Plain-language summary Driven systems — a chemical mixture kept reacting, a fluid continuously stirred, a living cell burning fuel — typically settle into one of several possible stable states or repeating patterns. A long-standing rule of thumb, the *maximum entropy production* (MEP) principle, guesses that such a system will choose whichever option dissipates energy fastest. The guess often works, but not always: sometimes the system settles instead on a lower-dissipation option. This paper asks what governs those failures. It splits the "cost" of a rare switch between states into two distinct parts: one tied to how much energy is dissipated (the quantity MEP cares about), and a separate, time-symmetric part that measures how much restless back-and-forth activity — called *frenesy* — the switch involves. When this second, activity-based part is what tips the balance, the system selects against the MEP guess. The central result is a clean inequality: the activity imbalance between the forward and backward switching routes can never exceed half of the dissipation circulating around the loop those two routes form. Equivalently, a single number η between −1 and +1 measures how strongly activity, rather than dissipation, is steering the choice; it reaches its extreme values exactly where the system hands off from one preferred route to another. The result also implies a strict no-go: at equilibrium, where nothing circulates, this activity imbalance is exactly zero. Sustained circulation — a genuinely non-equilibrium condition — is therefore required for activity-driven, anti-MEP selection to occur at all. The bound is not a new physical law but an exact identity of the standard least-cost-path (large-deviation) description of rare events. What makes the proof work is a single structural condition: the two competing routes must be comparable under time reversal. Where that condition fails — for instance when three or more states compete and the comparison is no longer between a route and the reversal of its rival — the inequality genuinely breaks, and the accompanying code exhibits the breakdown explicitly. That is not a caveat but the sharpest evidence for what the theorem actually rests on. The reproduction package (Mendeley Data, doi:10.17632/3dy4nv92r8) The code is not part of this upload: it is deposited at Mendeley Data and linked from this record under "Is supplemented by". The package confirms the bound across random networks, chemical reaction networks, a rotating model system, and a spatial field model, and turns it into a practical diagnostic: from a single recorded trajectory — once the competing switching routes are identified — one can tell whether an observed choice was driven by activity, by dissipation, or by boundary effects. The diagnostic is not merely proposed but demonstrated. It is run *blind* on simulated trajectories: the routes are resolved from the data alone, the circulating dissipation is estimated without any knowledge of the escape prefactor, and only afterwards is the answer compared with the exact computation. At a fresh operating point the blind prediction recovers η = 0.72 against a true value of 0.725. The diagnostic also has honest limits, and the code maps them: it works inside a window of intermediate driving, and fails outside it — at weak driving the estimate is swamped by noise, and near the extreme value of η the two competing routes become indistinguishable in the data, exactly where the theory predicts they must. Why it matters Predicting which state a driven system will select is a basic, still-open problem across physics, chemistry, biology, and climate science, and several proposed selection principles — maximum entropy production, and related ideas such as dissipative adaptation — try to answer it by appealing to dissipation alone. This work shows that dissipation is only part of the story: a time-symmetric activity channel, invisible to those principles, can override them, and it does so specifically under non-equilibrium driving. Rather than refuting MEP, the result places it. MEP-like alignment holds only when the activity channel is quiet, and the inequality pins the size of the activity imbalance — the part that can reverse the outcome — to the circulating dissipation, with equality exactly at the hand-off between competing routes. A caution the paper makes explicit: reaching that extreme value is *not* generic. It requires a genuine hand-off between two distinct escape routes; in ordinary driven bistable systems the activity imbalance stays well below its ceiling, so the bound is loose rather than tight. Where the effect is strongest is precisely where a single dominant route ceases to exist — a tension the paper states rather than hides. The framework is operational. Because its key quantities can be estimated from a single observed steady-state trajectory, the bound doubles as a diagnostic that classifies the mechanism behind an observed selection — activity-, dissipation-, or boundary-driven — once the relevant routes are known. That makes the ideas testable in simulation and, in principle, in experiments on active matter, chemical reaction networks, and other driven systems where competing stable states are the rule rather than the exception. Preprint; not peer reviewed. The upload contains the manuscript (37 pp.).
