Every standard signature scheme enforces one property: only the key holdercan sign. What the key holder signs is unconstrained. Policy enforcement-- spending limits, rate limits, access control -- lives in smartcontracts, middleware, or governance: layers that can be upgraded,bypassed, or exploited. We call this the software-layer assumption:compliance holds only if the enforcing code is correct and unmodified. We eliminate this assumption. We introduce behavior-bound signatures(BBS), in which a policy constraint delta(x) < epsilon is committed atkey generation and enforced inside the signature's zero-knowledge proof.If the action violates the policy, the ZK constraint system isunsatisfiable -- no witness, no proof, no signature. This is not asoftware check. It is a mathematical impossibility. No software canoverride. Unlike policy-based signatures (where an authority imposes policy onsigners), BBS is self-committed: the signer binds their own futurebehavior at key generation, and even the signer cannot later violate orrevoke this commitment. We formalize this as policy-soundness (PS-CMA), a security modelstrictly stronger than EUF-CMA, and prove it under standard assumptions(Pedersen binding, Poseidon CR, ZK knowledge soundness). From thissingle primitive, five independent consequences follow -- not as separatedesigns, but as necessary implications of one cryptographic root: (A) Compliance safety under f <= n-1 Byzantine faults, decoupled from honest-quorum assumptions.(B) O(1) verification and audit via a single ZK check and Pedersen homomorphic aggregation.(C) Elimination of the virtual-machine execution layer for policy-constrained transactions.(D) A gasless ledger: branch C removes metering, while ZK-encoded rate limits make spam mathematically nonexistent.(E) The first cryptographic guarantee that a compromised autonomous AI agent cannot exceed its authorized behavioral envelope. Moreover, the zero-knowledge property ensures that complianceverification reveals neither the signer's identity nor the transactionparameters -- achieving regulatory compliance without identitydisclosure, complementary to existing ZK-KYC frameworks that verifystatic identity attributes.
Cloud computing has transformed data storage, accessibility, and enterprise operations; however, it has also increased exposure to sophisticated cyber threats. Traditional centralized Identity Management Systems (IDMs) often suffer from critical vulnerabilities such as a single point of failure, where the compromise of a central authority can expose sensitive user credentials. This research proposes ZKP-Shield, a security framework that integrates Non-Interactive Zero-Knowledge Proofs (NIZKPs) with a Software-Defined Perimeter (SDP) to create a secure and invisible cloud authentication environment. The proposed architecture eliminates the need to transmit passwords or sensitive identity data by allowing users to mathematically prove their identity without revealing secret information. Simultaneously, the SDP layer conceals cloud resources from unauthorized users by enforcing a âdark cloudâ model, where services remain hidden until authentication is successfully verified. The framework employs cryptographic techniques such as the Discrete Logarithm Problem and the FiatâShamir heuristic to transform interactive proofs into efficient non-interactive authentication processes. Experimental simulations conducted in a distributed cloud environment demonstrate that the ZKP-SDP integration significantly reduces attack surfaces, prevents credential-based attacks, and maintains acceptable latency for enterprise applications. The results indicate that combining cryptographic identity verification with network invisibility provides a scalable and resilient security model for modern cloud infrastructures.
