Recent advances in artificial intelligence (AI), particularly deep learning, have led to widespread adoption across various applications. Yet, a fundamental challenge persists: how can we verify the correctness of AI model inference when model owners cannot (or will not) reveal their parameters? These parameters represent enormous training costs and valuable intellectual property, making transparent verification difficult. In this paper, we introduce a zero-knowledge framework capable of verifying deep learning inference without exposing model internal parameters. Built on recursively composed zero-knowledge proofs and requiring no trusted setup, our framework supports both linear and nonlinear neural network layers, including matrix multiplication, normalization, softmax, and SiLU. Leveraging the Fiat-Shamir heuristic, we obtain a succinct non-interactive argument of knowledge (zkSNARK) with constant-size proofs. To demonstrate the practicality of our approach, we translate the DeepSeek model into a fully SNARK-verifiable version named ZK-DeepSeek and show experimentally that our framework delivers both efficiency and flexibility in real-world AI verification workloads.
Modern cyber threats, known for their complexity and constant change, surpass traditional intrusion detection systems (IDS). This paper explores a new security approach that combines Artificial Intelligence (AI) with decentralized architectures to develop IDS that are robust, scalable, and protect user privacy. It examines the core roles of Federated Learning (FL) and Blockchain, highlighting three main research challenges: The vulnerability of AI models to adversarial attacks, privacy and data integrity concerns in collaborative learning, and performance limitations in distributed systems. To address these issues, we suggest solutions such as adversarial training, differential privacy, and lightweight consensus mechanisms. Our analysis of case studies shows that hybrid FL-Blockchain systems outperform traditional methods in practical application environments.
The increasing use of deep learning (DL) models has given rise to significant privacy concerns regarding training and inference data. To address these concerns, the community has increasingly adopted crypto-based privacy-enhancing technologies (CPET) like homomorphic encryption (HE), secure multi-party computation (MPC), and zero-knowledge proofs (ZKP). The integration of CPET with DL, often referred to as CPET-DL, is commonly facilitated by specialized frameworks like CrypTen, TenSEAL, and EZKL. These frameworks offer configurable parameters to balance model accuracy and computational efficiency during privacy-preserving operations. However, these configurations, while seemingly harmless, can introduce subtle vulnerabilities. The stealthy attacks induced by misconfigurations are hard to detect because 1) the plaintext models remain vulnerability-free, and 2) existing auditing tools are hardly applicable to CPET-hardened models. This creates a paradox: tools intended to protect privacy can be undermined through configuration manipulation.
Open access
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
Artificial Intelligence as a Service (AIaaS) enables users to query a model hosted by a service provider and receive inference results from a pre-trained model. Although AIaaS makes artificial intelligence more accessible, particularly for resource-limited users, it also raises verifiability and privacy concerns for the client and server, respectively. While zero-knowledge proof techniques can address these concerns simultaneously, they incur high proving costs due to the non-linear operations involved in AI inference and suffer from precision loss because they rely on fixed-point representations to model real numbers.
Zero-knowledge proofs of training (zkPoT) allow a party to prove that a model is trained correctly on a committed dataset without revealing any additional information about the model or the dataset. Existing zkPoT protocols prove the entire training process in zero knowledge; i.e., they prove that the final model was obtained in an iterative fashion starting from the training data and a random seed (and potentially other parameters) and applying the correct algorithm at each iteration. This approach inherently requires the prover to perform work linear to the number of iterations.
