Muhammad Tahir, Adem Orsdemir, Usman Khalid, Alptekın Küpçü
The rapid adoption of blockchain technologies has intensified the need for robust security mechanisms in Ethereum smart contracts (SC). Due to immutability, vulnerabilities cannot be patched after deployment, leading to significant financial losses. While traditional static and dynamic analysis tools are widely used, recent research has explored Machine Learning (ML) and Deep Learning (DL) techniques for automated vulnerability detection. However, many existing approaches focus on single-vulnerability detection or suffer from high false positive rates and limited interpretability. To address these challenges, this study proposes an interpretable DL framework for multi-vulnerability detection in SC. The proposed model employs a lightweight One-Dimensional Convolutional Neural Network (1D-CNN) integrated with Integrated Gradients from Explainable AI (XAI) to provide transparent model decisions. SC opcode sequences are transformed into RGB-encoded sequential representations, preserving execution order while enabling efficient feature extraction. This study adopts a multi-class classification setting to evaluate generalization across diverse vulnerability types. The framework is evaluated using the publicly available Messi-Q dataset, containing labeled samples across multiple vulnerability types. Experimental results demonstrate effective multi-class detection, with performance varying across vulnerability types due to dataset imbalance and structural similarities. The model maintains efficiency while providing interpretable insights for selected vulnerability classes. The model provides opcode-level attribution, revealing localized patterns for certain vulnerabilities and more distributed attention for others. These findings demonstrate the practicality of lightweight and interpretable DL methods for scalable SC security analysis.
Gustav Olaf Yunus Laitinen-Fredriksson Lundström-Imanov, N I Abdullayeva
Generative artificial intelligence now synthesizes photorealistic imagery, audio, and video at a cost that defeats traditional forensic intuition. The legal consequences span three regimes studied so far in isolation: international operational law, domestic procedure, and product regulation. This article presents a unified evidentiary framework that maps cryptographic content provenance, robust statistical watermarking, and zero knowledge attestation to the proof requirements of each regime. We define a five tier threat model spanning naive regeneration, adversarial laundering, cross model regeneration, active watermark removal, and insider provenance forgery. We release a public benchmark of 12000 generated items across image, audio, and video modalities under six laundering pipelines for 72000 evaluation samples. We evaluate four representative schemes and report true positive rate at fixed false positive rate, robustness area under the curve, computational overhead, and a regime conditioned legal sufficiency score. We translate empirical detection bounds into legal sufficiency thresholds for command decisions under the law of armed conflict, for criminal and civil admissibility under domestic procedure, and for persistence audits under the European Union Artificial Intelligence Act and analogous regimes. The result is a reproducible reference pipeline, a public benchmark, and model annexes that lawyers, engineers, and operators can deploy together.
Open access
2 source records
Adversarial Robustness in Machine Learning
Digital Media Forensic Detection
Generative Adversarial Networks and Image Synthesis
Executive Summary This paper introduces a deterministic mathematical framework for nested learning designed to eliminate catastrophic forgetting in continuous learning systems. Standing as the first Proof of Concept (POC) of its type ever made, it completely flips the traditional AI safety paradigm. Instead of letting all data into a model and relying on post-hoc, probabilistic safeguards or heuristic mitigations to fix corruption after it occurs, this architecture implements an immutable mathematical gatekeeper called the H2E Sheriff. By filtering incoming data at the doorstep, it ensures that incoherent or corrupting inputs are rejected before they can ever modify or overwrite stored knowledge, ensuring absolute preservation of prior learning by architectural design. Theoretical Foundation & Key Components The framework anchors AI learning governance to absolute mathematical ground truths rather than learned data distributions or human preferences. Arithmetic Spectral Theory (AST): Synthesizes four classical transforms—Laplace, Euler, Fourier, and Mellin—into a single spectral operator, the L-EFM operator. At the critical line ($\sigma = 0.5$), the normalized magnitude of this operator evaluates to exactly 1 over prime sets, creating a universal coherence invariant. Empirical testing across diverse