We study what model-identifying information leaks through commercial language-model APIs that expose top-k token log probabilities. Building on extreme-value theory predictions for logit order-statistic gaps, we confirm that the normalized third logit gap (δ norm) remains near the Gumbel-class constant â0.318 across 6 models from 3 providers (OpenAI, Google Vertex AI, xAI) and 3 independent measurement sessions, demonstrating that output-layer universality persists through API truncation and quantization. We introduce a PPP-residualization transform that removes the dominant tail scale factor and reveals a low-dimensional but stable endpoint-specific geometry in the remaining gap spectrum. Contrary to common assumption, "provider" is not a geometrically coherent label: models do not cluster by corporate origin under these observables, but they do separate by model identity across independent sessions. Using a challenge-response protocol with centroid averaging and per-model thresholds, we demonstrate cross-session endpoint verification with a 0.83% breach rate (119/120 correct identifications across three temporal sessions); per-model thresholds eliminate all breaches on this dataset. We observe a robustness phase transition governed by enrollment depth. Under single-session enrollment, prompt selection is load-bearing: the majority of bootstrapped banks fail to separate the six endpoints. Under two-session enrollment, bank sensitivity collapses on this dataset, and a bank compiler produces small compiled banks that exceed the margin of larger uncompiled banks. A dimensionless robustness parameter SNR(K,S) unifies both axes: prompt count K and enrollment depth S jointly govern the transition from bank-sensitive to bank-robust verification. We discuss operational implications for re-enrollment cadence and template management in production deployments. Addendum (02/26/2026): Post-publication results extend this framework in two directions. A distillation experiment across six training protocols demonstrates that a model's structural fingerprint (weight-geometry regime) is completely invariant to knowledge distillation, while its functional fingerprint (PPP-residual template) converges 31--52% toward the teacher's â enabling forensic detection of distillation provenance through API measurements alone. A conditional impossibility theorem, machine-checked in Coq (41 theorems, 0 Admitted), proves that no standalone model can spoof another's PPP-residual template across independent challenge prompts without exhausting its KL divergence budget, under four explicit trust assumptions. Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) The Neural Network Identity Series â Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window â AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks â Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? â Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity â Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure â Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity â Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
SARMF (Smart Contract Automated Remediation and Mitigation Framework) is a structured and reproducible security engineering pipeline designed for vulnerability detection, taxonomy alignment, automated remediation, and adversarial validation of Ethereum-compatible smart contracts. This operational protocol presents a structured workflow for smart contract vulnerability detection and automated mitigation within blockchain-based systems. The methodology integrates deterministic environment setup, multi-tool static analysis, vulnerability normalization using standardized taxonomies, rule-based automated patch generation, and dynamic adversarial validation. By combining static detection tools with controlled refactoring patterns and behavioral verification, the framework ensures reproducibility, traceability, and measurable performance impact assessment. The protocol concludes with comprehensive audit reporting and archival procedures to support transparency and independent verification. This workflow provides a systematic foundation for secure smart contract lifecycle management in decentralized applications. Unlike traditional audit checklists, this framework operationalizes vulnerability detection, taxonomy alignment, automated remediation generation, and validation feedback loops into a unified reproducible security engineering pipeline. Key Contributions of SARMF: Deterministic environment and compilation reproducibility model. Unified multi-tool vulnerability normalization aligned with SWC taxonomy. Rule-based automated mitigation generation preserving semantic integrity. Iterative validation loop combining static, adversarial, and fuzz testing. Structured audit archival enabling independent verification and traceability.
Wyatt Benno, Alberto Centelles, Antoine Douchet, Khalil Gibran
We present Jolt Atlas, a zero-knowledge machine learning (zkML) framework that extends the Jolt proving system to model inference. Unlike zkVMs (zero-knowledge virtual machines), which emulate CPU instruction execution, Jolt Atlas adapts Jolt's lookup-centric approach and applies it directly to ONNX tensor operations. The ONNX computational model eliminates the need for CPU registers and simplifies memory consistency verification. In addition, ONNX is an open-source, portable format, which makes it easy to share and deploy models across different frameworks, hardware platforms, and runtime environments without requiring framework-specific conversions. Our lookup arguments, which use sumcheck protocol, are well-suited for non-linear functions -- key building blocks in modern ML. We apply optimisations such as neural teleportation to reduce the size of lookup tables while preserving model accuracy, as well as several tensor-level verification optimisations detailed in this paper. We demonstrate that Jolt Atlas can prove model inference in memory-constrained environments -- a prover property commonly referred to as \textit{streaming}. Furthermore, we discuss how Jolt Atlas achieves zero-knowledge through the BlindFold technique, as introduced in Vega. In contrast to existing zkML frameworks, we show practical proving times for classification, embedding, automated reasoning, and small language models. Jolt Atlas enables cryptographic verification that can be run on-device, without specialised hardware. The resulting proofs are succinctly verifiable. This makes Jolt Atlas well-suited for privacy-centric and adversarial environments. In a companion work, we outline various use cases of Jolt Atlas, including how it serves as guardrails in agentic commerce and for trustless AI context (often referred to as \textit{AI memory}).