The VR cycle built an operational mathematics — arithmetic, numbers,sets, forms, topology, a continuum on Brouwer's path — and onlyafterwards wrote out the logic it had been standing on: ZTL, Zero-TrustLogic (concept DOI 10.5281/zenodo.21318981). This preprint carries outthe programme "raise VR onto ZTL" and verifies, rather than declares,the thesis that VR always stood on ZTL. Three steps, every claim eitherMEASURED (machine enumeration, reproducible by the ZTL repository'stest stands) or kernel-checked in Lean 4 with the axiom footprintprinted per object. (a) Witnessed identity is a ZTL atom discipline: verdicts are packagedwith their certificates; the alive inference rules are witnessconstructors; identity on finite operational sets and on the vonNeumann register is totally earnable; groundedness of a set isorthogonal to earnability of its identity; a fully earned register isclassical. The entire verdict layer sits on the empty axiom list. Step(a) also returned a correction to ZTL itself: the verdict-warranty is atwo-grade ladder (sound — never lies; hereditary — never revoked),published same-day as ZTL v1.1 (DOI 10.5281/zenodo.21323552). (b) Choice sequences are the lazy register: the lawless stage court ofa growing sequence coincides with ZTL's global supervaluation totally(a law is knowledge: it narrows the worlds); Kripke persistence isnative to the lazy register; warranted greedy verdicts are exactly theBrouwer-assertable ones; the fallen law of identity p→p is redeemed bythe stage court — a law of logic, not of data. (c) The survival ledger: a proof survives the move onto ZTL iff itstands below the classical floor. The cycle's four-tier axiom ledgerwas therefore the ZTL-survival audit all along; sweeping 405live-audited objects plus flagship anchors shows that everything VRcalls operational moves, and what stays is exactly what the cycle hadalready flagged as classical by design, by substrate, or by borrowedplumbing. No operational theorem died in the move. The preprint also measures the delta against intuitionism: ZTL and IPCare incomparable as law-sets (p→p falls in ZTL, Jankov's weak excludedmiddle holds), agree 14/14 on premised classical rules, and part wayson every structural signature (finite matrix, disjunction property,double negation, the status of an unproved sentence). A thirdfoundations posture, not a relabelling of the second. AI disclosure: prepared with the assistance of Claude (Anthropic),Variant A architecture (human curator directing the model as architectand implementer); all mathematical content and decisions are due to thehuman author. This work was developed with Claude Fable 5. Reliabilitydoes not depend on trusting the AI: every claim is reproducible by therepositories' regressions and the Lean 4 kernel.
Distributed systems can verify whether a transaction or state transition is valid, yet they often cannot establish whether the underlying action was authorized under a meaningful, current, and context-specific expression of consent. This limitation becomes increasingly significant as autonomous software agents, artificial intelligence systems, decentralized applications, and connected devices act across organizational and technical boundaries. This article presents a nonproprietary framework for verifiable consent in distributed systems through AI-assisted identity governance and recursive zero-knowledge proofs. The framework represents consent as a structured, machine-verifiable authorization object containing the consenting subject, requesting actor, permitted action, contextual constraints, validity period, policy version, and revocation state. A bounded AI-governance layer evaluates requests against explicit policies and contextual evidence while remaining subordinate to deterministic rules, human-defined constraints, and auditable decision procedures. Approved authorization statements are transformed into privacy-preserving cryptographic proofs, allowing a verifier to confirm that relevant consent and policy conditions were satisfied without requiring disclosure of the underlying identity attributes, private data, or complete policy record. To support high-volume environments, individual proofs may be recursively composed into succinct aggregate proofs. This construction separates expensive proof generation from efficient downstream verification and provides a basis for scalable authorization auditing across distributed infrastructure. The article defines the system model, consent lifecycle, trust assumptions, proof relationships, revocation requirements, and principal security properties, including authorization soundness, privacy preservation, replay resistance, policy-version integrity, and revocation safety. It also analyzes the architectural tradeoffs associated with AI reasoning, cryptographic proving costs, governance design, key management, and interoperability. The proposed framework does not disclose implementation-specific circuits, source code, model configurations, deployment topology, or proprietary protocol parameters. Instead, it establishes a general research foundation for treating consent as a verifiable computational primitive. Potential applications include decentralized identity, autonomous agents, regulated data exchange, financial services, healthcare information systems, Internet of Things networks, and cross-platform digital authorization.
Sepehr Noroozi Chakoli, Seyed Ali Etrati, Seyed Mohammad Etrati, Hamid Haj Seyyed Javadi
Large Language Models (LLMs) are now embedded in security and privacy critical applications, yet they remain vulnerable to attacks that span their entire data life cycle. This survey provides a comprehensive, cryptography-aware review of these risks across three phases—training, inference, and deployment; while explicitly connecting them to classical security goals and primitives. We introduce a simple stage-wise risk scoring model inspired by NIST risk assessment that propagates vulnerabilities across the life cycle, and we instantiate it with a numeric example linking training time poisoning to inference time data extraction. We further propose a life cycle aligned evaluation framework that maps modern benchmarks (e.g., HarmBench, JailbreakBench, TrustLLM, DecodingTrust) to concrete threat classes and reports representative quantitative results, such as attack success rates under different defenses. Finally, we analyze the practicality of advanced defenses—including differential privacy, fully homomorphic encryption, secure multi-party computation, and zero knowledge proofs—in light of their computational overhead and deployment constraints, building on foundational cryptography and privacy works. Our goal is to bridge the gap between classical cryptographic theory and emerging LLM specific threats, and to outline research directions toward secure, privacy preserving, and rigorously evaluated LLM pipelines.
