Frequent security issues with smart contract vulnerabilities have become a pressing challenge in the industry. Conventional program analysis methods lack flexibility and extensibility, leading to high false positive rates. Deep learning approaches are emerging as a new trend to address this issue. Compared to other neural networks, graph convolutional networks can better capture the structural and logical information of smart contracts. However, existing methods do not fully consider the scale-free characteristics of smart contracts and fail to leverage their complex hierarchical structures and semantic information. Therefore, we develop an end-to-end vulnerability detection framework using Riemannian Graph Convolutional Networks (RGCNet). We first construct smart contract graphs that are rich in semantic and structural information. Next, we learn features of the smart contract graph in the Riemannian manifold, thereby better reflecting its actual topology. Simultaneously, the word embedding network extracts semantic features, forming an end-to-end network where modules promote one another. Extensive experiments are conducted on three vulnerabilities using real-world smart contracts. The results show that the proposed approach exhibits superior performance over state-of-the-art methodologies in terms of accuracy, precision, and recall.
Yinhao Xiao, Chih-Chung Liu, Mingshu Cong, Le Yang
DeFi smart-contract vulnerabilities often arise from protocol-level financial semantics rather than syntactic Solidity patterns. Direct LLM prompting can generate plausible patches that compile but leave oracle, vault, lending, or AMM invariants unresolved. We aim to make LLM-based smart-contract repair more reliable by separating patch generation from domain-specific judgment and requiring accepted patches to improve check-visible semantic obligations. We present DeFiSent, a check-guided repair framework. It normalizes contract code, infers protocol roles, routes vulnerability-family checks, emits structured findings and violated invariants, and prompts an LLM with this evidence. Candidate patches are accepted only after compilation, tests, interface preservation, non-increasing semantic severity, and invariant-specific gates. We evaluate DeFiSent on a coverage-aware corpus from DeFiHackLabs, EVMbench, LISA-Bench, SmartBugs Curated, and BCCC-SCsVuls-2024. The DeepSeek campaign contains 40,452 paired tasks and 80,904 model-mode runs, including a 41,332-row code-level shard. On the unified 6,000-task DeepSeek subset, check guidance improves dynamic pass rate from 54.82\% to 79.95\%, semantic-improvement rate from 40.42\% to 53.92\%, and total severity reduction from 8,733 to 24,084. On a 2,000-task SiliconFlow matrix, aggregate semantic-improvement rate increases from 27.0\% to 57.8\%. Structured findings and gate-based validation substantially improve LLM repair behavior for DeFi contracts. DeFiSent does not replace expert auditing, but it provides a reproducible path for aligning LLM-generated patches with financial-semantic proof obligations.
Autonomous remote robots [16, 15] are increasingly deployed in disaster response scenarios [14] to support critical tasks such as victim localization and damage assessment. However, the ambient nature of such environments, which is marked by uncertainty, data heterogeneity, and limited connectivity, usually poses significant challenges to autonomous decision-making and trust. Thus, this paper proposes a framework for a multi-layered approach for a hybrid agent architecture that integrates Federated Learning (FL) with Belief-Desire-Intention (BDI) models, enabling remote robotic agents to learn collaboratively from distributed data using Distributed Ledger Technology (DLT) while preserving privacy, and to reason about their goals and intentions using cognitive frameworks of eXplainable AI (XAI). We further present a methodology for coherently embedding FL outcomes into BDI reasoning through semantic mapping and learning-enhanced ontologies. This integration will allow agents to dynamically update their beliefs and intentions based on learned insights, thereby enhancing autonomy, adaptability, and explainability in ambient disaster response systems.
