Zero-Knowledge Proofs (ZKPs) are critical for privacy-preserving techniques and verifiable computation. Many ZKP protocols rely on key kernels such as the SumCheck protocol and Merkle Tree commitments to enable their key security properties. These kernels exhibit balanced binary tree computational patterns, which enable efficient hardware acceleration. Although prior work has investigated accelerating these kernels as part of an overarching ZKP protocol, exploiting this common tree pattern remains relatively underexplored. We conduct a systematic evaluation of these tree-based workloads under different traversal strategies, analyzing performance on multi-threaded CPUs and the Multifunction Tree Unit (MTU) hardware accelerator. We introduce a hardware-friendly Hybrid Traversal for binary tree that improves parallelism and scalability while significantly reducing memory traffic on hardware. Our results show that MTU achieves up to $1478\times$ speedup over CPU at DDR-level bandwidth and that our hybrid traversal outperforms breadth-first search by up to $3\times$. These findings offer practical guidance for designing efficient hardware accelerators for ZKP workloads with binary tree structures.
Hasib Ahmed Md Khyrul Islam, Huy T. Vo, Aditya Rane
In the era of synthetic media, deepfake manipulations pose a significant threat to information integrity. To address this challenge, we propose TrustDefender, a two-stage framework comprising (i) a lightweight convolutional neural network (CNN) that detects deepfake imagery in real-time extended reality (XR) streams, and (ii) an integrated succinct zero-knowledge proof (ZKP) protocol that validates detection results without disclosing raw user data. Our design addresses both the computational constraints of XR platforms while adhering to the stringent privacy requirements in sensitive settings. Experimental evaluations on multiple benchmark deepfake datasets demonstrate that TrustDefender achieves 95.3% detection accuracy, coupled with efficient proof generation underpinned by rigorous cryptography, ensuring seamless integration with high-performance artificial intelligence (AI) systems. By fusing advanced computer vision models with provable security mechanisms, our work establishes a foundation for reliable AI in immersive and privacy-sensitive applications.
Open access
2 source records
Adversarial Robustness in Machine Learning
Digital Media Forensic Detection
Generative Adversarial Networks and Image Synthesis
This paper presents the design, development, and thorough evaluation of a novel network security prototype that integrates Artificial Intelligence (AI) and blockchain technology to significantly enhance cyber security. As AI becomes increasingly embedded in cybersecurity solutions, ensuring the provenance, accountability, and integrity of AI-generated decisions has emerged as a critical challenge. Without reliable logging mechanisms, AI models remain vulnerable to adversarial manipulation and pose significant risks to critical security infrastructure. To address this, our research combines a state-of-the-art Convolutional Neural Network (CNN)-based threat detection module with a permissioned Ethereum-compatible blockchain. A custom-designed Solidity smart contract ensures secure, structured storage of comprehensive AI model metadata, while interactions with the blockchain are seamlessly managed through a lightweight Flask-based REST API. Each recorded transaction generates a unique cryptographic fingerprint, providing robust evidence for audits and forensic analyses. We evaluated the system's effectiveness through rigorous experimentation on a controlled test network, confirming immutability, traceability, and verifiable integrity of all logged metadata entries. Results demonstrated significant improvements in anomaly detection accuracy, reduced false-positive rates, and ensured real-time responsiveness essential for effective intrusion prevention. Despite controlled-environment limitations, such as transaction latency and blockchain-related operational costs, our prototype successfully establishes proof-of-concept for leveraging blockchain as an immutable audit trail for AI-driven cybersecurity systems. Future research directions include integrating advanced scaling techniques, such as layer 2 solutions, and extending the blockchain logging capabilities to cover the entire AI model lifecycle, including detailed training logs and comprehensive version histories. This work provides foundational contributions towards building trusted, auditable, and transparent AI solutions in regulated cyber security domains.
