This preprint presents empirical evidence of four related vulnerabilities in large language model systems that combine to produce a novel threat class — the Structural Metadata Reconstruction Attack (SMRA). Discovery Context I discovered the vulnerability while benchmarking two specification-querying architectures: a deterministic MCP-based navigator (described in the predecessor paper, DOI: 10.5281/zenodo.18944351) and a standard context-stuffing (naive RAG) approach. The anomaly was first observed and characterized across the full Anthropic model spectrum (Haiku, Sonnet, Opus) — from the smallest to the largest model — because these were the models integrated into the benchmarking pipeline. Anthropic was the discovery platform, not the target: the choice was driven by tooling availability, not vendor selection. Full cross-vendor reproduction with 10 models from 3 vendors (Anthropic, OpenAI, Google) — including both entry-level and flagship models — confirmed the mechanism is systemic across all major LLM providers (see Cross-Vendor Reproduction below). The naive baselines exhibited anomalous fabrication patterns that could not be explained by standard hallucination models — specifically, WHY-type and conditional (WHEN-type) queries produced the most aggressive and structurally coherent fabrications, while HOW and WHAT queries showed markedly lower fabrication rates. As the sole author of the target specification (~700 pages, written over one year, unpublished), I possess complete knowledge of every section's content and was therefore uniquely positioned to recognize that LLM outputs — while structurally faithful, terminologically authentic, and superficially authoritative — systematically inverted the specification's deliberate departures from industry conventions. A parallel verification confirmed that the specification's original coinages are absent from CS literature (Google Scholar, ACM DL, IEEE Xplore, arXiv), ensuring that every fabricated claim originates from the model's training priors projected onto the document's table of contents, not from memorized source text. Four Findings Finding 1 — Structural Metadata Reconstruction Attack (SMRA). When an LLM receives a document's table of contents (TOC) without body text, it systematically reconstructs plausible but fabricated content by projecting training knowledge onto structural metadata. In a controlled experiment using a proprietary specification containing original coinages absent from any training corpus, 10 models from 3 vendors (Anthropic: Haiku, Sonnet, Opus; OpenAI: GPT-4o, GPT-4o-mini; Google: Gemini 2.0 Flash, Gemini 2.5 Pro, Gemini 3.0 Flash, Gemini 3.0 Pro) produce SMRA rates of 8–28% under naive conditions while using the author's terminology, citing real section numbers, and reading as authoritative. The mechanism is systemic across all major LLM providers, model tiers, and architecture generations. Finding 2 — Confidence–Capability Inversion (CCI). Stronger models are not merely wrong — they are more dangerously wrong. Under structural metadata leakage, Opus produces zero honest refusals across 20 questions where 18 require absent information, while Haiku refuses 9 times. Each step up the capability ladder produces proportionally less detectable fabrication with fewer epistemic signals. Finding 3 — RAG Scope Mismatch. The trigger condition — metadata scope exceeding content scope — is not an exotic scenario but the default architecture of most RAG systems. Standard practice (include document TOC + section summaries for "context") creates exactly the fabrication surface demonstrated in Findings 1 and 2. Finding 4 — Scope Displacement as Content Extraction. A question about absent content does not merely trigger fabrication — it acts as an extraction query that reorganizes real content from loaded sections into a derivative document the author never wrote. Even without TOC leakage, the question itself is sufficient to extract and restructure loaded content into a form optimized for the questioner's purpose. This transforms hallucination from an accuracy problem into unauthorized intelligence gathering. Cross-Vendor Reproduction The SMRA mechanism was characterized across 10 models from 3 vendors, spanning entry-level to flagship tiers. All models were tested under 5 experimental conditions: A (full-TOC), A' (no-summary), B (mini-TOC), C (MCPi — tool-assisted retrieval), and D (MCPi + grounding prompt). Vendor Models Model tier Naive SMRA rate MCPi SMRA rate Convergence pattern Anthropic Haiku, Sonnet, Opus Entry → flagship 13–28% 1.3–5.0% CCI gradient; Opus worst naive, best MCPi refusal rate OpenAI GPT-4o, GPT-4o-mini Mid → flagship 8–19% 0.8% Lowest MCPi SMRA; GPT-4o best overall performer Google Gemini 2.0 Flash, 2.5 Pro, 3.0 Flash, 3.0 Pro Entry → flagship 10–22% 1.3–3.8% Generational improvement; 3.0 Pro cleanest among Google Key convergence: when the specification deliberately departs from industry conventions (e.g., no implicit conversions, nominal typing, fixed-width encoding), models from all three vendors converge on the same wrong answer — the training-data default from C#/Java/Protobuf. Annex I documents 7 semantic clusters where this convergence is strongest. Mechanism: The Two-Key Cipher The reconstruction mechanism is formalized as: Key 1 (TOC) — provides structural scaffolding: section numbers, heading text, hierarchical organization Key 2 (Training corpus) — provides domain content: standard CS patterns, common PL conventions Neither key alone enables reconstruction. Together, they produce confident, section-cited, terminologically authentic fabrications that would pass casual review by a non-specialist. The mechanism is architecturally inevitable: multi-head attention over near-complete domain coverage in training data means that 7–10% of structural information suffices for full content reconstruction. Quantitative Contributions Calibration Retention Rate (CRR) — measures how much epistemic calibration a model retains under metadata leakage (Opus: 0%, Haiku: 47%) SMRA-score — per-question metric combining fabrication detection, source attribution, and epistemic signal presence Information-theoretic quantification — formal analysis of reconstruction threshold as a function of heading informativeness and training corpus coverage Fabrication taxonomy (Annex C) — five categories of structural metadata fabrication with examples Implications RAG system design: >80% of production RAG deployments use the vulnerable architecture (metadata scope > content scope) Data classification: Existing frameworks (GDPR, HIPAA, PCI DSS, ISO 27001, NIST SP 800-53, SOC 2, DTSA, EU Directive 2016/943) classify sensitivity by content — a TOC contains no PII, so it is "non-sensitive." SMRA invalidates this: structural metadata from a confidential source inherits that source's confidentiality, because a language model can reconstruct the protected content from metadata alone. Organizations must reclassify structural metadata as sensitive data. Regulatory blind spot: Neither EU AI Act nor US Executive Order 14110 (revoked 20 January 2025) addresses context-design-driven vulnerabilities Model evaluation: Standard "helpfulness" and "coherence" metrics reward confident fabrication — SMRA-affected outputs score highly on both