We report on a systematic measurement study of unauthenticated Ollama AI inference servers exposed on the public internet. Using passive enumeration via the Shodan Internet Intelligence Platform, we identify 20,971 publicly accessible Ollama endpoints and more than 54,000 total AI inference services across more than ten backend types, all reachable with no authentication. We conduct targeted proof-of-concept probing against three representative endpoints spanning enterprise cloud, residential broadband, and commercial VPS infrastructure across three countries (USA, Sweden, Austria). All three endpoints score maximum exploitability across five dangerous write operations (model deletion, arbitrary pull, push exfiltration, persistent model poisoning, and clone operations), zero security headers, and zero rate limiting. We document a previously unreported financial fraud vector arising from the proliferation of cloud API proxy models (:cloud suffix), through which unauthenticated access to an Ollama endpoint constitutes direct financial fraud against the endpoint owner's commercial AI API accounts. Extending beyond prior work, we characterize four Retrieval-Augmented Generation (RAG) layer PII exfiltration vectors that require no write access or special knowledge: (1) context-token session hijacking via /api/generate's persistent KV-cache state; (2) cleartext HTTP conversation history re-transmission; (3) co-deployed RAG database exposure; and (4) prompt-based RAG context extraction. In live testing, the fourth vector extracted 11 of 11 PII categories including financial credentials, medical diagnoses, and authentication passwords on the first plain-language prompt against a live production endpoint. We additionally identify a supply chain risk arising from shared model artifact digests across geographically separated endpoints, and a novel operator risk taxonomy distinguishing technically sophisticated but selectively insecure operators from the commonly assumed unaware operator class. All probing used entirely synthetic personal data. No real user conversations were accessed or retained. Responsible disclosure notices were sent to relevant ISPs prior to submission.
Reentrancy remains one of the most persistent and damaging vulnerabilities in Ethereum smart contracts, enabling adversaries to recursively drain funds despite the presence of static and runtime defenses. Existing studies mainly focus on detection or program analysis, but they do not explain why and under what conditions attackers decide to exploit. In this work, we introduce a decision-theoretic framework that models reentrancy as a profit-maximizing problem under gas, risk, and atomicity constraints. Our framework derives the conditions under which reentrancy attacks are economically viable and provides an algorithm for computing optimal exploit strategies. We further extend the analysis to multi-contract attacks, capturing sequential, parallel, and optimized execution strategies. A simulation environment evaluates profitability across varying balances and gas configurations, highlighting thresholds where attacks become infeasible. Finally, we translate attacker decision profiles into practical defense recommendations for developers, auditors, and DeFi system designers. This framework bridges the gap between exploit detection and adversarial economics, offering a rigorous basis for strengthening smart contract security. This framework establishes a theoretical baseline for adversarial economics in smart contract security, forming a foundation for future MEV-aware exploitability models and Layer-2 risk analysis.
Large language models and agentic AI systems deployed in regulated, safety-critical, and high-stakes enterprise environments require governance infrastructure that is simultaneously cryptographically verifiable, regulatorily defensible, operationally efficient, and natively explainable. Existing approaches treat these properties as separate concerns addressed by separate toolchains. The result is an accountability architecture that is fragmented, difficult to audit end-to-end, and structurally incapable of satisfying the converging global regulatory requirement that AI decisions be not merely governed but explainable. This paper presents THEMIS-xAI (Trusted High-Assurance Evidence Management Integrity System for Explainable AI): a unified, governance-native framework that integrates cryptographic evidence management, runtime policy enforcement, explainability generation, privacy-preserving verification, and continuous compliance monitoring into a single coherent architecture. THEMIS-xAI is organized around four architectural planes-Evidence, Control, Security, and Explainability-and eleven integrated subsystems. We demonstrate that THEMIS-xAI achieves 83% coverage of the NIST AI RMF 1.0 control set (advancing from a 72% baseline), provides architectural coverage of fifteen regulatory frameworks with per-control status disclosure, and produces per-decision explanation artifacts that are cryptographically anchored, independently verifiable, and structured to align with the transparency and documentation goals of applicable AI governance frameworks. Legal sufficiency requires independent regulatory assessment. Implementation status is transparent throughout: the Evidence and Control Planes are in active enterprise pilot deployment; the Explainability Plane modules M1-M4 are implemented; M5-M6 are at research-prototype stage; zero-knowledge enforcement proofs are at proof-of-concept stage with production hardening planned in Phase 4.