Daniel Commey, Benjamin Appiah, Griffith Selorm Klogo, Garth V. Crosby
Federated Learning (FL) enables collaborative model training on decentralized data without exposing raw data. However, the evaluation phase in FL may leak sensitive information through shared performance metrics. In this paper, we propose a novel protocol that incorporates Zero-Knowledge Proofs (ZKPs) to enable privacy-preserving and verifiable evaluation for FL. Instead of revealing raw loss values, clients generate a succinct proof asserting that their local loss is below a predefined threshold. Our approach is implemented without reliance on external APIs, using self-contained modules for federated learning simulation, ZKP circuit design, and experimental evaluation on both the MNIST and Human Activity Recognition (HAR) datasets. We focus on a threshold-based proof for a simple Convolutional Neural Network (CNN) model (for MNIST) and a multi-layer perceptron (MLP) model (for HAR), and evaluate the approach in terms of computational overhead, communication cost, and verifiability.
Smart contract vulnerabilities have led to billions in losses, yet finding actionable exploits remains challenging. Traditional fuzzers rely on rigid heuristics and struggle with complex attacks, while human auditors are thorough but slow and don't scale. Large Language Models offer a promising middle ground, combining human-like reasoning with machine speed. Early studies show that simply prompting LLMs generates unverified vulnerability speculations with high false positive rates. To address this, we present A1, an agentic system that transforms any LLM into an end-to-end exploit generator. A1 provides agents with six domain-specific tools for autonomous vulnerability discovery, from understanding contract behavior to testing strategies on real blockchain states. All outputs are concretely validated through execution, ensuring only profitable proof-of-concept exploits are reported. We evaluate A1 across 36 real-world vulnerable contracts on Ethereum and Binance Smart Chain. A1 achieves a 63% success rate on the VERITE benchmark. Across all successful cases, A1 extracts up to \$8.59 million per exploit and \$9.33 million total. Using Monte Carlo analysis of historical attacks, we demonstrate that immediate vulnerability detection yields 86-89% success probability, dropping to 6-21% with week-long delays. Our economic analysis reveals a troubling asymmetry: attackers achieve profitability at \$6,000 exploit values while defenders require \$60,000 -- raising fundamental questions about whether AI agents inevitably favor exploitation over defense.
K. Praveen Kumar, Shaik Lubna, Pullagurla Tharun Kumar
Smart contracts are an integral part of blockchain networks, enabling automation and security of transactions. But undetected smart contract vulnerabilities can be exploited severely. Manual code review and static analysis, which are traditional methods for detecting vulnerabilities, tend to be time-consuming and do not possess the capability to identify sophisticated flaws. This work proposes a new method using a tailored Convolutional Neural Network (CNN) to examine Ethereum Solidity smart contract bytecode to provide effective and strong vulnerability detection. Our model is highly accurate and efficient, with 87.75 % accuracy, 86.38 % precision, 87.09 % recall, and an F1-score of 86.22 % on the Slither audited smart contract dataset. This innovation offers an efficient and scalable solution for Ethereum-based smart contracts security.
Bing Xue, Jun Zhang, Zhongwei An, Zhaoxiong Song · 6 authors
In recent years, graph neural networks have demonstrated strong capabilities in processing graph-structured data and have made significant progress in the field of smart contract vulnerability detection. This paper introduces HF-Sec, a novel framework for smart contract vulnerability detection. The framework first automatically generates heterogeneous contract graphs from the source code of Ethereum smart contracts to represent the control flow and function call relationships of the code. Then, by using a multi-source attention mechanism, the framework is able to synthesize features from different sources to capture key information from multiple perspectives. In addition, HF-Sec utilizes Fast Graph Transformer Networks and Kolmogorov-Arnold Networks to automatically extract mission-critical meta-paths and enhance the interpretability of the model. We performed experimental validation on a mixed dataset containing 423 contracts with vulnerabilities and 2742 contracts without vulnerabilities. The experimental results show that HF-Sec can significantly improve the accuracy of smart contract vulnerability detection, which is better than the methods based on machine learning or traditional analysis techniques. Through a series of ablation experiments, we further verified the importance of various key components in HF-Sec to improve the detection accuracy.