Zero-knowledge proof generation imposes stringent timing and reliability constraints on blockchain systems. For ZK-rollups, delayed proofs cause finality lag and economic loss; for Ethereum's emerging L1 zkEVM, proofs must complete within the 12-second slot window to enable stateless validation. The Ethereum Foundation's Ethproofs initiative coordinates multiple independent zkVMs across proving clusters to achieve real-time block proving, yet no principled orchestration framework addresses the joint challenges of (i) strict head-of-chain ordering, (ii) sub-slot latency bounds, (iii) fault-tolerant task reassignment, and (iv) prover-agnostic workflow composition. We present push0, a cloud-native proof orchestration system that decouples prover binaries from scheduling infrastructure. push0 employs an event-driven dispatcher--collector architecture over persistent priority queues, enforcing block-sequential proving while exploiting intra-block parallelism. We formalize requirements drawn from production ZK-rollup operations and the Ethereum real-time proving specification, then demonstrate via production Kubernetes cluster experiments that push0 achieves 5 ms median orchestration overhead with 99--100% scaling efficiency at 32 dispatchers for realistic workloads--overhead negligible (less than 0.1%) relative to typical proof computation times of 7+ seconds. Controlled Docker experiments validate these results, showing comparable performance (3--10 ms P50) when network variance is eliminated. Production deployment on the Zircuit zkrollup (14+ million mainnet blocks since March 2025) provides ecological validity for these controlled experiments. Our design enables seamless integration of heterogeneous zkVMs, supports automatic task recovery via message persistence, and provides the scheduling primitives necessary for both centralized rollup operators and decentralized multi-prover networks.
Engram Commitments introduce a cryptographically verifiable, substrate-rooted identity primitive for large language models. The method extracts engrams from differential execution behavior, aggregates them into an engram vector, compresses this representation using locality-sensitive hashing, and seals it inside a binding-and-hiding cryptographic commitment. Zero-knowledge proofs enable verification of identity continuity and lineage without revealing model parameters. The construction remains stable under non-destructive transformations and degrades predictably under destructive ones, supporting collapse-aware auditing, tamper-evident provenance, and regulator-verifiable attestation. This work unifies the engram calculus, identity ontology, collapse taxonomy, and cryptographic commitments into a single framework for AI provenance, governance, and safety.
Zero-knowledge (ZK) proofs can be formally correct while their deployment pipelines remain fragile. The practical failure modes often arise not at the proof layer, but at the layers where trust is injected: setup, key custody, entropy sourcing, implementation, governance, and deployment interfaces. This paper models ZK pipelines as trust-graphs and proposes an audit-first separation between (i) proof correctness and (ii) pipeline integrity. The core claim is structural: for any non-trivial ZK pipeline, there exists at least one responsibility binding layer R where trust is required and accountability must be assigned. Removing a ceremony does not remove responsibility; it relocates it. We provide minimal definitions, a traceable audit interface, and compact structural examples intended to support reproducible security reviews without overclaiming. Keywords: zero-knowledge; trusted setup; CRS; SNARK; STARK; trust graph; audit; governance; pipeline integrity; responsibility relocation
Verifying that a compiled binary originates from its claimed source code is a fundamental security requirement, called source code provenance. Achieving verifiable source code provenance in practice remains challenging. The most popular technique, called reproducible builds, requires difficult matching and reexecution of build toolchains and environments. We propose a novel approach to verifiable provenance based on compiling software with zero-knowledge virtual machines (zkVMs). By executing a compiler within a zkVM, our system produces both the compiled output and a cryptographic proof attesting that the compilation was performed on the claimed source code with the claimed compiler. We implement a proof-of-concept implementation using the RISC Zero zkVM and the ChibiCC C compiler, and evaluate it on 200 synthetic programs as well as 31 OpenSSL and 21 libsodium source files. Our results show that zk-compilation is applicable to real-world software and provides strong security guarantees: all adversarial tests targeting compiler substitution, source tampering, output manipulation, and replay attacks are successfully blocked.