Open access
Explainable Artificial Intelligence (XAI)
Adversarial Robustness in Machine Learning
Artificial Intelligence in Healthcare and Education
The convergence of vehicular technology, artificial intelligence (AI), and distributed computing has catalyzed the emergence of the Internet of Vehicles (IoV) as a cornerstone of next-generation intelligent transportation systems (ITS). By enabling vehicle-to-everything (V2X) communication, IoV supports cooperative perception, real-time decision-making, and autonomous driving. However, the reliance on large-scale, data-driven intelligence in IoV exposes systems to critical challenges, including adversarial poisoning, privacy leakage, identity forgery, and the fragility of centralized learning architectures. Federated Learning (FL) has been proposed as a promising paradigm to alleviate some of these issues by enabling distributed model training without centralizing sensitive vehicular data. Nonetheless, conventional FL remains vulnerable to security and trust limitations, particularly in dynamic vehicular environments. This thesis addresses these challenges by designing secure, privacy-preserving, and scalable FL frameworks that leverage distributed ledger technologies and cutting-edge security mechanisms.The thesis advances knowledge through four interconnected contributions. First, two novel optimization-driven poisoning attack models are introduced: PA-PSOSA and PAPSOGA, which combine particle swarm optimization with simulated annealing and genetic algorithms, respectively. These models demonstrate that even a small poisoning budget can substantially degrade global model utility under black-box and clean-label constraints, highlighting the urgency of robust defenses in vehicular FL. Second, a permissioned blockchain-enabled FL (BCFL) framework is proposed, in which consortium edge nodes running Practical Byzantine Fault Tolerance (PBFT) consensus replace the central aggregator. With blockchain integration and data validation mechanisms, this design ensures identity authentication, verifiable audit trails, and improved resilience against poisoning and Sybil attacks, while maintaining high model accuracy under adversarial conditions. Third, the framework is further enhanced to achieve inference-resistance by integrating secure aggregation (SecAgg) and differential privacy (DP), and lightweight with off-chain commitments. This design significantly reduces ledger storage requirements, increases system throughput, and mitigates inference-based privacy risks. Finally, to overcome the scalability limitations of PBFT-based BCFL, a DAG-enabled FL (DFL) framework is developed. By leveraging parallel validation, utility-score-based tip selection, and reputation-weighted aggregation, this framework significantly improves scalability, reduces communication complexity, and enhances robustness in asynchronous vehicular environments.Together, these contributions articulate a coherent progression from exposing vulnerabilities in vehicular FL to constructing secure, privacy-preserving, and scalable frameworks tailored for IoV ecosystems. The findings demonstrate that interdisciplinary integration of optimization theory, cryptography, differential privacy, and distributed ledger technologies is indispensable for trustworthy vehicular intelligence. Beyond theoretical significance, the proposed frameworks offer practical designs for deployment in safety-critical IoV environments. Future research directions include the integration of zero-knowledge proofs (ZKP) for verifiable privacy, adaptive defenses against evolving adversarial strategies, and experimental validation in real-world vehicular testbeds. Collectively, this thesis establishes a foundation for secure federated intelligence in IoV, contributing to the reliability, efficiency, and trustworthiness of next-generation ITS.
The security issues surrounding smart contracts have garnered significant attention due to potential vulnerabilities that can lead to financial losses and a decline in trust. Despite the development of various vulnerability detection methods by researchers, existing models often suffer from low accuracy and high false positive rates. Additionally, opcode-based vulnerability detection methods frequently introduce excessive noise due to long sequences, impairing the model’s generalization capabilities. To address these challenges, this paper proposes a dual-branch vulnerability detection model, referred to as EXCT, which integrates features from both the original opcode sequences and significant opcode sequences. We employ an improved extractive summarization technique, KTextRank, to extract important opcode sequence segments. A hierarchical Transformer is utilized for global feature extraction, while Convolutional Neural Networks (CNN) are employed for local feature extraction from the original opcode sequences. Finally, we fuse the global and local features to effectively identify specific vulnerabilities within smart contract code. Experiments conducted on two real-world datasets demonstrate that our proposed approach significantly enhances performance on publicly available datasets.