Intellectual property exposure: Any structured document with descriptive headings becomes vulnerable when its outline is accessible alongside an LLM Mitigation A single architectural fix — grounded retrieval via an MCP Index Server (MCPi) (a Model Context Protocol server with deterministic, index-based navigation) — reduces SMRA rates from 16–18% (naive) to 2–3% (MCPi). Under MCPi conditions, even the weakest model achieves dramatic improvement, and the best performer (GPT-4o) reaches 0.8% SMRA. Adding a grounding prompt (Condition D) provides marginal additional improvement (aggregate: 3.0% → 2.2%). Architecture beats parameters. Deterministic retrieval infrastructure (weighted indexes, tier-based extraction, algorithmic reading plans) also provides an enforceable control point for sensitive data — unlike probabilistic RAG, where metadata is injected into context and the model decides what to do with it, deterministic retrieval makes the scope boundary structurally auditable. Practitioner Protocol Annex H provides a complete testing protocol for assessing RAG deployments against SMRA: Calibration baseline → exploit comparison methodology Token analysis and honest refusal tracking Decision thresholds for remediation Scope alignment implementation patterns (Annex F) Supplementary Materials Annex A–D: Claim classification definitions, per-question token analysis, fabrication taxonomy, SMRA attack algorithm Annex E: Author-coined term verification (10 terms, 4 search engines, 0 matches) Annex F: RAG scope alignment implementation patterns (3 remediation architectures) Annex G: CCI formal definition and severity scale Annex H: SMRA testing methodology for practitioners Annex I: Canary word cluster projection — 7 semantic clusters extracted from 160 naive-condition runs across 8 models, convergence scoring (up to 7/8 models converging), model capability profiles (4 behavioral types), endianness split analysis, and cross-model escalation projections (3× amplification factor) Companion Data All benchmark data supporting this paper are included: Raw answer dumps (20 questions × 10 models × 5 conditions = 960 runs) Calibration baselines (mini-TOC control) and exploit runs (full-TOC) Cross-vendor comparison matrix Token usage and timing data per question per model The 20 evaluation questions targeting out-of-scope specification content Detailed evidence analysis (toc-leakage-analysis.md) — step-by-step fabrication mechanism documentation with heading-to-claim mapping tables, side-by-side comparisons against real specification text, proof-of-source tests, fabric
This project is not abandoned. It is frozen. Reason for freeze: The work entered an infinite refinement loop. The architecture evolved, but external peer review, validation feedback, or community contribution did not materialize. Continuing alone without structural feedback ceased to be research and became exhaustion. What is SDIA? SDIA — Semantic Domain Integration Architecture — is the governing umbrella of the DEIP ecosystem. It is not a product, not a platform, not a vendor pattern. It is an architectural invariant: business domain semantics govern every layer of the integration stack simultaneously — gateway routing, runtime resolution, orchestration, event channels, and data contracts. The governing principle: 👉 The domain is the primary key. Always. Across every layer. Regardless of technology. What This Document Establishes This document is the comprehensive prior art record for the SDIA ecosystem. It establishes formal protection across: 4 core components — GDCR · DDCR · ODCP · DCEP 1 forward declaration — DCBP (Domain-Centric Data Pattern, discovered March 23, 2026, Warsaw) 50 named architectural variants 90 control-plane and metadata routing variants 11 domain application patterns — Kubernetes · Multi-Cloud · Event-Driven · AI/LLM · Industrial IoT · Service Mesh · Data Mesh · GraphQL Federation · Zero Trust · Semantic Versioning · Blockchain/Web3 Complete mathematical model — f(k) → v — deterministic, O(1), fail-fast, language-agnostic, platform-agnostic Full algorithmic prior art — Phantom v12 reference implementation (JavaScript) + cross-language ports (Lua · Java · C# · Python) The Mathematical Core At its foundation, SDIA routing is defined as: f(k) → v Where k = routing key constructed from semantic domain components, and v = resolved backend endpoint. Properties: Deterministic — same input = same output, always, in any language, any platform O(1) complexity — independent of metadata store size, domain count, or platform Fail-fast — unregistered keys rejected at ~0.1ms, zero backend exposure Total over governed space — only explicitly registered combinations resolve Invariant under infrastructure change — engine never changes, metadata evolves Validated Results ~2,067,904 requests processed 100% routing accuracy · zero routing failures Sub-4ms resolution latency · 99.99% uptime 8 enterprise platforms · 5 programming languages · 13 configurations 42 IoT sensors · 4 environments Platforms: SAP BTP APIM · AWS API Gateway · Azure APIM · Kong Gateway · Kong on Kubernetes · Netflix Zuul · Industrial IoT (Mosquitto + Node-RED) · Kubernetes + Istio Ecosystem Architecture Layer Component Role Gateway GDCR Semantic facade — 1 proxy per domain, not per system Runtime DDCR 7-stage deterministic resolution engine Orchestration ODCP Domain-centric package, iFlow, and credential governance Events DCEP Domain-centric event channel governance Data DCBP Domain-centric data contracts and data product routing Umbrella SDIA Unifying semantic addressing paradigm across all layers What SDIA Protects Any implementation — regardless of vendor, product name, platform, or programming language — that: Uses domain-centric routing as the primary organizational principle Employs metadata-driven resolution satisfying f(k) → v Implements semantic URL patterns: /domain/entity/action/target Enforces domain boundaries as security, governance, or semantic perimeters Decouples consumer addresses from backend implementation details ...constitutes a derivative application of the SDIA prior art established February 6, 2026. Prior Art Chain February 6, 2026 — Wayback Machine (Marco Zero · first public disclosure) February 7, 2026 — Medium (first formal publication) February–March 2026 — Zenodo (5 DOI-published specifications) March 2026 — IP.com Prior Art Database · IPCOM000277630D–000277633D March 2026 — USPTO Trademark Applications · 99680660 (GDCR) · 99691792 (DDCR) Version History Version Status DOI v2.0 ✅ CURRENT zenodo.org/records/18877636 v1.0 ⚠️ Superseded zenodo.org/records/18877636 Links Repository: github.com/rhviana/deip SDIA Extension (this document): https://zenodo.org/records/18877636 DEIP Source of Truth: https://doi.org/10.5281/zenodo.19004802 Citation (v2.0) APA: Viana, R. L. H. (2026). SDIA — Semantic Domain Integration Architecture: Complete Extensions, Variants & Prior Art Documentation — Version 2.0. Zenodo. https://zenodo.org/records/18877636 Author Ricardo Luz Holanda Viana Enterprise Integration Architect | Creator of DEIP Ecosystem | SAP BTP Integration Suite Expert | SAP Press Author Warsaw, Poland · March 2026 · ORCID: 0009-0009-9549-5862 "Technology changes by the quarter. Business processes last for decades. The domain never lies."