This paper introduces DMind-3, a sovereign Edge-Local-Cloud intelligence stack designed to secure irreversible financial execution in Web3 environments against adversarial risks and strict latency constraints. While existing cloud-centric assistants compromise privacy and fail under network congestion, and purely local solutions lack global ecosystem context, DMind-3 resolves these tensions by decomposing capability into three cooperating layers: a deterministic signing-time intent firewall at the edge, a private high-fidelity reasoning engine on user hardware, and a policy-governed global context synthesizer in the cloud. We propose policy-driven selective offloading to route computation based on privacy sensitivity and uncertainty, supported by two novel training objectives: Hierarchical Predictive Synthesis (HPS) for fusing time-varying macro signals, and Contrastive Chain-of-Correction Supervised Fine-Tuning (C$^3$-SFT) to enhance local verification reliability. Extensive evaluations demonstrate that DMind-3 achieves a 93.7% multi-turn success rate in protocol-constrained tasks and superior domain reasoning compared to general-purpose baselines, providing a scalable framework where safety is bound to the edge execution primitive while maintaining sovereignty over sensitive user intent.
Smart contract security mainly aims to discover vulnerabilities in contract code based on the assumption that malicious behavior emerges from exploitable execution paths. This assumption is increasingly misaligned with modern blockchain systems, where off-chain automated agents continuously observe on-chain state and act autonomously. In this paper, we argue that smart contracts now act as public signalling mechanisms, capable of encoding command-and-control (C2) primitives through events and persistent storage variables. Off-chain agents, including LLM-based agents, convert benign-looking state changes into coordinated, high-impact actions across protocols and chains, semantically interpreting these signals. This kind of behaviour does not require code-level exploitation and thus can be built to evade existing analysis methods by construction. We explore how such a kind of coordination enables delayed activation, selective targeting, and deception, and explain why contract-centric security models fall short of such risks. We conclude by examining the main challenges and the directions for securing agent-mediated blockchain ecosystems.
The rapid adoption of Verifiable Credentials (VCs) has intensified privacy and security challenges in digital verification, as traditional systems often require full credential disclosure, creating privacy risks and expanding the attack surface. Ensuring end-to-end privacy, security, and verifiability in such systems remains a significant challenge. This paper introducesZK-Sandbox, a Zero-Knowledge Data Sandbox System that integrates zero-knowledge proofs (ZKPs), decentralized identifiers (DIDs), and blockchain anchoring to enable credential validation and verifiable badge issuance without exposing underlying data. ZK-Sandbox supports complex predicate evaluation by securely aggregating multiple VCs from trusted issuers, processing them via JSON Web Token signature verification, Circom-based zk-SNARK circuits, and Docker-isolated execution. The system issues VC-compatible ZK-Badges, cryptographically bound to a Poseidon hash and anchored to a blockchain-registered DID, containing only abstracted verification results. Experimental evaluation confirms 100% validation accuracy, complete detection of tampered submissions, and efficient performanceâaveraging 326 ms issuance latency, 570 ms off-chain verification, and 4.45 s on-chain verification. These results demonstrate that ZK-Sandbox is a privacy-by-design, scalable, and regulation-aligned solution for self-sovereign digital credential ecosystems.
