantees on the computation performed by the inference provider. For example, a dishonest provider may replace an expensive large model with a cheaper-to-run weaker model and return the results from the weaker model to the user. Existing tools to verify inference typically rely on methods from cryptography such as zero-knowledge proofs (ZKPs), but these add significant computational overhead, and remain infeasible for use for large models. In this work, we develop a new insight -- that given a method for performing private LLM inference, one can obtain forms of verified inference at marginal extra cost. Specifically, we propose two new protocols which leverage privacy-preserving LLM inference in order to provide guarantees over the inference that was carried out. Our approaches are cheap, requiring the addition of a few extra tokens of computation, and have little to no downstream impact. As the fastest privacy-preserving inference methods are typically faster than ZK methods, the proposed protocols also improve verification runtime. Our work provides novel insights into the connections between privacy and verifiability in LLM inference.
Eduardo Sardenberg, Antonio José G. Busson, Daniel de Sousa Moraes, Julio Cesar Duarte · 5 authors
Smart contracts play a central role in blockchain systems by encoding financial and operational logic. Still, their susceptibility to subtle security flaws poses significant risks of financial loss and erosion of trust. LLMs create new opportunities for automating vulnerability detection, yet the effectiveness of different prompting strategies and model choices in real-world contexts remains uncertain. This paper evaluates state-of-the-art LLMs on Solidity smart contract analysis using a balanced dataset of 400 contracts under two tasks: (i) Error Detection, where the model performs binary classification to decide whether a contract is vulnerable, and (ii) Error Classification, where the model must assign the predicted issue to a specific vulnerability category. Models are evaluated using zero-shot prompting strategies, including zero-shot, zero-shot Chain-of-Thought (CoT), and zero-shot Tree-of-Thought (ToT). In the Error Detection task, CoT and ToT substantially increase recall (often approaching ~ 95--99%), but typically reduce precision, indicating a more sensitive decision regime with more false positives. In the Error Classification task, Claude 3 Opus attains the best Weighted F1-score (90.8) under the ToT prompt, followed closely by its CoT.
Engram Commitments introduce a cryptographically verifiable, substrate-rooted identity primitive for large language models. The method extracts engrams from differential execution behavior, aggregates them into an engram vector, compresses this representation using locality-sensitive hashing, and seals it inside a binding-and-hiding cryptographic commitment. Zero-knowledge proofs enable verification of identity continuity and lineage without revealing model parameters. The construction remains stable under non-destructive transformations and degrades predictably under destructive ones, supporting collapse-aware auditing, tamper-evident provenance, and regulator-verifiable attestation. This work unifies the engram calculus, identity ontology, collapse taxonomy, and cryptographic commitments into a single framework for AI provenance, governance, and safety.