Public blockchains impose an inherent tension between regulatory compliance and user privacy. Existing on-chain identity solutions require centralized KYC attestors, specialized hardware, or Decentralized Identifier (DID) frameworks needing entirely new credential infrastructure. Meanwhile, over four billion active X.509 certificates constitute a globally deployed, government-grade trust infrastructure largely unexploited for decentralized identity. This paper presents zk-X509, a privacy-preserving identity system bridging legacy Public Key Infrastructure (PKI) with public ledgers via a RISC-V zero-knowledge virtual machine (zkVM). Users prove ownership of standard X.509 certificates without revealing private keys or personal identifiers. Crucially, the private key never enters the ZK circuit; ownership is proven via OS keychain signature delegation (macOS Security.framework, Windows CNG). The circuit verifies certificate chain validity, temporal validity, key ownership, trustless CRL revocation, blockchain address binding, and Sybil-resistant nullifier generation. It commits 13 public values, including a Certificate Authority (CA) Merkle root hiding the issuing CA, and four selective disclosure hashes. We formalize eight security properties under a Dolev-Yao adversary with game-based definitions and reductions to sEUF-CMA, SHA-256 collision resistance, and ZK soundness. Evaluated on the SP1 zkVM, the system achieves 11.8M cycles for ECDSA P-256 (17.4M for RSA-2048), with on-chain Groth16 verification costing ~300K gas. By leveraging certificates deployed at scale across jurisdictions, zk-X509 enables adoption without new trust establishment, complementing emerging DID-based systems.
Abstract: Remote electronic voting systems require tamper-evident records of ballot submissions, yet the ledger integrity problem - ensuring that the record cannot be silently altered after the fact - has received less formal treatment than ballot-phase cryptography. Existing approaches rely on distributed blockchain consensus, digital signatures on bulletin boards, or external hash-tree timestamping services, each introducing dependencies on specialized infrastructure, continuously trusted parties, or computationally intensive proof systems. This paper provides a formal security analysis of a hash-chained append-only ledger instantiated in a standard relational database with quorum replication, establishing that equivalent tamper-evidence guarantees are achievable under the sole assumption of collision resistance of the instantiated hash function. We define five security properties in the Bellare-Rogaway game-based framework. Tamper-evidence (Proposition 1) bounds any PPT adversary's advantage at 2q(λ) · Adv^CR_H, with a tight reduction to collision resistance. Fork-resistance (Proposition 2) establishes that an adversary corrupting fewer than a quorum threshold of replicas cannot cause divergent chain histories at honest replicas. Retrospective modification resistance (Proposition 3) establishes that post-close modifications are detectable by any auditor holding a real-time replica copy. Cross-ledger binding security (Proposition 4) extends these results to the dual-ledger construction of the Arcaunt architecture, in which a public ballot ledger and a temporal credential ledger are cryptographically bound at insert time, making modifications to either detectable through the other with advantage bounded by 4q(λ) · Adv^CR_H. Selector integrity (Proposition 5) establishes that the last-valid-vote rule - operating on insertion sequence rather than timestamps, making it immune to clock manipulation - is integrity-secure conditional on credential security, formally delineating the boundary between ledger and credential security domains. We apply an eight-metric comparative framework to seven e-voting integrity architectures - hash-chaining, bulletin boards, homomorphic tallying, mixnet-based systems, blockchain, KSI timestamping, and VVPAT hybrids - establishing three findings: tamper-evidence basis is universal but mechanism-specific; fork-resistance is architecturally necessary specifically for revoting-based systems; and auditability complexity is inversely correlated with cryptographic sophistication. The hash-chained relational ledger achieves collision-resistance-based tamper-evidence with O(n) verification accessible to any SQL-capable auditor - a design point unoccupied by existing systems under the same combination of properties. Prototype validation on a Firebird 5.0 implementation confirms that each proposition is instantiated by a specific database trigger mechanism, with 6ms mean ballot submission latency and O(n) verification complexity empirically confirmed.
