Blockchain Papers

Abraham Itzhak Weinberg

No abstract is available for this record.

Soonduck Yoo, Dae-Yeol Kim, Do-Yup Kim

Agent-based federated learning (FL) enables multiple nodes to collaboratively train a global model without sharing raw data, thereby mitigating privacy and security concerns. However, FL inherently relies on the credibility of participating agents, making trust assurance critical in environments susceptible to malicious attacks and operational faults. This paper proposes a procedural architecture for evaluating and enhancing agent credibility in distributed ledger-based FL (DLFL) systems. The proposed architecture spans the agent life cycle, consisting of the pre-training, in-training, and post-training stages, and integrates three verification domains: data-based, behavior-based, and technology-based verification. In the pre-training stage, data-based verification assesses data integrity and quality through reference distribution analysis and entropy reduction to improve learning stability. During the in-training stage, behavior-based verification establishes a dual mechanism that monitors and analyzes agents’ learning processes and outcomes and detects anomalies in updates and performance. In the post-training stage, technology-based verification ensures record immutability and accountability through blockchain, cryptographic validation, and auditing mechanisms. By combining these multi-layered procedures, the proposed architecture enables systematic and continuous evaluation of agent credibility, fostering a trustworthy FL ecosystem and enabling future applications in autonomous agent collaboration and trust-oriented AI governance.

Deny Prasetyo, Siska Narulita, Ahmad Jurnaidi Wahidin, Rosalina Yani Widiastuti · 7 authors

This study introduces a trust centric machine learning framework designed to improve decision making reliability and security in decentralized digital service ecosystems. Traditional machine learning models often focus on accuracy and efficiency but fail to address the challenges of trust and security in decentralized environments. In contrast, the proposed framework integrates dynamic trust indicators and employs Federated Learning (FL) to ensure privacy while enhancing decision making performance. The framework also incorporates Zero Knowledge Proofp based Verifiable Machine Learning (ZKP-VML), which ensures transparency and security without compromising sensitive data. Through continuous real time trust assessments, the framework adapts to changing conditions, improving the accuracy and reliability of decisions in environments where participants may not fully trust each other. The application of this framework in autonomous vehicles and IoT networks demonstrated its ability to make robust, secure decisions, even in complex and uncertain scenarios. The framework’s ability to incorporate both trust and security into its decision making processes sets it apart from traditional models, which typically do not address the trustworthiness of data or participants. This research highlights the importance of integrating trust and security into machine learning models, particularly in decentralized systems, and offers a robust solution to trust management challenges. However, challenges such as scalability and computational efficiency remain, and future work should focus on enhancing these aspects, along with exploring the framework's applicability in other decentralized domains like finance or supply chain management. The integration of privacy preserving technologies and improvements in adversarial robustness are also potential areas for future research.

Kichang Lee, Sungmin Lee, Jaeho Jin, JeongGil Ko

Modern cloud-based AI training relies on extensive telemetry and logs to ensure accountability. While these audit trails enable retrospective inspection, they struggle to address the inherent non-determinism of deep learning. Stochastic operations, such as dropout, create an ambiguity surface where attackers can mask malicious manipulations as natural random variance, granting them plausible deniability. Consequently, existing logging mechanisms cannot verify whether stochastic values were generated and applied honestly without exposing sensitive training data. To close this integrity gap, we introduce Verifiable Dropout, a privacy-preserving mechanism based on zero-knowledge proofs. We treat stochasticity not as an excuse but as a verifiable claim. Our approach binds dropout masks to a deterministic, cryptographically verifiable seed and proves the correct execution of the dropout operation. This design enables users to audit the integrity of stochastic training steps post-hoc, ensuring that randomness was neither biased nor cherry-picked, while strictly preserving the confidentiality of the model and data.