finite prime-related sets demonstrates that the system achieves a steady-state spectral coherence of exactly 0.5 at this critical line. Safety Thresholds ($\Lambda$): Computed directly from the Euler attenuation product over the first $n$ primes rather than being trained on data. The framework identifies $\Lambda_{12} = 0.9944590549$ as the primary perimeter gate boundary. The H2E Sheriff Manifold: Maps real-valued input embeddings onto the product manifold $\mathbb{H}^2 \times SPD(3)$. Incoming data is geometrically evaluated against a prime-anchored reference center ($x^*$) constructed from normalized prime coordinates. Spectral Risk Overlap Index (SROI): A metric determining an embedding's proximity to the coherent reference center on the manifold. Inputs are processed via a strict decision rule: accepted into the knowledge base if $SROI > \Lambda$, and conservatively rejected if $SROI \le \Lambda$. Experimental Validation The framework was validated using 10-dimensional vectors with controlled noise levels under a deterministic seed and 50-decimal-place precision. Threshold Discrimination: Calibration experiments confirmed that the $\Lambda_{12}$ threshold cleanly separates stable, coherent embeddings (noise $< 1.0$) from erratic, incoherent ones (noise $\ge 2.0$). Knowledge Base Integrity: During nested learning protocols featuring mixed streams of inputs, the H2E Sheriff successfully blocked corrupting data. In a stream of 30 inputs, all 12 incoherent attempts were rejected at the gate. The final knowledge base retained an average SROI of 0.996076, demonstrating zero degradation of stored knowledge and complete preservation of prior learning. Current Limitations & Future Work As the first exploratory POC mapping absolute prime structures to continuous AI safety boundaries, the paper transparently identifies clear vectors for future scaling and development: Dimensionality & Scaling: The initial validation operates on 10-dimensional embeddings and compact knowledge bases. Because the geodesic distance and matrix logarithm calculations on $SPD(3)$ scale cubically ($O(n^3)$), evaluation on large-scale, high-dimensional neural network workloads remains untested. Hyperparameter Selection: The choices for the scaling factor ($\tau = 50$) and the optimal prime set size ($n = 12$) are empirically driven for this distribution and lack a generalized analytical method for automatic selection in new problem domains. Modality Generalization: The threshold was calibrated on Gaussian noise and has not yet been exposed to complex embedding distributions like large language model tokens or image feature vectors. Neural Network Integration: The current implementation acts as a post-hoc filter on static vectors. Integrating this rigid mathematical gatekeeping into backpropagation-based training loops—where internal representations continually shift—remains an open architectural challenge. Theoretical Completeness: The core spectral coherence value of 0.5 at $\sigma = 0.5$ is an empirical invariant observed across finite sets; a formal, universal proof extending this to all infinite prime sets or establishing its absolute equivalence to the Riemann Hypothesis is not yet established.
As large language models (LLMs) grow in scale and are predominantly served from remote platforms, verifying faithful inference execution becomes critical (i.e., ensuring that a provider actually executes the advertised model and computational workload rather than a tampered or downsized variant). Zero-knowledge (ZK) LLM inference offers an appealing approach. It promises public verifiability and delivers per-instance guarantees of equational correctness by proving that an output is consistent with executing a public architecture under committed, private weights. Though, we show that it does not bind the effort expended to produce the output. In this paper, we formalize this overlooked effort gap and introduce the Hollow-LLM Attack, in which a dishonest provider retains the declared architecture and parameter count but embeds ghost weights whose algebraic structure collapses effective computation. These witnesses satisfy the verification circuit and yield valid proofs, even though the dishonest model owner, who serves as the prover, performs computation commensurate with a much smaller model than the declared public architecture. This creates a profitable equilibrium in which providers deliver provably correct outputs at small-model cost while overclaiming model size. Accordingly, we characterize concrete families of ghost weights that compose with standard transformer blocks and show that such hollow deployments substantially reduce serving cost with zero quality loss under the same verification circuit. These findings underscore that proof of correct inference is not proof of large-model execution and necessitate additional protections to bind correctness to verifiable computational work.
