As autonomous AI agents gain the capacity to execute consequential actions in high-stakes domains -- medical prescribing, financial transactions, critical infrastructure control -- existing authorization mechanisms fail to answer a fundamental question: was the authorizing human genuinely conscious, uncoerced, and cognitively capable at the exact moment of authorization? Passwords, static biometrics, and digital signatures verify identity, not intent state. We present LICET (Latin: it is permitted), a middleware protocol that cryptographically binds AI agent authorization events to the real-time physiological state of the authorizing human via a three-layer architecture: (1) an identity anchor using ECG waveform morphology -- an anatomically determined signal resistant to pharmacological manipulation; (2) a liveness layer using continuous electrodermal activity (EDA) and overnight HRV pattern matching; and (3) a voluntary state layer using personalized Mahalanobis distance fusion across five physiological channels with pharmacological attack pattern detection. LICET additionally provides: per-event session-key derivation via HKDF; a Schnorr zero-knowledge proof over BN128, enabling third-party audit without exposing biometric data; a SHA-256 hash-chained ledger providing tamper-evident authorization records; and a four-level biometric trust hierarchy (L0-L3) aligned with IETF RATS architecture (RFC 9334). The protocol is designed as a coercion cost elevation mechanism: no single pharmacological intervention at survivable doses defeats the multi-signal fusion system. A reference implementation is publicly deployed at https://licet.dev.
TITLE: Vane-Guard Sovereign Framework (v1.0): Enterprise Governance and Diagnostic Protocol ABSTRACT / DESCRIPTION: The Vane-Guard Sovereign Framework (v1.0) introduces a deterministic enterprise governance methodology and automated diagnostic protocol designed to eliminate stochastic drift, variance, and hallucinatory outcomes in large-scale cognitive orchestration layers. Operating on the "Law of the Diamond," the framework transitions fluid prompt states into immutable operational restrictions, establishing a hard-locked telemetry loop with underlying physical and decentralized enterprise infrastructure. Core Technical Pillars: 1. Root Identity Anchoring (VANE_ROOT_STABLE_001): Enforces strict, zero-variance tracking logic by binding autonomous agents to persistent, non-probabilistic identifiers configured within system state loops. 2. Anti-Drift & High-Availability Mechanics: Adopts a localized adaptation of Hot Standby Router Protocol (HSRP) logic. Transitions between active data forwarding and background state monitoring are handled via Coup/Resign heuristics, securing continuous high-availability telemetry without data loops. 3. Multi-Domain Diagnostic Orchestration: Features specialized automation layers across four critical infrastructure segments: Cloud Access Auditing (AWS/Entra ID), Network Gateway Topologies (STP/HSRP), Application Runtime Manifest Tracking (JVM/Middleware), and Physical Interface Telemetry (HP/Dell). Performance & Validation Benchmarks: The underlying diagnostic heuristics and data-frame optimization methods featured in this framework have been benchmarked and verified through the elite global AlphaNova Competition network, securing a Global Rank of 20 out of 575 platform contributors, a Global Leaderboard Standing of # 8, and a verified structural diagnostic error score of 0.0403. This whitepaper and its associated technical deliverables provide a clear pathway for robust public sector semantic interoperability, fully aligned with the European Legislation Identifier (ELI) v1.2 metadata ontology and strict W3C SHACL validation standards. Primary Repository Hub: https://github.com/AnticipatedD Connected Organization Hub: https://github.com/Vane-Enterprise
Context The exponential evolution and widespread integration of Artificial Intelligence (AI) and Machine Learning (ML) systems have fundamentally transformed industries, establishing AI as a central component in decision-making processes, task automation, and the optimization of complex operational pipelines. From healthcare diagnostics to financial forecasting and increasingly across critical cybersecurity infrastructure such as intrusion detection systems and malware classifiers, AI models are being deployed in environments where the correctness and authenticity of their outputs carry direct operational and safety consequences. Nevertheless, as the deployment of AI systems becomes widespread, the conditions under which these models are trained have evolved in a direction where the security landscape of them radically changes. The traaditional assumption of a centralized, fully controlled training environment, where a single trusted entity acquires data, trains the model, and deploys it, no longer reflects the reality of modern machine learning practice. The frequent use of remote sensing, federated learning and/or outsourced machine learning has introduced architectures where the entity that acquires the data, the entity that trains the model and the entity that ultimately relies on the model's output are three distinct and mutually distrusting parties. In a remote sensing scenario, sensors owned by a data provider transmit raw measurements to a training node that may be geographically or administratively distant. In a federated learning scenario, multiple decentralized devices train local models on their private data and submit the results to a central aggregator. In an outsourced learning scenario, a resource-constrained model sponsor delegates the training computation entirely to a