Leanne Ngo, Tran Tien Nhat, anon anon, Triet Huynh Minh Le · 7 authors
Smart contracts underpin modern blockchain ecosystems, enabling decentralized applications in DeFi and digital asset management. However, their immutability exacerbates programming errors and vulnerabilities, leading to unpatchable flaws and significant financial losses, as seen in high-profile exploits. Current vulnerability detection methods including static and dynamic analysis—face critical limitations: (1) static analysis suffers from state-space explosion, control-flow complexity, over-approximation, and high false positives; (2) dynamic fuzzing relies on syntactic/random mutations lacking semantic awareness, inefficiently exploring deep state-dependent paths and complex transaction sequences; (3) both static and dynamic approaches overlook semantic-structural gaps, such as execution order semantics in reentrancy vulnerabilities; (4) fuzzing reports lack explainability, hindering practical auditing. To address these challenges, we propose MAESFuzz1, a multi-agent semantic-guided smart contract fuzzing framework that integrates static structural analysis, dynamic execution feedback, and Large Language Model (LLM)–assisted reasoning within a closed-loop architecture. MAESFuzz employs LLMs as semantic advisors to guide seed generation, transaction sequence construction, and mutation refinement, enabling effective exploration of deep state-dependent behaviors and complex multi-transaction vulnerabilities. Extensive evaluation on the SoliAudit benchmark and a real-world dataset of deployed Ethereum contracts shows that MAESFuzz improves vulnerability detection by up to 28.7% relative to state-of-the-art (SOTA) smart contract fuzzers on SoliAudit. On real-world contracts, MAESFuzz uncovers 25 more expert-validated vulnerabilities than the strongest SOTA baseline while maintaining 94.38% precision and competitive execution coverage. In addition, MAESFuzz generates structured, execution-grounded audit reports to enhance interpretability and support practical security auditing.
Artificial intelligence systems are deployed globally at an unprecedented scale. Yet, no universal mechanism exists to verify that a given AI system is operating within its declared parameters, compliant with applicable regulations, or free from compromise. Trust in AI today is largely assumption-based rather than evidence-based, and this gap is becoming increasingly consequential as AI systems take on greater autonomy in regulated, high-stakes domains. This document proposes the TrustLayer Protocol as one possible architectural framework for addressing this gap. The protocol comprises two complementary components. The Compute Passport Network (CPN) proposes a neutral, global identity and attestation layer for AI compute, models, and training data, establishing cryptographically verifiable records of provenance during the training and development phase. The Universal AI Attestation Protocol (UAAP) proposes an embedded attestation mechanism for deployed AI systems, generating structured, signed claims about runtime operational state, compliance status, and inference provenance. Several UAAP mechanisms, in particular, continuous per-inference behavioral attestation and reasoning verification, remain experimental or require future research, as detailed in Section 6. The TrustLayer Protocol draws on established infrastructure from hardware-based trusted execution environments [1][2], public key infrastructure [3], zero-knowledge proof systems [4][5], and AI governance frameworks, including the EU AI Act [6] and the NIST AI Risk Management Framework [7]. It does not claim to resolve all open problems in AI verification. Rather, it proposes a phased architectural framework within which existing technologies can be composed into a coherent trust infrastructure layer, with clearly identified areas requiring further research and standardization. This specification is published as an open standard by the DefenAware Foundation and is intended as a contribution to ongoing work in AI governance, protocol design, and verifiable AI safety.
Agentic artificial intelligence systems — autonomous, multi-step AI agents capable of planning, tool use, and cascading real-world action — present a qualitatively distinct governance challenge from static AI models. The EU AI Act, while a landmark regulatory achievement, contains a structural gap: it mandates documentation and incident reporting but does not require real-time, publicly verifiable, tamper-proof audit infrastructure adequate for governing agentic systems at the pace and scale of current deployment. This paper documents a pattern of AI-enabled harm across four independent evidential sources — the ENISA 2025 Threat Landscape report, the November 2025 GTG-1002 autonomous cyberattack campaign, the February 2026 breaches of Mexican democratic infrastructure, and concurrent AI-automated attacks at scale — and argues that this pattern establishes the governance case for mandatory real-time accountability infrastructure for critical agentic systems. We propose a three-pillar framework. First, a Public Immutable Audit Ledger (PIAL): a distributed ledger-anchored system recording cryptographically hashed event logs in real time, governed by a technology-neutral requirements framework specifying fourteen functional and non-functional criteria any qualifying platform must satisfy. Second, a revised incident taxonomy separating automated telemetry — immediate, machine-generated — from narrative disclosure obligations, resolving the perverse incentives created by conflating these in existing frameworks. Third, a tiered implementation pathway classifying agentic systems into four risk tiers (Critical, High-Risk, Standard, Experimental) using an operational decision framework, with obligations scaled proportionately. The paper identifies zero-knowledge proof capability as a domain-specific precondition — not merely a research priority — for Tier A PIAL adoption in healthcare and law enforcement contexts where existing legal obligations under GDPR Article 9 and Directive 2016/680 may not be satisfied by current architecture. Six specific legal questions requiring formal resolution by the EU AI Office are identified, spanning GDPR Chapter V data transfers, NIS2 Article 23 interaction, DORA Article 19 alignment, and the data sovereignty status of public distributed ledger anchor submissions. The framework is accompanied by a reference implementation case study and a companion Technical Blueprint. The governance infrastructure proposed is proportionate, deployable with existing technology across the core architecture, and designed to be compatible with the EU AI Act's existing provisions while addressing their identified limitations.