As the core application of blockchain technology, smart contracts have been widely used in many fields such as finance, supply chain, and copyright management. Smart contracts are prone to various vulnerabilities that attackers can exploit to steal or freeze funds. Traditional vulnerability detection methods rely heavily on complex rules defined by experts, which are difficult to adapt to the explosion of smart contracts. Some recent studies of neural network-based vulnerability detection methods rely on contract source code, and the accuracy of bytecode-level vulnerability detection methods is low. To overcome the limitations of existing methods, we propose CV-IRTL, a new method for smart contract vulnerability detection. Specifically, CV-IRTL designs a vulnerability detection framework for smart contracts based on inverted residual network architecture and transfer learning. In particular, CV-IRTL enables vulnerability detection at the bytecode level, simplifies data preprocessing, utilizes transfer learning to better capture vulnerability characteristics and effectively address dataset imbalances. We have extensively tested CV-IRTL on a dataset containing six vulnerabilities. The experimental results show that the macro average F1-score is 90.75%, and the overall false positive rate is 9.6%, which is better than representative methods in performance.
Federated learning has found extensive application in the multimedia domain. However, due to its distributed nature, it is vulnerable to attacks such as Byzantine poisoning. To counteract malicious attacks, the secure aggregation process in federated learning requires input validation from participants. Existing input verification schemes, such as ACORN (USENIX Security 2023), ROFL (S&P 2023), et al., efficiently assess the validity of client inputs, but they fail to account for the impact of weights and do not support weighted secure aggregation. To address these issues, we propose α-SAV, an efficient weighted input verification scheme that utilizes Pedersen commitments to encrypt both privacy and weighted gradients. Our scheme incorporates a non-interactive zero-knowledge proof, the Sigma protocol, allowing clients to generate input proofs without interacting with the server. Verified inputs can then contribute to weighted aggregation. α-SAV is highly compatible, seamlessly integrating into existing federated learning frameworks with minimal additional cost. Experimental results demonstrate that the cost of α-SAV is linear. When trained on the MNIST dataset, the client computation time for α-SAV is 1.6 seconds, resulting in only 24% additional cost compared to ACORN and 3% compared to ROFL.
While Federated learning (FL) is considered privacy-preserving by nature, it remains vulnerable to many attacks, such as data and model poisoning, that compromise data integrity and model accuracy. Conventional privacy-preserving federated learning (PPFL) mechanisms, including homomorphic encryption (HE), secure aggregation, and secure multiparty computation (SMPC) demonstrate several limitations, such as high computational complexity, significant communication overhead, and scalability challenges. To overcome the aforementioned issues, we propose an end-to-end secure FL architecture that integrates differential privacy (DP), zero-knowledge proof (ZKP), and median aggregation. DP prevents data leakage during model updates by introducing Laplacian noise for privacy preservation. ZKP is implemented through Schnorr’s protocol, which enables lightweight and efficient client authentication without revealing sensitive information. Finally, median aggregation is incorporated to mitigate the impact of outliers and adversarial updates, ensuring robust prediction aggregation. The experimental results indicate that the proposed approach outperforms other well-known PPFL methods including partially homomorphic encryption (PHE), fully homomorphic encryption (FHE) and SMPC. It delivers substantial improvements in global accuracy, especially for larger client counts, with gains of 10%-30% over the other methods. The client training time is significantly reduced by 70%-90%, ensuring faster processing. The approach also excels at reducing average round latency by 80%-95%, enhancing the overall efficiency of the system. Communication overhead is significantly reduced by 65%-85%, lowering data transfer costs per round. Furthermore, the size of the model is minimized by 60%-85%, making it more resource efficient and scalable for larger deployments.