The transition from traditional paper-based voting to electronic systems has introduced significant efficiencies but has simultaneously created centralized vulnerabilities, including susceptibility to database manipulation and a lack of transparent audit trails. This research proposes a decentralized, blockchain-based voting framework designed to restore public trust through cryptographic immutability and end-to-end verifiability. By utilizing a Permissioned Proof of Stake (PPoS) consensus mechanism, the system achieves the high transaction throughput necessary for national-scale elections while maintaining a decentralized security posture that prevents any single entity from compromising the results. The technical core of this framework integrates Zero-Knowledge Proofs (ZKPs) to resolve the tension between voter anonymity and auditability. This allows voters to prove their eligibility and the validity of their ballot without disclosing their identity or specific choice, thereby upholding the sanctity of the secret ballot. To address modern security threats, the study incorporates Post-Quantum Cryptography (PQC) to safeguard against future decryption capabilities and utilizes Layer 2 scaling solutions to ensure network resilience during peak voting periods. Methodological validation was conducted through a simulated electoral environment, testing the system against common attack vectors such as DDoS and 51% attacks. The results indicate that the decentralized model significantly reduces the risk of systemic fraud compared to centralized alternatives. This paper concludes that while socio-technical barriers to entry exist, the proposed blockchain architecture provides a scalable, secure, and transparent foundation for the future of digital democracy.
Zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs) are a key technology to privacy-preserving applications today. The complexity of proof generation, however, heavily constrains throughput in latency-sensitive environments. The computational burden primarily stems from two fundamental algorithms: Multi-Scalar Multiplication (MSM) and the Number Theoretic Transform (NTT). We propose a series of optimizations for these two kernels, including computation-transfer pipelining, load balancing, and memory access fusion, achieving 1.97 × to 2.16 × proof generation speedup over a state-of-the-art open source GPU acceleration library. Our design also supports out-of-core computation, enabling the generation of large-scale ZKP proofs.
Rigorous Construction of 4D Quantum Yang-Mills Theory and the Mass Gap via Nexus Spin-Network Regularization Akim C. Setenta1 Nexus Theory Research Group | @seventy.dev Manuscript v2.1 — June 2026. Prepared for submission to arXiv (math-ph; hep-th). Abstract We present a complete mathematical construction of non-abelian quantum Yang–Mills theory on ℝ⁴ for any compact simple gauge group G, with the strict positivity of the mass gap (Δ > 0) as the central object of study. Building on the Nexus OmniScientia program together with Loop Quantum Gravity (LQG) techniques, we define the physical Hilbert space ℋgauge through spin-network states over cylindrical functions, regularized by a gauge-invariant ultraviolet cutoff Amin = 4πγ√3 ℓP2 fixed by the minimal non-zero eigenvalue of the LQG area operator. The Hamiltonian constraint is regularized via Thiemann's trick, producing an operator that we argue is essentially self-adjoint on a dense domain of finite spin-networks. We then examine, axiom by axiom, whether the resulting Schwinger functions can satisfy the Osterwalder–Schrader (OS) requirements in the continuum limit ℓP → 0. Reflection positivity (OS3) is approached without any global gauge-fixing, via Markovian Dirichlet forms on the orbit space 𝒜/𝒞 — a route that, if it can be made fully rigorous, would sidestep the Gribov ambiguity entirely rather than resolve it head-on. Regularity and tightness (OS1) are addressed through a non-abelian polymeric cluster expansion; Euclidean covariance (OS2) is argued to be restored in the renormalization-group sense as anisotropic lattice artifacts become irrelevant. Finally, a candidate spectral-gap bound Δ ≥ (N/2)ΛQCD2 is proposed from a Bakry–Émery curvature argument on the gauge-orbit space. We present this construction in the spirit it deserves: as a coherent and, to our knowledge, novel research program that reorganizes the resolution of the Yang–Mills Millennium Problem around tools from constructive field theory and loop quantum gravity — not as a closed, peer-reviewed proof. Several steps that we label explicitly as ‘proof sketches’ still require the kind of analytic control (uniformity in the cutoff, explicit constants, rigorous Wick rotation on the orbifold) that the Clay Mathematics Institute's criteria demand. Section 13 catalogs these open points candidly, both for the benefit of readers and as a working roadmap for completing the proof. Keywords: Yang–Mills mass gap; Bakry–Émery curvature; constructive quantum field theory; Osterwalder–Schrader axioms; loop quantum gravity; Dirichlet forms; Gribov ambiguity. 1 Independent researcher. Correspondence and source materials: @seventy.dev.
Sovereign is a Prove/Pull communication protocol designed to address the structural imbalance of modern digital communication, where senders can impose cognitive and computational costs on recipients without corresponding friction. The protocol requires messages to carry a cryptographic proof of intent through one of three mechanisms: adaptive Proof-of-Work, private zero-knowledge proximity credentials, or registry-attested clearance tokens. Verification is performed by a decentralized Sovereign Audit Network (SAN), which attests that messages satisfy recipient-defined acceptance policies before delivery. This document presents the complete architectural specification of Sovereign, including the MessageEnvelope format, federated attestation protocol, dual Sparse Merkle Tree issuer registry with revocation support, Groth16 zero-knowledge proximity credential circuit, identity hierarchy, security assumptions, economic model, limitations, and phased deployment strategy. This release is Version 1.0 of the design specification. It is an unimplemented protocol proposal; all performance figures are engineering targets based on primitive benchmarks and require validation through future reference implementation. The work is published to establish a public technical record, invite peer review, and support future research, collaboration, and implementation efforts.