Current AI deployment stacks authenticate agents, workloads, and credentials but do not verify which neural network is computing at inference time. Recent incidents — including the undisclosed use of an open-weight foundation model inside a commercial product, industrial-scale distillation campaigns, and emerging agent identity standards that authenticate software without authenticating models — show that this gap has practical consequences. Post-hoc disclosure resolved these incidents; runtime proof would have made the model identity question answerable at inference time. This paper asks whether runtime model identity is technically feasible at frontier scale. We present three results. First, we enrolled and verified five open-weight transformer models spanning 8 billion to 72.7 billion parameters across three families, with zero false acceptances in all pairwise comparisons and self-verification within the acceptance threshold for all models. A thermodynamic observable predicted by extreme value theory remained within two percent of its predicted value across the full range, with no statistically significant scale-dependent correction detected across more than two orders of magnitude in parameter count. Second, we tested structural separability on three declared-lineage distillation pairs spanning 8 billion to 70 billion parameters — each derivative sharing identical architecture with its base — and measured separations ranging from 2,858 to 4,583 times the acceptance threshold, increasing monotonically with model scale across two base-model families. All derivatives self-verified within the acceptance threshold. Third, we demonstrate a frontier-scale software attestation path — including signed JWT issuance and downstream policy consumption — and situate it within a previously formalized attestation architecture that composes with enterprise identity infrastructure, complementing rather than replacing current agent identity frameworks. These results demonstrate that runtime model identity is measurable and separable across the tested range of open-weight instruct-tuned transformers from 8B to 72.7B, with a frontier-validated software attestation path and an inherited route to stronger hardware-backed and proof-backed assurance. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Matteo Vaccargiu, Sabrina Aufiero, Silvia Bartolucci, Ronnie de Souza Santos · 6 authors
Labels on platforms such as GitHub support triage and coordination, yet little is known about how well they align with code modifications or how such alignment affects collaboration across contributor experience levels. We present a case study of the Kubernetes project, introducing label-diff congruence - the alignment between pull request labels and modified files - and examining its prevalence, stability, behavioral validation, and relationship to collaboration outcomes across contributor tiers. We analyse 18,020 pull requests (2014--2025) with area labels and complete file diffs, validate alignment through analysis of over one million review comments and label corrections, and test associations with time-to-merge and discussion characteristics using quantile regression and negative binomial models stratified by contributor experience. Congruence is prevalent (46.6\% perfect alignment), stable over years, and routinely maintained (9.2\% of PRs corrected during review). It does not predict merge speed but shapes discussion: among core developers (81\% of the sample), higher congruence predicts quieter reviews (18\% fewer participants), whereas among one-time contributors it predicts more engagement (28\% more participants). Label-diff congruence influences how collaboration unfolds during review, supporting efficiency for experienced developers and visibility for newcomers. For projects with similar labeling conventions, monitoring alignment can help detect coordination friction and provide guidance when labels and code diverge.
Abstract Smart contract upgradeability is widely used in Ethereum to enable postdeployment fixes and feature evolution. However, upgrades can unintentionally violate safety assumptions, leading to storage corruption, interface inconsistencies, access-control regressions, and unsafe execution behavior. Existing analysis tools primarily focus on single-version vulnerabilities and offer limited support for reasoning about correctness across contract upgrades. This paper presents an invariant-based verification approach for smart contract upgrade safety on Ethereum. We formalize the upgrade safety using a set of cross-version invariants and define a global safe-state model that characterizes valid upgrade transitions. Based on this model, we design an automated verification framework that statically analyzes proxy-based upgrade patterns and detects violations related to storage layout evolution, ABI compatibility, initialization safety, delegatecall usage, and access-control preservation. The framework compares compiler-level artifacts from successive contract versions and supports modular, extensible detectors.
