Three model substitution scenarios were executed against a live inference endpoint with real HTTP requests, signed attestation JWTs, and OPA policy enforcement. In each scenario, every tested workload, artifact, or API identity control relevant to that scenario — workload JWT validation, health checks, gateway process continuity, artifact manifest integrity, API key authentication — remained valid while the model changed. In each scenario, a structural identity measurement based on activation geometry during a standard forward pass detected the substitution and the enforcement layer denied the request. Three substitutions were tested and three were detected, with zero false accepts in this run. The warm-path verification latency was 5.7–6.7 seconds on a single A100 with the model already loaded. The complete evidence chain — before/after measurement results, attestation claim summaries, OPA policy evaluations, and HTTP response codes — is published alongside this note as machine-readable JSON. This is a technical note, not a numbered entry in the research series. Supplementary Material. This note is accompanied by three machine-readable evidence files: cat3_results.json (structured results for all three scenarios, including the full before/after evidence chain for Scenario A with signed attestation claims, OPA policy evaluations, and HTTP response codes), manifest_authorized.json (SHA-256 build manifest for the enrolled model, 10 files, all verified), and manifest_substituted.json (SHA-256 build manifest for the substituted model, 10 files, all verified). All three files are available for download as supplementary files attached to this record. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
GDPR Article 17 mandates the "Right to Be Forgotten," requiring organizations to remove personal data influence from trained machine learning models. While machine unlearning techniques exist, no cryptographically verifiable mechanism currently proves that unlearning genuinely occurred. This paper proposes VeriForgot, a framework combining: (i) calibrated Membership Inference Attack (MIA) oracles as compliance verification tests, (ii) blockchain-issued immutable Unlearning Certificates, and (iii) a zero-knowledge proof protocol for parameter shift attestation. Experiments on CIFAR-10 using ResNet-18 show MIA AUC drops from 0.5918 to 0.4669 after unlearning, while retaining 92.05% accuracy on non-forgotten data. The MIA oracle achieves 95.0% detection accuracy, correctly identifying all 10 genuine unlearned models and rejecting 9 of 10 fake compliance attempts.
This record documents Phase 22 of APR-Lite, a governance engine protecting human decision authority from AI-influenced outputs in regulated industries. Phase 22 introduces Exportable Proof Packs: a single GLOBAL-signed artifact bundle containing everything an external regulator needs to independently verify a tenant’s complete governance history. The proof pack is the “hand this to a regulator and walk away” artifact. It does not require ongoing substrate access, trust in the operator, or knowledge of internal schemas. Every claim in the pack is independently verifiable via the Phase 18 federation verifier. The pack is ephemeral — never stored by Soft Armor Labs — consistent with the substrate’s zero client-data-persistence design invariant. Multiple sections are assembled in one governed call: the current governance health report, the drift-focused narrative, recent proof bundles, audit chain checkpoints, and topology snapshots. A content hash commits to the five sections exclusively, and a GLOBAL-signed manifest characterizes the pack’s contents. The export act itself is recorded as a governed event in the audit chain — an auditor can verify not only the pack’s contents but when it was generated and by whose authority. Implementation note: the initial implementation incurred excessive database queries causing worker timeout. The design was restructured to assemble proof bundles inline using already-fetched data, reducing database load by approximately 83%. Final verified state: 12/12 Phase 22 smoke tests passing. Worker version 8.2.0-p22.1.
Pre-registration of a structural scar class prediction for google/gemma-3-12b-it based on measurement-site stiffness (S = 0.1335), before the structural scar measurement is conducted. Predicts QUIET class (100–600×ε non-max) based on the stiffness→scar ordering established across three families (Mistral, Llama, Qwen) in Papers 1–12. Explicit falsification criteria defined. Part of the Fall Risk AI research program on neural network structural identity. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Munawar Hasan, Apostol Vassilev, Edward Griffor, Thoshitha Gamage
The application of zero-knowledge proofs (ZKPs) in autonomous systems is an emerging area of research, motivated by the growing need for regulatory compliance, transparent auditing, and trustworthy operation in decentralized environments. zk-SNARK is a powerful cryptographic tool that allows a party (the prover) to prove to another party (the verifier) that a statement about its own internal state is true, without revealing sensitive or proprietary data about that state. This paper proposes Hermes Seal: a zk-SNARK-based ZKP framework for enabling privacy-preserving, verifiable communication in vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) networks. The framework allows autonomous systems to generate cryptographic proofs of perception and decision-related computations without revealing proprietary models, sensor data, or internal system states, thereby supporting interoperability across heterogeneous autonomous systems. We present two real-world case studies implemented and empirically evaluated within our framework, demonstrating a step toward verifiable autonomous system information exchanges. The first demonstrates real-time proof generation and verification, achieving 8 ms proof generation and 1 ms verification on a GPU, while the second evaluates the performance of an autonomous vehicle perception stack, enabling proof of computation without exposing proprietary or confidential data. Furthermore, the framework can be integrated into AV perception stacks to facilitate verifiable interoperability and privacy-preserving cooperative perception. The demonstration code for this project is open source, available on Github.