Yoon-Nyoung Jung, Subin Jo, Seo-Hyun Yun, Hwajeong Seo
Electronic voting systems inherently encompass a structural tension among ballot secrecy, verifiability, and coercion resistance. Voters must be able to verify whether their votes have been included; however, if such verification information can serve as evidence presentable to a third party, it becomes a basis for post-election intimidation. Existing studies have focused primarily on performance evaluation or data separation, and have not comprehensively addressed the structural tension between verifiability and coercion resistance. This study defines this tension as the verification paradox and designs and implements an electronic voting prototype on a three-organization consortium based on Hyperledger Fabric 2.5, combining a 2-of-3 endorsement policy, nullifier-based anonymity, Exponential ElGamal homomorphic tallying, zero-knowledge proof (ZKP)-based ballot validity verification, panic-password-based deniable verification, and Private Data Collection (PDC)-based coerced vote separation. Quantitative evaluation results confirm a server latency overhead of +0.9% for ElGamal relative to the AES performance baseline, statistical indistinguishability between normal and panic responses (p>0.05), and a peak throughput of approximately 40.7 TPS (with an error rate of 0%) under 1000 concurrent voters. Through this prototype implementation and quantitative evaluation, we show the potential of permissioned blockchains to partially and practically mitigate the verification paradox. This study, however, does not provide a formal security proof, and it is subject to a trust assumption on PDC as well as to the experimental limitations of a single evaluation environment and a limited load range.
Blockchain technology has profoundly revolutionized decentralized applications across financial systems, global supply chains, and applied informatics. However, it remains susceptible to systemic security hazards. This systematic review comprehensively evaluates core architectural vulnerabilities within blockchain infrastructures, consensus mechanisms, and peer-to-peer (P2P) network layers spanning the decade from 2015 to 2025. We focus primarily on the mechanics, operational taxonomy, and evolutionary trajectories of Sybil attacks, wherein malicious actors forge multiple pseudonymous identities to gain disproportionate systemic influence. By synthesizing the foundational academic literature with real-world empirical case studies, such as automated airdrop farming exploits in Layer-2 ecosystems (e.g., Arbitrum, zkSync) and decentralized finance (DeFi) governance manipulations, we analyze attack mechanisms, quantifiable impacts, and mitigation vectors. Our findings chart the structural evolution of Sybil strategies from rudimentary P2P routing disruptions to complex, economically driven application-layer interventions. Finally, we evaluate contemporary defenses, such as Proof-of-Personhood (PoP) systems and zero-knowledge (ZK) cryptography, offering actionable recommendations for the integration of W3C-compliant decentralized identity (DID) frameworks and behavioral analytics to enhance systemic fault tolerance.
Rohan Goyal, Venkatesan Guruswami, Yihang Sun, Mary Wootters
Proximity gaps are a property of error correcting codes that arise in the study of Interactive Oracle Proofs (IOPs) and Succinct Non-interactive Arguments of Zero Knowledge (SNARKs). Recent work of Goyal and Guruswami has established near-optimal proximity gaps for many families of codes, including subspace design codes, as well as random ensembles like random linear codes, Reed-Solomon codes with random evaluation points, and Gallager's ensemble of LDPC codes (Goyal & Guruswami, 2025). However, the parameters for these latter randomized ensembles are worse than the parameters for subspace design codes, and degrade as the degree ell increases. In this work, we obtain improved proximity gaps for random ensembles of codes, including random linear codes, Reed-Solomon codes with random evaluation points, and Gallager's ensemble. Quantitatively, our results for these random ensembles match the results that Goyal and Guruswami attained for subspace design codes. In fact, our techniques are a black-box transference from subspace design codes: any progress on subspace design codes will automatically lead to analogous progress for these random ensembles. To obtain our results, we extend the Local Coordinate-wise Linear (LCL) property framework developed by Levi, Mosheiff, and Shagrithaya and by Brakensiek, Chen, Dhar, and Zhang to a \textit{row-span constrained} version (Levi, Mosheiff & Shagrithaya, 2025; Brakensiek, Chen, Dhar & Zhang, 2025). This allows us to cast \textit{curve-decodability} -- a property that implies proximity gaps -- directly as a row-span constrained LCL property, and make use of that machinery. In contrast, because curve-decodability is not obviously a vanilla LCL property, prior work had worked with a proxy property instead, leading to the aforementioned parameter losses.