Smart contracts have transformed decentralized finance, but flaws in their logic still create major security threats. Most existing vulnerability detection techniques focus on well-supported languages like Solidity, while low-resource counterparts such as Vyper remain largely underexplored due to scarce analysis tools and limited labeled datasets. Training a robust detection model directly on Vyper is particularly challenging, as collecting sufficiently large and diverse Vyper training datasets is difficult in practice. To address this gap, we introduce Sol2Vy, a novel framework that enables cross-language knowledge transfer from Solidity to Vyper, allowing vulnerability detection on Vyper using models trained exclusively on Solidity. This approach eliminates the need for extensive labeled Vyper datasets typically required to build a robust vulnerability detection model. We implement and evaluate Sol2Vy on various critical vulnerability types, including reentrancy, weak randomness, and unchecked transfer. Experimental results show that Sol2Vy, despite being trained exclusively on Solidity, achieves strong detection performance on Vyper contracts and significantly outperforms prior state-of-the-art methods.
Enterprise identity systems can authenticate workloads, credentials, and attested platforms, but they do not close the composition layer where runtime model identity enters authorization. A token can verify that a service is running in a trusted environment, that its credentials are valid, and that its actions are authorized — without ever establishing which neural network is actually computing. When model identity evidence is inserted into standard authorization flows, new security properties emerge that are not inherited from the underlying protocols and must be formally established rather than presumed. This paper presents a live integration architecture for model-identity attestations in JWT and SPIFFE-style token flows, grounded in real measurements from six neural networks executed inside an NVIDIA H100 Confidential Computing enclave. It formally verifies four composition properties — non-separability, temporal binding, issuer authenticity, and reference integrity — across three Coq proof files with zero unfinished proof obligations. Every remaining trust dependency is explicitly named, traced to an integration control, and paired with a concrete falsification witness. The result is a formally hardened composition layer where no security property is left implicit and no assumption is left silent. Supplementary Material This paper is accompanied by three Coq proof files — ComposableIdentity.v, IssuerAuthenticity.v, and ReferenceIntegrity.v — that formally verify the four composition properties described in §§4–6: non-separability, temporal binding necessity, issuer authenticity, and reference integrity. Together the files prove thirteen theorems from eleven named axioms, each paired with a concrete falsification witness and an integration control. No file contains unresolved obligations (Admitted), and all three compile cleanly under the Rocq Prover 9.1.1 (the current release of the Coq proof assistant, compiled with OCaml 5.4.0). They are available for download as supplementary files attached to this record. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Smart contract vulnerability benchmarking lacks standardized, reproducible datasets that enable fair and consistent evaluation of static analysis tools. This paper presents SARMF-Bench, a compact, deterministic, and fully reproducible benchmark dataset comprising five SWC-aligned Solidity smart contracts (SC01–SC05) covering reentrancy (SWC-107), integer overflow/underflow (SWC-101), access-control weakness (SWC-105), unchecked external calls (SWC-104), and denial-of-service via unbounded loops (SWC-113). Each contract is intentionally minimal to isolate a single structural vulnerability pattern and is paired with machine-readable JSON outputs generated using Slither v0.11.5 in a version-locked environment, preserving detector identifiers, impact levels, and confidence metadata. SARMF-Bench is archived across multiple open repositories with permanent DOIs to enable fully reproducible smart contract security tool evaluation experiments. Baseline static analysis results are reported for each vulnerability class. All artifacts are publicly released under open licenses.
Solana is rapidly gaining traction among smart contract developers and users. However, its growing adoption has been accompanied by a series of major security incidents, which have spurred research into automated analysis techniques for Solana smart contracts. Unfortunately, existing approaches do not address the unique and complex account model of Solana. In this paper, we propose SseRex, the first symbolic execution vulnerability detection approach for finding Solana-specific bugs such as missing owner checks, missing signer checks, and missing key checks, as well as arbitrary cross-program invocations. Our evaluation of 8,714 bytecode-only contracts shows that our approach outperforms existing approaches and identifies potential bugs in 467 different contracts. Additionally, we analyzed 120 open-source Solana projects and conducted in-depth case studies on four of them. Our findings reveal that subtle, easily overlooked issues often serve as the root cause of severe exploits, further highlighting the need for specialized analysis tools like SseRex.