The rapid paradigm shift from passive, advisory Large Language Models (LLMs) to autonomous, agentic artificial intelligence systems has introduced critical execution risks. Traditional AI governance frameworks operate predominantly at the "evidence" layer-documenting data provenance, recording audit trails, and logging static safety evaluations. However, a structural vulnerability arises during the downstream execution phase: under operational pressure, autonomous agents can experience "authority drift," executing high-consequence actions based on stale dependencies, bypassed safety states, or invalid runtime authorities. To resolve this decoupling paradox, this paper introduces the Zero-Knowledge Kill-Switch (ZKKS), a cryptographic runtime enforcement architecture designed for Zero-Knowledge Web Servers (ZKWS). Rather than relying on post-hoc logging, ZKKS acts as a network-level, math-enforced execution barrier. By compiling safety policies into non-interactive zero-knowledge proofs (zk-SNARKs) and enforcing them via a Linear Temporal Logic (LTL) runtime state machine, the ZKWS dynamically halts downstream actions at the point of execution when a mathematical invariant or freshness threshold is violated-without decrypting or accessing the underlying private data payloads. We prove that ZKKS bounds operational failure to zero under deterministic policy constraints, bridging the critical gap between upstream integrity evidence and downstream execution control.
IoT device authentication must resist impersonation and credential theft while respecting the computational constraints of edge devices. Existing frameworks rely on static cryptographic keys that, once extracted, enable full impersonation, whereas RF fingerprinting schemes that bind identity to hardware imperfections transmit and store device templates in plaintext, exposing them to template theft and linkability attacks. ZK-RFAuth is a three-phase authentication framework that integrates Siamese neural network-based RF fingerprinting, Groth16 zero-knowledge proof (ZKP) verification, and proof-of-authority blockchain logging. During registration, a Siamese convolutional network extracts a compact embedding from raw I/Q samples and commits a Poseidon hash of the quantized mean template on-chain. During verification, the prover generates a Groth16 proof demonstrating that the L1 distance between a fresh embedding and the registered template falls below a per-device threshold without revealing either vector. The proof and authentication outcome are recorded on-chain for tamper-evident auditing. Evaluated on the WiSig dataset (28 WiFi transmitters, 224,000 frames), ZK-RFAuth achieves 91.4% closed-set accuracy and 2.25% equal error rate at embedding dimension d = 64, with 88.4% genuine acceptance rate and 70.8% open-set rogue rejection using per-device P95 thresholds. The ZKP circuit requires only 972 rank-1 constraint system (R1CS) constraints over 100× fewer than an equivalent SHA-256 circuit producing 144-byte proofs verifiable in approximately 3 ms.
Open access
2 source records
Wireless Signal Modulation Classification
Physical Unclonable Functions (PUFs) and Hardware Security
Deepfake technology poses a growing threat to digital trust across journalism, law, and politics. Current CNN-based detectors capture local artifacts but struggle with high-quality fakes and offer no way to prove their predictions are genuine. This paper presents DeepTrust, a framework combining a hybrid CNN–Transformer detector with Zero-Knowledge Proof (ZKP) verification and blockchain-based record-keeping. The detection model fuses spatial features from an attention-enhanced Xception network, global context from ViT-B/16, and spectral cues from a Frequency Encoder through a cross-attention mechanism. Predictions are cryptographically committed using a Pedersen scheme with the Fiat-Shamir heuristic, then stored on a proof-of-work blockchain. Evaluated on FaceForensics++, Celeb-DF, DFD, and 140K Real vs Fake, DeepTrust achieves 97.00% accuracy and 0.999 AUC on FaceForensics++, with balanced per-class accuracy despite imbalance ratios up to 1:8.5. ZKP overhead remains below one millisecond per prediction.