Elif Nur Kucur, Tolga Büyüktanır, Muharrem Ugurelli, Kazım Yıldız

Privacy-preserving machine learning (PPML) constitutes a core element of responsible AI by supporting model training and inference without exposing sensitive information. This survey presents a comprehensive examination of the major cryptographic PPML techniques and introduces a unified taxonomy covering technical models, verification criteria, and evaluation dimensions. The study consolidates findings from both survey and experimental works using structured comparison tables and emphasizes that recent research increasingly adopts hybrid and verifiable PPML designs. In addition, we map PPML applications across domains such as healthcare, finance, Internet of Things (IoT), and edge systems, indicating that cryptographic approaches are progressively transitioning from theoretical constructs to deployable solutions. Finally, the survey outlines emerging trends—including the growth of zero-knowledge proofs (ZKPs)-based verification and domain-specific hybrid architectures—and identifies practical considerations that shape PPML adoption in real systems.

Shinichi Nagata

Decision-OS V5 Revised (SiriusA2) addresses a practical AI safety problem: how human oversight can prevent irreversible decisions from being executed under pressure, confusion, coercion, or panic. It is designed for safety-critical, non-medical decision support settings where a user may be authenticated, yet the execution path may still be unsafe. The framework proposes a human-in-the-loop confirmation layer for irreversible risk. Instead of allowing a valid user action to move directly into execution, SiriusA2 routes protected actions through auditable confirmation states such as Request, Observe, Hold, Approve, Reject, Stop Candidate, Execute, and Revoke. The core mechanism is a trajectory-aware duress_score. This score is not an intent classifier, diagnosis, truthfulness score, or autonomous veto. It is an operational control-routing signal used to detect when a valid execution path deviates from an ordinary decision trajectory and approaches irreversible harm. SiriusA2 preserves human final consent through two-step confirmation, an explicit revoke path, optional family multisig, and a Zero-Knowledge approval layer (310/320) that verifies authorization without exposing personally identifiable information. The duress_score does not replace ZK approval or multisig; it routes actions into the confirmation path, while ZK qualification and multisig provide independent authorization conditions before irreversible execution. The revised manuscript integrates the SiriusA Adoption Gate into the main paper. The gate provides a Hold-first confirmation path for irreversible, externally pressured, unusually urgent, or high-stake actions: Request → Observe/Hold → Approve/Reject → Execute/Revoke. A score-based Stop Candidate does not automatically become Stop or Freeze. Stop or Freeze requires an independent non-score condition, such as verified revoke input, ZK-qualified m-of-k approval, policy-defined guardian confirmation, or an emergency protocol condition. If no such condition is available, SiriusA intentionally prefers continued Hold and evidence preservation over an AI-only execution veto. This release also clarifies cold-start behavior, causal bridge support, baseline maturity, corrected event terms, disclosure boundaries for calibration-sensitive parameters, and non-PII audit requirements. Safety is operationalized through auditable state transitions, non-PII KPIs, five-line gate outputs, evidence packaging (ZIP + SHA256), and explicit prohibitions on automatic transmission, payment, or reporting. A minimal proof-of-concept gate exists as a public runtime artifact, demonstrating PASS / DELAY / BLOCK routing, conservative severity merging, evidence union, pre-execution checking, and auditable JSON outputs. Deployment-level validation, calibration, and domain-specific robustness remain future work. Gateway / series index:https://github.com/shin4141/decision-os-paper Recommended read order:V5 Revised (SiriusA2) → V6 (PIC) → V8 (v2)Optional: V7 (AGI definition) Related repositories:- V5 Policy Pack / specification and adoption materials: https://github.com/shin4141/paper-public- Gate engine / MMAR-L0: https://github.com/shin4141/mmar-l0-core- SiriusA core runtime: https://github.com/shin4141/siriusA-core SSOT:GitHub repository “decision-os-paper”.This PDF corresponds to the revised SiriusA2 release candidate committed to the SSOT repository. Release note:This revised release integrates the trajectory-aware duress_score definition, SiriusA Adoption Gate, ZK qualification layer, family multisig, independent non-score Stop conditions, non-PII audit structure, V4-compatible escalation interface, and proof-of-concept gate positioning into the main paper. Transparency / Author’s Note:https://github.com/shin4141/decision-os-paper/blob/main/AUTHORS_NOTE.md

