By 2025, an estimated 67.9% of the global populationâ5.56 billion peopleâwill rely on internet-connected AI tools like ChatGPT to automate tasks, write code, and solve complex problems. While these systems redefine productivity, their centralized architectures pose severe risks: opaque data custodianship, algorithmic surveillance, and vulnerabilities to breaches (e.g., model inversion attacks) have eroded user trust. This paper introduces Decentralized AI Guardians, a framework that merges lightweight AI models with blockchain technology to shift privacy control from corporations to users. At its core, the framework embeds AI âguardiansâ into blockchain nodes, enabling real-time, context-aware decisions about data access. Each guardian evaluates requests based on factors like app reputation, time, and user history. For instance, it might grant a navigation app daytime location access but deny a social media platform the same privilege at midnight. Permissions are stored on an immutable ledger, eliminating single points of failure. Two innovations ensure privacy and adaptability. First, federated learning allows guardians to refine decision-making collaborativelyâedge devices process data locally and share anonymized threat patterns (e.g., phishing trends) without exposing raw information. This reduces latency to 12.3 ms, critical for IoT and mobile applications. Second, zero-knowledge proofs (ZKPs) cryptographically validate compliance without disclosing sensitive details, such as confirming a userâs age without revealing their birthdate. Enforcement is automated via blockchain smart contracts, which penalize violations (e.g., revoking access) and dynamically update policies based on collective AI consensus. For example, if guardians detect a surge in malicious requests disguised as app updates, smart contracts globally block similar activity. Tested against GDPR compliance and adversarial attacks, the framework reduces unauthorized data disclosures by 72% compared to centralized systems while improving threat detection accuracy by 40%. Crucially, it resists âprivacy theaterâ: users cryptographically control their guardians, and AI models are auditable through open-source governance. This transparency ensures accountability, allowing stakeholders to scrutinize decisions and propose upgrades via decentralized voting. By decentralizing control, the framework bridges the gap between static regulations and evolving digital threats. It empowers users to define and enforce privacy rules in real time, offering policymakers a blueprint for scalable, ethical governance. For developers, it provides tools to build AI systems that prioritize user sovereignty over surveillance. In an era of escalating data exploitation, solutions like Decentralized AI Guardians are vital to balancing technological progress with fundamental human rights.
Joon Sik Kim, Kwangsu Lee, Jong Hwan Park, Hyoseung Kim
A threshold key encapsulation mechanism (TKEM) facilitates the secure distribution of session keys among multiple participants, allowing key recovery through a threshold number of shares. TKEM has gained significant attention, especially for decentralized systems, including blockchains. However, existing constructions often rely on trusted setups, which pose security risks such as a single point of failure and are limited by fixed participant numbers and thresholds. To overcome this issue, we propose a dynamic TKEM with a transparent setup, allowing for a flexible selection of both recipients and thresholds without relying on trusted third parties in the setup phase. In addition, our construction does not rely on pairing operations, which are less efficient compared to exponentiation. We prove the selective chosen-ciphertext security of our construction under the decisional Diffie-Hellman assumption, zero-knowledge, and soundness of a non-interactive zero-knowledge (NIZK) proof system. We also show that our scheme satisfies decapsulation consistency when the underlying NIZK system is sound. Our proof-of-concept implementation highlights the practicality and efficiency of this approach, further advancing the field of threshold cryptography.