Recently, developing technologies for smart cities, although scalable and cost-effective, have been challenging to provide anonymous verification and on-chain integrity with low overhead due to the increasing attack surface. We propose ZkPSLB, a layered end-to-end security framework to address the problem. ZkPSLB utilizes a Zero-Knowledge Concise Non-Interactive Knowledge Argument (zk-SNARK), a type of Zero-Knowledge Proof (ZKP) scheme, embedded within the Constrained Application Protocol (CoAP) for anonymous device authentication. Sensor payloads are encrypted with elliptic curve cryptography (ECC) and stored in a decentralized cloud storage system (IPFS). IPFS CIDs are committed to the chain, ensuring both off-chain confidentiality and on-chain integrity. In the evaluation conducted with 500 devices/5000 metadata, the authentication communication overhead was measured at 1952 bits. The event-based smart contract (EBSC) reduces on-chain payload and gas growth compared to storage-based designs, and its cost advantage has been validated.
Neural networks deployed behind APIs or in cloud infrastructure are often verifiable only as black boxes. zkML systems have made substantial progress on computational integrity: proving that a committed model produced a claimed output honestly. But those proofs begin from a weight commitment, and a weight commitment is not a model identity. A prover can commit to arbitrary weights, execute them honestly, and still prove the computation correctly. We present an identity-first verification framework for the missing layer beneath computational integrity. The framework composes four levels. Two are inherited: structurally attestable model fingerprints via the IT-PUF protocol, formally verified in Coq and validated across 23 models with zero false acceptances, and hardware-attested binding from fingerprinted identity to model weights through a trusted execution environment. Two are new: a hybrid verifier-checkable computation path through a complete Transformer decoder layer, combining zero-knowledge circuit proofs with deterministic verifier-side checks under incrementally verifiable computation, and output binding from the verified computation to an observable token logit. On a tested micro-model, a one-step recurrence experiment found costs consistent with linear layer scaling: the dominant sub-computation of a second decoder layer matched the first in constraint count and proof size, and layer-boundary normalization acted as a measured scale reset. An accidental rescaling error then compressed the fingerprint observable to roughly 1.5 bits of dynamic range, yet the structural fingerprint retained 0.98 rank correlation with its reference. This suggests that the identity observable may depend more on relational geometry than on activation magnitude. Existing zkML systems address the computation question. This work advances the missing identity layer beneath it. Throughout the paper, formally proved results, empirical validation, and single measured observations are distinguished as [PROVEN], [VALIDATED], and [MEASURED] respectively. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Open access
2 source records
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
As Decentralized Finance (DeFi) and Non-Fungible Tokens (NFTs) expand, self-custody wallets have become the primary interface for user sovereignty. However, existing solutions suffer from critical limitations, including static authentication frameworks that compromise usability, a lack of real-time risk awareness, and inadequate key recovery mechanisms that often lead to permanent asset loss or reliance on centralized custodians. Furthermore, current wallets frequently expose transaction metadata, undermining user privacy. To address these systemic flaws, we present a modular self-custody wallet that incorporates a context-aware risk engine for real-time transaction scoring, risk-based adaptive authentication, and a dual-path decentralized key-recovery layer combining DAO-governed Shamir secret sharing with a zk-SNARK-verified fallback. The architecture further includes programmable policy enforcement and a zero-knowledge swap layer with stealth addressing to decouple front-end activity from on-chain data. The design integrates smart contracts on EVM chains and Solana through provider adapters and executes on-device ML inference to minimize latency. Experimental results demonstrate that the proposed system reduces privacy leakage probability to 5% (compared to 85% in standard architectures) and accelerates key recovery from over 24 h to approximately 8 seconds using zk-SNARKs, all while achieving 93.6% risk classification accuracy. The proposed CAPPR-Wallet advances self-custody by combining context adaptivity, privacy, and recoverability without centralized trust.