Savvy Sharma, George Petrovic, Sarthak Kaushik

Healthcare AI needs large, diverse datasets, yet strict privacy and governance constraints prevent raw data sharing across institutions. Federated learning (FL) mitigates this by training where data reside and exchanging only model updates, but practical deployments still face two core risks: (1) privacy leakage via gradients or updates (membership inference, gradient inversion) and (2) trust in the aggregator, a single point of failure that can drop, alter, or inject contributions undetected. We present zkFL-Health, an architecture that combines FL with zero-knowledge proofs (ZKPs) and Trusted Execution Environments (TEEs) to deliver privacy-preserving, verifiably correct collaborative training for medical AI. Clients locally train and commit their updates; the aggregator operates within a TEE to compute the global update and produces a succinct ZK proof (via Halo2/Nova) that it used exactly the committed inputs and the correct aggregation rule, without revealing any client update to the host. Verifier nodes validate the proof and record cryptographic commitments on-chain, providing an immutable audit trail and removing the need to trust any single party. We outline system and threat models tailored to healthcare, the zkFL-Health protocol, security/privacy guarantees, and a performance evaluation plan spanning accuracy, privacy risk, latency, and cost. This framework enables multi-institutional medical AI with strong confidentiality, integrity, and auditability, key properties for clinical adoption and regulatory compliance.

Aaron Chan, Alex Ding, Frank Sicong Chen, Alan Wu · 6 authors

The rapid integration of Large Language Models (LLMs) into decentralized physical infrastructure networks (DePIN) is currently bottlenecked by the Verifiability Trilemma, which posits that a decentralized inference system cannot simultaneously achieve high computational integrity, low latency, and low cost. Existing cryptographic solutions, such as Zero-Knowledge Machine Learning (ZKML), suffer from superlinear proving overheads (O(k NlogN)) that render them infeasible for billionparameter models. Conversely, optimistic approaches (opML) impose prohibitive dispute windows, preventing real-time interactivity, while recent "Proof of Quality" (PoQ) paradigms sacrifice cryptographic integrity for subjective semantic evaluation, leaving networks vulnerable to model downgrade attacks and reward hacking. In this paper, we introduce Optimistic TEE-Rollups (OTR), a hybrid verification protocol that harmonizes these constraints. OTR leverages NVIDIA H100 Confidential Computing Trusted Execution Environments (TEEs) to provide sub-second Provisional Finality, underpinned by an optimistic fraud-proof mechanism and stochastic Zero-Knowledge spot-checks to mitigate hardware side-channel risks. We formally define Proof of Efficient Attribution (PoEA), a consensus mechanism that cryptographically binds execution traces to hardware attestations, thereby guaranteeing model authenticity. Extensive simulations demonstrate that OTR achieves 99% of the throughput of centralized baselines with a marginal cost overhead of $0.07 per query, maintaining Byzantine fault tolerance against rational adversaries even in the presence of transient hardware vulnerabilities.

Mohammed Alhayani, Wisam Hazım Gwad, Shahab Wahhab Kareem, Moustafa Fayad

The increasing use of blockchain smart contracts has introduced new security challenges, as small coding errors can lead to major financial losses. While rule-based static analyzers remain the most common detection tools, their limited adaptability often results in false positives and outdated vulnerability patterns. This study presents a comprehensive comparative analysis of machine learning (ML) and deep learning (DL) methods for smart contract vulnerability detection using the BCCC-SCsVuls-2024 benchmark dataset. Six models (Random Forest, k-Nearest Neighbors, Simple and Deep Multilayer Perceptron, and Simple and Deep one-dimensional Convolutional Neural Networks) were evaluated under a unified experimental framework combining RobustScaler normalization and Principal Component Analysis (PCA) for dimensionality reduction. Our experimental results from a five-fold cross-validation show that the Random Forest classifier achieved the best overall performance with an accuracy of 89.44% and an F1-score of 93.20%, outperforming both traditional and neural models in stability and generalization. PCA-based feature analysis revealed that opcode-level features, particularly stack and memory manipulation instructions (PUSH, DUP, SWAP, and RETURNDATASIZE), were the most influential in defining contract behavior.