Hengxin Lei, Thein Lai Wong, Tong Ming Lim, Xiangfu Zhao · 6 authors
Smart contracts, an important component of blockchain technology, have received widespread attention due to their decentralized and trustworthy characteristics. However, the security vulnerabilities of smart contracts pose a serious threat to their reliability, causing huge economic losses to users. Existing analysis tools are used to detect security vulnerabilities in smart contracts. However, due to their excessive reliance on hard rules defined by experts when detecting vulnerabilities in smart contracts, the time to perform the detection significantly increases as the complexity of smart contracts increases. In this study, we developed a novel hybrid machine learning model called Bi-CUR. The Bi-CUR model extracts the feature matrix of smart contract opcodes through Bigram and detects smart contract vulnerability through CUR matrix decomposition. It approximates the original matrix by selecting rows and columns, thereby reducing computational complexity while maintaining the features of the data. Compared with traditional vulnerability detection methods, models based on CUR matrix decomposition showed higher efficiency and accuracy. In addition, the model ensured interpretability, which makes it applicable to different types of smart contract vulnerability detection.
WebAssembly has become the preferred smart contract format for various blockchain platforms due to its high portability and near-native execution speed. To effectively understand WebAssembly contracts, it is crucial to recover high-level type signatures because of the limited type information that WebAssembly provides. However, existing studies on type inference for smart contracts primarily center around Ethereum Virtual Machine bytecode, which is not applicable to WebAssembly owing to their differing targets and runtime semantics. This paper introduces WasmHint, a novel solution that leverages deep learning inference to automatically recover high-level parameter and return types from WebAssembly contracts. More specifically, WasmHint constructs a wCFG representation to clarify dependencies within WebAssembly code and simulates its execution to capture type-related operational information. By learning comprehensive code semantics, it infers parameter and return types, with a semantic corrector designed to enhance information coordination. We conduct experiments on a newly constructed dataset containing 77,208 WebAssembly contract functions. The results demonstrate that WasmHint achieves inference accuracies of 80.0% for parameter types and 95.8% for return types, with average improvements of 86.6% and 34.0% over the baseline methods, respectively.
The rapid evolution of phishing attacks targeting email, chat, and social media platforms poses a significant threat to digital security, with a reported 667% surge in spear-phishing during the 2020 COVID-19 crisis [1]. Current AI-based detection systems face challenges in dataset diversity, adversarial robustness, computational scalability, model interpretability, and privacy preservation, limiting their efficacy in real-time, multi-platform environments. This paper introduces PhishGuard, an innovative framework for real-time phishing detection, designed to overcome these limitations. PhishGuard integrates lightweight transformer models (e.g., distilled BERT), hybrid detection techniques combining natural language processing (NLP), propagation analysis, and user behavior analysis, and explainable AI (XAI) methods like SHAP and LIME for transparent decision-making. Privacy-preserving techniques, including federated learning and local differential privacy, ensure secure processing of sensitive user data. Evaluated on diverse datasets such as PhiKitA, Enron, and a custom social media corpus, PhishGuard achieves up to 97.5% accuracy, 94% F1-score, and inference times below 5 ms, demonstrating scalability for resource-constrained devices. The framework also incorporates zero-knowledge proofs for verifiable inference, addressing trust and integrity concerns. By tackling cross-domain generalization, adversarial robustness, and real-time performance, PhishGuard offers a scalable, user centric solution for secure digital communications, with applications in finance, healthcare, and social media platforms. Future enhancements include multilingual support and image based phishing detection, paving the way for a comprehensive defense against evolving cyber threats.