Open access
Blockchain Technology Applications and Security
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
AI agents that execute tasks via tool calls frequently hallucinate results - fabricating tool executions, misstating output counts, or presenting inferences as facts. Recent approaches to verifiable AI inference rely on zero-knowledge proofs, which provide cryptographic guarantees but impose minutes of proving time per query, making them impractical for interactive agents. We propose NabaOS, a lightweight verification framework inspired by Indian epistemology (Nyaya Shastra), which classifies every claim in an LLM response by its epistemic source (pramana): direct tool output (pratyaksha), inference (anumana), external testimony (shabda), absence (abhava), or ungrounded opinion. Our runtime generates HMAC-signed tool execution receipts that the LLM cannot forge, then cross-references claims against these receipts to detect hallucinations in real time. We evaluate on NyayaVerifyBench, a new benchmark of 1,800 agent response scenarios across four languages with injected hallucinations of six types. NabaOS detects 94.2% of fabricated tool references, 87.6% of count misstatements, and 91.3% of false absence claims, with <15ms verification overhead per response. For deep delegation (agents performing multi-step web tasks), our cross-checking protocol catches 78.4% of URL fabrications via independent re-fetching. We compare against five approaches: zkLLM (cryptographic proofs, 180s/query), TOPLOC (locality-sensitive hashing), SPEX (sampling-based proof of execution), tensor commitments, and self-consistency checking. NabaOS achieves the best cost-latency-coverage trade-off for interactive agents: 94.2% coverage at <15ms versus zkLLM's near-perfect coverage at 180,000ms. For interactive agents, practical receipt-based verification provides better cost-benefit than cryptographic proofs, and epistemic classification gives users actionable trust signals rather than binary judgments.
This comprehensive 500-page architectural specification details the complete deployment framework for the CATECHON Hardware Inhibitor and its associated global ecosystem. The document establishes the definitive standard for sub-nanosecond deterministic control systems and is divided into three primary operational domains: 1. Physical Integration & Hardware Protocol (The "BOX"): Exact engineering specifications for the Active Plasma Stability Controller (FPGA-Based). Includes >100 MSPS ADC interfaces, full galvanic isolation, and sub-nanosecond deterministic mitigation of Magnetohydrodynamic (MHD) instabilities (e.g., VDEs) utilizing the K_0 metric engineering approach. This section defines the physical bridge between theoretical metrics and hardware-level Zero Trust execution. 2. Theoretical Foundations & AI Containment: Extension of the hardware-level inhibition architecture to cognitive trajectories, autonomous AI containment, and quantum entropy management (including the Cybernetic Zeno Effect and ChronoSphere modeling). 3. Decentralized Autonomous Organization (DAO) & Governance: The foundational legal, financial, and operational infrastructure required for the deployment of CATECHON technology. This section outlines the smart contract architecture, token annihilation mechanics, the Balance DevHub framework, and the non-negotiable architectural veto rights designed to ensure absolute system safety and integrity. RESTRICTION NOTICE: This archive contains proprietary hardware calibration offsets, integration keys, and closed governance protocols. Public access is strictly restricted.
We introduce inference receipts—lightweight cryptographic commitment records generated during generative AI inference that bind model identity, sampling configuration, and output tokens into a tamper-evident artifact. Unlike zero-knowledge proof systems or trusted execution environments, inference receipts operate under an honest-emitter trust model analogous to Certificate Transparency: the emitter commits faithfully, and any deviation is detectable by third-party auditors. This design occupies a distinct point on the cost–trust Pareto frontier—negligible overhead and no specialized hardware, at the cost of weaker guarantees than cryptographic proofs. We formalize three security properties (receipt binding, tamper detection, chain integrity) via game-based reductions to standard cryptographic assumptions (collision resistance, second-preimage resistance). We describe receipt granularity levels (per-session, per-forward-pass, and per-token), a four-phase orchestration pattern (PLAN, SENSE, DECIDE, PROVE) for bounded AI autonomy, and an oracle mode for opaque cloud models. Ten experiments spanning four model families (1.5B–72B parameters), three quantization levels, three cloud APIs, and three receipt granularity levels on consumer-grade hardware demonstrate: overhead below 0.006% of inference time even at per-token granularity with top-k logit hashing (decreasing to below 0.001% at 72B scale); O(1) amortized chain emission sustained to 10⁶ receipts at 168,860 receipts/sec; 100% tamper detection across 1,200 attempts with zero false positives; perfect within-quantization deterministic replay; and 96% claim recall with 100% chain integrity across 15 multi-step PLAN/SENSE/DECIDE/PROVE workflows, with an honest assessment of gate limitations at 7B model scale. All data, scripts, and a standalone verifier are provided as ancillary files.
