A provenance-bound values model published as a public evaluator rather than deployed as a filter — why open weights defeat a filter and strengthen a referee, why the same weights bear three different relations to the model they judge, and why an evaluator that gatekeeps its own judgments has reproduced the defect it exists to correct. A values model — a model that judges conduct against a standard — is an established artifact. Guard models, safety classifiers, critic models, preference models and process reward models all instantiate the family, and the engineering is not in dispute. What is in dispute, and what this paper specifies, is the posture in which such an artifact is published, which we argue is not a deployment detail but the property that determines whether the artifact does anything at all. We identify an inversion that we believe has not been stated as a design principle. A values model deployed as a filter — sitting in a serving path, permitting or refusing — is defeated by publication of its weights, because the published artifact is precisely the oracle against which an attacker optimizes; recent optimization-based attacks against safety-classifier pipelines report attack success rates of roughly 71% where prior black-box methods achieved approximately zero. The same model published as an evaluator — emitting verdicts about systems it does not control — is strengthened by publication, because open weights are what allow a third party to reproduce and therefore to trust its verdicts. Openness is not a property with a fixed sign. Its sign is set by posture. From this we derive a second result. The independent-evaluation literature documents at length the ways in which the evaluated party's control over access corrupts evaluation: short access windows, low rate limits, evaluator dependence on the goodwill and funding of the party being evaluated. We observe that the defect is symmetric and that its mirror image has not been named. An evaluator that controls access to its own judgments holds the same kind of power, pointed the other way — it can decline to evaluate, deprioritize, or be unavailable for a party it wishes to spare or to punish. We therefore specify a non-gatekeeping constraint: the ability to obtain a judgment must not depend on the evaluator's permission, which requires that the model, the harness, and the evaluation corpus be freely runnable, and which makes any hosted endpoint a convenience rather than a channel. We specify provenance-binding as the constitutive constraint on the model's outputs: every judgment must resolve to a citation into a fixed canonical corpus, and a judgment that cannot be so resolved is withheld rather than emitted. This trades coverage for auditability deliberately, and it distinguishes the artifact from values models trained on preference data whose sources cannot be named, and from purpose-authored value-rule corpora, whose rules are written for the alignment task itself and therefore cannot serve as an independent ground truth. Finally we specify that a single such artifact bears three non-interchangeable relations to the systems it judges, selected by carrier: a gate in the publisher's own hardware, a citation requirement without veto in an autonomous successor agent, and a referee in the wider world. We state plainly that the middle case must not be implemented as the first, because a veto held by a smaller model over a more capable agent bounds that agent at the evaluator's ceiling — the weak-supervisor problem applied to the very system the arrangement exists to enable. A consequence we did not initially see, and which we regard as the most immediately actionable result in the paper: the two postures are complements rather than alternatives, and the natural first evaluation subject for a referee is a filter. A filter's characteristic failure is silent bypass; an evaluator watching its record converts that failure into a recorded one. And because safety classifiers are frequently published open-weight and emit discrete, samplable decisions, this is the one evaluation target for which the access problem does not arise at all — no cooperation, permission, or notice is required from the artifact's publisher. We do not claim to have solved scalable oversight. We claim that a narrow, citation-bound, openly published evaluator is a tractable and underoccupied position in the design space, and that its tractability comes precisely from what it refuses to do. --- Provenance. This paper is part of the THonly research corpus, dedicated to the public domain under CC0 1.0. The canonical version is at https://thonly.org/research/the-referee-not-the-governor. Its SHA-256 is 1184b0f3e5408a504c60be2d542b551df1c22facedfe18bb9a689bb50a9cc3fe, independently timestamped to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three trust authorities, one of them eIDAS-qualified. AI co-authorship is disclosed. Miss Aquarius is the consistent name used for the AI collaboration across all venues.
