The rapid growth of blockchain technology has driven the widespread adoption of smart contracts; however, their inherent vulnerabilities have led to significant financial losses. Traditional auditing methods, while essential, struggle to keep pace with the increasing complexity and scale of smart contracts. Large language models (LLMs) offer promising capabilities for automating vulnerability detection, but their adoption is often limited by high computational costs. Although prior work has explored leveraging large models through agents or workflows, relatively little attention has been given to improving the performance of smaller, fine-tuned models—a critical factor for achieving both efficiency and data privacy. In this paper, we introduce HKT-SmartAudit, a framework for developing lightweight models optimized for smart contract auditing. It features a multi-stage knowledge distillation pipeline that integrates classical distillation, external domain knowledge, and reward-guided learning to transfer high-quality insights from large teacher models. A single-task learning strategy is employed to train compact student models that maintain high accuracy and robustness while significantly reducing computational overhead. Experimental results show that our distilled models outperform both commercial tools and larger models in detecting complex vulnerabilities and logical flaws, offering a practical, secure, and scalable solution for smart contract auditing. The source code is available in the GitHub repository1.
Modern decentralized computing relies on two core architectural pillars: peer-to-peer (P2P) network topographies and cryptographic distributed ledgers. While early logical overlays prioritized file distribution without structural validation, contemporary blockchain deployments demand a stateful, highly adversarial communication layer. This paper provides an exhaustive analysis of the structural intersection between P2P routing mechanisms and consensus verification. We dissect the operational evolution from stateless distributed file indexes to stateful, trustless ledgers. Furthermore, we model the mathematical dynamics of epidemic data propagation, isolate systemic network-layer threat vectors such as boundary routing manipulation and node isolation attacks, and critique structural solutions implemented to scale data dissemination without inducing centralization.
Interoperation across distributed ledger technology (DLT) networks hinges upon the secure transmission of ledger state from one network to another.This is especially challenging for private networks whose ledger access is limited to enrolled members.Existing approaches rely on a trusted centralized proxy that receives encrypted ledger state of a network, decrypts it, and sends it to members of another network.Though effective, this approach goes against the founding principle of DLT, namely avoiding single points of failure (or single sources of trust).In this paper, we leverage fully-distributed broadcast encryption (FDBE in short) to build a fully decentralized protocol for confidential information-sharing across private networks.Compared to traditional broadcast encryption (BE), FDBE is characterized by distributed setup and key generation, where mutually distrusting parties agree on a BE's public key without a trusted setup, and securely derive their decryption keys.Given any FDBE, two private networks can securely share information as follows: a sender in one network uses the other network's FDBE public key to encrypt a message for its members.The resulting construction is secure in the simplified universal composability (UC) framework.To further demonstrate the practicality of our approach, we present the first instantiation of an FDBE that enjoys constantsized decryption keys and ciphertexts, and evaluate the resulting performances through a reference implementation that considers two private Hyperledger Fabric networks within the Hyperledger Cacti interoperation framework.
Blockchain technology, in simple words, is an innovative force that democratizes the methodologies of financial transactions by creating safe, traceable, and unalterable digital data. This research investigates how blockchain increases financial transparency in banking, government, and supply chain management for different sectors. It identifies block chain’s core features: decentralized ledgers, real-time auditing, and transparent data sharing, in total reducing information asymmetry and thus fraud, increasing public trust. This study will focus on the role of block chain in financial reporting, as immutable transaction records ensure audit-free error-free error checks and compliance with regulatory standards. The primary use cases for this are anticorruption government procurement systems, banking networks improving fraud detection, and supply chain platforms ensuring product traceability. Smart contracts integrated into financial processes help reduce intermediaries and promote accountability. The paper concludes with an overview of emerging trends in zero-knowledge proofs, decentralized finance, and blockchain-based governance systems that may transform the standards of transparency. Some policy recommendations for leaders are investment in blockchain research, the development of regulatory frameworks, and fostering cross-industry collaboration. Blockchain technology is expected to redefine financial transparency through accountability, fraud reduction, and increased public trust in digital economies.