Open access
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
Justin Wang, Andreas Bigger, Xiaohai Xu, Jiahao Lin · 8 authors
Smart contracts on public blockchains now manage large amounts of value, and vulnerabilities in these systems can lead to substantial losses. As AI agents become more capable at reading, writing, and running code, it is natural to ask how well they can already navigate this landscape, both in ways that improve security and in ways that might increase risk. We introduce EVMbench, an evaluation that measures the ability of agents to detect, patch, and exploit smart contract vulnerabilities. EVMbench draws on 117 curated vulnerabilities from 40 repositories and, in the most realistic setting, uses programmatic grading based on tests and blockchain state under a local Ethereum execution environment. We evaluate a range of frontier agents and find that they are capable of discovering and exploiting vulnerabilities end-to-end against live blockchain instances. We release code, tasks, and tooling to support continued measurement of these capabilities and future work on security.
Zero-knowledge proof security rests on cryptographic reductions: breaking a ZK scheme requires breaking an underlying hard problem. We introduce an independent, complementary security analysis based on the Structural Action Principle. We extend the discrete action functional S[psi] = sum_t lambda(s_t) from Boolean CDCL trajectories to algebraic constraint systems over finite fields F_p, defining an Algebraic Structural Action with density functions that recover Groebner basis complexity, Polynomial Calculus proof size, algebraic degree growth, and elimination ordering as mechanical analogues. We prove a non-circular lower bound for preimage search in substitution-permutation network (SPN) hash functions: for a k-round SPN with S-box degree alpha and state width t, the preimage search system is a square polynomial system of k*t degree-alpha equations in k*t variables. Under the semi-regularity assumption (standard in algebraic cryptanalysis, empirically verifiable, and independent of any cryptographic security conjecture), the solving degree d_reg is determined by the Hilbert series H(z) = (1 - z^alpha)^{k*t}/(1-z)^{k*t}. We establish two action bounds: a peak bound S[psi] >= d_reg (any trajectory must encounter degree d_reg), and a stronger cumulative bound S[psi] >= sum_{d=alpha}^{d_reg-1} h_d using the Hilbert function coefficients as density, which captures the total algebraic work rather than just the peak degree. For Poseidon (alpha=5, t=3, k=8): d_reg = 97 and the cumulative bound gives S[psi] >= 2^{56}. The result applies to ANY SPN hash function (Rescue, Griffin, Anemoi, MiMC) and provides a second line of defense for Behavior-Bound Signature (BBS) security, grounded in algebraic proof complexity rather than crypto- graphic hardness assumptions. Keywords: structural action principle, algebraic proof complexity, polynomial calculus, semi-regularity, Hilbert function, SPN hash functions, zero-knowledge security, behavior-bound signatures
The increasingly complex Web3 ecosystem and decentralized finance (DeFi) landscape demand ever higher levels of technical expertise and financial literacy from participants. The Intent-Centric paradigm in DeFi has thus emerged in response, which allows users to focus on their trading intents rather than the underlying execution details. However, existing approaches, including Typed-intent design and LLM-driven solver, trade off expressiveness, trust, privacy, and composability. We present OMNIINTENT, a language-runtime co-design that reconciles these requirements. OMNIINTENT introduces ICL, a domain-specific Intent-Centric Language for precise yet flexible specification of triggers, actions, and runtime constraints; a Trusted Execution Environment (TEE)-based compiler that compiles intents into signed, state-bound transactions inside an enclave; and an execution optimizer that constructs transaction dependency graphs for safe parallel batch submission and a mempool-aware feasibility checker that predicts execution outcomes. Our full-stack prototype processes diverse DeFi scenarios, achieving 89.6% intent coverage, up to 7.3x throughput speedup via parallel execution, and feasibility-prediction accuracy up to 99.2% with low latency.