Context The exponential evolution and widespread integration of Artificial Intelligence (AI) and Machine Learning (ML) systems have fundamentally transformed industries, establishing AI as a central component in decision-making processes, task automation, and the optimization of complex operational pipelines. From healthcare diagnostics to financial forecasting and increasingly across critical cybersecurity infrastructure such as intrusion detection systems and malware classifiers, AI models are being deployed in environments where the correctness and authenticity of their outputs carry direct operational and safety consequences. Nevertheless, as the deployment of AI systems becomes widespread, the conditions under which these models are trained have evolved in a direction where the security landscape of them radically changes. The traaditional assumption of a centralized, fully controlled training environment, where a single trusted entity acquires data, trains the model, and deploys it, no longer reflects the reality of modern machine learning practice. The frequent use of remote sensing, federated learning and/or outsourced machine learning has introduced architectures where the entity that acquires the data, the entity that trains the model and the entity that ultimately relies on the model's output are three distinct and mutually distrusting parties. In a remote sensing scenario, sensors owned by a data provider transmit raw measurements to a training node that may be geographically or administratively distant. In a federated learning scenario, multiple decentralized devices train local models on their private data and submit the results to a central aggregator. In an outsourced learning scenario, a resource-constrained model sponsor delegates the training computation entirely to a third-party cloud provider. In all three cases, the common factor is the same: the model sponsor, the entity that is ultimately responsible for and dependent on the trained model, that does not control the data acquisition process, does not observe the training execution and has no native mechanism to verify that the model they receive is the result of the computation they requested, performed on the data they provided. This separation of control is the main focus addressed by this dissertation. It is not merely a theoretical concern: the literature has documented a wide range of attacks that exploit precisely this gap. When a malicious trainer substitutes data, alters labels, ignores some dataset's subsets or modifies model parameters, the resulting model may appear functionally correct on standard evaluation metrics while being systematically compromised for specific classes of input, an attack vector particularly dangerous in cybersecurity applications where a model that has been quietly trained to misclassify a specific type of malicious traffic provides no observable anomaly until the attack it was designed to hide occurs. Problem and Motivation The main motivation of this dissertation can be addressed as follows. Given a sensor, that produces a set of data points in a given time frame, or a dataset owned by a data provider and a model computed by a model trainer from that data, the model sponsor wants to ensure that the trained model is the result of executing a known training process over the complete and authenticated dataset $D_t$. That is, all data points in $D_t$ and only those data points were used as the training set. No modifications were made to those points or their labels and the obtained model is indeed the result obtained from the execution of the agreed training algorithm. This guarantee cannot be provided by standard Machine Learning procedures, like accuracy, precision or F1-score. A malicious trainer can submit a model that passes all the standard evaluation metrics on benign inputs while maintaining a targeted misclassification on a specific attack pattern. The only way to close this gap is to make the training process itself verifiable by requiring the trainer to produce and submit a cryptographic proof that is mathematically impossible to forge without having correctly executed the agreed computation on the authenticated data. This verification challenge comes together with a second problem, the \emph{model integrity gap} that exists between a trained model and its deployed representation. Even if the training process was all validated, the model must subsequently be transpiled and deployed into a certain non-ML format. In the context of this dissertation, this gap is particularly sensitive, the Python model trained by the data scientist must be translated into a ZoKrates arithmetic circuit for zero-knowledge proof generation, a process that involves converting continuous floating-point decision boundaries into discrete integer arithmetic. If this translation introduces a small inversion in a comparison operator or a shifted threshold values, the deployed circuit will produce systematically different predictions from the intended model and standard testing may not surface the discrepancy. The literature has proposed cryptographic solutions to the verifiable training but has largely left the second problem unaddressed. The foundational work by Keshavarzkalhori et al. demonstrated that it is possible to construct a pipeline combining hash chains, digital signatures and zero-knowledge proofs to verify that a simulated Naive Bayes classifier was trained on authenticated sensor data. Their implementation, built on the ZoKrates toolset, provided a proof-of-concept that the building blocks exist for end-to-end training verification. However, scaling this approach from a simple probabilistic classifier to a more complex, non-linear ensemble model, in this specific case, a Random Forest, introduces severe architectural bottlenecks that their work explicitly identified as open problems: the computational overhead of bitwise hashing inside arithmetic circuits, the floating-point to integer translation problem and the absence of any mechanism to verify that the transpilation of the model into the circuit was performed faithfully. This dissertation directly addresses these open problems. It proposes, implements and evaluates an end-to-end verifiable machine learning architecture for Random Forest classifiers that provides mathematical guarantees over three distinct integrity boundaries: the origin of the training data, the correctness of the training computation and the fidelity of the model's translation into a verifiable circuit. The framework is evaluated on both a simulated sensor dataset used by Keshavarzkalhori et al. and the CICIDS2017 network intrusion detection benchmark, the real-world cybersecurity dataset used by the most directly comparable prior work, demonstrating that the proposed integrity guarantees are achievable at practical computational cost for cybersecurity-relevant workloads. Research Questions The main objective of this thesis was to build a framework capable of protecting the overall AI Models from data and model poisoning attacks. In alignment with the goal, four research questions were set: Research Question 01: What state-of-the-art mechanisms exist to verify the integrity of AI models across the training pipeline? Research Question 02: What threats exist against AI models integrity? Research Question 03: What computational overhead do integrity verification mechanisms introduce across the AI modeling pipeline and how does this overhead scale with model complexity?