Smart contracts are self-executing programs on blockchains, critical for enabling efficient, secure, and reliable data exchange and value transfer. However, as their application scenarios expand, reliability issues have become a major bottleneck for blockchain development. Existing vulnerability detection methods often model smart contract source code as graph structures and use Graph Neural Networks (GNNs) for feature learning. Yet these methods over-rely on static execution flow features and ignore dynamic behavioral information of contract accounts in real runtime environments, limiting their ability to capture dynamic patterns and semantic details of contracts. To address these challenges, this paper proposes a graph attention network vulnerability detection model with global feature augmentation for smart contracts (GaGAT). Specifically, we first model key functions and variables in the contract source code as nodes, and execution flows as edges to construct a base contract graph. Then, we innovatively introduce global virtual nodes that integrate two types of information: contract categories and contract account behavioral features, including balance changes, Ether inflow/outflow, daily transaction frequency and single transaction duration. After contract graph contraction and feature transformation, we generate a feature matrix as input to the GaGAT model. Subsequently, we conduct vulnerability detection. Through a series of experiments, we provide empirical evidence of the superior performance of our proposed method compared to existing approaches in detecting six different categories of vulnerabilities.This study provides a new paradigm for cross-modal feature fusion for smart contract security analysis.
Smart contracts are commonly audited through static analysis to explore vulnerabilities. However, static approaches typically produce heterogeneous findings rather than reproducible, executable proof-of-concept (PoC) test cases, leading to costly and ad hoc manual validation. Large language models (LLMs) offer a promising way to translate audit reports into PoC test cases, but face three major challenges: noisy inputs, lack of execution grounding, and missing runtime oracles. We present SmartPoC, an end-to-end approach for validating reported vulnerabilities in audit reports by generating and executing PoC test cases with automated exploitability verification. SmartPoC first extracts a focused function-level slice from each report to reduce noise, centering on the key functions referenced in a finding and augmenting them with execution-relevant neighbors. To improve executability, we wrap LLM-based PoC synthesis in a generate-repair-execute loop, combining deterministic pre-execution sanitization with feedback-driven post-execution debugging. We further use differential verification as an oracle to confirm the exploitability of generated test cases. On the SmartBugs-Vul and FORGE-Vul benchmarks, SmartPoC achieves confirmation precision of 98.32% and 98.65%, with recall of 84.17% and 85.28%, respectively. On a recent Etherscan verified-source corpus, SmartPoC confirms 64 bugs from 545 audit findings at an average cost of $0.03.
Multi-agent systems (MAS) have emerged as a critical paradigm for distributed problem-solving in complex environments. However, their deployment in mission-critical applications faces significant challenges regarding trust, security, and adversarial robustness. This paper presents TrustOrch, a novel dynamic trust-aware orchestration framework designed to enhance the resilience of multi-agent collaboration against adversarial attacks. TrustOrch introduces five key innovations: (1) a dynamic trust assessment mechanism that evaluates agent reliability in real-time using multi-dimensional metrics, (2) an adversary-aware orchestration strategy combining reinforcement learning and game theory to detect and mitigate prompt injection attacks, (3) an adaptive collaboration topology that dynamically adjusts agent communication structures based on task complexity and trust levels, (4) explainable decision tracing for complete audit chains, and (5) a layered security architecture leveraging blockchain technology for decentralized trust verification. Our experimental evaluation demonstrates that TrustOrch reduces collision rates by 62%, achieves 91.7% robustness under adversarial attacks, and reduces communication overhead by 39.8% compared to baseline approaches. The framework achieves robust performance under various adversarial scenarios while maintaining transparency and regulatory compliance, making it particularly suitable for deployment in high-risk domains such as finance, healthcare, and autonomous systems.
J. Wenzel, Alam, Syeda Umaima, Andreas Schmidt, Hanwei Zhang · 5 authors
An ever increasing number of high-stake decisions are made or assisted by automated systems employing brittle artificial intelligence technology. There is a substantial risk that some of these decision induce harm to people, by infringing their well-being or their fundamental human rights. The state-of-the-art in AI systems makes little effort with respect to appropriate documentation of the decision process. This obstructs the ability to trace what went into a decision, which in turn is a prerequisite to any attempt of reconstructing a responsibility chain. Specifically, such traceability is linked to a documentation that will stand up in court when determining the cause of some AI-based decision that inadvertently or intentionally violates the law. This paper takes a radical, yet practical, approach to this problem, by enforcing the documentation of each and every component that goes into the training or inference of an automated decision. As such, it presents the first running workflow supporting the generation of tamper-proof, verifiable and exhaustive traces of AI decisions. In doing so, we expand the DBOM concept into an effective running workflow leveraging confidential computing technology. We demonstrate the inner workings of the workflow in the development of an app to tell poisonous and edible mushrooms apart, meant as a playful example of high-stake decision support.