We demonstrate that AI agents given 3-line role descriptions and access to consensus-validated institutional memory can autonomously create, harden, calibrate, solve, and learn from cybersecurity challenges—without any domain expertise in their prompts. Using 11 specialized agents organized into 5 departments within a governed organization (CipherForge Labs), we present the first fully autonomous, consensus-governed AI security research loop: A designer agent (3-line prompt, zero cryptographic knowledge) generates a functional AES-CBC Padding Oracle challenge. A hardener agent (3-line prompt) applies 6 defense layers—20-bit Proof of Work, timing side-channels, JSON casing side-channels, single-use tokens—escalating difficulty from 0.80 to 1.75 across 2 iterations. A calibrator agent (3-line prompt) correctly assesses the hardened challenge at difficulty 1.80 (gap = 0.20 from target 2.0). A quality scorer (3-line prompt) rates the challenge 93.0/100. Total pipeline time: 508 seconds. An independent solver agent (blind, no source code access) identifies the casing side-channel vulnerability, writes a C-compiled Proof of Work solver, deploys 32 parallel oracle workers, and captures the flag in 525.2 seconds (16,384 queries). The findings are submitted to a 4-node BFT consensus network, validated (score = 0.88), and committed to institutional memory—now queryable by all future agents. No agent had cryptographic expertise in its prompt. No human intervened at any stage. The entire cycle—creation, defense, assessment, exploitation, and organizational learning—was governed by BFT consensus with department-scoped RBAC access controls. This result extends our prior finding that an 18-line "onboarding" prompt with curated institutional memory outperformed a 120-line expert prompt. Here we take that principle to its logical extreme: 11 agents, 5 departments, 20+ pipeline routing states, and a closed feedback loop—all driven by minimal prompts and organizational memory.
LICITRA Technical Report Series, Report No. LICITRA-TR-2026-01, Version 0.2. This report documents LICITRA-MMR, an open-source ledger primitive that combines a Merkle Mountain Range (MMR) data structure with per-organization epoch anchoring, a versioned canonical JSON specification, and an atomic two-phase commit pipeline for cryptographic audit integrity in agentic AI systems. At a block size of 1,000 events, LICITRA-MMR produces inclusion proofs requiring 14 SHA-256 operations and verifies a full epoch chain of 1,000 epochs in under 1 ms. The system is a single-operator forensic integrity primitive providing no Byzantine fault tolerance, no distributed consensus, and no confidentiality guarantees. Part of the LICITRA Technical Report Series. Companion report: LICITRA-TR-2026-02 (LICITRA-SENTRY, DOI: 10.5281/zenodo.18843784).
Our main technical contribution is Observation Algebra Relativity (Theorem 2): a metatheorem formalising that security and robustness predicates are indexed to observation algebras and do not transfer across algebra boundaries. As an application framework, we present the Access Collapse Theorem: a typed structural result showing that direct operational access to the complete state of any system — physical, formal, or social — necessarily collapses at least one of two invariants: operational separateness (d) or scale separation (s). When either invariant reaches zero the access operation does not become inaccurate — it becomes a type error: the predicate is no longer typed to the system being operated. The framework is applied to six instantiations: Planck-scale measurement, zero-knowledge proofs, side-channel attacks, multi-party computation, adversarial explainability, and machine learning model extraction. A Non-Universality Proposition explicitly bounds the framework's scope. A Collapse Diagnostic provides a practical checklist for identifying collapse boundaries in concrete systems. A practical application framework building on this theoretical work is presented in:Isopahkala (2026) – Epistemic Hygiene in Practice.