Modular exponentiation is among the most demanding computational operations in cryptographic systems. Effective computation of modular exponentiation is most beneficial for public-key cryptography. The computational complexity and the growing number of bits of the key size, as required by increasingly stringent security demands in the RSA, the Diffie–Hellman key exchange and the Zero-Knowledge Proof (ZKP) protocols, have become a top research priority in terms of algorithmic efficiency. This study proposes a novel triple modular exponentiation algorithm based on the Improved Common-Multiplicand-Multiplication (ICMM) framework. The exact complexity formula was obtained through systematic probabilistic analysis of eight mutually exclusive bit-level states. The efficiency of modular exponentiation is primarily determined by the number of modular multiplications and exponentiation squares required. It is observed that improved common-multiplicand multiplication efficiently minimizes the computational complexity of the triple modular exponentiation by reducing the number of modular multiplications. The overall computational complexity of triple modular exponentiation is 1.875j, where j is the bit length of the exponent. This represents a reduction of approximately 16.7% in total multiplication count relative to double modular exponentiation, corresponding to a 44.4% reduction on a per-exponent basis, and a reduction of 58.3% relative to three independent binary exponentiations. This study concludes that the proposed decomposition reduces the average-case computational complexity of triple modular exponentiation to 1.875j modular multiplications for a j-bit exponent. The proposed triple modular exponentiation algorithm is shown to have lower number of multiplications per bit length of exponent as compared to double modular exponentiation. This result demonstrates the potential of proposed algorithm to reduce the computational cost of triple modular exponentiation in cryptographic protocols where it is a recurring operation, such as interactive ZKP identification schemes.
The Al-Rakhawy Document for Digital Sovereignty (EPSA) presents a complete engineering blueprint for encrypted machine learning. It integrates Federated Learning, Zero-Knowledge Proofs, and Smart Contracts across five layers. Key innovations include Pedersen Commitments for lightweight edge processing and the Al-Rakhawy Equation, which calculates fair rewards based on marginal impact. This system ensures absolute data privacy, breaks central monopolies, and provides users with immediate, mathematically guaranteed economic returns.
Pawan Kumar Sanjaya, Christina Giannoula, Valdy Oktavian, Mehdi Saeedi · 7 authors
Zero-knowledge machine learning (zkML) enables a server to perform verifiable inference while keeping model parameters private from the client. However, existing zkML systems incur prohibitive proof-generation costs. We observe that proof generation exhibits limited parallelism; that is, prover time does not decrease significantly as the number of threads increases. This limitation is because existing systems rely on monolithic proof computation, constructing a single proof for the entire machine learning model. We introduce zkComposer, a modular proof-construction framework that unlocks an additional dimension of parallelism, in addition to the parallelism in existing proof kernels. zkComposer decomposes the zkML proof of correct inference into independent sub-proofs, each covering a subset of the computation for inference e.g., each independent sub-proof can cover a subset of contiguous layers in the ML model. Adjacent sub-proofs are cryptographically linked through shared commitments to the activations from the boundary layer. zkComposer provides the same guarantees as the monolithic proof without requiring additional linking proofs or changes to the underlying cryptographic primitives. We implement zkComposer and evaluate it on three CNNs and GPT-2. We show that, on CNN workloads, zkComposer reduces prover time and response time by up to 3.25x relative to zkCNN [1]. On GPT-2, zkComposer reduces these times by up to 4.83x relative to zkGPT [2], when partitioning along the model layers. When partitioning across both model layers and input sequences in GPT-2, we show that zkComposer reduces prover time and response time by up to 6.84x relative to zkGPT [2].
[Depreciated and replaced by V3] This pre-V3 paper is replaced by the corresponding V3 clean-room reconstruction: There Is No Nothing: A Premise-Free Operational Foundation and an Open Verification Platform for Smithian Fold Theory. The V3 source platform is https://github.com/MettaMazza/ernos-labs-sft-platform. The original DOI, concept DOI, version number and files are preserved for transparent historical provenance; this record must not be presented or cited as current V3 work.A comprehensive, highly rigorous consolidated manuscript dismantling black-box AI through the deterministic Smithian Fold Theory. We present exact zero-parameter derivations of the fine-structure constant (137.03599917718), Levinthal's paradox, structural genetics, and SOTA empirical competitive parity in Chess, Symmetric Go, and Natural Language Processing. Unison AI operates at 57 million times the computational efficiency of modern Transformers, tracing physical geometry without gradient descent.