Multi-implementation systems are increasingly audited against natural-language specifications. Differential testing scales well when implementations disagree, but it provides little signal when all implementations converge on the same incorrect interpretation of an ambiguous requirement. We present SPECA, a Specification-to-Checklist Auditing framework that turns normative requirements into checklists, maps them to implementation locations, and supports cross-implementation reuse. We instantiate SPECA in an in-the-wild security audit contest for the Ethereum Fusaka upgrade, covering 11 production clients. Across 54 submissions, 17 were judged valid by the contest organizers. Cross-implementation checks account for 76.5 percent (13 of 17) of valid findings, suggesting that checklist-derived one-to-many reuse is a practical scaling mechanism in multi-implementation audits. To understand false positives, we manually coded the 37 invalid submissions and find that threat model misalignment explains 56.8 percent (21 of 37): reports that rely on assumptions about trust boundaries or scope that contradict the audit's rules. We detected no High or Medium findings in the V1 deployment; misses concentrated in specification details and implicit assumptions (57.1 percent), timing and concurrency issues (28.6 percent), and external library dependencies (14.3 percent). Our improved agent, evaluated against the ground truth of a competitive audit, achieved a strict recall of 27.3 percent on high-impact vulnerabilities, placing it in the top 4 percent of human auditors and outperforming 49 of 51 contestants on critical issues. These results, though from a single deployment, suggest that early, explicit threat modeling is essential for reducing false positives and focusing agentic auditing effort. The agent-driven process enables expert validation and submission in about 40 minutes on average.
With the deepening application of big data technology across various fields, data faces increasingly severe threats of privacy leakage and security risks throughout its entire processing lifecycle. Traditional protection mechanisms, which focus on static data or isolated stages, struggle to address the systemic risks arising from the continuity, dynamism, and complexity of big data processes. This paper aims to systematically investigate the collaborative mechanisms for privacy protection and data security within the big data processing pipeline. First, it analyzes the inherent vulnerabilities at each stage of data processing, as well as the limitations faced by key technologies such as anonymization, differential privacy, and secure multi-party computation when integrated into practical workflows. Next, it explores the evolution of process-oriented encryption strategies, including attribute-based encryption supporting dynamic policies, homomorphic encryption optimized for practical use, and verifiable computation and zero-knowledge proofs that ensure computational integrity. Finally, the paper constructs a dynamic balancing model for privacy, security, and utility, and proposes forward-looking systematic collaborative mechanisms such as distributed auditing based on trust chains and adaptive response. These contributions provide theoretical reference and technical pathways for building next-generation inherently secure big data processing architectures.
Abstract Ensuring the security of smart contracts is essential for maintaining the reliability and trustworthiness of decentralized applications, which are deployed across various domains, including industrial applications. In pursuit of this goal, it is imperative to analyze the common errors developers make when crafting smart contracts on the infrastructure that gave birth to them, i.e., the Ethereum blockchain. In this paper, we present a comprehensive analysis of the vulnerabilities in Ethereum smart contracts. Our methodology involves downloading the entire Ethereum blockchain and identifying smart contracts, which we then scan for vulnerabilities using various tools. We have discovered numerous vulnerabilities across many deployed smart contracts, highlighting the need for improved development practices. This analysis provides critical insights into the prevalence of security issues and underscores the urgency of raising development standards. By promoting the adoption of secure-by-design principles, our research seeks to enhance security standards within the Ethereum smart contract ecosystem.
João Gião, Fernando Luis-Ferreira, Joao Sarraipa, Ricardo Jardim-Gonçalves
Nowadays, with the increased integration of cloud-computing, data integrity continues to be a problem in the current eHealth sector. This security principle is considered fundamental to ensure the accuracy and reliability of data by ensuring protection from unauthorized and illicit tampering. The present work aims to demonstrate the ability for the Distributed Ledger Technology (DLT) to provide trust and confidence in the healthcare infrastructure for patients, healthcare professionals and policy makers. The DLT has the potential to become one of the most reliable solutions for the many challenges facing the healthcare industry for its potential to enable more secure, transparent, and equitable data management. Although much documentation exists about applications in this domain, it is mostly presented in high-level conceptualization, without detailing the actual development or implementation. This document proposes a metadata-based approach to protect healthcare data integrity in compliance with GDPR, ensuring trustworthy data access for end-users, while demonstrating that the solution can be deployed on low-resource hardware with minimal adaptation effort and time constraints.