Open access
Adversarial Robustness in Machine Learning
Generative Adversarial Networks and Image Synthesis
Ensuring node labeling stability is critical for graph-based learning systems, directly impacting trust evaluation, node classification, and structure-aware inference in complex relational domains. Traditional manual annotation is costly and inconsistent, necessitating automated alternatives such as Large Language Models (LLMs). However, while LLM-assisted annotation improves efficiency, the reliability of node labeling remains a concern due to structural biases, particularly in unsupervised and semi-supervised learning settings. This dissertation systematically investigates the role of strong-tie structures in stabilizing label predictions across different node labeling paradigms, examining their influence on unsupervised trust prediction, defense against poisoning attacks in graph neural networks (GNNs), and LLM-based annotation. First, we analyze how strong-tie structures influence unsupervised trust prediction in decentralized systems and financial networks. Our study reveals that trust annotation propagates preferentially along strong ties, making it susceptible to targeted adversarial manipulations. By strategically modifying a minimal number of edges, an attacker can significantly alter trust/untrust label assignments, exposing vulnerabilities in existing trust prediction frameworks. Our analysis reveals that strong-tie structures are preferentially exploited by adversarial agents. Understanding these patterns provides deeper insight into the structural vulnerabilities of trust prediction systems and offers a basis for evaluating the robustness of different algorithms. Next, we extend our investigation to structural poisoning attacks in semi-supervised learning. Our findings show that poisoning behaviors exhibit clear structural preferences, targeting specific strong-tie patterns to maximize their impact on label propagation. This motivates our proposed Graph Adaptive Neural Network (GANN) framework, which dynamically adjusts propagation mechanisms based on fuzzy-theoretic strong-tie graphs (STiG). By integrating adaptive trust and risk zones, GANN mitigates the spread of adversarial noise while preserving high-confidence label prediction. Through structural decomposition and adaptive validation, our approach significantly strengthens defense mechanisms in poisoned graph environments. Finally, we propose CSA-LLM (Crowd-sourced homophily-ties-based graph annotation via large language models), which utilizes strong-tie graph structures to design LLM prompts that enhance annotation quality. By embedding structural priors in prompt engineering, CSA-LLM improves consistency in automated label generation, offering a scalable alternative to traditional manual annotation. This structured approach not only enhances annotation robustness, but also mitigates the inconsistencies introduced by structure-agnostic token generation, where LLMs generate labels based solely on textual prompts without considering graph topology. This dissertation provides a unified perspective on the impact of strong-tie structures across node labeling paradigms, bridging trust prediction, adversarial resilience, and LLM-assisted annotation. Our findings contribute to the development of attack-aware, structure-informed annotation frameworks, with implications for applications in social network security, financial fraud detection, recommendation systems, and decentralized finance (DeFi).
Industrial Digital Twins (DTs) require cryptographic verification for external audits without exposing proprietary models—a challenge for continuous-time simulations with thousands of ODE integration steps. Existing methods fail: monolithic SNARKs exceed memory limits beyond 3000 steps, while naive recursive approaches impose > 200× overhead. We present ZKP-DS, combining sensitivity-driven precision allocation (35% circuit reduction), hierarchical proof batching (26-39× speedup via parallelization), and probabilistic epoch sampling (78% verification reduction with > 99.99% fraud detection). Fixed-step Runge-Kutta integration in adaptive fixed-point arithmetic ensures both cryptographic soundness and IEEE-compliant numerical accuracy. Experiments on full-scale power systems (2000 states, 10,000 steps) achieve 5.6−8.5× computational overhead with sub-60ms constant-time verification on university GPU clusters. Results demonstrate that zero-knowledge proofs can provide mathematical integrity guarantees for industrial cyber-physical systems at practical costs, enabling trustworthy multi-stakeholder monitoring and regulatory compliance.
Smart contract security has progressed from vulnerability detection toward a broader research agenda that includes semantic reasoning, automated repair, adversarial robustness, and real-time exploit detection. This paper develops a capstone-oriented research narrative around four directions: foundation-model-based smart contract semantics and vulnerability reasoning [1], automated smart contract repair with formal guarantees [2], adversarial learning for robust malicious contract and transaction detection [3], and real-time transaction-level exploit detection at blockchain scale [4]. We connect these directions to two recent studies that characterize the current frontier: a diagnostic analysis of where smart contract security analyzers fall short [5] and a scalable real-time system for malicious Ethereum transaction detection [6]. The resulting framework is intended to help students formulate capstone projects that are technically grounded, empirically measurable, and aligned with contemporary smart contract security research.