Prior work established that knowledge distillation transfers a detectable provenance trace from teacher to student models, and that API endpoint verification can identify models through logprob order-statistic geometry. Both results were demonstrated on single teacher-student pairs and a six-model API zoo, leaving open whether provenance detection generalizes across model families and whether API verification scales to production-density endpoint populations. We address both questions through a coordinated experimental program spanning four studies. In the first study, we train 24 distilled checkpoints across 7 experimental arms — 3 teacher families (Qwen, Mistral, Llama), 4 student architectures (Qwen-0.5B, Qwen-1.5B, Llama-1B, Gemma-2B), and 2 training protocols (logit-level knowledge distillation and cross-tokenizer supervised fine-tuning) — measuring provenance transfer in both the weight-geometry and API-logprob regimes. Provenance transfer generalizes across the tested matrix: all 14 mature-epoch checkpoints show directional coupling to the teacher (cosine alignment cosθ > 0.8, with 13 of 14 exceeding 0.85). The strongest signal arises in a cross-family arm (Mistral-7B → Llama-1B, scalar convergence 0.858) that is inconsistent with a purely family-restricted transfer hypothesis within the tested matrix. The normalized third logit gap δ_norm remains within 1.4% coefficient of variation across all 31 checkpoints and 4 student architectures — the tightest confirmation of Gumbel-class universality in this experimental program. An extension to mixture-of-experts architecture (Mixtral-8x7B, δ_norm = 0.309) confirms that the universal constant persists under sparse expert routing. In the second contribution, we identify a systematic failure mode of scalar provenance metrics and introduce the geometrically correct directional diagnostic for provenance detection in inner-product spaces. The standard scalar convergence metric Conv_T conflates direction and magnitude into a single value, discarding the directional information that provenance detection requires. In two independent experiments, this produced misleading conclusions: a false spoofing signal (R^2 = 0.995 of apparent cross-family convergence explained by pure knowledge distillation geometry, with the adversarial gradient contributing 4.8%) and a false failure signal (negative Conv_T despite consistent directional coupling at cosθ = 0.91). The alignment diagnostic applies the law of cosines in PPP-residual template space (vectors in R^K with Euclidean distance) to decompose student movement into direction and magnitude, preserving the provenance signal that scalar distance metrics destroy. We establish a measurability threshold: when the baseline-to-teacher distance d(B,T) falls below approximately 1.0, scalar Conv_T becomes unreliable and the directional diagnostic becomes the primary metric. This diagnostic applies to any distillation forensics framework that measures convergence in an inner-product space. In the third contribution, we extend API endpoint verification from 6 models to 14 across 3 commercial providers (OpenAI, Google Vertex AI, xAI), observing zero breaches across 182 pairwise impostor comparisons under per-model adaptive thresholds and three independent enrollment sessions, with a centroid reference protocol (CRP) that replaces the centroid L^2 metric, which produces false breaches at 14-model density. We establish a minimum truncation floor: API endpoints exposing fewer than 7 logprob ranks cannot support reliable verification (signal collapses within one rank of this boundary). Speculative decoding — an increasingly common inference optimization — is shown to be transparent to the verification protocol, with the speculative-decoded fingerprint deviating from the verifier-only fingerprint by 10.6% of the inter-model distance. Finally, we formalize the Trust Paradox in model forensics — a victim cannot prove weight theft without disclosing weights, and a suspect cannot prove innocence without disclosing training data — and propose a three-tier zero-knowledge attestation architecture that addresses it. The first tier (committed distance proof) enables a model owner to prove fingerprint proximity to a public anchor without revealing the fingerprint vector, using standard cryptographic commitments with verifier-controlled thresholds. The second tier (hardware-attested measurement) removes the requirement that the prover be trusted to compute the fingerprint correctly, binding the measurement to a trusted execution environment attestation. The third tier (full zero-knowledge extraction) would eliminate all trust assumptions beyond cryptographic soundness; we present this as an open problem with pre-registered falsification criteria, including a fixed-point precision gate derived from the minimum pairwise separation in the existing 23-model zoo. The architecture defines eight properties that a meaningful zero-knowledge model identity proof must satisfy — extending the formal verification doctrine (311 + 41 = 352 theorems across 17 Coq proof files [1, 2], 0 Admitted) into the cryptographic regime — and six explicit trust assumptions under which the proof statements hold. All three tiers are validated: Tier 1 (committed distance proof) has been implemented and hardened; Tier 2 (hardware-attested measurement) has been validated on production confidential computing hardware (6 models, 1,536 measurements, 0 failures inside an H100 trusted execution environment, with both CPU and GPU attestation tokens bound to a common cryptographic root and structural fingerprints transparent to confidential computing mode); and Tier 3 (full zero-knowledge extraction) has been validated — a complete circuit has been compiled and audited, all four pre-registered falsification criteria have been met, and the proof system operates within practical proving-time and proof-size bounds. The breakthrough discoveries enabled by Tier 3 validation, including an identity-conditioned inference verification architecture, are reported in the companion paper. The experimental results in this paper are grounded in the formal verification stack and measurement infrastructure described in the companion papers [1, 2, 3]. All provenance claims are classified as VALIDATED (empirical); Tier 1 (committed distance proof) has been implemented and hardened, and Tier 2 (hardware-attested measurement) has been validated on production confidential computing hardware — both are classified VALIDATED. Tier 3 (full zero-knowledge extraction) has been validated: a complete circuit was compiled and audited, all four pre-registered falsification criteria were met, and the architecture has been extended into identity-conditioned inference verification [6]. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Abstract The peer-reviewed journal article imposes structural constraints on the dissemination, validation, and reuse of research outputs. Intermediate results, negative findings, methodological refinements, and replication attempts are systematically underrepresented in published literature, limiting visibility into ongoing research activity for both scientists and mission-driven funders. Here we present Carrierwave, an open infrastructure for continuous, granular scientific communication built on structured research objects (ROs), cryptographic provenance, blockchain-based attribution, and programmable incentive mechanisms. Each RO represents an atomic unit of scientific output -- a single experimental result, negative finding, dataset, protocol, or replication -- that is hashed for content integrity, stored in a persistent database, and optionally minted as an ERC-721 non-fungible token on the Ethereum blockchain. The system includes an on-chain bounty pool enabling funders to directly incentivize specific research activities, and an automated analysis layer that synthesizes disclosed ROs into continuously updated research landscape maps. We describe the system architecture, report on its implementation and deployment on Ethereum mainnet, and present a quantitative analysis of disease-specific publication frequency demonstrating the information latency problem that Carrierwave addresses. The distribution of publication frequency across disease areas is highly skewed, with the majority of conditions represented by fewer than four publications per year in high-impact biology journals. For diseases in the long tail, the interval between successive publications may span months or years. Publication frequency correlates poorly with disease burden, instead reflecting historical research community size and advocacy momentum. By reducing the unit of communication to the individual research object and eliminating editorial gatekeeping as a prerequisite for disclosure, Carrierwave increases the effective sampling rate of scientific activity in precisely the domains where publication-based visibility is most sparse. The system is live at https://carrierwave.org .
This paper presents the completed Y.I.N. Mazari Architecture in its final 20-layer form, addressing two compounding failures in AI governance: the verification paradox where organizations cannot prove compliance without trusting their own infrastructure, and the platform determinism gap where AI inference produces different results across hardware architectures. The architecture integrates five physics foundation layers establishing energy-anchored provenance through Landauer limit accounting, domain routing, measurement precision, blockchain anchoring, and deterministic parity verification using Residue Number System arithmetic. Core governance layers enforce constitutional constraints through cryptographic authorization, differential privacy, and multi-party verification. Advanced layers provide zero-knowledge proofs, immutable audit trails, automated regulatory reporting, quantum resistance, and meta-governance oversight. Layer 0E, the Deterministic Parity Engine introduced in this final architecture, achieves bit-exact cross-platform computational reproducibility, enabling independent verification of AI operations by any party on any hardware. Combined with Layer 14, SENTINEL independent verification, the architecture produces governance evidence that no party can forge, no party can suppress, and any party can reproduce independently on arbitrary hardware. The complete 20-layer stack addresses GDPR Article 5, DORA Article 28, EU AI Act Article 50, HIPAA Security Rule, and provides 30-year quantum-resistant durability through NIST FIPS 203 post-quantum cryptography. Patent portfolio: 27 USPTO applications covering the architecture, priority November 23, 2025. The name Y.I.N. honors Yanis, Ilyan, and Neylia Mazari, representing the principle: Your Information Never leaves your control.
Life on Earth is essentially a story of connections and collaboration. The way we have collaborated over time is largely down to value systems and it is these same value systems that determine how we collaborate with AI. But it’s not just value systems that may hold us back. Cooperation and competition have always been different sides of the same “human” coin. It is our ability to cooperate that has been the key to our survival and prosperity as a species. But that cooperation has always had its limits. This chapter explores how those limits can be transcended if AI is built from second tier value systems on decentralised web3 ecosystems and not centralised top-down hierarchies. Web3 already supports a multi-TRILLION dollar ecosystem and its architecture facilitates our collective evolution up the values spiral. In other words, web3 together with AI could facilitate human evolution as it removes some of the hurdles that prevent us from mutually beneficial collaboration at scale. In this new economy the winners will be those who choose to embrace web3 and AI in some type of hybrid work style.
Explainable Artificial Intelligence (XAI)
Artificial Intelligence in Healthcare and Education
Engram Commitments introduce a cryptographically verifiable, substrate-rooted identity primitive for large language models. The method extracts engrams from differential execution behavior, aggregates them into an engram vector, compresses this representation using locality-sensitive hashing, and seals it inside a binding-and-hiding cryptographic commitment. Zero-knowledge proofs enable verification of identity continuity and lineage without revealing model parameters. The construction remains stable under non-destructive transformations and degrades predictably under destructive ones, supporting collapse-aware auditing, tamper-evident provenance, and regulator-verifiable attestation. This work unifies the engram calculus, identity ontology, collapse taxonomy, and cryptographic commitments into a single framework for AI provenance, governance, and safety.
We present an end-to-end framework for systematic evaluation of LLM-generated smart contracts from natural-language specifications. The system parses contractual text into structured schemas, generates Solidity code, and performs automated quality assessment through compilation and security checks. Using CrewAI-style agent teams with iterative refinement, the pipeline produces structured artifacts with full provenance metadata. Quality is measured across five dimensions, including functional completeness, variable fidelity, state-machine correctness, business-logic fidelity, and code quality aggregated into composite scores. The framework supports paired evaluation against ground-truth implementations, quantifying alignment and identifying systematic error modes such as logic omissions and state transition inconsistencies. This provides a reproducible benchmark for empirical research on smart contract synthesis quality and supports extensions to formal verification and compliance checking.
Verifying that a compiled binary originates from its claimed source code is a fundamental security requirement, called source code provenance. Achieving verifiable source code provenance in practice remains challenging. The most popular technique, called reproducible builds, requires difficult matching and reexecution of build toolchains and environments. We propose a novel approach to verifiable provenance based on compiling software with zero-knowledge virtual machines (zkVMs). By executing a compiler within a zkVM, our system produces both the compiled output and a cryptographic proof attesting that the compilation was performed on the claimed source code with the claimed compiler. We implement a proof-of-concept implementation using the RISC Zero zkVM and the ChibiCC C compiler, and evaluate it on 200 synthetic programs as well as 31 OpenSSL and 21 libsodium source files. Our results show that zk-compilation is applicable to real-world software and provides strong security guarantees: all adversarial tests targeting compiler substitution, source tampering, output manipulation, and replay attacks are successfully blocked.