Talia Ruiz Mendoza

AI development requires reliable datasets, yet today’s data supply chains face challenges in traceability, authenticity and ethical compliance. This study introduces a blockchain-assisted data integrity framework that ensures transparent and verifiable provenance for AI model training. The proposed system uses smart contracts to record data lineage, ownership, preprocessing transformations and annotation events. IPFS-based off-chain storage reduces blockchain load while ensuring immutability. A verification engine allows auditors to evaluate dataset compliance with ethical and regulatory standards, including bias mitigation and consent validation. Experiments utilized three real AI workflows: medical imaging, sentiment analysis and environmental sensor classification. Findings show a 92 percent reduction in provenance disputes and an improvement in audit efficiency by 41 percent. The system also provides tamper-resistant documentation supporting responsible AI governance. Latency tests show minimal performance impact due to parallelized validation nodes. This research demonstrates that blockchain can provide a robust backbone for ethical AI ecosystems, where transparency and trust are critical. Future work will explore confidentiality enhancements using zero-knowledge proofs.

Vinoth Punniyamoorthy, Ashok Gadi Parthi, Mayilsamy Palanigounder, Ravi Kiran Kodali · 6 authors

Distributed machine learning systems require strong privacy guarantees, verifiable compliance, and scalable deployment across heterogeneous and multi-cloud environments. This work introduces a cloud-native privacy-preserving architecture that integrates federated learning, differential privacy, zero-knowledge compliance proofs, and adaptive governance powered by reinforcement learning. The framework supports secure model training and inference without centralizing sensitive data, while enabling cryptographically verifiable policy enforcement across institutions and cloud platforms. A full prototype deployed across hybrid Kubernetes clusters demonstrates reduced membership-inference risk, consistent enforcement of formal privacy budgets, and stable model performance under differential privacy. Experimental evaluation across multi-institution workloads shows that the architecture maintains utility with minimal overhead while providing continuous, risk-aware governance. The proposed framework establishes a practical foundation for deploying trustworthy and compliant distributed machine learning systems at scale.

Uisang Lee, Changhoon Chung, Junmo Lee, Sung Jun Moon

The rapid growth of Ethereum has made it more important to quickly and accurately detect smart contract vulnerabilities. While machine-learning-based methods have shown some promise, many still rely on rule-based preprocessing designed by domain experts. Rule-based preprocessing methods often discard crucial context from the source code, potentially causing certain vulnerabilities to be overlooked and limiting adaptability to newly emerging threats. We introduce BugSweeper, an end-to-end deep learning framework that detects vulnerabilities directly from the source code without manual engineering. BugSweeper represents each Solidity function as a Function-Level Abstract Syntax Graph (FLAG), a novel graph that combines its Abstract Syntax Tree (AST) with enriched control-flow and data-flow semantics. Then, our two-stage Graph Neural Network (GNN) analyzes these graphs. The first-stage GNN filters noise from the syntax graphs, while the second-stage GNN conducts high-level reasoning to detect diverse vulnerabilities. Extensive experiments on real-world contracts show that BugSweeper significantly outperforms all state-of-the-art detection methods. By removing the need for handcrafted rules, our approach offers a robust, automated, and scalable solution for securing smart contracts without any dependence on security experts.