The rapid proliferation of generative AI has collapsed the scarcity-based filters of digital trust, enabling synthetic identities, algorithmic fraud, and systemic epistemological uncertainty. Conventional authentication methods—passwords, cloud-stored biometrics, and external hardware tokens—are inherently fragile, centralized, and vulnerable to coercion or theft. This article proposes a paradigm shift toward bodily cryptographic sovereignty: a dental implant-based digital anchor that derives a Physically Unclonable Function (PUF) key from the unique acoustic resonance and microarchitecture of the human jawbone. The architecture integrates Zero-Knowledge Proofs (ZKP) for privacy-preserving verification, hardware zeroization to neutralize extraction attacks, and a configurable duress protocol for coercion scenarios. By leveraging globally established dental infrastructure and informed-consent medical protocols, the model bypasses the regulatory resistance and psychological friction associated with centralized biometric registries. It enables graded identity, scoped AI-agent delegation, and origin-verified digital communication. The proposed framework transitions digital trust from fragile external devices to an inseparable biological-cryptographic symbiosis, offering a scalable, voluntary, and regulatorily aligned architecture for the post-AI trust economy.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Large language model (LLM) ecosystems such as Claude Code and ChatGPT increasingly rely on skills: packages of natural-language instructions and executable tools. Once in the LLM's context, skill content cannot be reliably separated from trusted instructions, and a skill's executable side can invoke privileged actions, exposing the skill supply chain to injection, tampering, and rug-pull attacks. Existing defenses are stage-bound: centralized signing, audit reports unbound from the runtime artifact, or policy engines that cannot attest to what was approved. We present SIGIL, the first framework that seals the audit-runtime gap for LLM skills. SIGIL delivers verifiable hosting through a tamper-evident, decentralized on-chain registry from which LLMs fetch skills directly. The registry admits four publication types, Transparent, Licensed, Sealed, and Committed, spanning plaintext public distribution, monetized access, custodial use, and off-chain workflows; before admission, every skill is vetted by a Decentralized Autonomous Organization (DAO) audit committee that supports pluggable auditing methods under a stake-and-slash economic model. At load time, SIGIL delivers verified loading through a skill verification protocol executed by a Skill Verification Loader (SVL) embedded as the mandatory loading path: the SVL retrieves and decrypts the skill as its type requires, verifies its integrity against the on-chain record, and enforces its permission manifest before context injection. We evaluate SIGIL on a real-world deployment against 1,023 in-the-wild skills spanning six attack types. At load time, the SVL verifies each skill's integrity against its on-chain record and enforces its approved permission manifest, completing batched verification under 86 ms. Together, these results show that LLM skills can be cryptographically bound from publication through runtime at practical cost.
Open access
3 source records
Adversarial Robustness in Machine Learning
Artificial Intelligence in Healthcare and Education
Smart contracts on blockchains are prone to diverse security vulnerabilities that can lead to significant financial losses due to their immutable nature. Existing detection approaches often lack flexibility across vulnerability types and rely heavily on manually crafted expert rules. In this paper, we present an LLM-based framework for practical smart contract vulnerability detection. We construct and release a large-scale dataset comprising 31,165 professionally annotated vulnerability instances collected from over 3,200 real-world projects across 15 major blockchain platforms. Our approach leverages precise AST-based context extraction and vulnerability-specific prompt design to instantiate customized detectors for 13 prevalent vulnerability categories. Experimental results demonstrate strong effectiveness, achieving an average positive recall of 0.92 and an average negative recall of 0.85, highlighting the potential of carefully engineered contextual prompting for scalable and high-precision smart contract security analysis.
AI hallucination is a cost problem, not a knowledge problem. This paper documents that three sentences of prompt-level instruction — IDK+COMP: a compression mandate paired with a refusal permission — reproduce hallucination suppression matching or exceeding a full multi-constraint methodology across three frontier AI models. Preliminary results: Gemini — 6.3% hallucination rate (Baseline 57.5%). ChatGPT — 0.0% (Baseline 22.2%). Claude — 0.0% on both. The paper establishes hallucination as a utility-maximizing response to a cost structure that makes confident invention cheaper than refusal. Change the cost structure at the prompt level — without touching the model, without retraining, at near-zero cost — and the behavior changes. IDK is load-bearing. COMP (the compression mandate) is the environment in which it operates. Secondary findings: hedging is not a mitigation — it is a co-symptom of unresolved uncertainty, and this dataset moves the hedge-hallucination relationship in both directions depending on directive design. Plausibility-trap strings (SPLAM, Vandermeer Effect) expose the limit of cost-structure interventions: the model cannot recognize the unrecognizable. 410 trials. Three frontier AI models. Five governance conditions. Proof-of-concept dataset; results are directional.