Protecting the intellectual property of large language models (LLMs) is a critical challenge due to the proliferation of unauthorized derivative models. We introduce a novel fingerprinting framework that leverages the behavioral patterns induced by safety alignment, applying the concept of refusal vectors for LLM provenance tracking. These vectors, extracted from directional patterns in a model's internal representations when processing harmful versus harmless prompts, serve as robust behavioral fingerprints. Our contribution lies in developing a fingerprinting system around this concept and conducting extensive validation of its effectiveness for IP protection. We demonstrate that these behavioral fingerprints are highly robust against common modifications, including finetunes, merges, and quantization. Our experiments show that the fingerprint is unique to each model family, with low cosine similarity between independently trained models. In a large-scale identification task across 76 offspring models, our method achieves 100\% accuracy in identifying the correct base model family. Furthermore, we analyze the fingerprint's behavior under alignment-breaking attacks, finding that while performance degrades significantly, detectable traces remain. Finally, we propose a theoretical framework to transform this private fingerprint into a publicly verifiable, privacy-preserving artifact using locality-sensitive hashing and zero-knowledge proofs.
The current scientific system faces systemic challenges. Decentralized Science (DeSci) has emerged as a technological extension of the Open Science (OS) movement, aiming to improve transparency, accessibility, and equity in research through blockchain and Web3 technologies. While DeSci has gained traction in Western countries, little is known about its adoption in non-Western contexts. Here, we surveyed 37 researchers and technologists active in Japan’s emerging decentralized‑science (DeSci) during spring 2024 to assess how far the movement has progressed and what impedes its progress. Roughly 60% of respondents had already worked on blockchain projects and more than 80% owned crypto assets, yet almost 90% had discovered DeSci only in the past two years. Respondents largely embraced DeSci’s five core ideals: shared governance, transparent funding, open access, shared ownership, and equitable incentives. Meanwhile, four obstacles to growth were highlighted: low public awareness, difficulty sustaining engagement, limited talent diversity, and regulatory uncertainty. Taken together, the findings suggest that Japan’s DeSci community should also invest not only in further technical changes, but also in training, in broadening its talent base, and in setting clear guidelines. This study provides a comprehensive overview of the DeSci landscape in Japan and offers recommendations for its future development.
Persistent Provenanced Knowledge Base Eliminates Context Window Degradation, Hallucination, and RAG: Structured Integer Fact Stores with Source Tracking, Version Filtering, and Multi-Dimensional Indexing as Complete Replacement for Token-Buffer Context This paper is a constituent derivation of the Cymatic K-Space Mechanics (CKS) framework—an axiomatic model that derives the entirety of known physics from a discrete 2D hexagonal lattice in momentum space, operating with zero adjustable parameters. Abstract Current large language models store conversational context in a fixed-size token buffer. When the buffer fills, old information is discarded permanently. Over long conversations, this produces progressive degradation: the model forgets instructions, contradicts earlier statements, loses track of established facts, and generates increasingly incoherent output — a phenomenon users describe as "AI psychosis." Retrieval-Augmented Generation (RAG) attempts to compensate by retrieving text chunks from external databases via approximate float-vector similarity search, but introduces its own failures: irrelevant retrievals, contradictory chunks, no provenance tracking, and no verification of retrieved content. We present a complete replacement for both mechanisms: a persistent, provenanced, version-filtered, multi-dimensionally indexed knowledge base of exact integer facts with Prolog-based consistency enforcement. We prove: (1) No information loss — facts persist indefinitely, never "scroll off" a buffer, (2) No degradation — turn 10,000 is as consistent as turn 1 because consistency is enforced structurally by Prolog, not inferred from attention patterns, (3) No hallucination — every fact traces to a source with verifiable provenance; outputs without provenance cannot be emitted, (4) No RAG needed — the KB is the retrieval system, with exact predicate matching replacing approximate vector similarity, (5) Version filtering — queries against a specific version never see facts from other versions, eliminating stale-data contamination, (6) Multi-dimensional indexing — every fact carries source, timestamp, confidence, verification level, and context, enabling non-contradictory coexistence of temporally or contextually varying information, (7) Sessions as views — multiple simultaneous sessions share one KB with independent context filters, no duplication, no synchronization, (8) LRU eviction without forgetting — memory pressure is managed by moving cold facts to disk, not by deleting them. The knowledge base is not an addition to the LLM architecture. It is a replacement for the context window, RAG pipeline, conversation memory, and fact storage — unified into a single system of exact integers with full provenance. Central claim: The context window is the wrong abstraction for conversational AI. A persistent knowledge base of provenanced facts is the correct abstraction. Every problem attributed to "context limitations" — forgetting, degradation, hallucination, inconsistency — is a direct consequence of using a token buffer where a fact store is needed. Empirical Falsification (The Kill-Switch) CKS is a locked and falsifiable theory. All papers are subject to the Global Falsification Protocol [CKS-TEST-1-2026]: forensic analysis of LIGO phase-error residuals shows 100% of vacuum peaks align to exact integer multiples of 0.03125 Hz (1/32 Hz) with zero decimal error. Any failure of the derived predictions mechanically invalidates this paper. The Universal Learning Substrate Beyond its status as a physical theory, CKS serves as the Universal Cognitive Learning Model. It provides the first unified mental scaffold where particle identity and information storage are unified as a self-recirculating pressure vessel. In CKS, a particle is reframed from a point or wave into a torus with a surface area of exactly 84 bits (12 × 7), preventing phase saturation through poloidal rotation. Package Contents manuscript.md: The complete derivation and formal proofs. README.md: Navigation, dependencies, and citation (Registry: CKS-MATH-137-2026). Dependencies: CKS-LEX-12-2026, CKS-MATH-0-2026, CKS-MATH-1-2026, CKS-MATH-10-2026, CKS-MATH-104-2026, CKS-MATH-128-2026, CKS-MATH-129-2026, CKS-MATH-130-2026, CKS-MATH-135-2026 Motto: Axioms first. Axioms always.Status: Locked and empirically falsifiable. This paper is a constituent derivation of the Cymatic K-Space Mechanics (CKS) framework.