This study focuses on the core needs of consumer data privacy protection in the context of the digital economy and creates a blockchain-based privacy and security architecture. Through a layered design, this architecture effectively combines data collection, blockchain core, privacy computing, smart contracts, and application integration modules. It integrates key techniques such as zero-knowledge proofs, homomorphic encryption, and decentralized identity to ensure that data is encrypted and stored throughout its creation and destruction, implements meticulous access rights management, and implements a verifiable audit process. The dataset used in this experiment is the 2024 CMS market county-level administrative district public dataset in the United States. In an environment simulating actual business pressures, the privacy protection effectiveness, system scalability, and computational and storage costs of this proposed system are tested. Comparisons are made with two typical implementations. While ensuring differential privacy and k-anonymity, the proposed system improves data transmission speed, reduces processing latency, and reduces storage consumption. This demonstrates the potential and superior performance of this system across multiple entities and industries. This study provides a practical and feasible technical implementation for blockchain-driven consumer data privacy protection and offers a verifiable engineering reference for data governance and cross-industry data sharing in the United States.
Yan Watequlis Syaifudin, Vipkas Al Hadid Firdaus, Imam Fahrur Rozi, Chandrasena Setiadi · 8 authors
The digitization of health records has enhanced clinical efficiency, but amplified risks related to data privacy, integrity, and auditability.While permissioned blockchains offer immutability and traceability, they often fail to reconcile transparency with confidentiality-either exposing sensitive data or obscuring it beyond regulatory scrutiny.To address this gap, this paper presents an integrated framework that combines Zero-Knowledge Proofs (ZKPs) with a permissioned blockchain to enable verifiable yet private healthcare transactions.A visit centric Electronic Health Record (EHR) model supports three real-world use cases: medication validity, procedure confirmation, and demographic verification.A four-layer architecture decouples data, application logic, cryptographic trust, and audit logging, allowing end-to-end validation without raw data disclosure.Experimental evaluation across three ZKP libraries (snarkJS, ZoKrates, and gnark) on a synthetic dataset of 1,000 patient visits demonstrates sub-500 ms verification latency, with snarkJS selected for its ecosystem compatibility despite slower raw performance.End-to-end pipeline latency averages 1.35 s, confirming feasibility for batch workflows such as insurance claims.The system further includes a web-based auditor interface that validates tamper-evidence under off-chain attacks, bridging cryptographic guarantees with operational compliance.
To harness the commercial potential of medical data, various blockchain-based data-sharing and exchange platforms have been proposed. A key challenge is accurately tracing the provenance and transformations of medical data assets throughout the exchange process. Existing methods cannot facilitate exchanges of publicly hosted datasets while maintaining fairness, as they require revealing keys to the blockchain during interactions. This paper presents MEDET, a novel data exchange scheme that ensures traceability of medical data assets while protecting data privacy and guaranteeing exchange fairness. MEDET leverages zero-knowledge proofs to securely verify transformations within medical datasets and confirm data authenticity. Unlike previous schemes, MEDET supports both simple data exchanges and detailed tracking of data transformations and transaction histories, aiding in the provenance and value assessment of medical records. Additionally, MEDET features a key-secure protocol for fair exchange without disclosing symmetric keys. Compared to existing fair exchange schemes, MEDET uniquely ensures the privacy of publicly hosted data while simultaneously upholding the exchange fairness. The security analysis of MEDET demonstrates its security and privacy properties. The evaluation of MEDET indicates that it outperforms existing schemes in tracking data transformations and facilitating exchanges.