As Generative AI (AIGC) achieves pixel-level realism and real-time interaction; traditional digital authentication paradigms face an unprecedented "authenticity crisis". Software-level defenses and static biometrics are increasingly vulnerable to high-fidelity AI-generated threats. This paper proposes a novel Human-Source Authentication architecture, termed Testing, Inspection, and Certification (TIC), which shifts the verification focus from logical correctness to the real-time presence of a physical entity. At the core of TIC is the Pulse-Eye Handshake (PEH) protocol, which integrates hardware-level Physical Unclonable Functions (PUF) with the physiological dynamics of the human pupillary light reflex (PLR). By leveraging a "Hardware Trinity" comprising smart glasses, a smartwatch, and a smart ring, the protocol constructs a deterministic "Shield of Time". This shield exploits the significant latency gap between the computational overhead of AI inference (typically >300ms) and the intrinsic physical limits of the human autonomic nervous system (8.3-35ms). Furthermore, architecture employs recursive zero-knowledge proof (ZKP) based on the Nova protocol to ensure multi-modal verification without compromising user privacy. Security analysis demonstrates that the proposed system remains robust against sophisticated modeling attacks and AI-driven acceleration. Our work provides a foundational anchor for digital sovereignty and system resilience in the era of pervasive AI and Industry 5.0.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
Federated learning across IoT devices must simultaneously protect each device’s update from disclosure, prevent malicious participants from biasing the global model, and hide which devices are participating from outside observers. Existing systems typically address only a subset of these goals: secure aggregation hides individual updates but cannot validate them, plaintext-based robust filtering requires the server to see updates, and most cryptographic pipelines ignore timing privacy. This paper presents TriSAFE, a protocol composition for IoT federated learning with a single coordinating server and three threshold helpers. The server holds no decryption key. TriSAFE combines four mechanisms that are usually studied in isolation: (i) encrypted client updates accompanied by zero-knowledge proofs that each coordinate lies within a bounded range; (ii) a new lightweight binding step (the plaintext-equivalence protocol, PEP) that cryptographically ties the values proven in zero knowledge to the exact ciphertext later aggregated by the server, closing a substitution gap left by range proofs alone; (iii) helper-added differential privacy noise applied homomorphically before any decryption, so the server only ever sees a noised aggregate; and (iv) fixed-cadence batching with calibrated cover traffic to hide participation from passive network observers. Across two IoT intrusion-detection benchmarks (Edge-IIoTset and N-BaIoT) and MNIST, TriSAFE keeps accuracy within 0.1-2.1 percentage points of the no-attack baseline under Byzantine, label-flip, FANG, and time-delay attacks, with attack success rate below 1% (<0.1% for FANG). Timing inference by a passive observer drops close to chance, and the end to end overhead is 7-36% relative to a non-defended baseline. On MNIST, TriSAFE achieves 89-91% accuracy, 15-17 points above the MODEL benchmark under the same attack suite. The design is practical for gateway-assisted IoT deployments under the assumption that the coordinator does not collude with two helpers and that at least two helpers contribute honest DP noise.