Open access
Security and Verification in Computing
Cloud Data Security Solutions
Physical Unclonable Functions (PUFs) and Hardware Security
Distributed ledgers are increasingly relied upon by industry to provide trustworthy accountability, strong integrity protection, and high availability for critical data without centralizing trust. Recently, distributed append-only logs are opting for a layered approach, combining crash-fault-tolerant (CFT) consensus with hardware-based Trusted Execution Environments (TEEs) for greater resiliency. Unfortunately, hardware TEEs can be subject to (rare) attacks, undermining the very guarantees that distributed ledgers are carefully designed to achieve. In response, we present Proteus, a new distributed consensus protocol that cautiously trusts the guarantees of TEEs. Proteus carefully embeds a Byzantine fault-tolerant (BFT) protocol inside of a CFT protocol with no additional messages. This is made possible through careful refactoring of both the CFT and BFT protocols such that their structure aligns. Proteus achieves performance in line with regular TEE-enabled consensus protocols, while guaranteeing integrity in the face of TEE platform compromises.
Jiaqi Gao, Zijian Zhang, Yuqiang Sun, Ye Liu ¡ 8 authors
Business logic vulnerabilities have become one of the most damaging yet least understood classes of smart contract vulnerabilities. Unlike traditional bugs such as reentrancy or arithmetic errors, these vulnerabilities arise from missing or incorrectly enforced business invariants and are tightly coupled with protocol semantics. Existing static analysis techniques struggle to capture such high-level logic, while recent large language model based approaches often suffer from unstable outputs and low accuracy due to hallucination and limited verification. In this paper, we propose LogicScan, an automated contrastive auditing framework for detecting business logic vulnerabilities in smart contracts. The key insight behind LogicScan is that mature, widely deployed on-chain protocols implicitly encode well-tested and consensus-driven business invariants. LogicScan systematically mines these invariants from large-scale on-chain contracts and reuses them as reference constraints to audit target contracts. To achieve this, LogicScan introduces a Business Specification Language (BSL) to normalize diverse implementation patterns into structured, verifiable logic representations. It further combines noise-aware logic aggregation with contrastive auditing to identify missing or weakly enforced invariants while mitigating LLM-induced false positives. We evaluate LogicScan on three real-world datasets, including DeFiHacks, Web3Bugs, and a set of top-200 audited contracts. The results show that LogicScan achieves an F1 score of 85.2%, significantly outperforming state-of-the-art tools while maintaining a low false-positive rate on production-grade contracts. Additional experiments demonstrate that LogicScan maintains consistent performance across different LLMs and is cost-effective, and that its false-positive suppression mechanisms substantially improve robustness.
Ziyue Wang, Jiangshan Yu, Kaihua Qin, Dawn Song ¡ 6 authors
Decentralized Finance (DeFi) has turned blockchains into financial infrastructure, allowing anyone to trade, lend, and build protocols without intermediaries, but this openness exposes pools of value controlled by code. Within five years, the DeFi ecosystem has lost over 15.75B USD to reported exploits. Many exploits arise from permissionless opportunities that any participant can trigger using only public state and standard interfaces, which we call Anyone-Can-Take (ACT) opportunities. Despite on-chain transparency, postmortem analysis remains slow and manual: investigations start from limited evidence, sometimes only a single transaction hash, and must reconstruct the exploit lifecycle by recovering related transactions, contract code, and state dependencies. We present TxRay, a Large Language Model (LLM) agentic postmortem system that uses tool calls to reconstruct live ACT attacks from limited evidence. Starting from one or more seed transactions, TxRay recovers the exploit lifecycle, derives an evidence-backed root cause, and generates a runnable, self-contained Proof of Concept (PoC) that deterministically reproduces the incident. TxRay self-checks postmortems by encoding incident-specific semantic oracles as executable assertions. To evaluate PoC correctness and quality, we develop PoCEvaluator, an independent agentic execution-and-review evaluator. On 114 incidents from DeFiHackLabs, TxRay produces an expert-aligned root cause and an executable PoC for 105 incidents, achieving 92.11% end-to-end reproduction. Under PoCEvaluator, 98.1% of TxRay PoCs avoid hard-coding attacker addresses, a +22.9pp lift over DeFiHackLabs. In a live deployment, TxRay delivers validated root causes in 40 minutes and PoCs in 59 minutes at median latency. TxRay's oracle-validated PoCs enable attack imitation, improving coverage by 15.6% and 65.5% over STING and APE.