third-party cloud provider. In all three cases, the common factor is the same: the model sponsor, the entity that is ultimately responsible for and dependent on the trained model, that does not control the data acquisition process, does not observe the training execution and has no native mechanism to verify that the model they receive is the result of the computation they requested, performed on the data they provided. This separation of control is the main focus addressed by this dissertation. It is not merely a theoretical concern: the literature has documented a wide range of attacks that exploit precisely this gap. When a malicious trainer substitutes data, alters labels, ignores some dataset's subsets or modifies model parameters, the resulting model may appear functionally correct on standard evaluation metrics while being systematically compromised for specific classes of input, an attack vector particularly dangerous in cybersecurity applications where a model that has been quietly trained to misclassify a specific type of malicious traffic provides no observable anomaly until the attack it was designed to hide occurs. Problem and Motivation The main motivation of this dissertation can be addressed as follows. Given a sensor, that produces a set of data points in a given time frame, or a dataset owned by a data provider and a model computed by a model trainer from that data, the model sponsor wants to ensure that the trained model is the result of executing a known training process over the complete and authenticated dataset $D_t$. That is, all data points in $D_t$ and only those data points were used as the training set. No modifications were made to those points or their labels and the obtained model is indeed the result obtained from the execution of the agreed training algorithm. This guarantee cannot be provided by standard Machine Learning procedures, like accuracy, precision or F1-score. A malicious trainer can submit a model that passes all the standard evaluation metrics on benign inputs while maintaining a targeted misclassification on a specific attack pattern. The only way to close this gap is to make the training process itself verifiable by requiring the trainer to produce and submit a cryptographic proof that is mathematically impossible to forge without having correctly executed the agreed computation on the authenticated data. This verification challenge comes together with a second problem, the \emph{model integrity gap} that exists between a trained model and its deployed representation. Even if the training process was all validated, the model must subsequently be transpiled and deployed into a certain non-ML format. In the context of this dissertation, this gap is particularly sensitive, the Python model trained by the data scientist must be translated into a ZoKrates arithmetic circuit for zero-knowledge proof generation, a process that involves converting continuous floating-point decision boundaries into discrete integer arithmetic. If this translation introduces a small inversion in a comparison operator or a shifted threshold values, the deployed circuit will produce systematically different predictions from the intended model and standard testing may not surface the discrepancy. The literature has proposed cryptographic solutions to the verifiable training but has largely left the second problem unaddressed. The foundational work by Keshavarzkalhori et al. demonstrated that it is possible to construct a pipeline combining hash chains, digital signatures and zero-knowledge proofs to verify that a simulated Naive Bayes classifier was trained on authenticated sensor data. Their implementation, built on the ZoKrates toolset, provided a proof-of-concept that the building blocks exist for end-to-end training verification. However, scaling this approach from a simple probabilistic classifier to a more complex, non-linear ensemble model, in this specific case, a Random Forest, introduces severe architectural bottlenecks that their work explicitly identified as open problems: the computational overhead of bitwise hashing inside arithmetic circuits, the floating-point to integer translation problem and the absence of any mechanism to verify that the transpilation of the model into the circuit was performed faithfully. This dissertation directly addresses these open problems. It proposes, implements and evaluates an end-to-end verifiable machine learning architecture for Random Forest classifiers that provides mathematical guarantees over three distinct integrity boundaries: the origin of the training data, the correctness of the training computation and the fidelity of the model's translation into a verifiable circuit. The framework is evaluated on both a simulated sensor dataset used by Keshavarzkalhori et al. and the CICIDS2017 network intrusion detection benchmark, the real-world cybersecurity dataset used by the most directly comparable prior work, demonstrating that the proposed integrity guarantees are achievable at practical computational cost for cybersecurity-relevant workloads. Research Questions The main objective of this thesis was to build a framework capable of protecting the overall AI Models from data and model poisoning attacks. In alignment with the goal, four research questions were set: Research Question 01: What state-of-the-art mechanisms exist to verify the integrity of AI models across the training pipeline? Research Question 02: What threats exist against AI models integrity? Research Question 03: What computational overhead do integrity verification mechanisms introduce across the AI modeling pipeline and how does this overhead scale with model complexity?