Ruichao Liang, Jing Chen, Ruochen Cao, Kun He · 8 authors
Smart contracts, as Turing-complete programs managing billions of assets in decentralized finance, are prime targets for attackers. While fuzz testing seems effective for detecting vulnerabilities in these programs, we identify several significant challenges when targeting smart contracts: (i) the stateful nature of these contracts requires stateful exploration, but current fuzzers rely on transaction sequences to manipulate contract states, making the process inefficient; (ii) contract execution is influenced by the continuously changing blockchain environment, yet current fuzzers are limited to local deployments, failing to test contracts in real-world scenarios. These challenges hinder current fuzzers from uncovering hidden vulnerabilities, i.e., those concealed in deep contract states and specific blockchain environments. In this paper, we present SmartShot, a mutable snapshot-based fuzzer to hunt hidden vulnerabilities within smart contracts. We innovatively formulate contract states and blockchain environments as directly fuzzable elements and design mutable snapshots to quickly restore and mutate these elements. SmartShot features a symbolic taint analysis-based mutation strategy along with double validation to soundly guide the state mutation. SmartShot mutates blockchain environments using contract’s historical on-chain states, providing real-world execution contexts. We propose a snapshot checkpoint mechanism to integrate mutable snapshots into SmartShot’s fuzzing loops. These innovations enable SmartShot to effectively fuzz contract states, test contracts across varied and realistic blockchain environments, and support on-chain fuzzing. Experimental results show that SmartShot is effective to detect hidden vulnerabilities with the highest code coverage and lowest false positive rate. SmartShot is 4.8× to 20.2× faster than state-of-the-art tools, identifying 2,150 vulnerable contracts out of 42,738 real-world contracts which is 2.1× to 13.7× more than other tools. SmartShot has demonstrated its real-world impact by detecting vulnerabilities that are only discoverable on-chain and uncovering 24 0-day vulnerabilities in the latest 10,000 deployed contracts.
Federated Learning is a transformative approach to building secure and resilient AI systems by enabling decentralized model training without exposing raw data. As part of Challenges and Solutions for Cybersecurity and Adversarial Machine Learning, this chapter examines its role in enhancing cybersecurity and mitigating adversarial threats, emphasizing its privacy-preserving capabilities and robustness against attacks. Key security challenges, including adversarial model poisoning, communication risks, and data privacy concerns, are analyzed alongside solutions such as differential privacy, secure aggregation, and robust optimization techniques. The discussion extends to Federated Learning's applications in critical sectors such as healthcare, finance, and edge computing, where secure AI deployment is essential. Addressing these challenges and proposing viable solutions, the chapter provides a comprehensive perspective on Federated Learning's potential to enhance AI security and resilience in adversarial environments.
Federated Learning (FL) has emerged as a critical paradigm for enabling privacy-preserving machine learning, particularly in regulated sectors such as finance and healthcare. However, standard FL strategies often encounter significant operational challenges related to fault tolerance, system resilience against concurrent client and server failures, and the provision of robust, verifiable privacy guarantees essential for handling sensitive data. These deficiencies can lead to training disruptions, data loss, compromised model integrity, and non-compliance with data protection regulations (e.g., GDPR, CCPA). This paper introduces Differentially Private Resilient Temporal Federated Learning (DP-RTFL), an advanced FL framework designed to ensure training continuity, precise state recovery, and strong data privacy. DP-RTFL integrates local Differential Privacy (LDP) at the client level with resilient temporal state management and integrity verification mechanisms, such as hash-based commitments (referred to as Zero-Knowledge Integrity Proofs or ZKIPs in this context). The framework is particularly suited for critical applications like credit risk assessment using sensitive financial data, aiming to be operationally robust, auditable, and scalable for enterprise AI deployments. The implementation of the DP-RTFL framework is available as open-source.
This paper presents a legal and privacy-preserving use of a covert channel built over BLE, specifically between two Android devices. A custom communication protocol has been designed and implemented through a dedicated mobile application, leveraging BLE advertisement packets for unidirectional message exchange. The protocol integrates non-interactive Zero-Knowledge Proofs (ZKPs) to strengthen the authentication mechanism while preserving anonymity. This allows the receiver to verify the sender’s legitimacy without revealing or exchanging identifying information, achieving blind authentication in a fully connectionless and decentralized architecture. The resulting system enables encrypted, anonymous, and verifiable communication over BLE without pairing or persistent sessions. Experimental validation confirms the protocol’s feasibility, efficiency, and resilience against common wireless threats like spoofing, replay, and message injection. This work demonstrates how BLE and ZKP can be combined to form a secure, privacy-preserving covert communication framework applicable in real-world mobile environments.