This paper introduces a novel framework for Zero-Knowledge Infrastructure Verification (ZKIV) that combines chaos engineering principles with security operations and zero-knowledge proofs to create a robust infrastructure verification system. By leveraging these technologies within a DevOps context, organizations can validate the integrity and security posture of their infrastructure without revealing sensitive configuration details or credentials. This approach, which we term ChaosSecOps, represents a significant advancement in infrastructure security verification, enabling teams to verify compliance, detect misconfigurations, and identify vulnerabilities without exposing sensitive information. Through a detailed AWS implementation case study, this paper demonstrates how ZKIV can be applied to modern cloud environments to enhance security, streamline compliance verification, and build resilient systems.Executive SummaryThis paper introduces Zero-Knowledge Infrastructure Verification (ZKIV), a novel framework for validating the security and compliance of complex, modern infrastructure (particularly cloud environments like AWS) without exposing sensitive configuration details or credentials. ZKIV achieves this by combining principles from:⢠Zero-Knowledge Proofs (ZKPs): While full cryptographic ZKPs are discussed, the paper focuses on "functional zero-knowledge" approaches practical for infrastructure. This means proving that security controls are in place and functioning correctly without revealing the underlying configurations themselves. Examples include black-box testing, output-only verification, and attestation.⢠Chaos Engineering: The deliberate introduction of controlled failures (like misconfigurations or simulated attacks) to test system resilience and the effectiveness of security controls.⢠Security Operations (SecOps): Continuous monitoring, threat response, and security automation practices.⢠DevOps: Leveraging automation, continuous integration/continuous delivery (CI/CD), and Infrastructure as Code (IaC). The integration of these disciplines is termed ChaosSecOps. Key Benefits of ZKIV⢠Enhanced Security: Verification happens without needing to expose sensitive data, reducing the attack surface.⢠Improved Compliance: Continuous, automated verification ensures ongoing adherence to regulatory and internal security policies (e.g., PCI DSS, SOC 2). Evidence is collected in a zero-knowledge manner.⢠Reduced Operation Risk: Proactive identification of vulnerabilities and misconfigurations before they can be exploited.⢠Increased Confidence: Greater assurance in the security posture due to systematic and continuous testing.⢠Scalability: Verification is automated and can be used across many systems.⢠Efficiency: Verification can be done faster.ZKIV Framework ComponentsThe framework consists of several key components that work together:⢠Verification Orchestrator: The central control point for scheduling, executing, and managing verification tests.⢠Policy Engine: Defines and enforces security and compliance rules (using policy-as-code).⢠Test Agents: Ephemeral (short-lived) components deployed within the infrastructure to perform black-box testing.⢠Evidence Collection System: Gathers test results in a way that preserves zero-knowledge (no sensitive data revealed).⢠Remediation Framework: Automates the fixing of identified security issues.AWS Implementation Case StudyA detailed case study demonstrates ZKIV implementation within a financial services organization using AWS. Key AWS services used include AWS Organizations, Security Hub, Lambda, Step Functions, EventBridge, Systems Manager, S3, and Config. The case study shows practical application of zero-knowledge techniques like:⢠Least-Privilege IAM Roles: Verification agents have only the permissions needed to check configurations, not to access the data they protect.⢠Output-Only Verification: Validating database security settings without querying the database itself.⢠Black-Box Network Testing: Using isolated containers to test network segmentation without accessing internal network configurations.
Constructing efficient isogeny-based protocols is an active area of research in post-quantum cryptography. An important building block in constructing such protocols is non-interactive zero-knowledge proofs of knowledge, which convince a verifier that a prover possesses some secret information about an isogeny without revealing it. Prior proofs of knowledge of an isogeny based on ÎŁ-protocols [JD11, DDGZ22,GPS17,BCC+23] suffer from various deficiencies. They require computing large degree coprime Nâ˛-isogenies, which means they must either work over larger field extensions or choose a prime large enough to have rational Nâ˛-torsion. Further, they suffer from poor performance due to their small challenge space, resulting in many parallel repetitions to achieve negligible soundness error. This thesis presents new techniques for constructing isogeny proofs of knowledge by constructing generic instances which encode isogeny relations. These instances can then be implemented with a generic proof system (i.e. a zk-SNARK) to produce non-interactive arguments for isogeny relations, such as proving knowledge of a cyclic (2^n)-isogeny. Compared to prior approaches, zk-SNARKs allow for several orders of magnitude improvement to prover and verification times, and proofs are additionally succinct, they scale sublinearly with the witness size. To motivate our approach with an application, we construct a variant of the CGL hash function [CLG09], requiring trusted setup, along with an associated proof of honest evaluation via generic techniques. Given the function satisfies a conjectured notion of unpredictability, we use it, along with its evaluation proof to construct a verifiable random function (VRF), in the random oracle model. As an independent contribution, we prove the security of the associated generic VRF transformation. As an orthogonal contribution, we explore the shortcomings of various works which construct proofs of knowledge in modern literature in a dedicated cryptanalysis section. In particular, we show that a peer-reviewed variant of SeaSign [Kim24] is not zero-knowledge, leading to a key recovery attack; that a proof of knowledge of a commitment to an elliptic curve discrete logarithm [FLM22] is not sound (and propose a fixed protocol), and that the CROSS identification protocol [BBB+24] does not satisfy their claimed level of zero-knowledge.