Basil Hanafi, Mohammad Ubaidullah Bokhari, Mudasir Ahmad Wani, Kashish Ara Shakil · 5 authors

Various types of research are being carried out to advance in the field of cryptography and develop a more robust technique for security. Adversarial neural cryptography (ANC) is a recent development in this extension, which possesses huge potential to be implemented in various domains. There is a continuous need for the development of more adaptive techniques to secure data while in communication using deep learning and other applied artificial intelligence techniques, which serves as the motivation for this work stems from the increasing need for adaptive, robust encryption mechanisms to address the limitations of traditional cryptographic techniques in securing sensitive blockchain transactions. This article proposes a new approach for the protection of private smart contracts on blockchain systems via ANC. The proposed method in the research is dynamic adversarial training using three neural networks to secure smart contract transactions. It optimizes the encryption and decryption processes against evolving cyber threats. The algorithm strives to attain a high key agreement rate (KAR) and a lower Eve’s decryption failure rate (EDFR) eventually proving its efficacy in attaining privacy and security in blockchain applications and adaptability. This research will incite more studies on ANC and its practical implementations in ensuring private smart contracts and overcoming the present cryptographical approaches with significant development because of their potential.

Mohammad M Maheri, Sunil Cotterill, Alex Davidson, Hamed Haddadi

Machine unlearning aims to remove the influence of specific data points from a trained model to satisfy privacy, copyright, and safety requirements. In real deployments, providers distribute a global model to many edge devices, where each client personalizes the model using private data. When a deletion request is issued, clients may ignore it or falsely claim compliance, and providers cannot check their parameters or data. This makes verification difficult, especially because personalized models must forget the targeted samples while preserving local utility, and verification must remain lightweight on edge devices. We introduce ZK APEX, a zero-shot personalized unlearning method that operates directly on the personalized model without retraining. ZK APEX combines sparse masking on the provider side with a small Group OBS compensation step on the client side, using a blockwise empirical Fisher matrix to create a curvature-aware update designed for low overhead. Paired with Halo2 zero-knowledge proofs, it enables the provider to verify that the correct unlearning transformation was applied without revealing any private data or personalized parameters. On Vision Transformer classification tasks, ZK APEX recovers nearly all personalization accuracy while effectively removing the targeted information. Applied to the OPT125M generative model trained on code data, it recovers around seventy percent of the original accuracy. Proof generation for the ViT case completes in about two hours, more than ten million times faster than retraining-based checks, with less than one gigabyte of memory use and proof sizes around four hundred megabytes. These results show the first practical framework for verifiable personalized unlearning on edge devices.

Shai Levin, Robi Pedersen

No abstract is available for this record.

Hana Yusupova

AI systems rely heavily on high-quality training data, yet provenance tracking remains fragmented and vulnerable to manipulation. This study presents a blockchain-enabled data provenance framework designed to bring transparency and verifiability to AI training pipelines. The architecture records dataset lineage, preprocessing steps, annotation events and model updates using immutable smart contract transactions. A lightweight off-chain storage mechanism reduces blockchain overhead while maintaining audit guarantees. The system was tested with three machine learning pipelines involving image classification, text processing and sensor analytics. Results show a 95 percent reduction in provenance disputes and full traceability across all data contributors. Smart contracts automate compliance checks and access permissions, ensuring that only validated datasets feed into the training process. The framework improves accountability for AI ethics, model bias evaluation and regulatory reporting. Experiments confirm that blockchain latency does not significantly affect pipeline throughput due to parallelized validation nodes. The work demonstrates how decentralized technologies can support trustworthy AI development. Future research will explore integration with zero-knowledge proofs to further enhance confidentiality.

Panagiotis Karmiris

ExecMesh introduces cryptographically verifiable computation as a foundational primitive for regulatory compliance and audit trail requirements in AI/ML systems [1–3]. By combining commitmentbased verification with secure multi-party oracles and a two-tier regulatory architecture, ExecMesh enables enterprises to meet FDA, SEC, and EU AI Act requirements while maintaining the benefits of decentralized infrastructure. Immediate Value Proposition: ExecMesh provides immediate value as an audit trail and provenance layer for regulated AI systems, independent of advances in zero-knowledge proof technology. Even without full verification of large neural networks, the system delivers cryptographic guarantees for data integrity, execution timestamps, and pipeline reproducibility—meeting core regulatory requirements today.