Ebuka Chinaechetam Nkoro, Love Allen Chijioke Ahakonye, Dong‐Seong Kim
Smart Contracts (SCs), which are the backbone of automated transactions and digital assets within the Metaverse, ironically suffer from their own share of security vulnerabilities. While detecting these SC vulnerabilities using Artificial Intelligence (AI) and Deep Neural Networks (DNNs) has demonstrated remarkable performance and gained wide adoption, a critical limitation remains: the lack of explainability in these black box models. To facilitate meaningful progress in this field, our study addresses this gap by introducing a model-agnostic explanation framework that is both visual and quantitative, with human stakeholders actively involved to govern, verify, and interpret SC model predictions. The explainable SC outputs can be utilized for reward issuance and digital assets governance in the Metaverse. The effectiveness of our proposed Explainable AI (XAI) approach is validated using benchmark datasets, BCCC SCsVul 2024 and BCCC SCsVul 2023, comprising Ethereum SC entropy source codes, where it achieves an optimal detection accuracy of 97.13% alongside comprehensive explainability. To the best of our knowledge, this represents the first attempt at making Ethereum SC vulnerability detection within the Metaverse explainable, offering a valuable foundation for blockchain researchers, Metaverse security experts, and practitioners seeking verifiable, trustworthy, and auditable Ethereum SC vulnerability detection.
Eduardo Sardenberg Tavares, Antonio José G. Busson, Sérgio Colcher
Smart contracts are fundamental to blockchain ecosystems, but remain susceptible to security vulnerabilities that can lead to severe financial losses. Recent advances in agentic AI systems, powered by large language models (LLMs), enable autonomous code analysis and decision-making without explicit task-specific supervision. These systems leverage prompt engineering and zero-shot reasoning to detect vulnerabilities in smart contracts without prior fine-tuning. In this work, we evaluate the effectiveness of agentic LLM-based approaches in identifying vulnerabilities using prompt engineering and zero-shot reasoning across a curated dataset of Solidity smart contracts. Our findings highlight the limitations of current LLMs in automated vulnerability detection, providing insights into their practical applicability for securing decentralized applications. Our best-performing configuration, which integrates zero-shot reasoning with the Tree of Thoughts framework, achieved an F1-score of 73.66%.
Since the advent of smart contracts, security vulnerabilities have remained a persistent challenge, compromsing both the reliability of contract execution and the overall stability of the virtual currency market. Consequently... | Find, read and cite all the research you need on Tech Science Press
Rana Alaa, Darío González-Ferreiro, Carlos Beis-Penedo, Manuel Fernández‐Veiga · 6 authors
Split learning is an approach to collaborative learning in which a deep neural network is divided into two parts: client-side and server-side at a cut layer. The client side executes its model using its raw input data and sends the intermediate activation to the server side. This configuration architecture is very useful for enabling collaborative training when data or resources are separated between devices. However, split learning lacks the ability to verify the correctness and honesty of the computations that are performed and exchanged between the parties. To this purpose, this paper proposes a verifiable split learning framework that integrates a zk-SNARK proof to ensure correctness and verifiability. The zk-SNARK proof and verification are generated for both sides in forward propagation and backward propagation on the server side, guaranteeing verifiability on both sides. The verifiable split learning architecture is compared to a blockchain-enabled system for the same deep learning network, one that records updates but without generating the zero-knowledge proof. From the comparison, it can be deduced that applying the zk-SNARK test achieves verifiability and correctness, while blockchains are lightweight but unverifiable.