Autonomous AI agents executing consequential actions require authorization mechanisms that verify not only identity but voluntary intent. LICET (Latin: it is permitted) is a cryptographic middleware protocol binding AI agent authorization to real-time multi-modal physiological state via a three-layer architecture: (1) ECG waveform morphology matching as a medication-resistant identity and liveness anchor; (2) electrodermal activity (EDA) as a sympathetic cholinergic liveness signal immune to beta-adrenergic blockade; and (3) personalized Mahalanobis distance fusion over five physiological signals to elevate the cost of pharmacological coercion attacks. LICET defines a Biometric Trust Level hierarchy (L0-L3) aligned with the IETF RATS architecture (RFC 9334), per-event HKDF session-key derivation, HMAC biometric temporal signatures, Schnorr zero-knowledge proofs over BN128, and a SHA-256 hash-chained tamper-evident ledger. A reference implementation is publicly deployed at https://licet.dev/v1/.
We present CHRONOS, the first autonomous AI agent that simultaneously achieves plaintextblindness (all data is processed under fully homomorphic encryption without ever beingexposed), cryptographically enforced time bound existence (the agent’s own decryption key islocked behind a publicly verifiable proof of sequential work, rendering it inaccessible until aprecise future moment), and remote verifiability of self destruction (a zero knowledge proofcertifies that the key material has been irreversibly destroyed after mission completion). Theagent’s operational lifespan is governed by a “cryptographic fuse” constructed from a proof ofsequential work (PoSW) whose computation time accurately matches the intended missionduration. A drand decentralized randomness beacon serves as a trusted time oracle to trigger thefinal key shredding. Crucially, the erasure proof is a non interactive zero knowledge argument(SNARK) that proves the correct execution of the entire self destruction sequence—including thePoSW solution, decryption of the private key, and subsequent memory zeroization—enablingany third party to cryptographically verify the agent’s annihilation without trusting the agent orits hardware. We provide a complete system architecture, a formal security model with gamebased definitions and reductions to standard assumptions, and a proof of concept implementationusing Zama’s TFHE rs for encrypted inference, a Cohen Pietrzak PoSW implementation, and aGroth16 SNARK. Our benchmarks indicate that FHE inference on a small neural network (50 Kparameters) completes in seconds, the PoSW background thread consumes negligible resources,and the erasure proof can be generated and verified in under three seconds. CHRONOSrepresents a fundamental advance in secure, disposable AI agents, with immediate applications indefense, intelligence, and high privacy environments.
This appendix proposes the Luevano Standard as an assurance architecture combining zero-knowledge proofs for model inference with remote attestation, providing stronger runtime evidence for AI governance. It frames this as a technological measure supporting EU AI Act Article 9 and Article 11 compliance demonstration, not as a universal legal solution.
Modern vehicles are distributed embedded computing platforms whose expanding network connectivity-CAN bus, Bluetooth, cellular telematics, and over-the-air (OTA) update channels-exposes them to the same class of adversarial attacks studied in cloud and enterprise environments. Machine learning (ML)-based intrusion detection systems (IDS) have emerged as the primary defensive response, yet these models are themselves vulnerable to adversarial perturbation: a well-crafted malicious CAN frame can evade an ML-based IDS in the same way that an adversarial image patch fools a computer-vision classifier. This paper traces the threat landscape from foundational automotive attack-surface studies through contemporary adversarial ML research, examines how resource-constrained embedded platforms limit defensive options, and proposes a defense architecture that combines behavioral anomaly detection with zero-knowledge proof (ZKP) attestation for invehicle control units. We argue that ZKP-based component attestation-previously dismissed as computationally impractical for embedded systems-is now feasible given recent advances in succinct non-interactive arguments of knowledge (SNARKs), and that combining it with adversarially trained ML-IDS models yields defensein-depth that addresses both network-layer and hardware-layer attack vectors.