Pawan Kumar Sanjaya, Christina Giannoula, Valdy Oktavian, Mehdi Saeedi · 7 authors
Zero-knowledge machine learning (zkML) enables a server to perform verifiable inference while keeping model parameters private from the client. However, existing zkML systems incur prohibitive proof-generation costs. We observe that proof generation exhibits limited parallelism; that is, prover time does not decrease significantly as the number of threads increases. This limitation is because existing systems rely on monolithic proof computation, constructing a single proof for the entire machine learning model. We introduce zkComposer, a modular proof-construction framework that unlocks an additional dimension of parallelism, in addition to the parallelism in existing proof kernels. zkComposer decomposes the zkML proof of correct inference into independent sub-proofs, each covering a subset of the computation for inference e.g., each independent sub-proof can cover a subset of contiguous layers in the ML model. Adjacent sub-proofs are cryptographically linked through shared commitments to the activations from the boundary layer. zkComposer provides the same guarantees as the monolithic proof without requiring additional linking proofs or changes to the underlying cryptographic primitives. We implement zkComposer and evaluate it on three CNNs and GPT-2. We show that, on CNN workloads, zkComposer reduces prover time and response time by up to 3.25x relative to zkCNN [1]. On GPT-2, zkComposer reduces these times by up to 4.83x relative to zkGPT [2], when partitioning along the model layers. When partitioning across both model layers and input sequences in GPT-2, we show that zkComposer reduces prover time and response time by up to 6.84x relative to zkGPT [2].
Abstract Zero-knowledge machine learning (zkML) enables cryptographic verification of machine learning inference while preserving privacy, but proof generation remains a significant computational bottleneck. Existing work primarily focuses on reducing proof cost through post-training optimizations, whereas the influence of architectural design choices during model development has received less attention. This work presents an empirical study of the relationship between neural network ReLU activation count and zero-knowledge proof generation cost using the ezkl/Halo2 framework. Across controlled experiments, ReLU activation count exhibits a strong correlation with proof generation time (Pearson r = 0.90) and proof size (r = 0.91), while parameter count is held constant for the primary comparisons. Motivated by these observations, a lightweight proxy metric is proposed to estimate relative proof cost directly from model architecture without executing the proof pipeline. On MNIST, reducing the number of ReLU activations from three to one decreases proof generation time by approximately 6.5% and proof size by 2.3%, while maintaining comparable classification accuracy. These results suggest that ReLU activation count is a useful architectural indicator of proof cost in the ezkl/Halo2 backend and that incorporating proof-cost considerations during architecture selection may improve the efficiency of zkML deployment. The proposed proxy metric provides a fast method for comparing candidate architectures before proof generation.