Decentralized finance failures frequently arise not from a single obviously unsafe function, but from valid operations composed into an invalid state transition. Static analyzers and vulnerability checklists remain valuable, yet they often stop before answering the question that determines real risk: can an adversary control the preconditions, sequence, capital, ordering, and external dependencies required to turn a defect into impact? This working paper presents the Invariant-to-Exploit (I2E) framework, a practitioner-oriented method for connecting architecture assumptions to executable invariants, stateful counterexamples, exploitability evidence, and remediation regression tests. I2E consists of six linked activities: system scoping, invariant-ledger construction, adversarial controllability analysis, stateful sequence generation, exploitability tracing, and fix validation. The framework is applied retrospectively to three publicly documented incidents: KyberSwap Elastic, Euler, and the Curve sDOLA LlamaLend market. These analyses do not claim prospective vulnerability discovery; instead, they demonstrate the test signals that reviewers can derive from public root-cause information. The principal contribution is a reproducible audit worksheet that preserves the chain from protocol assumption to broken property, realistic exploitability, observable impact, and regression-tested remediation. The method is designed to remain usable by independent security researchers who cannot publish confidential client evidence. A benchmark design is proposed for future controlled comparison against checklist-only security review.
Hospitals are increasingly under pressure because of the growing volume of imaging tests carried out, but also because of the sophistication of the attacks by the cybercriminal. Conventional security systems are unable to meet today's challenges to patient records and radiological data. In this research, these challenges are addressed directly by designing an advanced defence system that is specifically designed for medical imaging archiving and communication systems in radiology departments. Architected an extensive protective architecture with seven layers that are interconnected. It's a combination of cutting-edge encryption techniques capable of resisting the powerful future quantum computer, authentication processes that validate every access attempt on the fly, data patterns that are learned, suspicious activity recognized, blockchain technology that makes data impossible to tamper with, and predictive algorithms that foresee threats before they happen. Our system is proactive, identifying and neutralising threats at an early stage, instead of reacting to attacks as they happen. Real-world validation took place within five different hospital networks, covering two years, and thus subjected the framework to the real conditions of operation and to real cyber threats. The results of the system's performance were outstanding – the system had a rate of 99.9% accuracy in detecting malicious activities and a rate of 0.15% False Alarms. The overhead for security operations was just 23 milliseconds, not affecting clinical workflow. Most impressively, there was a 67% reduction in the number of attempts to break in onto the network unauthorisedly, due to the formidable defence measures that they faced.Our framework thwarted 847 real tests against it, ranging from sophisticated persistent intrusions and previously unknown software vulnerabilities to attempts by ransomware to encrypt patient information – all during testing. The system ensured complete compliance with healthcare privacy laws from various jurisdictions, aligning with the American HIPAA regulations, the European GDPR and the new quantum-security protocols. In essence, this is a paradigm shift in medical imaging security, offering healthcare institutions proactive and intelligent protection that safeguards patient privacy and institutional integrity in the face of future threats.
Recent intrusion detection systems (IDS) increasingly rely on machine learning (ML) and deep learning techniques to detect sophisticated cyberattacks. However, many existing frameworks still suffer from limited explainability, black-box decision-making, and the absence of secure trust verification mechanisms for intrusion records. To address these challenges, this paper proposes TAE-IDS, a Trust-Aware Explainable Intrusion Detection Framework that integrates attention-based meta-ensemble learning, SHapley Additive exPlanations (SHAP)-driven explainability, and blockchain-inspired tamper-evident validation within a unified cybersecurity architecture. The proposed framework employs heterogeneous base classifiers, namely Logistic Regression (LR), Extra Trees (ET), and XGBoost (XGB), to capture diverse network traffic characteristics. Uncertainty-aware meta-features, including logits, confidence scores, and entropy representations, are extracted from the base learners and processed by an adaptive Bidirectional Long Short-Term Memory (BiLSTM) attention-based meta-classifier for contextual intrusion reasoning and adaptive ensemble aggregation. To enhance transparency and analyst trust, SHAP-based explainability is incorporated to provide both global and local interpretations of intrusion predictions. Furthermore, a blockchain-inspired tamper-evident validation mechanism based on SHA-256 cryptographic hashing is integrated to enable tamper-proof intrusion logging, immutable auditing, and secure forensic verification of IDS outputs. The proposed framework was evaluated on the UNSW-NB15 and CICIDS2017 benchmark datasets under both binary and multiclass intrusion detection settings. Experimental results demonstrate that TAE-IDS achieves strong intrusion detection performance, interpretable intrusion reasoning, and effective blockchain-assisted tamper-evident validation on the evaluated benchmark datasets. The integration of explainable artificial intelligence (XAI) and blockchain-assisted validation enhances transparency, forensic traceability, and the integrity of intrusion records while providing a foundation for future validation in operational network environments.