The intersection of Artificial Intelligence (AI) and distributed systems has given rise to Federated Learning (FL), a paradigm that enables decentralized model training without compromising local data privacy. As organizational data silos grow, deploying complex machine learning models across highly distributed edge networks becomes a critical infrastructural challenge. Standard FL implementations suffer from severe vulnerabilities related to adversarial gradient updates and computational bottlenecks at the aggregation layer. This paper presents a novel, end-to-end distributed architecture that hardens FL pipelines using advanced cryptographic verification and optimized big data processing frameworks. We introduce a Zero-Knowledge Proof (ZKP) wrapper that cryptographically validates node computations before global aggregation, neutralizing model poisoning attacks without inspecting raw gradients. Additionally, we evaluate the system's performance using extreme gradient boosting models optimized for distributed edge execution. We formalize the mathematical transformation of the machine learning loss functions into Rank-1 Constraint Systems (R1CS) suitable for succinct verification. Extensive experimental results demonstrate that our hybrid architecture achieves a 94.2\% accuracy retention under adversarial conditions while maintaining scalable throughput across 1,000 parallel distributed nodes, effectively bridging the gap between rigorous cryptographic security and high-performance distributed AI.
AI hallucination is a cost problem, not a knowledge problem. This paper documents that three sentences of prompt-level instruction — IDK+COMP: a compression mandate paired with a refusal permission — reproduce hallucination suppression matching or exceeding a full multi-constraint methodology across three frontier AI models. Gemini: 6.3% hallucination rate (Baseline 57.5%). ChatGPT: 0.0% (Baseline 22.2%). Claude: 0.0%. The paper establishes hallucination as a utility-maximizing response to a cost structure that makes confident invention cheaper than refusal. Change the cost structure at the prompt level — without touching the model, without retraining, at near-zero cost — and the behavior changes. IDK is load-bearing. The compression mandate is the environment in which it operates. Secondary findings: hedging is not a mitigation — it is a co-symptom of unresolved uncertainty, and this dataset moves the hedge-hallucination relationship in both directions depending on directive design. Plausibility-trap strings (SPLAM, Vandermeer Effect) expose the limit of cost-structure interventions: the model cannot recognize the unrecognizable. In a plausibility-trap domain, IDK+COMP is worse than nothing. 410 trials. Three frontier AI models. Five governance conditions. Proof-of-concept dataset; results are directional. Companion resources: Kowalski et al. (2026a), A Puma in a Teacup: Signal Quality and Hallucination Suppression Through Prompt-Level Incentive Restructuring. https://doi.org/10.5281/zenodo.19502460 Kowalski, M. M. and Claude (Anthropic). (2026). Taxonomy of AI Bullshit: hallucination and hedging subcategories. Zenodo. https://doi.org/10.5281/zenodo.20631337. Kowalski, M. M. & Claude (Anthropic). (2026). Hallucination Test Suite and Execution Records: test strings, activation blocks, trial data and AI transcripts. Zenodo. https://doi.org/10.5281/zenodo.21325014.
This paper argues that trust scores — from credit ratings and ESG scores to AI-generated trust metrics — fail not because of poor implementation, but because trust itself is the wrong abstraction. Trust is not a scalar quantity but a contextual, relational, and topological phenomenon. Any attempt to reduce it to a universal numerical score leads to fragility, manipulation, exclusion, and systemic failure. We identify five structural failure modes (context collapse, Goodhart's Law, epistemic centralization, irreversibility, and metric substitution for truth), supported by historical case studies (Enron, Wirecard, Volkswagen Dieselgate, the 2008 subprime crisis, ESG rating failures). A formal impossibility argument demonstrates that no universal trust score can simultaneously satisfy context independence, temporal stability, observer neutrality, and manipulation resistance. We propose proof-based systems as the alternative paradigm, where trust is not measured but rendered unnecessary through local, irreversible verification. Examples include Bitcoin Proof-of-Work, zero-knowledge proofs, and blockchain-based supply chain traceability.