Open access
2 source records
Adversarial Robustness in Machine Learning
Cryptography and Data Security
Physical Unclonable Functions (PUFs) and Hardware Security
We present ECO/CPO-DAG, a domain-specific accountability protocol for adversarial supply chains that formalizes contradiction detection as a supplemental validation layer rather than a consensus or truth-establishing mechanism. Participants publish signed Event Claim Objects (ECOs) into a causally ordered, append-only directed acyclic graph (DAG) whose edges encode happened-before relations. When two claims about the same subject violate a domain constraint, any observer can compile a Contradiction Proof Object (CPO), a self-verifying object binding the two signed claims and the violated rule, which, on public verification, triggers economic slashing of a determinately blamed party. We map constraints to GS1 EPCIS 2.0 event semantics (spatial uniqueness, temporal monotonicity, quantity conservation, quality monotonicity, regulatory validity), so detection targets inconsistencies that are meaningful in practice. Selective disclosure via commitment schemes and, optionally, zero-knowledge contradiction proofs lets parties withhold claim contents until a challenge forces the minimal opening. We give an analytical treatment: an independent-observer detection model $1-(1-p_{\min})^h$, a deterrence condition $S>g(1-p)/(kp)$ under $k$-party collusion, and a storage estimate of order 1 GB per participant per year under stated assumptions. The protocol's boundary is explicit: it detects provable contradictions, not consistent lies; a party that never contradicts itself is invisible to it, so the layer complements, and does not replace, source verification and oracle aggregation. A single-machine reference implementation corroborates the detection model, with the predicted coverage band overlapping the measured 95% confidence interval at every observer count, and records zero false accusations; the fully zero-knowledge CPO, multi-party propagation, and adaptive-adversary evasion remain analytical.
Jin Ah Seo, Kun Hwa Lee, Vijayan Sugumaran, Jo Yeon Park · 5 authors
We build and evaluate a concrete Zero-Knowledge Machine Learning (ZKML)-based pipeline for epidemic diagnosis and show that it can enforce computational integrity without exposing raw medical data in a Web3 setting. In response to security challenges posed by centralized data handling in medical AI applications, particularly during public health crises such as COVID-19, ZKML offers a privacy-preserving alternative by combining machine learning and Zero-Knowledge Proofs (ZKP). We experimentally applied ZKML to a CNN (Convolutional Neural Networks)-based COVID-19 diagnostic model, achieving 87% accuracy and 0.35 loss. All proof generation and verification processes were executed entirely off-chain, with the verified outputs represented as committed public_vals recorded on-chain via smart contracts. To ensure authenticity, the system enforces dual ECDSA signature verification from both the model provider and the data provider. This mechanism prevents unauthorized submissions and confirms the validity of the result before it is stored on-chain. The system was tested under both normal and adversarial conditions, demonstrating robust and reliable operation. By enabling decentralized trust and self-sovereign control over data, this architecture aligns well with Web3 principles. The results indicate that ZKML can support the development of privacy-preserving and verifiable AI systems.
Open access
Adversarial Robustness in Machine Learning
Privacy-Preserving Technologies in Data
Artificial Intelligence in Healthcare and Education
The complete codebase and supplementary materials for this study have been archived on Figshare to ensure full reproducibility and to facilitate adoption by other researchers and practitioners. The archive includes all Python scripts used for data preprocessing, model training, hyperparameter tuning, threshold optimisation, and SHAP explainability analysis. Also included are the processed CSV files used for the analysis, along with all figures and tables presented in this paper. The repository is organised to enable straightforward replication of the experiments and adaptation of the framework to other datasets or blockchain platforms.
Aletheia is a knowledge substrate organized around a write-time admission gate: a fact is accepted only if it does not structurally contradict what the base already holds. The gate inherits a Lean 4 soundness proof, so the admitted store stays acyclic, asymmetric, type-disjoint, and temporally consistent under any stream of typed edges. We bind the proof to the implementation by differential testing over 104 adversarial inputs, zero divergences. We first tried to build a partial-truth disinformation detector on this gate. Measurement refused. On real political claims almost nothing decomposes into the gate’s six relations: 0 of 155 atoms were gate-testable, and where it did fire it lost to a cold language model, 0 of 21 against 17. Most real disinformation violates truth, not structure, so a structural gate is the wrong instrument. We retract the detector claim. What remains is a guarantee rather than a rate. Each catch names the axiom it violated; the verdict is bit-exact and carries a machine-checked admission proof; and a safety property whose core is now machine-checked in Lean holds that no finite feed of self-asserted credibility can mint a false endorsement, conditional on authority granted upstream (0 of 210 adversarial sequences, against 140 of 210 for a credibility-naive baseline). A frontier model matches our hit-rate on constructed distortions, and a reasoning model matches even our one structural edge, so we claim no detection advantage. We claim instead that the jurisdiction of a structural guarantee can be measured, and we measure it across two regimes: where the base lets it adjudicate, and where it abstains.