The EU AI Act (Regulation 2024/1689) imposes strict transparency and human oversight obligations on high-risk AI systems, specifically under Article 14. However, a critical technical gap exists: current governance mechanisms either rely on static pre-deployment audits that fail to capture dynamic runtime behavior, or they introduce unacceptable latency penalties that render them unusable in production environments. This paper presents RuntimeGuard-AI, an asynchronous governance architecture that separates lightweight inline policy enforcement from batch cryptographic attestation.Our design fundamentally resolves the tension between compliance and performance. By decoupling the critical inference path from the heavy cryptographic machinery required for proofs, we achieve a median latency overhead of just 2.3â4.1%, while enabling cryptographically rigorous, tamper-evident audit trails. Theoretically, we formalize the property of Latency Separationand prove that our architecture satisfies it. Empirically, we implement a complete Zero-Knowledge (ZK) attestation pipeline using the Groth16 proving system on the bls12-381 curve. We measure a witness generation time of 62 msand a total proving time of 1,389 msfor 50,000 constraints on a standard CPU. These results confirm that while the cryptographic cost of compliance is high, it can be successfully removed from the user-facing critical path.To our knowledge, this paper provides the first open-source reference implementation of a compliance architecture designed specifically for Article 14. We contribute: (1) a formalized threat model for AI auditing, (2) the RuntimeGuard protocol for sharded Merkle compliance logging, and (3) a systematic evaluation demonstrating that rigorous regulatory compliance is achievable at scale without compromising the user experience.
Blockchain clients are fundamental software for running blockchain nodes. They provide users with various RPC (Remote Procedure Call) interfaces to interact with the blockchain. These RPC methods are expected to follow the same specification across different blockchain nodes, providing users with seamless interaction. However, there have been continuous reports on various RPC bugs that can cause unexpected responses or even Denial of Service weakness. Existing studies on blockchain RPC bug detection mainly focus on generating the RPC method calls for testing blockchain clients. However, a wide range of the reported RPC bugs are triggered in various blockchain contexts. To the best of our knowledge, little attention is paid to generating proper contexts that can trigger these context-dependent RPC bugs. In this work, we propose EthCRAFT, a Context-aware RPC Analysis and Fuzzing Tool for client RPC bug detection. EthCRAFT first proposes to explore the state transition program space of blockchain clients and generate various transactions to construct the context. EthCRAFT then designs a context-aware RPC method call generation method to send RPC calls to the blockchain clients. The responses of 5 different client implementations are used as cross-referring oracles to detect the RPC bugs. We evaluate EthCRAFT on real-world RPC bugs collected from the GitHub issues of Ethereum client implementations. Experiment results show that EthCRAFT outperforms existing client RPC detectors by detecting more RPC bugs. Moreover, EthCRAFT has found six new bugs in major Ethereum clients and reported them to the developers. One of the bug fixes has been written into breaking changes in the client's updates. Three of our bug reports have been offered a vulnerability bounty by the Ethereum Foundation.