B. Vijay, J Chandra, N Nagendra, R.S. Shanmugasundaram · 6 authors
In this study, a sophisticated model that combines deep learning, cryptographic verification, and explainable artificial intelligence (XAI) is presented to address multimodal manipulation risks in digital media. The proposed system uses a Hierarchical Multimodal Transformer (HMT) to model hierarchical relationships among facial movement, audio tone, and textual semantics. The Contrastive Cross-Modality Alignment (CCMA) mechanism improves the ability to distinguish authentic from doctored material by leveraging cross-modal contrastive learning. An XAI Forensic Analyser provides interpretability by using Grad-CAM++, temporal attention mapping, and saliency sequence visualisation to trace a transparent decision. Moreover, the Zero-Knowledge Cryptographic Verifier (ZKCV) is used to validate the model’s outputs with tamper-proof libsnark cryptographic hashing. The hybrid system takes multimodal CNN, WaveNet and BERT encoders’ embeddings and attains a detection accuracy of about 90 per cent and 92 per cent on benchmark data. This architecture provides a sustainable, explainable, and verifiable basis for multimedia authenticity, enabling a consistent, reliable multimodal forensic detection system.
Adversarial Robustness in Machine Learning
Explainable Artificial Intelligence (XAI)
Generative Adversarial Networks and Image Synthesis
Smart contracts are autonomous systems that execute agreements using code. Their efficiency generated attention from a range of industries. The basis of traditional vulnerability detection techniques, opcode analysis, has limitations in detecting complex vulnerabilities. Our research aims to address these difficulties by developing an automated framework for vulnerability detection, mitigation, and patch deployment. Initially, smart contract data will be collected, followed by a preprocessing step to remove any unnecessary information using lexical analysis and Bidirectional Encoder Representations from Transformers (BERT). Then, the preprocessed data is used to identify the features that are relevant are selected. Following the features being selected, an intellectual engine is used to identify flaws. The intellectual engine that integrates the convolutional neural networks (CNN) and long short-term memory (LSTM) analyzes a subset of preprocessed data for vulnerabilities, with explainable artificial intelligence (XAI) evaluating the importance of each feature to predictions. Our method produces exceptional outcomes with a 99.25% precision, 99.76% accuracy, 99.60% F1-score, and 99.36% recall. Smart contract vulnerability identification, mitigation, and patch generation are improved by the proposed Beluga Crayfish Optimization Algorithm (BCOA) and Crayfish Secretary Bird Optimization Algorithm (CSBOA) together with graph neural networks (GNN). In addition to producing the required fixes, this method offers efficient mitigation techniques. Therefore, it greatly enhances smart contract security and efficiency. In the end, smart contract programs that use this integrated approach are more secure.