Abstract We present two simple zero-knowledge interactive proofs that can be instantiated with many of the standard decisional or computational hardness assumptions. Compared with traditional zero-knowledge proofs, in our protocols, the verifier starts first, by emitting a challenge, and then, the prover answers the challenge.
Imagine sharing that you know a secret without revealing the secret itself. This is what zero-knowledge proofs (ZKPs) aim to do. In ZKPs there is a prover who claims knowledge of something and a verifier who checks this claim. The goal of this project is to further explore current technologies revolving around ZKPs and understand possible adaptations to an everyday application beyond blockchain use cases. To explore the practical use of ZKPs, this project introduces a web puzzle application that keeps the solutions of individual users private using ZKPs. A user can solve a logic- based puzzle like Binairo or Sudoku and check the validity of their solution by sharing only a ZKP of the solution. That way, the solution never leaves the userâs device. To further strengthen the security, the following two checks are implemented: (1) making sure that the solution matches the original puzzle, and (2) integrating the userâs ID during the generation process. These checks prevent users from reusing a proof to âsolveâ other puzzles or for the proof to be stolen by another user. To implement this application, different ZKP frameworks are considered. Circom and snarkjs are selected because of their active development, clear documentation and good web development capabilities. The final result is a secure application that demonstrates how ZKPs can be applied in a realistic and practical way. This highlights their broader potential in digital security. In most applications, the impact of ZKPs is intentionally hidden, as good cybersecurity aims to operate in the background. The ZKP-Puzzles application puts the ZKPs in the spotlight and visualizes how ZKPs work.
Open access
graph theory and CDMA systems
Graph Labeling and Dimension Problems
Advanced Steganography and Watermarking Techniques
Istiaque Ahmed, Kentaroh Toyoda, Tadashi Nakano, Thi Hong Tran
Traditional digital identity systems struggle with centralization, vulnerability to manipulation, and a lack of transparency. In distributed identity, different cryptographic methods are used for issuing credentials, that create challenges during presentation. It suffer from a fundamental interoperability barrier with heterogeneous digital-signature schemes, forcing each verifier either to implement every scheme or to trust a central translation gateway. We propose a signature-agnostic verification framework that eliminates this barrier. The core idea is to commit a salted root hash of credential claims to a distributed ledger and ensure the authenticity using a smart contract. A zero-knowledge proof (zk-SNARK) is used to prove a selected claim set without revealing actual information. The verification reduces to a single hash-consistency check, and the verifier never touches issuer-specific signatures. A pleasant side effect is that the same verifiable presentation (VP) can be reused across verifiers and sessions, since trust derives from the on-chain anchor rather than transient signatures. This research will advance the identification ecosystem, enabling applications such as eKYC across finance, healthcare, and other sectors. We implement our method on Ethereum Virtual Machine (EVM) using Groth16, benchmark gas cost, proof size, and latency, and show its feasibility and computational efficiency. The privacy and security analysis confirms that the proposed solution is resistant to various attacks.
V. S. Ramachandran, Hayder M. A. Ghanimi, Bhaskar Marapelli, Navleen Kaur ¡ 8 authors
This paper introduces a Cyber-Physical System (CPS) that can be used to improve privacy protection in enterprise Blockchain (BC) systems, particularly in Hyperledger Fabric (HF). The proposed CPS employs advanced methods to facilitate a privacy-preserving authorization mechanism. Using data masking, Homomorphic Encryption (HE), and complex digital signatures, the model ensures the confidentiality of transaction data during the authorization process. Additionally, the implementation of Secure Multiparty Computation (SMC) and Zero-Knowledge Proofs (ZKP) enhances the security of the data by preventing unauthorized personnel from accessing it and ensuring that the approving peers remain anonymous. The solution proposed in the paper addresses the problems of conventional centralized access control, which can be manipulated and has data leakage problems. Experimental results have proved the designâs practical applicability and security trade-off, providing a robust foundation for enterprises to adopt privacy-preserving BC. Thus, the HF platform integration demonstrates the modelâs real-world applicability, which developed a secure, scalable, and efficient solution for handling sensitive transactions in distributed networks.