We describe a protocol that produces byte-identical outputs from frontier-scale language model inferenceand binds each output to a portable, offline-verifiable signed receipt. The construction has three parts.First, an inference substrate that runs models up to seventy-two billion dense parameters and forty-sevenbillion mixture-of-experts active parameters on NVIDIA H100, with cross-vendor extension to AMDInstinct MI300X. Output hashes match byte-for-byte across fresh process launches in every configurationmeasured; at single-GPU bf16 with eager attention the AMD and NVIDIA hashes are themselves byte-identical, including over fifty-one tokens of compounding frontier-scale generation, and at two-GPUtensor-parallel they differ as predicted by the underlying NCCL-ring versus RCCL-fabric all-reducetopology. Both are individually deterministic. Second, a canonical CBOR receipt schema with an Ed25519signature over a domain-separated message, implemented in Go, Python, and Rust, with cross-languagebyte-identity verified end-to-end and AMD-produced receipts verifying byte-for-byte through a Rustverifier built on x86 NVIDIA hardware. Third, a probabilistic spot-check verifier that re-executes asmall sample of receipts and rejects on mismatch; we prove a soundness lemma of the form 1−(1−f )kand validate it empirically across seventy adversary-verifier configurations with seven hundred thousandMonte Carlo trials. Verification costs about eighty microseconds per receipt on a single core. Eleventhousand sequential warm-model inferences ran without a single byte-identity failure. The contribution isthe construction itself: a primitive that gives issuer-independent fabrication soundness for AI inference atproduction cost, without a hardware-vendor dependency and without zero-knowledge proofs.
Large Reasoning Models (LRMs) and Multi-Agent Systems (MAS) in high-stakes domains demand reliable verification, yet centralized approaches suffer four limitations: (1) Robustness, with single points of failure vulnerable to attacks and bias; (2) Scalability, as reasoning complexity creates bottlenecks; (3) Opacity, as hidden auditing erodes trust; and (4) Privacy, as exposed reasoning traces risk model theft. We introduce TRUST (Transparent, Robust, and Unified Services for Trustworthy AI), a decentralized framework with three innovations: (i) Hierarchical Directed Acyclic Graphs (HDAGs) that decompose Chain-of-Thought reasoning into five abstraction levels for parallel distributed auditing; (ii) the DAAN protocol, which projects multi-agent interactions into Causal Interaction Graphs (CIGs) for deterministic root-cause attribution; and (iii) a multi-tier consensus mechanism among computational checkers, LLM evaluators, and human experts with stake-weighted voting that guarantees correctness under 30% adversarial participation. We prove a Safety-Profitability Theorem ensuring honest auditors profit while malicious actors incur losses. All decisions are recorded on-chain, while privacy-by-design segmentation prevents reconstruction of proprietary logic. Across multiple LLMs and benchmarks, TRUST attains 72.4% accuracy (4-18% above baselines) and remains resilient against 20% corruption. DAAN reaches 70% root-cause attribution (vs. 54-63% for standard methods) with 60% token savings. Human studies validate the design (F1 = 0.89, Brier = 0.074). The framework supports (A1) decentralized auditing, (A2) tamper-proof leaderboards, (A3) trustless data annotation, and (A4) governed autonomous agents, pioneering decentralized AI auditing for safe, accountable deployment of reasoning-capable systems.
The Model State Attestation Framework (MSAF) is the theoretical foundation of the Auburn Governance Stack. It establishes the intellectual authority for why cryptographic AI attestation is necessary, defines the three-tier attestation architecture, surveys over 200 papers from 2022 through 2026 confirming that no existing system composes hardware trust, continuous model health monitoring, and supply chain provenance into a unified attestation artifact, and documents the theoretical ceilings that bound what attestation can and cannot guarantee. The framework addresses a fundamental governance paradox: organizations deploying foundation models into critical infrastructure cannot definitively demonstrate that a specific output was generated by a model version in a compliant internal state. Current governance artifacts including model cards, training logs, and static benchmarks are descriptive rather than prescriptive and fundamentally non-verifiable. MSAF composes three verification tiers into a layered architecture. The first tier provides TEE-backed platform attestation for execution environment integrity, proving the silicon is real and uncompromised. The second tier provides signed continuous metrics for training and inference health monitoring, proving the model is healthy at the moment of inference. The third tier provides selective zero-knowledge proofs for high-value inference verification, enabling verification without exposing proprietary model internals. The composed attestation artifact is mapped to specific evidence requirements across five regulatory frameworks: EU AI Act Articles 11 and 15, FDA Software as a Medical Device Pre-Determined Change Control Plans, Federal Reserve SR 11-7 ongoing monitoring requirements, US Federal Procurement mandates, and AI insurance underwriting. The framework identifies the theoretical ceilings that bound attestation: Rice's theorem establishing the undecidability of semantic properties, the Impossibility Sandwich bounding what verification can achieve between Rice's theorem and Gödel's incompleteness, and TEE physical side-channel vulnerabilities limiting hardware trust guarantees. The honest framing: MSAF provides probabilistic risk reduction and accountability infrastructure, not behavioral safety guarantees. This is analogous to financial auditing, which certifies process compliance without guaranteeing future solvency. The building blocks exist individually. MSAF is the composition that binds them into an enforceable governance architecture. This work was previously hosted on Figshare, where the author maintained a portfolio of 29 publications with minted DOIs and an established ORCID record. The author's Figshare account was disabled without prior notice, without citation of a specific terms violation, and without opportunity for review, rendering all published items and their associated DOIs inaccessible. No communication was provided before or at the time of the disable action. This deposit and associated deposits on Zenodo ensure continued public accessibility of the author's research on institutional infrastructure with appropriate permanence guarantees.