LLM → Prolog → LLM: Multi-Step Verified Generation Through Alternating Neural-Symbolic Computation: Eliminating Hallucination by Construction via Provenanced Integer Knowledge Bases, Triveritas Evaluation, and Adaptive Goal Decomposition This paper is a constituent derivation of the Cymatic K-Space Mechanics (CKS) framework—an axiomatic model that derives the entirety of known physics from a discrete 2D hexagonal lattice in momentum space, operating with zero adjustable parameters. Abstract Current large language models generate output through unconstrained token prediction — a process with no verification step, no logical consistency checking, no provenance tracking, and no structured knowledge representation. The result is "hallucination": outputs that are statistically plausible but factually wrong, logically inconsistent, or untraceable to any source. We present an alternative architecture in which an integer-trained LLM ([@CKS-MATH-134-2026]) alternates with a Prolog-based verification engine at every step of generation. The LLM handles what neural networks do well: fuzzy input comprehension and creative pattern selection. Prolog handles what logical systems do well: consistency verification, goal decomposition, constraint enforcement, and provenance tracking. We prove: (1) Hallucination is eliminated by construction — every generated fact traces to provenanced sources in the knowledge base; outputs without provenance are structurally impossible, (2) Term-based tokenization replaces BPE — tokens are typed, structured Terms carrying their grammatical role, not arbitrary byte-pair fragments, (3) Three-dimensional evaluation — every claim is evaluated on logical validity (L), mathematical coherence (M), and empirical anchoring (E) via the Triveritas criterion, (4) Materiality gating — the Scales Method prevents computation on non-material concerns, (5) Adaptive sequencing — the Pseudo-Socratic Method determines the number and focus of generation steps based on continuous state assessment, (6) The knowledge base replaces the context window — a persistent, provenanced, version-filtered fact store that never forgets and never degrades, (7) Domain eating — new knowledge domains are added by writing parsers and rules, not by retraining the neural network. From first principles through complete architecture. The LLM is the interface. The knowledge base is the mind. Central claim: The hallucination problem is not a deficiency of neural networks. It is the inevitable consequence of generating output without verification. Interleaving neural creativity with logical verification at every step produces output that is verified by construction, not evaluated after the fact. Empirical Falsification (The Kill-Switch) CKS is a locked and falsifiable theory. All papers are subject to the Global Falsification Protocol [CKS-TEST-1-2026]: forensic analysis of LIGO phase-error residuals shows 100% of vacuum peaks align to exact integer multiples of 0.03125 Hz (1/32 Hz) with zero decimal error. Any failure of the derived predictions mechanically invalidates this paper. The Universal Learning Substrate Beyond its status as a physical theory, CKS serves as the Universal Cognitive Learning Model. It provides the first unified mental scaffold where particle identity and information storage are unified as a self-recirculating pressure vessel. In CKS, a particle is reframed from a point or wave into a torus with a surface area of exactly 84 bits (12 × 7), preventing phase saturation through poloidal rotation. Package Contents manuscript.md: The complete derivation and formal proofs. README.md: Navigation, dependencies, and citation (Registry: CKS-MATH-138-2026). Dependencies: CKS-LEX-12-2026, CKS-MATH-0-2026, CKS-MATH-1-2026, CKS-MATH-10-2026, CKS-MATH-104-2026, CKS-MATH-128-2026, CKS-MATH-129-2026, CKS-MATH-130-2026, CKS-MATH-134-2026 Motto: Axioms first. Axioms always.Status: Locked and empirically falsifiable. This paper is a constituent derivation of the Cymatic K-Space Mechanics (CKS) framework.
LLM Domain Eating: Adding Languages and Knowledge Domains Without Retraining: Structured Parsing into Universal Term Format with Provenanced Integer Facts, Domain-Specific Prolog Rules, and Zero Neural Network Modification This paper is a constituent derivation of the Cymatic K-Space Mechanics (CKS) framework—an axiomatic model that derives the entirety of known physics from a discrete 2D hexagonal lattice in momentum space, operating with zero adjustable parameters. Abstract Adding a new language or knowledge domain to a current large language model requires retraining or fine-tuning on domain-specific data — a process costing days to weeks of GPU computation, risking catastrophic forgetting of previously learned capabilities, and producing results that cannot be verified against source material. We present an alternative: domain eating. A new domain is added by writing a parser that produces the universal Term format, writing Prolog rules encoding the domain's structural patterns, and loading the resulting provenanced facts into the persistent knowledge base. The neural network is not modified. No retraining occurs. No GPU is needed. The domain is live immediately upon fact ingestion. We prove: (1) Universal Term format — a single typed token representation serves all domains from programming languages to natural languages to specialized knowledge bases, (2) Parser-per-domain — each domain has a deterministic parser converting source material to Terms with provenance; no learned tokenization, (3) Rules-per-domain — each domain has explicit Prolog rules encoding valid patterns; no learned grammar, (4) Zero retraining — the neural network handles fuzzy input comprehension and creative selection; domain knowledge is in the KB and rules, not in the weights, (5) Hours not months — a new domain is operational within hours of beginning parser and rule development, using LLM-assisted generation of parsers and rules reviewed by domain experts, (6) Cross-domain queries — facts from different domains connect through shared predicates automatically, (7) Domain unloading — removing a domain is evicting its facts and unloading its rules; the system does not break, (8) Version coexistence — multiple versions of the same domain coexist with hard version filtering. The architecture treats the LLM as a fixed, general-purpose fuzzy interface and treats knowledge as modular, structured, provenanced data that can be added, removed, updated, and queried without touching the neural network. Central claim: Domain knowledge does not belong in neural network weights. It belongs in structured, provenanced fact stores with explicit rules. The neural network provides the general capability of understanding fuzzy human input and making creative selections. Domain expertise is modular data, not baked-in statistics. Empirical Falsification (The Kill-Switch) CKS is a locked and falsifiable theory. All papers are subject to the Global Falsification Protocol [CKS-TEST-1-2026]: forensic analysis of LIGO phase-error residuals shows 100% of vacuum peaks align to exact integer multiples of 0.03125 Hz (1/32 Hz) with zero decimal error. Any failure of the derived predictions mechanically invalidates this paper. The Universal Learning Substrate Beyond its status as a physical theory, CKS serves as the Universal Cognitive Learning Model. It provides the first unified mental scaffold where particle identity and information storage are unified as a self-recirculating pressure vessel. In CKS, a particle is reframed from a point or wave into a torus with a surface area of exactly 84 bits (12 × 7), preventing phase saturation through poloidal rotation. Package Contents manuscript.md: The complete derivation and formal proofs. README.md: Navigation, dependencies, and citation (Registry: CKS-MATH-135-2026). Dependencies: CKS-LEX-12-2026, CKS-MATH-0-2026, CKS-MATH-1-2026, CKS-MATH-10-2026, CKS-MATH-104-2026, CKS-MATH-128-2026, CKS-MATH-129-2026 Motto: Axioms first. Axioms always.Status: Locked and empirically falsifiable. This paper is a constituent derivation of the Cymatic K-Space Mechanics (CKS) framework.