Model identity verification is only as trustworthy as the reference against which identity is resolved. A system may correctly establish that a model running now corresponds to an enrolled reference while remaining unable to establish that the reference itself was the authentic release of the named publisher. This technical note separates those two claims as identity continuity and enrollment provenance. It formalizes the poisoned-enrollment failure, in which an inauthentic artifact is enrolled under a legitimate model name and subsequently passes continuity verification correctly. The failure is therefore not a false acceptance by the measurement system, but an upstream identity-binding failure. The note shows that this boundary is shared across artifact signing, behavioral fingerprinting, reference-anchored activation auditing, and structural identity measurement, and relates the problem to established software supply-chain trust models. It proposes E0–E4 enrollment assurance profiles, distinguishes provenance profile from current attribution state, and describes remediation through revocation and re-establishment of provenance without discarding historical continuity evidence. No new measurement result is reported. The contribution is an evidence boundary, threat-model construction, assurance vocabulary, and remediation model for model identity verification. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note:: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Oleksandr Pidpalyi, Олександр Романов, Larysa Globa, Антон Романов · 6 authors
The subject matter of the article is the iTZBEI (Integrated Trust–ZTA–Blockchain SDN Efficiency Index) – a novel composite metric for quantitative security assessment of software-defined networks (SDN) integrating Zero Trust Architecture (ZTA) and Blockchain technologies. The relevance of the research is determined by the fact that the centralized SDN control model generates critical vulnerabilities, including DDoS attacks, unauthorized routing manipulation, and insider threats – for which no unified quantitative evaluation framework currently exists. The study introduced a formalized aggregated security metric that enables continuous monitoring and comparative assessment across all components of the SDN–ZTA–Blockchain architecture. The tasks to be solved include: (1) identification of principal SDN attack vectors; (2) formalization of a transaction-processing algorithm covering the full access lifecycle; (3) definition of nine local security indicators; and (4) construction of the iTZBEI index with justified weighting coefficients. The methods used combine mathematical formalization of access control processes, cryptographic transaction verification, and experimental emulation of attack scenarios in a Mininet–OpenDaylight–Hyperledger Fabric environment. Conclusions. The obtained results of the article consist in the development of a functional algorithm that performs dynamic verification of user requests, makes adaptive authorization decisions according to the principles of least privilege, and records these decisions in an immutable distributed ledger. A metrics system is proposed, including local indicators such as the Continuous Authorisation Integrity Score (CAIS), the Blockchain Audit Integrity Score (BAIS), and the Local Policy Integrity (LPI). On this basis, the generalized Integrated Trust and Zero-Trust Blockchain Evaluation Index (iTZBEI) is described as an aggregated metric for comparative evaluation and continuous monitoring of the network’s security state. Scientific novelty. This study introduces a unified SDN + ZTA + Blockchain framework for network security, formalizes a transaction-level algorithm that directly links access decisions with distributed audit procedures, and proposes the iTZBEI metric as the first integral indicator for evaluating the integration’s effectiveness in dynamic network environments.