Internet Traffic Analysis and Secure E-voting
Advanced Steganography and Watermarking Techniques
Filippo Scaramuzza, Giovanni Quattrocchi, Damian A. Tamburri
As Artificial Intelligence (AI) systems, particularly those based on machine learning (ML), become integral to high-stakes applications, their probabilistic and opaque nature poses significant challenges to traditional verification and validation methods. These challenges are exacerbated in regulated sectors requiring tamper-proof, auditable evidence, as highlighted by apposite legal frameworks, e.g., the EU AI Act. Conversely, Zero-Knowledge Proofs (ZKPs) offer a cryptographic solution that enables provers to demonstrate, through verified computations, adherence to set requirements without revealing sensitive model details or data. Through a systematic survey of ZKP protocols, we identify five key properties (non-interactivity, transparent setup, standard representations, succinctness, and post-quantum security) critical for their application in AI validation and verification pipelines. Subsequently, we perform a follow-up systematic survey analyzing ZKP-enhanced ML applications across an adaptation of the Team Data Science Process (TDSP) model (Data & Preprocessing, Training & Offline Metrics, Inference, and Online Metrics), detailing verification objectives, ML models, and adopted protocols. Our findings indicate that current research on ZKP-Enhanced ML primarily focuses on inference verification, while the data preprocessing and training stages remain underexplored. Most notably, our analysis identifies a significant convergence within the research domain toward the development of a unified Zero-Knowledge Machine Learning Operations (ZKMLOps) framework. This emerging framework leverages ZKPs to provide robust cryptographic guarantees of correctness, integrity, and privacy, thereby promoting enhanced accountability, transparency, and compliance with Trustworthy AI principles.
Large Language Models (LLMs) have shown great promise in code analysis and auditing; however, they still struggle with hallucinations and limited context-aware reasoning. We introduce SmartAuditFlow, a novel Plan-Execute framework that enhances smart contract security analysis through dynamic audit planning and structured execution. Unlike conventional LLM-based auditing approaches that follow fixed workflows and predefined steps, SmartAuditFlow dynamically generates and refines audit plans based on the unique characteristics of each smart contract. It continuously adjusts its auditing strategy in response to intermediate LLM outputs and newly detected vulnerabilities, ensuring a more adaptive and precise security assessment. The framework then executes these plans step by step, applying a structured reasoning process to enhance vulnerability detection accuracy while minimizing hallucinations and false positives. To further improve audit precision, SmartAuditFlow integrates iterative prompt optimization and external knowledge sources, such as static analysis tools and Retrieval-Augmented Generation (RAG). This ensures audit decisions are contextually informed and backed by real-world security knowledge, producing comprehensive security reports. Extensive evaluations across multiple benchmarks demonstrate that SmartAuditFlow outperforms existing methods, achieving 100 percent accuracy on common and critical vulnerabilities, 41.2 percent accuracy for comprehensive coverage of known smart contract weaknesses in real-world projects, and successfully identifying all 13 tested CVEs. These results highlight SmartAuditFlow's scalability, cost-effectiveness, and superior adaptability over traditional static analysis tools and contemporary LLM-based approaches, establishing it as a robust solution for automated smart contract auditing.
Ensuring the authenticity and integrity of digital images is increasingly critical as sophisticated manipulation techniques become more prevalent. This paper introduces an innovative approach utilizing adaptive zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge) to safeguard images against unauthorized alterations. Our method leverages zk-SNARKs to generate concise, privacy-preserving proofs that verify image authenticity, with parameters dynamically adjusted based on image content and context. We propose a dual-layered strategy: the first layer embeds cryptographic proofs into image metadata to provide robust yet compact verification, while the second layer features a real-time adaptive algorithm that optimizes zk-SNARKs parameters in response to detected manipulation patterns. Evaluated on the CASIA dataset, our approach achieves an accuracy rate of 98.7%, precision of 97.5%, recall of 99.0%, and an F-measure of 98.2% in detecting image tampering. Additionally, it maintains a PSNR of 47.2 dB, reflecting minimal impact on image quality. The proposed solution demonstrates significant robustness against various forgery techniques, positioning it as a substantial advancement in image security. This paper offers a comprehensive analysis of the method&s;s performance and its potential to enhance image security protocols through advanced cryptographic techniques.