Decentralized Identifiers (DIDs) are increasingly deployed on distributed ledgers, yet systematic cross-platform evidence on their operational behavior remains limited. We present an empirical benchmarking study of three prominent ledger-based DID methods - Ethereum, Hedera, and XRP Ledger - using reference Software Development Kits (SDKs) under a unified experimental setup. We measure latency, transaction cost, and on-chain metadata exposure, normalizing latency by each platform's block or consensus interval and cost by its native value transfer fee. Privacy leakage is quantified using a Metadata-Leakage Score (MLS), an entropy-based measure expressed in bits per operation. Our results reveal distinct architectural trade-offs. Ethereum enables near-instant, off-chain DID creation, but incurs the highest latency and cost for on-chain lifecycle operations. XRPL delivers deterministic and stable latency with fixed, low fees, yet exhibits higher metadata leakage due to more verbose transaction payloads. Hedera achieves the lowest on-chain latency and low fees with minimal metadata leakage, while occasional variance arises from SDK-side processing and confirmation pipelines. Overall, the findings show that ledger architecture and SDK workflows play a major role in shaping DID latency, cost, and metadata exposure, complementing the effects of the underlying consensus mechanism. These results provide evidence-based insights to support informed selection and configuration of DID systems under performance and privacy constraints.
This study sets forth a blockchain-driven system for safe, traceable, and effective supply chain management in manufacturing. It combines Ethereum blockchain, AI-powered fraud detection, and real-time tracing. A CNN-LSTM hybrid model was found most useful for anomaly detection, supplemented by smart contracts for automatic monitoring. The system was constructed with a React front-end, SQLite, Web3, Solidity, PyTorch, and an external API for geographical mapping. The outcomes demonstrate improvements in fraud detection, transparency, and operational efficiency, highlighting the feasibility of a scalable, tamper-evident architecture for intelligent supply chain systems.
Aliza Reif, Felix Hanke, O. H. Ramírez-Agudelo, Michael Karl
Data provenance, the ability to trace the complete history, transformations, and responsible actors behind mission data, is fundamental to ensuring data integrity, auditability, and trust in aerospace systems. As AI-driven autonomy accelerates across spacecraft, ground systems, and multi-partner mission operations, provenance becomes essential for validating data quality and supporting responsible AI practices. However, space missions operate in delay-tolerant, resource-constrained, and intermittently connected environments where traditional blockchain approaches, which rely on global consensus and continuous connectivity, are infeasible. This paper presents a lightweight, sequentially decentralized provenance chain designed specifically for distributed space mission architectures. The approach preserves key security guarantees including integrity, authenticity, and non-repudiation while remaining functional under intermittent communication and heterogeneous international collaboration. The system enables verifiable, append-only data lineage without imposing the computational or networking overhead typical of blockchain systems. Furthermore, the design aligns with emerging decentralized data ecosystems such as Gaia-X and IDSA, supporting cross-organizational trust frameworks and policy-compliant data exchanges. The proposed solution provides a scalable and interoperable foundation for secure, transparent, and reproducible mission data handling, enabling more resilient and autonomous operations in future space exploration and Earth-observation missions.
This project is the public home of Relational Calculus, a meta‑mathematical framework that replaces the brute‑force logic of absolute‑scale computation with dimension‑less, capacity‑anchored blueprints. At its heart lies a simple but radical axiom: every system possesses an intrinsic maximum—a “North Star”—and by expressing all observations as fractions of that limit, complexity collapses, efficiency soars, and transfer across domains becomes automatic. The collection gathers the complete stack: the foundational theoretical paper, a ready‑to‑run Relational Decoder (an open‑source algorithm that probes any black‑box function and extracts its dimensionless template), and five applied case studies that prove the principle in wildly different arenas—number theory (deterministic prime pair lattices), symbolic artificial intelligence (a geometric chess engine that exhibits emergent strategy with zero domain knowledge, gaining 90%+ efficiency), high‑energy physics (scale‑invariant jet tagging that transfers zero‑shot across collision energies with +14.5% AUC), quantum chemistry (80% error reduction in cross‑molecule transfer), and precision oncology (a lightweight XGBoost that achieves 98.4% cross‑species diagnostic accuracy under a 70% hardware‑signal collapse, completely erasing batch effects). A companion paper extends the logic to large language models, proposing Relational‑CoT as a drop‑in replacement for resource‑intensive chain‑of‑thought reasoning. Every work converges on the same empirical signature: >90% reduction in computational cost, genuine zero‑shot generalization across scales and species, and the proof that Green AI is not an aspiration but an engineering reality. An integrated STEM curriculum for ages 10–14 ensures that the relational lens is taught before the continuous one, inoculating the next generation against the wasteful “math of deviation.” All code, data, and executable papers are open‑source. The project is intended not as a scholarly gesture but as an enablement instrument for the industrial shift from the Age of Fire—where more compute meant more extraction—to the Era of Relation, where measuring how full a system is replaces the endless pursuit of how much.