Meng Li, Yifei Chen, Yan Qiao, Guixin Ye ¡ 7 authors
Blockchain technology autonomously executes smart contracts that require external data to facilitate specific applications, underscoring the necessity for Authenticated Data Feeds (ADF). Existing solutions fall short in providing genuine authentication of data, lack private and verifiable computations across multiple data sources, and overlook data traceability, rendering current systems inadequate for complex applications. We present WuKong (WK), a data governance system that offers authenticated, privately verifiable, and traceable data feeds. WK enables a server to collect faithful data through an oracle committee and to prove computation correctness in zero-knowledge proofs, and empowers legal entities to trace a leakage source conditionally. We formally define and prove the security of WK in the universal composability framework. We implement three applications that seamlessly integrate with WK. Experimental results indicate that WK effectively liberates sensitive data from distributed, untrusted, and anonymous providers, making it accessible to various services and establishing trust in a decentralized world.
Aiming at the current problems of cross-institutional mutual recognition, poor traceability and lack of trust in general education credit management, this study proposes a blockchain technology-based credit banking system construction scheme. The decentralised storage and sharing of credit data is achieved through the design of distributed ledger architecture, and smart contract technology is used to automate the execution of credit authentication, accumulation and conversion rules. Construct a standardised model of credit metadata, define the blockchain storage format of course code, credit hours, grades and other data fields, and apply the improved PBFT consensus mechanism to improve the transaction processing efficiency while ensuring data consistency. Zero-knowledge proof technology is used to realise privacy protection and ensure the security of students' sensitive information when it flows across institutions. Experimental results show that the system improves the efficiency of credit verification by 68% compared with the traditional centralised system.
With the widespread deployment of Deep-Learning-as-a-Service, secure multi-party computation-based outsourcing neural network (NN) inference has garnered significant attention for its high-security guarantee. Nevertheless, under the dishonest-majority setting with malicious adversaries, prior secure inference works are still costly in terms of communication and run-time. Additionally, existing outsourcing frameworks impose a substantial client-side design, which leads to obstacles in resource-constrained devices. To address the above challenges, we propose MD-SONIC, an online efficient and maliciously-secure framework for outsourcing NN inference with a dishonest majority. We first construct communication-efficient n-party protocols for the basic primitives such as fixed-point multiplication and most significant bit extraction by combining mask-sharing and TinyOT-sharing with SPD$\mathbb {Z}_{2^{k}}$seamlessly. Then, we build fast secure blocks for the widely used NN operators, including matrix multiplication, ReLU, and Maxpool, on top of our basic primitives. To enable an arbitrary number of users to outsource the secure inference task to n computing servers, we propose a lightweight-client and fast$\Sigma $paradigm named SPIN, stemming from zero-knowledge proofs. Our SPIN can be instantiated into a set of efficient outsourcing protocols over multiple algebraic structures (e.g., finite field and ring). We also conduct extensive evaluations of MD-SONIC on various neural networks. Compared to the work by DamgĂĽrd et al. (IEEE S&Pâ19) and MD-ML (USENIX Securityâ24), we achieve up to$594.4\times $and$45.1\times $online communication improvements, and improve the online execution time by at most$14.3\times $(resp.$20.5\times $) and$1.8\times $(resp.$2.3\times $) in LAN (resp. WAN).
Protecting user rights and enabling cross-border interoperability require the existence of private and secure management of personal identity data in digital environments. To address this need in the context of electronic health cards for digital identification and healthcare services, this paper proposes a novel architecture that integrates self-sovereign identity (SSI), verifiable credentials (VC), and zero- knowledge proofs (ZKP). With SSI, users maintain full control over their data, storing and sharing identity credentials through digital wallets using decentralized identifiers (DIDs). VC enables trusted organizations to issue authenticated, tamper-proof digital certificates, while ZKPs allow individuals to prove identity-related claims without disclosing unnecessary personal details. The combination of these technologies enables a framework that ensures a tradeoff between user privacy and security processes. The findings of the tests achieved indicate that our framework, compared to conventional models, optimizes the interoperability and privacy of e-health card systems. Additionally, the suggested solution supports recent data protection regulations and demonstrates strong potential for global adoption.