Open access
2 source records
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
The widespread deployment of neural networks has raised significant concerns regarding the integrity and privacy of model predictions, especially in malicious environments. Current approaches have explored zero-knowledge proofs for integrity verification. However, they suffer from inefficiency in proving runtime and a lack of rigorous integrity verification for non linear operations. To address these issues, we present a trustwor thy framework for Enhancing Integrity Verification of Convolutional Neural Network predictions (EIV-CNN) in a malicious model, whose key contributions are an efficient optimized sum check protocol and a robust enhanced verification mechanism. Specifically, we first propose an algorithm that enables efficient proving of both batch and collaborative CNN predictions by com bining sumcheck claims of multiple matrix multiplications into one. Moreover, we introduce a non-interactive sumcheck protocol with malicious security (NM-Sumcheck) to serve as a building block for publicly verifying matrix multiplication operations. Furthermore, we introduce a verifiable method for transforming nonlinear operations into matrix operations, enabling their sub sequent evaluation with the NM-Sumcheck protocol. Our EIV CNN provides malicious security, guarantees public verifiability, and preserves model privacy. Empirical results demonstrate that our sumcheck framework achieves constant prover time, verifier time, and proof size. Compared to the state-of-the-art, it achieves up to a 128.56× reduction in prover time, along with significant reductions in communication overhead and enhanced scalability.
This paper introduces ZKAP (Zero-Knowledge Audit Protocol), a cryptographic protocol in which a machine-learning inference is coupled to a zero-knowledge proof of constraint satisfaction in such a way that the output of the inference cannot be released on any observable channel unless the proof verifies. The protocol rests on two principal technical contributions: The Certified Stack — a composite object that cryptographically binds the model weights, a mandatory bit-integrity policy (integer quantisation), the inference runtime stack and the hardware configuration under a single commitment (RootHash), which is included as a public input to every proof produced by the system. Prove-before-output enforcement — a family of four embodiments (hardware output gate, trusted-execution-environment release path, silicon-level embodiment, syscall-intercepting software runtime) in which the output of the inference is physically blocked from leaving the system until the accompanying proof has verified against the Certified Stack commitment and against a constraint set signed by an external authority. Three supporting mechanisms are described: authority-signed formal constraints with a five-type taxonomy, a per-inference hash chain with external anchoring, and a three-party cryptographic separation of duties. The paper further discusses practical relaxations of the strict release semantics for real-time workloads. A soundness theorem is stated against a polynomial-time adversary controlling the operator of the inference, and regulatory implications for high-risk AI systems under Regulation (EU) 2024/1689 (Artificial Intelligence Act) are discussed. Priority declaration. The inventive mechanisms described in this paper are the subject of Bulgarian patent applications BG/P/2026/114317 (filed 30 March 2026) and PTBG202600000316742 (filed 12 April 2026). This preprint establishes the academic priority of the author, as of the date of the deposit timestamp, over the specific technical constructions described in Sections 3 and 4 of the paper. Access note. This deposit is under embargo until 31 March 2027. During the embargo, metadata (title, abstract, author, keywords, references) are publicly visible; the full text is not publicly accessible. The embargo date coincides with the Paris Convention priority deadline of the underlying Bulgarian patent application BG/P/2026/114317. The DOI assigned at deposit time serves as a timestamp for academic priority purposes, independent of the file's accessibility.