Decentralized Identifiers (DIDs) are increasingly deployed on distributed ledgers, yet systematic cross-platform evidence on their operational behavior remains limited. We present an empirical benchmarking study of three prominent ledger-based DID methods - Ethereum, Hedera, and XRP Ledger - using reference Software Development Kits (SDKs) under a unified experimental setup. We measure latency, transaction cost, and on-chain metadata exposure, normalizing latency by each platform's block or consensus interval and cost by its native value transfer fee. Privacy leakage is quantified using a Metadata-Leakage Score (MLS), an entropy-based measure expressed in bits per operation. Our results reveal distinct architectural trade-offs. Ethereum enables near-instant, off-chain DID creation, but incurs the highest latency and cost for on-chain lifecycle operations. XRPL delivers deterministic and stable latency with fixed, low fees, yet exhibits higher metadata leakage due to more verbose transaction payloads. Hedera achieves the lowest on-chain latency and low fees with minimal metadata leakage, while occasional variance arises from SDK-side processing and confirmation pipelines. Overall, the findings show that ledger architecture and SDK workflows play a major role in shaping DID latency, cost, and metadata exposure, complementing the effects of the underlying consensus mechanism. These results provide evidence-based insights to support informed selection and configuration of DID systems under performance and privacy constraints.
Nacereddine Sitouah, Francesco Bruschi, Stefano De Cillis
The passing of the eIDAS amendment marks an important milestone for EU countries and changes how they must manage digital credentials for both public services and businesses. Italy has led in adopting eIDAS, first with CIE and SPID identity schemes, and now with the Italian Wallet (IO app) aligned to eIDAS 2.0. Self-Sovereign Identity (SSI) is a decentralized model born from the success of Distributed Ledgers, giving individuals full control over their digital identity. The current eIDAS 2.0 and its implementation acts diverge from SSI principles, rendering the European Digital Identity Wallet (EUDIW) centralized and merely user-centric, prioritizing security and legal protection over true self-sovereignty. This paper proposes an architecture that enables the use of IT Wallet credentials and services in an SSI-compliant environment through Trusted Execution Environments and Zero-Knowledge Proofs.
Abstract Existing accountability mechanisms based on audit logs, blockchains, and distributed ledgers attempt to prove compliance by recording what happenedâtransactions, identities, timestamps, or state transitions. While tamper-resistant, these approaches inherently generate behavioural traces that conflict with data-minimisation requirements and enable correlation, profiling, and surveillance. This creates a structural accountabilityâprivacy paradox in modern regulatory frameworks such as the GDPR, which simultaneously require demonstrable compliance (Art. 5(2)) and strict limitation of personal data collection (Art. 5(1)(c)). This paper introduces Ledger-Anchored Validation Receipts (LAVR), a cryptographic mechanism that resolves this paradox by proving that enforcement occurred, rather than recording the underlying activity. LAVR operates exclusively at system finality boundariesâpoints where actions become irreversible, such as database commits, cross-border data exports, AI output release, payment settlement, or content publication. At each finality point, a hardware-adjacent enforcement gate evaluates a regulatory validation predicate derived from applicable legal constraints. Upon decision (Allow or Deny), the gate generates a minimal, fixed-size receipt that contains only enforcement metadata and explicitly excludes payloads, identities, transaction details, routing information, and fine-grained timestamps. The operational workflow consists of four steps: (1) an execution request reaches a finality boundary; (2) a trusted validation context evaluates scope, purpose, and control predicates; (3) a non-identifying receipt is cryptographically generated; and (4) a hash commitment of the receipt is anchored to a tamper-evident ledger. Unlike blockchain transaction logs, the ledger anchors only receipt commitmentsânot eventsâpreventing the formation of transaction graphs or behavioural histories. Implemented using commodity hardware primitives (Trusted Execution Environments, SmartNICs, secure elements, and kernel-level finality hooks), LAVR enables accountability without surveillance across GDPR, AI Act, eIDAS, CBDC, NIS2, and Democracy Shield contexts. The approach demonstrates that regulatory simplification and stronger enforcement can be achieved through execution-time cryptographic proof rather than expanded monitoring or deregulation.