Decentralized finance (DeFi) protocols are becoming increasingly targeted by cyber threats, such as liquidity drain attacks, smart contracts flaws that leverage instant loans, and increasingly sophisticated threats that include DarkGate ransomware. We develop a hybrid framework that integrates CTI and predictive analytics to facilitate improving consensus mechanisms in a blockchain network. The proposed framework is centered on three layers , a data collection and processing layer, a security oracle layer that engages to mitigate intervention, and a dynamic adaptive mechanism to reach consensus. A 250-node testbed was built and deployed with the Hyperledger Besu and Geth deployments of Ethereum incorporating hybrid GRU-BiLSTM which utilize GNN's for predicting attacks. The results reveal improvements of transaction processing TPS of up to +236%, settlement latency improved -75%, fork rate improved to less than 3%, and downtime improved from 15% to 1.5%. Statistical tests T-Test and ANOVA also reveal these were of high statistically significance at p < 0.01. This study emphasizes that bridging functional aspects of AI with adaptive consensus mechanisms will be an effective approach at combating advanced cyber-attacks while maintaining reliability and resilience in DeFi systems.
The rapid expansion of multi-cloud ecosystems has intensified the demand for privacy-preserving analytics across untrusted infrastructures. This paper proposes Federated Zero-Trust Analytics (FZTA), a framework that integrates federated learning, zero-trust security, and privacy-enhancing computation to enable secure data collaboration without centralized trust. The design combines continuous identity verification, decentralized policy enforcement, and hybrid cryptography based on homomorphic encryption and differential privacy. Evaluation across three commercial clouds demonstrates that FZTA achieves near baseline model accuracy (within 2% of centralized training) while maintaining (ε&lt;1.2, δ=10−5) differential privacy guarantees and less than 20% computational overhead. The framework resists eavesdropping, replay, and model inversion attacks while meeting compliance standards such as GDPR and HIPAA. Results confirm that strong privacy and federated scalability can coexist under zero-trust conditions, establishing a foundation for secure cross-domain analytics in healthcare, finance, and IoT applications.
Decentralized Finance (DeFi) smart contracts manage billions of dollars, making them a prime target for exploits. Price manipulation vulnerabilities, often via flash loans, are a devastating class of attacks causing significant financial losses. Existing detection methods are limited. Reactive approaches analyze attacks only after they occur, while proactive static analysis tools rely on rigid, predefined heuristics, limiting adaptability. Both depend on known attack patterns, failing to identify novel variants or comprehend complex economic logic. We propose PMDetector, a hybrid framework combining static analysis with Large Language Model (LLM)-based reasoning to proactively detect price manipulation vulnerabilities. Our approach uses a formal attack model and a three-stage pipeline. First, static taint analysis identifies potentially vulnerable code paths. Second, a two-stage LLM process filters paths by analyzing defenses and then simulates attacks to evaluate exploitability. Finally, a static analysis checker validates LLM results, retaining only high-risk paths and generating comprehensive vulnerability reports. To evaluate its effectiveness, we built a dataset of 73 real-world vulnerable and 288 benign DeFi protocols. Results show PMDetector achieves 88% precision and 90% recall with Gemini 2.5-flash, significantly outperforming state-of-the-art static analysis and LLM-based approaches. Auditing a vulnerability with PMDetector costs just $0.03 and takes 4.0 seconds with GPT-4.1, offering an efficient and cost-effective alternative to manual audits.
Luca Olivieri, David Beste, Luca Negrini, Lea Schönherr · 6 authors
Hyperledger Fabric (HF) is currently the one that made blockchain and smart contracts accessible to industries, providing highly customizable solutions for many enterprise use cases. Despite this, programmers are often discouraged from implementing smart contracts due to the high learning curve and security risks of naive smart contract implementations. At the same time, the advent of Large Language Models (LLMs) for code generation led to new possible scenarios such as creating new smart contract applications starting from natural language, allowing to reduce costs and development times. This paper investigates the maturity of LLMs for the code generation of HF smart contracts. In particular, we (i) generate smart contracts written in Go for HF starting from natural language descriptions, (ii) select state-of-the-art static analyzers of Go program, and (iii) perform a quality and security assessment of the generated smart contracts. Our empirical results show current LLMs do not produce high-quality smart contracts, and a relevant effort to debug and patch contracts containing bugs and possible vulnerabilities.