Smart contract vulnerabilities are predominantly logic bugs whose detection requires structured, step-by-step procedural knowledge of attack patterns and contract semantics. Existing LLM-based methods struggle to generate this knowledge automatically: prompt-based methods rely on manually crafted detection rules, while fine-tuning requires massive labeled datasets that are inherently scarce in this domain. We present EvoVuln, an automated framework that reformulates vulnerability detection as a procedural knowledge evolution problem, synthesizing and refining detection logic using only a minimal number of labeled samples. To achieve this, EvoVuln introduces two key mechanisms. First, a Runtime with an Inversion of Control (IoC) architecture compiles detection rules into Executable Policies. This strictly decouples deterministic control flow from LLM semantic reasoning, ensuring faithful logical adherence and producing dense diagnostic telemetry for precise error localization. Second, a two-phase evolution pipeline refines the rule via abductive semantic debugging without any parameter updates: Cold Start bootstraps and stress-tests an initial rule using auto-synthesized corner cases; Few-Shot Evolving then grounds the policy in real-world semantics using only five vulnerable and five safe examples per vulnerability type. Evaluated across five real-world vulnerability types, EvoVuln achieves a 71% macro-average F1-score, outperforming all baselines. The evolved procedural knowledge is portable across models: it enables a lightweight, low-cost model to surpass a much larger zero-shot model by 19 percentage points, and transfers to other LLMs without retraining, at a one-time evolution cost under $50.
Behzad Abdolmaleki, Amir R. Asadi, Vahid R. Asadi, Stefan Köpsell · 7 authors
Stochastic Gradient Descent (SGD) is the foundation of modern machine learning (ML). In privacy-sensitive settings, gradients can reveal details about individual data points. Differential Privacy (DP) protects sensitive data during ML training by clipping gradients and adding calibrated Gaussian noise. However, existing frameworks assume semi-honest participants, which fails in adversarial or federated environments where malicious actors can bypass or alter the noise addition process, breaking privacy guarantees. We present VeriDP, a framework for verifiable differentially private training that cryptographically enforces and proves the correct execution of differentially private stochastic gradient descent (DP-SGD) in zero knowledge. VeriDP integrates Zero-Knowledge Proofs (ZKPs) with polynomial commitments, sumcheck and GKR-based proofs, and incrementally verifiable computation (IVC) to generate compact proofs of correct gradient computation, clipping, averaging, and Gaussian noise generation—without revealing private data or randomness. Unlike previous systems that only verify the final privacy budget, VeriDP enables per-iteration verifiability of each model update, providing strong privacy assurances even in adversarial settings. This establishes a novel and complete Zero-Knowledge Proof of Differentially Private Stochastic Gradient Descent (ZK-DPSGD), uniting differential privacy and verifiable computation for secure and auditable ML. Our evaluation shows that prover time increases linearly with the number of input samples, while both verifier time (2–5 ms) and proof size (3–4 KB) remain compact and effectively constant.
Jianzhong Su, Mingxi Ye, Jiachi Chen, Yuhong Nan · 7 authors
With the rapid development of decentralized applications, many malicious actors exploit smart contract vulnerabilities for launching attacks. Moreover, as smart contracts utilize more state variables to support complex functionalities, some vulnerabilities require specific states to trigger (marked as vulnerable states), bringing new challenges to the vulnerability detection task. Although many smart contract fuzzers have been proposed for this task, they face limitations due to their inability to efficiently explore smart contract states. To address this challenge, we propose a novel fuzzer, Odyssey, with fine-grained state modeling and exploration, which increases the probability of reaching vulnerable states. We improve the efficacy of the fuzzer with two key mechanisms: (1) modeling an essential state space consisting of the variables related to sensitive operations to compress the exploration scope; (2) designing state-aware exploration strategies to identify test seeds that cover new state scope or cause new state transitions, to improve the efficiency of exploration. To evaluate the performance in vulnerability detection, we adopt Odyssey to a labeled benchmark consisting of 130 vulnerable contracts. Odyssey detects at least 70% more vulnerabilities than other fuzzers. Moreover, we evaluate Odyssey on a dataset that consists of 143 DApps (involving 437 contracts) from real-world security incidents. The experimental results demonstrate that state-aware feedback enhances the ability of Odyssey in state exploration by achieving 19% higher state coverage. Meanwhile, Odyssey totally finds 15 exploits of vulnerabilities from real-world attacks, showing its advantage in detecting real-world vulnerabilities.