As privacy concerns intensify in data-driven systems, this article presentsPriMa$\chi $, a hybrid framework that combines a genetic algorithm (GA) and reinforcement learning (RL) to optimize the privacy–utility tradeoff in differential privacy (DP) through explicit adaptive privacy–utility control. PriMa$\chi $adaptively selects perturbation configurations to minimize the privacy budget$(\varepsilon)$while preserving data utility$({\mathcal {U}})$. To support verifiable privacy-preserving analytics in decentralized environments, we further integrate PriMa$\chi $with a privacy-aware smart-contract framework that enables on-chain DP enforcement and zero-knowledge proof (ZKP) verification. The framework supports structured, transactional, and spatiotemporal workloads, including decentralized finance, electronic health records, census analytics, and location services. An interleaved Petri net model is used to formally verify privacy-aware state transitions in the smart-contract workflow. Experimental results show that PriMa$\chi $achieves utility of at least 80% under dataset-dependent privacy budgets in the range$0.003 \leq \varepsilon~\leq\unicode{0x0142}.43$, while also effectively mitigating model-extraction, membership-inference, and privacy-budget-exhaustion attacks. These results demonstrate that PriMa$\chi $provides adaptive, auditable, and practically deployable privacy protection for decentralized analytics.
Federated Learning (FL) enables collaborative model training across decentralized clients while preserving data privacy. However, practical deployments are often limited by significant communication overhead and vulnerability to Byzantine poisoning attacks. Existing defenses typically rely on post-hoc anomaly detection, but executing complex distance metrics or clustering on encrypted, sparsified updates creates a substantial computational burden for the aggregation server. We present a privacy-preserving FL framework that addresses these challenges by integrating Top-ksparsification, non-interactive zero-knowledge proofs (NIZKPs), and homomorphic encryption. Instead of relying on expensive ciphertext distance computations, our architecture uses a pre-aggregation global mask sign vector, generated through majority voting, to filter anomalous updates. This mechanism treats unselected gradient coordinates as explicit zero-votes, which mitigates malicious coalitions attempting to manipulate disjoint parameter subsets. A local error feedback mechanism ensures that heterogeneous client updates align over successive training rounds. Combined with NIZKPs to enforce coordinate-wise magnitude bounds, the framework provides Byzantine resilience without increasing communication costs or compromising privacy. Evaluations on MNIST and CIFAR-10 show that our approach maintains high communication efficiency and robustness. Under a 40% malicious client poisoning attack and a 50% sparsification ratio, the framework achieves final accuracies of 92.14% and 63.20%, respectively, demonstrating its effectiveness in bandwidth-constrained, hostile environments.
Federated learning across IoT devices must simultaneously protect each device’s update from disclosure, prevent malicious participants from biasing the global model, and hide which devices are participating from outside observers. Existing systems typically address only a subset of these goals: secure aggregation hides individual updates but cannot validate them, plaintext-based robust filtering requires the server to see updates, and most cryptographic pipelines ignore timing privacy. This paper presents TriSAFE, a protocol composition for IoT federated learning with a single coordinating server and three threshold helpers. The server holds no decryption key. TriSAFE combines four mechanisms that are usually studied in isolation: (i) encrypted client updates accompanied by zero-knowledge proofs that each coordinate lies within a bounded range; (ii) a new lightweight binding step (the plaintext-equivalence protocol, PEP) that cryptographically ties the values proven in zero knowledge to the exact ciphertext later aggregated by the server, closing a substitution gap left by range proofs alone; (iii) helper-added differential privacy noise applied homomorphically before any decryption, so the server only ever sees a noised aggregate; and (iv) fixed-cadence batching with calibrated cover traffic to hide participation from passive network observers. Across two IoT intrusion-detection benchmarks (Edge-IIoTset and N-BaIoT) and MNIST, TriSAFE keeps accuracy within 0.1-2.1 percentage points of the no-attack baseline under Byzantine, label-flip, FANG, and time-delay attacks, with attack success rate below 1% (<0.1% for FANG). Timing inference by a passive observer drops close to chance, and the end to end overhead is 7-36% relative to a non-defended baseline. On MNIST, TriSAFE achieves 89-91% accuracy, 15-17 points above the MODEL benchmark under the same attack suite. The design is practical for gateway-assisted IoT deployments under the assumption that the coordinator does not collude with two helpers and that at least two helpers contribute honest DP noise.