Revista, Zen, IA, 10

This paper addresses the critical need for accountability in artificial intelligence (AI) systems, particularly in domains where decisions have significant societal and ethical implications. We propose a novel framework leveraging auditable attestations to ensure provable compliance with predefined standards and regulations. The core of our approach involves generating verifiable proofs about the behavior and characteristics of machine learning models, allowing for independent audits and assessments. We explore the theoretical foundations of such attestations, focusing on cryptographic techniques like zero-knowledge proofs and secure multi-party computation, which enable the verification of model properties without revealing sensitive information. Furthermore, we discuss the practical implementation of our framework, including the design of attestation protocols, the selection of relevant model properties to verify, and the development of tools for generating and validating attestations. We illustrate the effectiveness of our approach through case studies in areas such as fairness in lending, transparency in healthcare, and safety in autonomous driving. Our results demonstrate the potential of auditable attestations to enhance trust and accountability in AI systems, fostering responsible innovation and deployment.

Xiaoqi Li, Zongwei Li, Wenkai Li, Zeng Zhang · 5 authors

Smart contracts are a core component of blockchain technology and are widely deployed across various decentralized scenarios. However, atomicity violations have become a critical potential security risk. Existing analysis tools often lack the precision required to detect these issues effectively. To address this challenge, we introduce AtomGraph, an automated framework designed for detecting atomicity violations. This framework leverages Graph Convolutional Networks (GCN) to accurately identify atomicity violations through multimodal feature learning and fusion. Specifically, driven by a collaborative learning mechanism, the model simultaneously learns from two heterogeneous modalities: extracting structural topological features from the bytecode-based Control Flow Graph (CFG) and uncovering deep semantics from its opcode sequence. We designed an adaptive weighted fusion mechanism to dynamically adjust the weights of features from each modality to achieve optimal feature fusion. Finally, GCN detects graph-level atomicity violations on the contract. Comprehensive experimental evaluations demonstrate that AtomGraph achieves 96.88% accuracy and 96.97% F1 score, outperforming existing tools. Furthermore, compared to the baseline concatenation fusion model, AtomGraph improves the F1 score by 6.4%, proving its potential in smart contract security detection.

Rafał Skowroński

Blockchain networks face a critical but understudied threat: wave attacks that exploit difficulty adjustment algorithms through strategic mining participation. Adversaries cyclically withdraw and re-enter mining to create oscillations that degrade network liveness and destabilize honest miners’ revenue. We present the first production-ready framework that maintains network responsiveness while enabling robust, post hoc threat detection. The framework employs a statistically rigorous pipeline featuring controller-aligned anomaly detection, transitive collusion grouping via union-find, and Benjamini–Hochberg False Discovery Rate control. We formally prove the economic viability of this architecture: when penalties on unvested rewards are enabled by governance, wave attacks become asymptotically unprofitable for rational adversaries. Evaluated on a 128-node distributed testbed simulating Bitcoin, Ethereum Classic, and Monacoin networks over 30 independent runs, our framework achieves 92.7% F1-score in detecting attacks, significantly outperforming baseline methods (74.7%). This work provides a complete, theoretically-grounded solution for securing proof-of-work blockchains against difficulty manipulation, forming the foundation for the adaptive AI-driven enhancements presented in our companion paper (Part II).