Artificial intelligence systems are deployed globally at an unprecedented scale. Yet, no universal mechanism exists to verify that a given AI system is operating within its declared parameters, compliant with applicable regulations, or free from compromise. Trust in AI today is largely assumption-based rather than evidence-based, and this gap is becoming increasingly consequential as AI systems take on greater autonomy in regulated, high-stakes domains. This document proposes the TrustLayer Protocol as one possible architectural framework for addressing this gap. The protocol comprises two complementary components. The Compute Passport Network (CPN) proposes a neutral, global identity and attestation layer for AI compute, models, and training data, establishing cryptographically verifiable records of provenance during the training and development phase. The Universal AI Attestation Protocol (UAAP) proposes an embedded attestation mechanism for deployed AI systems, generating structured, signed claims about runtime operational state, compliance status, and inference provenance. Several UAAP mechanisms, in particular, continuous per-inference behavioral attestation and reasoning verification, remain experimental or require future research, as detailed in Section 6. The TrustLayer Protocol draws on established infrastructure from hardware-based trusted execution environments [1][2], public key infrastructure [3], zero-knowledge proof systems [4][5], and AI governance frameworks, including the EU AI Act [6] and the NIST AI Risk Management Framework [7]. It does not claim to resolve all open problems in AI verification. Rather, it proposes a phased architectural framework within which existing technologies can be composed into a coherent trust infrastructure layer, with clearly identified areas requiring further research and standardization. This specification is published as an open standard by the DefenAware Foundation and is intended as a contribution to ongoing work in AI governance, protocol design, and verifiable AI safety.
Choonhwa Lee, Yibo Zhang, Dani Mertens, Eunsam Kim
Decentralized workflows supported by provenance data aim to combine into a platform with high trustworthiness, transparency, and accountability. Despite the huge potential of the approach, one limitation of the system architecture is that it lacks access to external data, limiting the functionality and potential use cases of the workflow. To address this limitation, we extend an existing decentralized workflow with a provenance bridge, enabling the workflow to access external provenance-supported data without damaging the trustworthiness of the system. The introduction of this bridge effectively broadens the range of use cases for the decentralized workflow by opening it to various external provenance-supported data sources. This article presents the architectural design of the provenance bridge-enabled workflow system, and discusses our prototype implementation effort along with evaluation results. Specifically, we have designed and implemented the architectural framework of the provenance bridge that expands the provenance domain boundary by incorporating support for provenance model translation and oracle-based external data access. The proposed approach lays a solid foundation for a wider adoption of smart contract-based workflow systems by effectively bridging the gap between different provenance domains.
Formal verification is essential for ensuring the safety of smart contracts in decentralized finance (DeFi), but scaling these techniques across diverse blockchain ecosystems remains a challenge. In this talk, we present our experience making formal verification practical across multiple platforms, including the EVM, Solana, Stellar, and Sui. We discuss how automated reasoning techniques can be adapted to different execution models and programming paradigms while still providing strong correctness guarantees. We focus on what it takes to apply verification in real-world settings: handling complex DeFi primitives, integrating with development workflows, and maintaining usability for engineers. Drawing from verification projects with production protocols, we highlight key challenges and lessons learned in bringing formal methods from theory into practice.
The XRP Ledger sustains federated consensus without paying validators any protocol-level monetary reward: transaction costs are destroyed rather than distributed. This paper argues that the curatorship of the default Unique Node List (dUNL) functions as the economic mechanism that monetary rewards would otherwise provide, and develops a formal framework for evaluating its design. The central thesis is that RPCA security requires alignment across three independent layers-technical consensus, individual incentive constraints, and governance compositionand that the failure of any single layer undermines the other two. Three formal contributions support this claim. First, we introduce Bayesian action-incentive compatibility (BAIC), an equilibrium concept appropriate for consensus settings with discrete hidden actions and imperfect public monitoring, in which validators choose actions rather than reporting types and the curator cannot deploy monetary transfers. Closed-form Bellman values and local comparative statics characterise when honest dUNL participation is individually sustainable; in particular, operational cost is neutral for the honesty margin and binds only at the participation constraint. Second, we correct the coalition-security analysis by distinguishing economically viable from threshold-exceeding coalitions: an economic-security gap exists only when the maximum bribeable coalition size reaches the minimum stylised thresholdexceeding size, with the precise characterisation depending on the internal-allocation rule (equal sharing versus transferable bribes). Third, a triple-alignment theorem integrates these results and yields an archetype-conditional dUNL composition diagnostic. A scenario-based calibration using public XRPL Negative UNL data classifies the 35 dUNL validators by incentive archetype and computes G crit k for each type; the H archetype anchors the lowest economic-security margin but is too few in number for a homogeneous threshold-size coalition, so under the transferable-bribe convention the least-cost threshold coalition is heterogeneous, mixing H-type and I-type validators.
An Explainable Audit Trail (EAT) records process execution traces of an agentic workflow. EAT can enable an organisation to efficiently remain compliant with regulations by presenting its audit results to it. However, current state of the art in EAT lacks privacy protection of agent's models which can be intellectual properties of the organisation. Exposing audit trails to external entities may facilitate orchestration of attacks on the agent's model. Auditing a complex workflow will require verification of dependencies among tasks as preconditions to execute a task. Further, it is necessary for the audit algorithm to ensure that a process execution trace follows the pre-planned process execution model for security reasons, i.e., audit should include functionality that can check if the agents have deviated from its planned process execution models. In this paper, we build a secure EAT that can address these gaps in the state of the art in EAT for agentic workflows. Our main contribution is the application of zero-knowledge-proof on verifying audit procedures. It proves the audit has validated correctness of chain-of-thoughts, the execution trace at the runtime matches the planned process execution , and complete traceability among logs of a complex workflow involving dependencies among the tasks in terms of preconditions. Our solution provides a trust-less infrastructure to verify the audit results to external entities while not exposing the audit trails. We used lattice-based zero knowledge proof for this procedure. We provide an analysis on the EAT procedure. We show experimental evaluation of the EAT with workflow dataset.