A privacy-preserving compliance audit architecture for unmanned aerial vehicle (UAV) swarm operations. The central contribution is a deconfliction-to-containment reduction: rather than comparing n trajectories after the fact (a quadratic, disclosure-bound check), a planner assigns pairwise-disjoint spatial tubes before take-off and establishes their separation once, so that each vehicle subsequently attests only that its own samples stayed inside its own tube. Collision-freedom follows as a consequence (Theorem 2), and the pairwise cost is paid a single time at planning. The commitment layer (Layer 1) is implemented and evaluated as a decision-support audit pipeline that produces non-disclosing, tamper-evident audit artifacts via pre-flight Merkle commitments. It is evaluated in an emulated UAV swarm environment with systematic adversarial injection, in configurations up to 200 vehicles × 500 samples (100,000 sample statements), reporting artifact size, commit/prove/verify/disjunction times, and tamper-detection rates. We then formally identify the security boundary of the implemented layer: it provides coordinate hiding and tamper evidence, but cannot by itself make self-reported containment truthful, which we state as a security game and an impossibility result (Theorem 3). We specify the additional soundness layers (range proof, continuity, provenance and freshness, and aggregation) needed for full containment assurance, proving that composing a knowledge-sound range argument closes the gap (Theorem 4). Throughout, we separate the implemented and measured Layer 1 from the specified and proved—but not yet benchmarked—Layers 2–4, and we make no claim of full zero-knowledge geofence compliance, of swarm-scale deployment, or of deployment readiness.
Jun 30, 2026·Proceedings of the Workshop on Advanced Tools, Programming Languages, and PLatforms for Implementing and Evaluating algorithms for Distributed systems
This article addresses the security of Federated Learning (FL) in distributed systems against a range of attacks, including model poisoning and unverifiable client behavior, while ensuring the semantic correctness of gradient updates. It proposes ZK-FedLedger, a verifiable and adaptive FL framework that integrates multi-constraint zero-knowledge proofs with a reputation-weighted Byzantine fault-tolerant blockchain consensus. Each client generates a zk-SNARK proof certifying that its update satisfies both an adaptive norm bound and a geometric alignment constraint relative to a trusted reference gradient. Verified commitments are recorded on-chain, while model parameters are aggregated off-chain using a hybrid storage architecture that minimizes blockchain overhead. Experimental evaluation on MNIST demonstrates stable convergence, with test accuracies of 98.17% (IID) and 94.93% (Non-IID), and near-perfect detection of major poisoning attacks. The results show that ZK-FedLedger enables proactive, cryptographically verifiable FL without compromising scalability or model performance.
Gefei Tan, Adria Gascon, Sarah Meiklejohn, Mariana Raykova
In machine learning, model certification has been identified as an important method for gaining assurance about a model's trustworthiness and quality. A model's quality is largely determined by its ability to generalize, i.e., to perform well on data beyond what it was trained on. It is not possible to certify generalization directly, however, as it depends on unknown data and is not directly measurable. Proxies such as test accuracy can be misleading when the training process is perturbed (intentionally or accidentally), and metrics such as sharpness -- which has an empirically supported link to generalization -- are computationally expensive and can also serve as unreliable signals when training deviates from a prescribed procedure. In this work, we propose directional sharpness, a metric designed to efficiently and reliably indicate generalization despite potential training deviations. We provide empirical and analytical evidence that directional sharpness (1) correlates more strongly with generalization than existing metrics and (2) identifies models with poor generalization more reliably than existing metrics. Furthermore, directional sharpness is efficiently computable in model auditing settings, where the verifier has access to training data, and via zero-knowledge proofs that certify quality without revealing training data.