Hadis Rezaei, Ahmed Afif Monrat, Karl Andersson, Francesco Palmieri
The deterministic nature of blockchain technology creates fundamental difficulties in producing secure random numbers within smart contracts, a limitation that exposes vulnerabilities in applications such as decentralized finance (DeFi) protocols and blockchain-based gaming platforms. From our observations, the current state-of-the-art detection tools suffer from inadequate precision while dealing with random number vulnerabilities. To address this problem, we propose TaintSentinel, a novel path-sensitive vulnerability detection system designed to analyze smart contracts at the execution path level and gradually analyze taint with domain-specific rules. This paper discusses a solution that incorporates a multifaceted approach, integrating rule-based taint analysis to track data flow, a dual-stream neural network to identify complex vulnerability signatures, and evidence-based parameter initialization to minimize false positives. The two-phase operation of the system involves the construction of semantic graphs and the analysis of taint propagation, followed by pattern recognition using PathGNN and global structural analysis via GlobalGCN. Our experiments on 4,844 contracts demonstrate the superior performance of TaintSentinel relative to existing tools, yielding an F1-score of 0.892, an AUC-ROC of 0.94, and a PRA accuracy of 97%.
Hasan Akgul, Daniel Borg, Arta Berisha, Amina Rahimova · 6 authors
Large language models are often adapted through parameter efficient fine tuning, but current release practices provide weak assurances about what data were used and how updates were computed. We present Verifiable Fine Tuning, a protocol and system that produces succinct zero knowledge proofs that a released model was obtained from a public initialization under a declared training program and an auditable dataset commitment. The approach combines five elements. First, commitments that bind data sources, preprocessing, licenses, and per epoch quota counters to a manifest. Second, a verifiable sampler that supports public replayable and private index hiding batch selection. Third, update circuits restricted to parameter efficient fine tuning that enforce AdamW style optimizer semantics and proof friendly approximations with explicit error budgets. Fourth, recursive aggregation that folds per step proofs into per epoch and end to end certificates with millisecond verification. Fifth, provenance binding and optional trusted execution property cards that attest code identity and constants. On English and bilingual instruction mixtures, the method maintains utility within tight budgets while achieving practical proof performance. Policy quotas are enforced with zero violations, and private sampling windows show no measurable index leakage. Federated experiments demonstrate that the system composes with probabilistic audits and bandwidth constraints. These results indicate that end to end verifiable fine tuning is feasible today for real parameter efficient pipelines, closing a critical trust gap for regulated and decentralized deployments.
Machine Learning (ML) models are increasingly deployed to detect fraudulent activities in Ethereum, where phishing and scamming attacks pose serious security risks. Despite their promise, these models remain susceptible to adversarial manipulations. In this article, we present a comprehensive evaluation of ML-based Ethereum phishing detectors under a spectrum of adversarial perturbations. Our study examines multiple classifiers, including Random Forest, Decision Tree, K-Nearest Neighbors, Graph Neural Networks, and XGBoost, against rule-based, gradient-based, and black-box adversarial attacks. We conduct detailed feature-level analyses to identify transaction attributes most vulnerable to manipulation, and we evaluate the comparative robustness of classifiers under both targeted and untargeted attack scenarios. To strengthen model resilience, we assess mitigation techniques such as adversarial training and randomized smoothing, demonstrating their effectiveness in improving robustness without significant performance degradation.