Modern information protection methods are primarily focused on increasing computational complexity: it is assumed that a task becomes secure if finding the true message requires too many resources. However, virtually all existing models --- from classical cryptanalysis to autonomous AI agents and retrospective analysis systems (Harvest \& Analyze) --- rely on one common assumption: there exists a verification signal that allows distinguishing the true interpretation from the set of false ones. In this work, we present the \textbf{HYBRA MIRAGE} storage architecture, which is based on a different problem formulation. Instead of increasing computational complexity, we propose to eliminate the very criterion of truth upon which directed search is based. The system constructs a space of plausible interpretations and physically excludes the possibility of repeated access to the used reference space~$V$: each of its vectors is applied exactly once and then destroyed on both sides. As a result, the function $\mathsf{Assemble}(C,K,p)$ remains deterministic and total, and any valid access parameter produces a formally correct result. Even with full access to the reference space $V$ and the PIN code, an autonomous analytical agent does not obtain a mechanism to confirm that the found interpretation corresponds to the original message: each vector from $V$ was used exactly once and physically destroyed. The $\mathsf{Assemble}$ algorithm is a trade secret and is not available to the analyst. Consequently, knowledge of $V$ without knowledge of the algorithm allows generating $10^{35}+$ equivalent interpretations, but does not allow singling out the single true one among them. The proposed approach does not make brute force computationally impossible; it makes the claim that the found interpretation is precisely the one embedded by the sender unprovable. Increasing computational resources, applying more sophisticated models, or massive enumeration can produce more candidates, but do not create a procedure that allows mathematically justifying the choice of a single true interpretation. For autonomous AI agents, this leads to the disappearance of the verification signal necessary for directed search. The loss function surface degenerates into a plane with zero gradient: no iterative optimization algorithm can converge to the true parameter faster than random guessing. HYBRA MIRAGE does not compete with classical cryptographic algorithms and does not replace them. The architecture serves as an environment model for analyzing the behavior of autonomous agents under conditions of the absence of a reliable verification signal and can be used as an infrastructure layer on top of existing storage methods. The architecture does not eliminate the agent's ability to generate candidates; it eliminates the possibility of using the generation result as proof of achieving truth. The analyst finds themselves trapped in a state of epistemic equilibrium, where truth and hallucination are architecturally indistinguishable from each other.
Arithmetization-oriented (AO) hash functions are the dominant cost in zero-knowledge proof systems, and their security against the strongest known attacks rests on the hardness of the constrained-input constrained-output (CICO) problem, solved by Gröbner-basis techniques. Raising the nominal algebraic degree of a design is known not to suffice, as recent attacks (FreeLunch, CheapLunch, resultant methods) have repeatedly shown. This work identifies a positional design lever for AO substitution-permutation networks over the Goldilocks field with the power-map S-box x^7: folding a low-degree quadratic coupling into the input of the S-box adds one bit of CICO ideal degree per round, whereas the same coupling placed in the linear layer or after the S-box adds nothing. The ideal degree follows the measured law D_I = 7^(R·m) · m · 2^(R−1) against a baseline of 7^(R·m), where R is the number of rounds and m the number of free input branches. Measurements in the msolve Gröbner engine indicate that the added degree is genuine rather than a nominal inflation (the F4 solving degree rises; an auxiliary-variable-free model reproduces the ideal degree; a resolved large instance rules out competing laws), that it is generic across four unrelated coupling patterns, that it is independent of the coupling density (one term per round suffices), and that it carries no differential/linear cost. The principle is instantiated as Alaniz-AO, a Goldilocks sponge whose HADES partial-round schedule reaches 0.74x the constraint cost of Poseidon2 at a 128-bit target under an explicit ω=2 cost model. A secondary result: the branch number of the linear layer does not govern algebraic CICO security. Measurements are reproducible and use proxy primes sharing the exponent structure of Goldilocks. Round counts and cost figures are extrapolations from the measured degree law under the stated cost model; instances beyond three rounds exceed the solver on commodity hardware and are reported as gaps. A reference implementation and reproduction scripts accompany the paper.
Open access
2 source records
Cryptographic Implementations and Security
Cryptography and Residue Arithmetic
Physical Unclonable Functions (PUFs) and Hardware Security
The automotive industry is transitioning to Zonal-oriented Architectures (ZoA) for Software-Defined Vehicles (SDVs), enabling frequent over-the-air (OTA) updates for 100+ Electronic Control Units (ECUs). While OTA updates improve efficiency, they introduce safety-critical security risks. Current standards like Uptane and AUTOSAR Adaptive rely on Public-Key Infrastructure (PKI). However, PKI-based authentication creates bandwidth bottlenecks in in-vehicle and vehicle-to-cloud (V2I) communication as ECU density increases. It also risks exposing sensitive vehicle configurations and passenger privacy due to centralized architectures. Next-generation Zonal SDVs require decentralized, scalable authentication with data privacy. To address this, we propose zk-ScalHard, a hardware-rooted, privacy-preserving authentication protocol. We introduce a decentralized, hierarchical trust-promotion model utilizing Silicon Physical Unclonable Functions (PUFs) and two novel Zero-Knowledge Proof (ZKP) circuits: (1) Zonal Identity and Integrity (ZIDI) and (2) High-Performance Computing Aggregation (HPCA). These circuits employ multi-party computation (MPC) and recursive aggregation to achieve decentralization and scalability. The integration of ZKPs and PUFs ensures 100% vehicle-level data sovereignty. Benchmarked against Uptane, zk-ScalHard achieves constant O(1) communication and verification complexity, improving upon the linear O(n) complexity of current systems. Evaluation shows a 99.2% reduction in authentication bandwidth and a 99.9% reduction in the temporal attack surface. Our results demonstrate that zk-ScalHard provides a scalable, secure, and GDPR-compliant architecture for future Zonal SDVs.