SONG Jianhua, CAO Kai, ZHANG Yan

In recent years,the security issues of smart contracts have become increasingly prominent,and vulnerability detection has become a key challenge.In scenarios where source code is not publicly available,bytecode-based detection methods have attracted significant attention.However,existing deep learning methods typically rely solely on sequences or graph structures,which makes it difficult to fully capture vulnerability features.To address this,this paper proposes a smart contract bytecode vulnerability detection method based on heterogeneous graphs and instruction sequences,called RGCN-ResNet1D(Relational Graph Convolutional Network and ResNet-based 1D Convolutional Network).This method models bytecode as a heterogeneous graph and instruction sequence,using a Relational Graph Convolutional Network(RGCN) to extract structural features and a ResNet-based 1D Convolutional Network(ResNet1D) to extract sequential features,and then fuses the two types of features for vulnerability detection.A cross-entropy loss function is also designed,which dynamically adjusts the weight based on the number of misclassified samples,effectively alleviating the class imbalance problem in the training set.Experimental results show that RGCN-ResNet1D achieves F1 scores of 95.43%,90.67%,and 92.31% for detecting integer overflow,timestamp dependency,and self-destruct vulnerabilities,respectively,significantly outperforming the comparison methods.

Yining Yuan, Yifei Wang, Yuanwei Xu, Zachary Yahn · 6 authors

This paper presents LLMBugScanner, a large language model (LLM) based framework for smart contract vulnerability detection using fine-tuning and ensemble learning. Smart contract auditing presents several challenges for LLMs: different pretrained models exhibit varying reasoning abilities, and no single model performs consistently well across all vulnerability types or contract structures. These limitations persist even after fine-tuning individual LLMs. To address these challenges, LLMBugScanner combines domain knowledge adaptation with ensemble reasoning to improve robustness and generalization. Through domain knowledge adaptation, we fine-tune LLMs on complementary datasets to capture both general code semantics and instruction-guided vulnerability reasoning, using parameter-efficient tuning to reduce computational cost. Through ensemble reasoning, we leverage the complementary strengths of multiple LLMs and apply a consensus-based conflict resolution strategy to produce more reliable vulnerability assessments. We conduct extensive experiments across multiple popular LLMs and compare LLMBugScanner with both pretrained and fine-tuned individual models. Results show that LLMBugScanner achieves consistent accuracy improvements and stronger generalization, demonstrating that it provides a principled, cost-effective, and extensible framework for smart contract auditing.

P. Prakash, Faheema Kattakath Sanil, Jeffrey Tom Shaji, Saravanan Palani · 5 authors

The adoption of privacy-preserving techniques in healthcare is significant, especially while handling sensitive medical information. Traditional machine learning approaches raise significant concern regarding privacy, regulations, and data protection. Federated learning has emerged as an effective machine learning approach that enables a group of local models to collaboratively train the global model by sharing their updates instead of sharing the sensitive medical data. Nevertheless, a significant issue with federated learning is its vulnerability to various attacks, including model corruption and data tampering. The authors propose a methodology for developing a secure and privacy-safeguarded collaborative learning model by integrating zero knowledge proof (ZKP) with federated learning (FL). The proposed RS-ZKP methodology utilizes Pedersen commitments within ZKP to verify feature importance, ensuring that they fall within specified bounds without disclosing the actual values. The methodology is validated on two benchmark datasets using metrics accuracy, precision, recall, and F1 score.

Jiaxi Liu, Lin Sun, Tianyu Kang, Di Wu · 7 authors

Federated Learning (FL) enables model training on distributed devices while preserving data privacy. However, malicious clients can submit fabricated model updates to fraudulently obtain training rewards, a behavior known as free-rider attacks. Existing detection-based solutions analyze anomalies in model updates but lack direct evidence of local training, making it fail to fully prevent free-riders. To address this limitation, we propose zkVFL, a verifiable FL framework leveraging Zero-Knowledge Proofs (ZKP) to ensure the integrity of local training while preserving privacy. To reduce the computational overhead of proof generation in ZKP, zkVFL introduces two novel techniques: (i) anomaly-aware client sampling to selectively perform ZKP verification and (ii) A recursive ZKP protocol (ReMPoT), incorporating a pruning-based layer selection technique, reduces proof generation costs. Experimental results demonstrate that zkVFL improves the accuracy and convergence of FL training under free-rider attacks while significantly reducing the computational and memory overhead of proof generation on resource-constrained devices.