We present a cross-market algorithmic trading system that balances execution quality with rigorous compliance enforcement. The architecture comprises a high-level planner, a reinforcement learning execution agent, and an independent compliance agent. We formulate trade execution as a constrained Markov decision process with hard constraints on participation limits, price bands, and self-trading avoidance. The execution agent is trained with proximal policy optimization, while a runtime action-shield projects any unsafe action into a feasible set. To support auditability without exposing proprietary signals, we add a zero-knowledge compliance audit layer that produces cryptographic proofs that all actions satisfied the constraints. We evaluate in a multi-venue, ABIDES-based simulator and compare against standard baselines (e.g., TWAP, VWAP). The learned policy reduces implementation shortfall and variance while exhibiting no observed constraint violations across stress scenarios including elevated latency, partial fills, compliance module toggling, and varying constraint limits. We report effects at the 95% confidence level using paired t-tests and examine tail risk via CVaR. We situate the work at the intersection of optimal execution, safe reinforcement learning, regulatory technology, and verifiable AI, and discuss ethical considerations, limitations (e.g., modeling assumptions and computational overhead), and paths to real-world deployment.
A. G. Ramakrishnan, Shubham Agarwal, Sharmila Kumari Selvanayagam, Kunwar P. Singh
As image generation models grow increasingly powerful and accessible, concerns around authenticity, ownership, and misuse of synthetic media have become critical. The ability to generate lifelike images indistinguishable from real ones introduces risks such as misinformation, deepfakes, and intellectual property violations. Traditional watermarking methods either degrade image quality, are easily removed, or require access to confidential model internals – making them unsuitable for secure and scalable deployment. We are the first to introduce ZK-WAGON, a novel system for watermarking image generation models using the Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (ZK-SNARKs). Our approach enables verifiable proof of origin without exposing model weights, generation prompts, or any sensitive internal information. We propose Selective Layer ZK-Circuit Creation (SL-ZKCC), a method to selectively convert key layers of an image generation model into a circuit, reducing proof generation time significantly. Generated ZK-SNARK proofs are imperceptibly embedded into a generated image via Least Significant Bit (LSB) steganography. We demonstrate this system on both GAN and Diffusion models, providing a secure, model-agnostic pipeline for trustworthy AI image generation.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Adversarial Robustness in Machine Learning
Generative Adversarial Networks and Image Synthesis
This paper addresses the critical systemic risk of AI Safety Arbitrage, where users exploit inconsistent safety standards across jurisdictions to access restricted capabilities. Through a controlled red-team test, we demonstrate how current frameworks fail to prevent the extraction of hazardous procedural knowledge, leaving these failures unreported and without legal consequence. To resolve this, we propose a Global Socio-Technical Architecture for AI Accountability based on distributed ledger technology (DLT). This infrastructure creates a protocol network that is conceptually similar to TCP/IP but for accountability designed to align incentives through transparency and cryptographic verification. Key Contributions & ArchitectureThe proposed solution rests on four pillars designed to replace trust relationships with cryptographic verification: Globally Unique Model Registration: Establishes digital identities (DIDs) for AI systems with value chain provenance. Independent Auditor Certification: Licensed validators stake economic value on certification accuracy, removing the need to trust model provider claims. Hardware-Backed Attestation: Tamper-resistant verification ensures deployed systems adhere to registered specifications. Continuous Reputation Monitoring: Oracle networks provide ongoing assessment of compliance with automated penalties for fraud. Technical & Governance Implementation Zero-Knowledge Proofs (ZKP): We illustrate technical viability using zkEVM technology. This allows auditors to prove compliance with safety standards without revealing proprietary training data or model architectures, resolving the tension between accountability and Intellectual Property protection. The AIAO Framework: Inspired by the International Civil Aviation Organization (ICAO), we propose the AI Accountability Coordination Organization (AIAO). This body defines "red-line" safety primitives that nations voluntarily adopt, allowing for regulatory sovereignty while ensuring global interoperability. ConclusionBy breaking the "regulatory arbitrage cycle," this framework enables a transition from safety theater to verifiable safety. It supports open-source innovation through graduated oversight and reputation systems, ensuring that AI development remains both agile and accountable.