Open access
3 source records
cs.CR
Physical Unclonable Functions (PUFs) and Hardware Security
Abstract Zero-knowledge machine learning (zkML) enables cryptographic verification of machine learning inference while preserving privacy, but proof generation remains a significant computational bottleneck. Existing work primarily focuses on reducing proof cost through post-training optimizations, whereas the influence of architectural design choices during model development has received less attention. This work presents an empirical study of the relationship between neural network ReLU activation count and zero-knowledge proof generation cost using the ezkl/Halo2 framework. Across controlled experiments, ReLU activation count exhibits a strong correlation with proof generation time (Pearson r = 0.90) and proof size (r = 0.91), while parameter count is held constant for the primary comparisons. Motivated by these observations, a lightweight proxy metric is proposed to estimate relative proof cost directly from model architecture without executing the proof pipeline. On MNIST, reducing the number of ReLU activations from three to one decreases proof generation time by approximately 6.5% and proof size by 2.3%, while maintaining comparable classification accuracy. These results suggest that ReLU activation count is a useful architectural indicator of proof cost in the ezkl/Halo2 backend and that incorporating proof-cost considerations during architecture selection may improve the efficiency of zkML deployment. The proposed proxy metric provides a fast method for comparing candidate architectures before proof generation.
Open access
2 source records
Adversarial Robustness in Machine Learning
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
This paper establishes, inside the Lean 4 proof assistant, a three-level formal identification. The levels are: (i) Belnap multilattice axioms for Weyl–Heisenberg covariant SIC-POVMs at $d=2^n$; (ii) the Zauner conjecture; and (iii) the mixed-signature Stark conjecture for the ray class field $K_d=\mathbb{Q}(\sqrt{(d-3)(d+1)})$, a real-quadratic case of Hilbert's Twelfth Problem. Fiducials are unit-normalized and satisfy $(d+1)|\langle\psi,D_{a,b}\psi\rangle|^2=1$. The equivalence hilbert_embedding_equiv_zauner is proved by rfl: the Belnap embedding into $\mathbb{C}^{2^n}$ and the Zauner conjecture at $d=2^n$ are definitionally the same proposition. The Belnap skeleton (orbit size $4^n$, Frobenius closure $\mu\circ\delta=\mathrm{id}$, join-equiangularity, Born rule) contains zero sorries. Open arithmetic content is marked by named gap axioms for Stark units on WH frames; a proof of Stark would close all three levels at once. For dimension $d=12$ we prove SICPOVM_Exists 12 outright. We construct an exact fiducial in a finitely presented $\mathbb{Q}$-algebra, verify 143 overlap identities with native_decide, and transfer everything to $\mathbb{C}^{12}$ along a ring homomorphism. The theorem crystal_forces_d12_sic depends on no axiom beyond Lean 4's standard foundations and compiler trust. This is, to our knowledge, the first machine-checked SIC-POVM existence in any dimension. For the frontier dimension $d=2048=2^{11}$ the transport apparatus is formalized and sorry-free. It includes a forward map $\varphi\colon B^{\oplus 11}\to\mathbb{C}^{2048}$, a reduction $\psi$ with $\psi\circ\varphi=\mathrm{id}$, a conditional reduction to Stark, and a non-real character obstruction that blocks the false branch. Unconditional existence remains open; the machinery that surrounds it is closed.
We present ECO/CPO-DAG, a domain-specific accountability protocol for adversarial supply chains that formalizes contradiction detection as a supplemental validation layer rather than a consensus or truth-establishing mechanism. Participants publish signed Event Claim Objects (ECOs) into a causally ordered, append-only directed acyclic graph (DAG) whose edges encode happened-before relations. When two claims about the same subject violate a domain constraint, any observer can compile a Contradiction Proof Object (CPO), a self-verifying object binding the two signed claims and the violated rule, which, on public verification, triggers economic slashing of a determinately blamed party. We map constraints to GS1 EPCIS 2.0 event semantics (spatial uniqueness, temporal monotonicity, quantity conservation, quality monotonicity, regulatory validity), so detection targets inconsistencies that are meaningful in practice. Selective disclosure via commitment schemes and, optionally, zero-knowledge contradiction proofs lets parties withhold claim contents until a challenge forces the minimal opening. We give an analytical treatment: an independent-observer detection model $1-(1-p_{\min})^h$, a deterrence condition $S>g(1-p)/(kp)$ under $k$-party collusion, and a storage estimate of order 1 GB per participant per year under stated assumptions. The protocol's boundary is explicit: it detects provable contradictions, not consistent lies; a party that never contradicts itself is invisible to it, so the layer complements, and does not replace, source verification and oracle aggregation. A single-machine reference implementation corroborates the detection model, with the predicted coverage band overlapping the measured 95% confidence interval at every observer count, and records zero false accusations; the fully zero-knowledge CPO, multi-party propagation, and adaptive-adversary evasion remain analytical.