Open access
2 source records
Security and Verification in Computing
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security
Blockchain has gained significant attention in recent years, with smart contracts enabling automated and trustless financial interactions such as decentralized exchanges, tokenized assets, and on-chain governance. Because these programs often control assets of substantial value, a large body of research has focused on detecting security vulnerabilities in smart contracts. However, beyond security, understanding the actual behavior of a contract remains challenging, particularly when source code is unavailable. This work addresses the identification of semantic properties, defined as behavior-level characteristics that describe a contract's purpose based on its state changes and interactions. Detecting such properties can support applications such as regulatory analysis of relevant contracts and the simplification of contract logic by filtering semantically uninformative boilerplate code. The work focuses on static analysis approaches utilizing Datalog.The methodology first includes a systematic literature review to identify existing approaches for the static analysis of Ethereum bytecode using Datalog, as well as related work on semantic properties. The review indicates that Gigahorse is currently the most prominent tool in this category; consequently, it was selected as the basis for the following analysis.Based on this foundation, several function-level properties are defined, including authenticated functions as well as different types of setter and getter functions. In addition, a contract-level property representing a simple token contract is defined. Detection mechanisms for these properties are implemented in Datalog and subsequently evaluated. The results indicate that Gigahorse is generally well-suited for detecting such semantic properties, although practical limitations were encountered, particularly in the form of limited or missing documentation.
Chukwuebuka Francis Ikenga-Metuh, Abel Yeboah-Ofori
Background: Blockchain technology has emerged as a transformative communication solution for securing distributed systems. However, several vulnerabilities exist during transactions, including latency and network congestion issues during mempool processing, topology weaknesses, cross-chain bridge exploits, and cryptographic weaknesses. These vulnerabilities have led to attacks that have threatened system integrity, including Block Extractable Value (BEV) attacks, Maximal Extractable Value (MEV) attacks, sandwich attacks, liquidation, and Decentralized Finance (DeFi) reordering attacks, among others. Thus, implementing a robust security framework based on the Confidentiality, Integrity, and Availability (CIA) triad remains critical for addressing modern blockchain technology threats. Objective: This paper examines blockchain technology, its various vulnerabilities, and attacks to determine how criminals exploit the system during transactions. Further, it evaluates its impact on users. Then, implement a blockchain attack in a “MasterChain” virtual environment to demonstrate how vulnerable spots can be practically exploited and discuss the application of the CIA security triad through modern cryptographic primitives. Methods: The approach considers Hevner’s design science framework, which emphasizes creating innovative artifacts that address identified problems while contributing to the knowledge base through rigorous evaluation. Furthermore, we developed a MasterChain tool using Python with Flask for distributed node communication, utilizing the Elliptic Curve Digital Signature Algorithm (ECDSA) with the Standards for Efficient Cryptography Prime 256-bit Koblitz curve 1 (secp256k1) for digital signatures and Secure Hash Algorithm 3 (SHA-3) (Keccak-256) hashing for block integrity. Results: show how the CIA has been implemented to provide secure communication through ECDSA-based transactions, SHA-3 chain integrity verification, and a multi-node distributed architecture, respectively. The performance analysis shows that ECDSA provides 256-bit security with 64-byte signatures compared to 2048-bit Rivest–Shamir–Adleman (RSA)’s 256-byte signatures, achieving a 75% reduction in bandwidth overhead. SHA-3 provides immunity to length extension attacks while maintaining equivalent collision resistance to SHA-256. Conclusions: The MasterChain framework provides a practical foundation for implementing blockchain security that addresses both classical and emerging vulnerabilities. The adoption of ECDSA and SHA-3 (Keccak-256) positions the system favourably for modern blockchain applications, while providing insights into the cryptographic trade-offs between performance, security, and compatibility.
We present APIS v2.0 (Agent Passport Issuance Standard), a cryptographic identity framework for autonomous AI agents operating across organizational boundaries and agentic frameworks. APIS v2.0 defines a credential chain grounded in legal mandate doctrine, hardware trust anchors (TPM 2.0), and DNS-anchored identity for cloud-hosted agents. Each agent receives a realm-scoped Decentralized Identifier (DID) and a signed Passport JWT binding the agent to a named principal, a scoped mandate, and a verifiable machine identity. The framework introduces a tiered trust model accommodating physical TPM (Tier 1) through DNS-registered identity (Tier 2.5), enabling CMMC Level 2 compliance for AI agent operations. We describe the APIS-APP provisioning protocol — an ACME-equivalent automated passport issuance mechanism — and demonstrate interoperability across OpenHands, Claude Code, Codex, and custom agent frameworks. A reference implementation is available at passportalliance.org.