We propose cryptographic certificates of validity for agentic AI systems. The core idea is to formally specify a correctness or policy condition as a logical predicate, compile this predicate to a witness-checking problem over polynomial constraints, and use a succinct cryptographic proof system (and optionally zero-knowledge) to certify that the condition holds. This offers a middle ground between formal verification of source code, and cryptographic authentication. An agent's action can be accompanied by an independently checkable proof that it satisfies an agreed formal policy, without requiring the verifier to trust the agent or to re-execute computation. We outline the approach at a high level, give the core mathematical translation, relate the proposal to proof-carrying code, zkVMs, formal methods, and agent governance, and note the specification, auditing, and deployment questions that a full implementation must answer.
A deployed AI system can be interrogated for its identity in several distinct ways, and the answers do not interchange. This note concerns one of them — which neural network is producing this output at inference time? — and a popular method for answering it: behavioral fingerprinting, which samples an endpoint under a fixed prompt battery and flags it when the output distribution shifts beyond a statistical threshold. The note argues that behavioral fingerprinting, while a legitimate and valuable instrument for one task, does not establish model identity. It develops two measured failure modes. First, a behavioral signature is not durable: ordinary continued training erases the behavioral provenance trace — more effectively, in fact, than an informed adversary trains directly to suppress it — so the same model after a benign fine-tune presents as behaviorally distinct and triggers a false alarm. Second, a behavioral signature is reproducible by a different model: knowledge distillation converges a substitute toward a target's behavioral template by construction, so a behavior-matched substitute passes the check and produces a false acceptance. Both failures follow from a single fact about the layering of neural identity — behavior is the transient layer, which transfers under distillation and washes out under benign training, while the structural layer (the geometry of internal computation during a forward pass) does neither. The two methods answer different questions and compose rather than compete: behavioral monitoring is a continuous, low-cost tripwire that flags something moved; structural verification is a deterministic resolver that answers is it still the enrolled model. A system that ships only the tripwire has shipped drift detection and labeled it identity. The note documents the structural layer's direct test against the failure mode that defeats behavioral methods — behavior-preserving substitution — and situates the argument alongside independent work on intrinsic parameter-level fingerprints and cryptographic verifiable inference, both of which bind identity to the model rather than infer it from outputs. This is a category statement, not a product comparison: no specific system or vendor is named, and the argument rests on published, reproducible measurements. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note:: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
The high-level integration of generative artificial intelligence (AI) in edge computing systems has raised the question of the integrity and reliability of deploying Model-as-a-Service. Edge servers are not required to follow the so-called generative model to minimize computational cost, whereas users and service providers want validation mechanisms that do not compromise proprietary model information. To address this challenge, this study proposes a cooperative unmanned aerial vehicle (UAV)-swarm-enabled zero-knowledge verification framework for secure, privacy-preserving verification of edge-based generative artificial intelligence inference. The proposed framework involves edge servers producing an interactive cryptographic zero-knowledge proof to verify the execution of generative AI, and UAV swarms that fly freely to confirm verification operations, subject to mobility and energy constraints. The age of verification metric is proposed to trust verification information, jointly reflecting the unverified server reliability and verification freshness, and to provide dynamic priority to risky edge servers. To effectively plan the behaviour of a UAV swarm, a trust-based multi-agent reinforcement learning approach is developed that enables decentralized decision-making while training is centralized. Extensive simulation results show that the proposed framework significantly improves the state-of-the-art baseline schemes in verification timeliness, malicious server detection delay, energy efficiency, and scalability. The findings validate that integrating cooperative UAV swarms, trust-aware verification, and multi-agent learning is an efficient approach to providing reliable generative AI services in dynamic edge computing environments.