With the rise of machine learning techniques, ensuring the fairness of decisions made by machine learning algorithms has become of great importance in critical applications. However, measuring fairness often requires full access to the model parameters, which compromises the confidentiality of the models. In this paper, we propose a solution using zero-knowledge proofs, which allows the model owner to convince the public that a machine learning model is fair while preserving the secrecy of the model. To circumvent the efficiency barrier of naively proving machine learning inferences in zero-knowledge, our key innovation is a new approach to measure fairness only with model parameters and some aggregated information of the input, but not on any specific dataset. To achieve this goal, we derive new bounds for the fairness of logistic regression and deep neural network models that are tighter and better reflecting the fairness compared to prior work. Moreover, we develop efficient zero-knowledge proof protocols for common computations involved in measuring fairness, including the spectral norm of matrices, maximum, absolute value, and fixed-point arithmetic. We have fully implemented our system, FairZK, that proves machine learning fairness in zero-knowledge. Experimental results show that FairZK is significantly faster than the naive approach and an existing scheme that use zero-knowledge inferences as a subroutine. The prover time is improved by 3.1x--1789x depending on the size of the model and the dataset. FairZK can scale to a large model with 47 million parameters for the first time, and generates a proof for its fairness in 343 seconds. This is estimated to be 4 orders of magnitude faster than existing schemes, which only scale to small models with hundreds to thousands of parameters.
Mohammed Ibraheem Hussein, Ohood Saadoon Hlail, Asma Ibrahim Hussein, Amjed Abbas Ahmed · 6 authors
Balancing efficient threat detection with data privacy becomes increasingly difficult as cyber threats develop in complexity. The Adaptive Zero-Knowledge Threat Hunting Framework (AZTH), a revolutionary integration of zero-knowledge proofs (ZKP) and artificial intelligence (AI) for private and secure cybersecurity operations, is presented in the presented study. AZTH maintains strong confidentiality regarding sensitive data yet uses federated learning, quantum-resistant cryptography, and dynamic deception systems to improve threat intelligence sharing as well as real-time threat mitigation. Together with an assessment of its efficacy in several operating situations, the architecture, approach, and possible uses of the framework are given.
Large language models (LLMs) excel at generating code from natural language instructions, yet they often lack an understanding of security vulnerabilities. This limitation makes it difficult for LLMs to avoid security risks in generated code, particularly in high-security programming tasks such as smart contract development for blockchain. Researchers have attempted to enhance the vulnerability awareness of these models by training them to differentiate between vulnerable and fixed code snippets. However, this approach relies heavily on manually labeled vulnerability data, which is only available for popular languages like Python and C++. For low-resource languages like Solidity, used in smart contracts, large-scale annotated datasets are scarce and difficult to obtain. To address this challenge, we introduce CodeBC, a code generation model specifically designed for generating secure smart contracts in blockchain. CodeBC employs a three-stage fine-tuning approach based on CodeLlama, distinguishing itself from previous methods by not relying on pairwise vulnerability location annotations. Instead, it leverages vulnerability and security tags to teach the model the differences between vulnerable and secure code. During the inference phase, the model leverages security tags to generate secure and robust code. Experimental results demonstrate that CodeBC outperforms baseline models in terms of BLEU, CodeBLEU, and compilation pass rates, while significantly reducing vulnerability rates. These findings validate the effectiveness and cost-efficiency of our three-stage fine-tuning strategy, making CodeBC a promising solution for generating secure smart contract code.