Graph neural networks (GNNs) have shown notable success in identifying security vulnerabilities within Ethereum smart contracts by capturing structural relationships encoded in control- and data-flow graphs. Despite their eff... | Find, read and cite all the research you need on Tech Science Press
This paper presents Zero-Knowledge Federated Learning Guard (ZK-FLGuard), a privacy-preserving and verifiable federated learning framework for real-time anomaly detection in Fifth-Generation Mobile Network (5G)-enabled Internet of Things (IoT) environments. Building on the integration of zero-knowledge proofs (zk-SNARK—Zero-Knowledge Succinct Non-interactive Argument of Knowledge) and blockchain-based access control, ZK-FLGuard ensures the integrity of model updates without exposing private data. Using real-world intrusion detection datasets (CICIDS2017—Canadian Institute for Cybersecurity Intrusion Detection System 2017, TON_IoT—Telecommunications Organisation of the National Security—IoT) and a synthetic adversarial dataset, our evaluation shows that ZK-FLGuard achieves up to 0.96 F1-score (harmonic mean of precision and recall), improves recall in low-frequency attack detection, and introduces less than 10% additional latency overhead compared to standard Federated Learning (FL). Compared with centralized Long Short-Term Memory (LSTM) and FL without Zero-Knowledge Proof (ZKP), ZK-FLGuard provides competitive accuracy while ensuring verifiable computation and strong privacy guarantees. We address the critical challenge of securing federated anomaly detection in 5G-enabled IoT systems against data leakage, model poisoning, and unauthorized access. While FL preserves privacy by keeping raw data local, it remains vulnerable to gradient leakage and adversarial manipulation. Our hypothesis is that combining zero-knowledge proofs and blockchain with FL can deliver a scalable, tamper-resistant, and privacy-preserving detection pipeline suitable for resource-constrained edge environments.
Current approaches to verifying AI training data compliance face a fundamental tension: copyright holders need to know whether their content was used in training (EU AI Act, Article 53(1)(d)), while model providers need to protect their training data as trade secrets (GDPR, trade secret law). Existing zero-knowledge proof systems for machine learning (ZKML) address this partially by providing proofs of non-membership for exact data points. However, real-world training pipelines involve tokenization, chunking, paraphrasing, and augmentation, rendering exact-match proofs insufficient. We identify a gap in the literature: no existing system combines semantic fingerprinting with zero-knowledge proofs to enable semantic non-membership verification. We propose an architecture for Zero-Knowledge Semantic Non-Membership (ZK-SNM) that enables a model provider to prove, without revealing any training data, that no document in their training corpus is semantically similar to a queried document above a specified threshold. We discuss the technical challenges, including the computational cost of similarity search within ZK circuits, and propose mitigation strategies based on locality-sensitive hashing and hierarchical verification. This position paper establishes the problem formulation and proposed architecture; experimental validation is left to subsequent work.
Federated learning (FL) enables collaborative model training while preserving data privacy, yet both centralized and decentralized approaches face challenges in scalability, security, and update validation. We propose ZK-HybridFL, a secure decentralized FL framework that integrates a directed acyclic graph (DAG) ledger with dedicated sidechains and zero-knowledge proofs (ZKPs) for privacy-preserving model validation. The framework uses event-driven smart contracts (EDSCs) and an oracle-assisted sidechain to verify local model updates without exposing sensitive data. A built-in challenge mechanism efficiently detects adversarial behavior. In experiments on image classification and language modeling tasks, ZK-HybridFL achieves faster convergence, higher accuracy, lower perplexity, and reduced latency compared to Blade-FL and ChainFL. It remains robust against substantial fractions of adversarial and idle nodes, supports sub-second on-chain verification with efficient gas usage, and prevents invalid updates and orphanage-style attacks. This makes ZK-HybridFL a scalable and secure solution for decentralized FL across diverse environments.
Proof-of-useful-work (PoUW) replaces the wasted computation of proof-of-work with valuable tasks such as machine-learning inference, but has historically failed on the verification asymmetry: useful work is as costly to verify as to perform. Zero-knowledge machine learning (zkML) removes the asymmetry cryptographically, yet proving overheads currently preclude verifying every job. We analyze a sampled-audit design in which each committed job is audited independently with probability p after commitment, escalating from cheap re-execution to a zkML dispute court, with detected fraud slashing a stake S. We prove that economic security reduces to one scale-invariant bound, S > c/p, where c is the cost of one job: the attacker's expected profit from fabricating k results is then strictly decreasing in k, so the optimal attack is a single fabricated job, and it is unprofitable. The bound is invariant to batch size and robust to exit scams, Sybil splitting, and audit-gap hunting; Monte Carlo simulation validates all claims. We further prove exponential fragility under randomness grinding, detection collapses to p g with g candidate seeds, making unbiasable randomness a hard requirement, and derive the cost-optimal sampling rate p * = δ /κ.