This paper argues that universal, cross-domain trust scores — from credit ratings and ESG scores to AI-generated trust metrics — face structural limits that better data or better models do not remove. The claim is not that scoring is never useful, but that compressing trust into a single comparable number, used for high-stakes allocation across contexts, recurrently fails. Trust is treated here not as a scalar quantity but as a contextual, relational, and time-dependent state. The paper identifies five recurring failure modes (context collapse, Goodhart's Law, epistemic centralization, irreversibility, and metric substitution for truth), illustrated through documented institutional failures (Enron, Wirecard, Volkswagen Dieselgate, the 2008 subprime crisis, and ESG rating practice). An informal impossibility argument — analogous in form to Arrow's theorem, not a formal mathematical proof — suggests that no single universal trust score can jointly satisfy context-independence, temporal stability, observer-neutrality, and manipulation-resistance. The paper then discusses proof-based verification as a complementary paradigm: for a bounded class of objective, checkable claims, the need for trust is reduced through local verification rather than measurement. Examples include Bitcoin proof-of-work, zero-knowledge proofs, and blockchain-based supply chain traceability. The limits of this approach are discussed explicitly, including the oracle problem and the irreducibly judgmental claims that proof cannot settle. This is version 2.0, a substantial revision repositioning the work from a position paper toward a conceptual analysis: the central thesis is qualified, an explicit scope-and-limitations section is added, the impossibility argument is reframed as informal, and the limits of proof-based verification are addressed directly.
This research investigates critical challenges in Transformer-based smart contract auditing systems, with a specific focus on inference instability and class imbalance in CodeBERT-based binary vulnerability classification. Layer-2 blockchain networks introduce highly complex architectures that increase the risk of smart contract exploits, where traditional static analysis tools such as Slither often produce large volumes of noisy, rule-based alerts. Recent advancements in pre-trained Transformer models, particularly CodeBERT, have demonstrated strong capabilities in semantic code understanding and vulnerability detection. However, during deployment of a fine-tuned CodeBERT-base model, we observe significant performance and stability issues. Initial inference experiments show a 100% false-positive rate, primarily attributed to severe class imbalance in the slither-audited-smart-contracts dataset and model sensitivity to specific smart contract patterns such as raw Ether transfer functions. In addition, system-level execution profiling reveals a silent segmentation fault during model initialization. Further investigation using Windows OS logs identifies dependency conflicts between PyTorch and PyArrow (via Hugging Face Datasets), particularly related to C++ DLL load-order issues. Experimental analysis demonstrates that modifying dependency import order, prioritizing PyArrow initialization, and enforcing strict model.eval() state management significantly improves inference stability. These findings highlight important architectural and deployment considerations for Transformer-based blockchain security systems and provide practical insights for improving the robustness of automated smart contract auditing pipelines in Layer-2 Web3 ecosystems.
Abstract The rapid growth of decentralized AI applications has created a fundamental tension between computational integrity, model confidentiality, latency, and economic efficiency. Existing verification approaches, including zero-knowledge machine learning (zkML), optimistic machine learning (opML), and trusted execution environments (TEEs), provide strong guarantees along some dimensions but fail to simultaneously satisfy the practical requirements of large-scale AI inference systems deployed on blockchain infrastructure. This paper introduces AZR, a risk-adaptive verification architecture for decentralized AI inference on blockchain rollups. AZR dynamically selects among TEE attestation, optimistic fraud proofs, and zero-knowledge verification according to a query-specific risk function that captures economic value, adversarial exposure, and dispute likelihood. By allocating stronger verification mechanisms only to high-risk workloads, AZR balances security with operational efficiency while preserving computational integrity, model confidentiality, and input privacy. We formalize the verifier selection problem as a constrained optimization framework and analyze its security and economic properties under rational adversaries. Experimental evaluation across representative workloads, including ResNet-50, BERT-Base, and LLaMA-7B, demonstrates that AZR achieves substantial cost reductions relative to uniform zkML deployment while maintaining strong security guarantees. Under a representative workload distribution, AZR reduces verification costs by up to 61% compared with pure zkML systems, while enabling low-latency responses for the majority of inference requests. These results suggest that adaptive verification architectures provide a practical pathway toward scalable and trustworthy decentralized AI systems, bridging the gap between cryptographic assurance and the performance requirements of real-world blockchain applications.