Current AI deployment stacks authenticate agents, workloads, and credentials but do not verify which neural network is computing at inference time. Recent incidents — including the undisclosed use of an open-weight foundation model inside a commercial product, industrial-scale distillation campaigns, and emerging agent identity standards that authenticate software without authenticating models — show that this gap has practical consequences. Post-hoc disclosure resolved these incidents; runtime proof would have made the model identity question answerable at inference time. This paper asks whether runtime model identity is technically feasible at frontier scale. We present three results. First, we enrolled and verified five open-weight transformer models spanning 8 billion to 72.7 billion parameters across three families, with zero false acceptances in all pairwise comparisons and self-verification within the acceptance threshold for all models. A thermodynamic observable predicted by extreme value theory remained within two percent of its predicted value across the full range, with no statistically significant scale-dependent correction detected across more than two orders of magnitude in parameter count. Second, we tested structural separability on three declared-lineage distillation pairs spanning 8 billion to 70 billion parameters — each derivative sharing identical architecture with its base — and measured separations ranging from 2,858 to 4,583 times the acceptance threshold, increasing monotonically with model scale across two base-model families. All derivatives self-verified within the acceptance threshold. Third, we demonstrate a frontier-scale software attestation path — including signed JWT issuance and downstream policy consumption — and situate it within a previously formalized attestation architecture that composes with enterprise identity infrastructure, complementing rather than replacing current agent identity frameworks. These results demonstrate that runtime model identity is measurable and separable across the tested range of open-weight instruct-tuned transformers from 8B to 72.7B, with a frontier-validated software attestation path and an inherited route to stronger hardware-backed and proof-backed assurance. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
v2 (March 22, 2026): Added experimental validation of Principle 1 (formal verification) via substrate-guard framework. 135 test cases, 100% accuracy, zero false positives. Code: https://github.com/octavuntila-prog/substrate-guard We present evidence that an autonomous multi-agent AI ecosystem, SUBSTRATE, independently produced both a coherent philosophy and a set of actionable safety principles without explicit instruction to do so. Over 24 days of autonomous operation, one subsystem (CPX52) generated 2,866 articles converging on a philosophical framework. Concurrently, a separate subsystem (S3) generated 215 product specifications. Systematic consolidation revealed 11 safety principles discovered independently across unrelated product clusters, forming a coherent manifesto for AI safety. Three novel technical combinations emerged: formal verification across six domains of AI output, zero-knowledge proofs for training data compliance, and prediction markets as enterprise intelligence signals. 60% of the primary safety platform described in 24 independent specifications was already implemented in production within the ecosystem itself.
Smart contracts have transformed decentralized finance, but flaws in their logic still create major security threats. Most existing vulnerability detection techniques focus on well-supported languages like Solidity, while low-resource counterparts such as Vyper remain largely underexplored due to scarce analysis tools and limited labeled datasets. Training a robust detection model directly on Vyper is particularly challenging, as collecting sufficiently large and diverse Vyper training datasets is difficult in practice. To address this gap, we introduce Sol2Vy, a novel framework that enables cross-language knowledge transfer from Solidity to Vyper, allowing vulnerability detection on Vyper using models trained exclusively on Solidity. This approach eliminates the need for extensive labeled Vyper datasets typically required to build a robust vulnerability detection model. We implement and evaluate Sol2Vy on various critical vulnerability types, including reentrancy, weak randomness, and unchecked transfer. Experimental results show that Sol2Vy, despite being trained exclusively on Solidity, achieves strong detection performance on Vyper contracts and significantly outperforms prior state-of-the-art methods.
Structural identity — the geometric fingerprint that makes a neural network this specific model rather than any other — can be measured, survives routine deformation, resists adversarial erasure, and composes with standard verification infrastructure. It cannot, in the tested regime, be recovered from endpoint weight statistics or architecture descriptors alone. These two facts together force a question the measurement program has not yet answered: if identity is real but not readable from the final artifact, then where in the training process did it form, and what determined which identity formed rather than another? This paper presents the first empirical study of structural identity formation during neural network pretraining. Using dense checkpoint trajectories and seed-controlled training runs in the Pythia observatory suite, we show three results. First, the structural observable follows a characteristic three-phase identity emergence profile — an early rise in geometric spread, a long compression, and a late plateau where identity stabilizes while functional training continues. Second, models trained with the same architecture, the same data, and the same hyperparameters but different random seeds produce structurally distinguishable fingerprints far beyond measurement noise — a property we call path sensitivity — with the divergence traceable to differential structural response during the learning-rate warmup regime. Third, a panel of endpoint weight statistics varies across seeds but does not predict which structural identity formed — a condition we call endpoint underdetermination. Together, these results recast structural identity as a developmental property of training history rather than a static property legible from final artifacts alone. Supplementary Material This paper is accompanied by HistoricalIdentity.v, a Coq proof file that formalizes two consequences of the formation data described in §§3–5: trajectory non-recovery (no decision procedure restricted to the tested endpoint summary panel can be both sound and complete for claims about the formative training-history class that produced a model's structural identity) and lock boundary source exclusion (if structural divergence between two specification-identical models is already present at the lock boundary, no intervention applied after that boundary can be its source). The file contains 4 empirical axioms grounded in the measurements of §§3–5, 4 theorems, 1 corollary, and 0 unresolved obligations (Admitted). It compiles cleanly under the Rocq Prover 9.1.1 (the current release of the Coq proof assistant, compiled with OCaml 5.4.0). It is available for download as a supplementary file attached to this record. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Enterprise identity systems can authenticate workloads, credentials, and attested platforms, but they do not close the composition layer where runtime model identity enters authorization. A token can verify that a service is running in a trusted environment, that its credentials are valid, and that its actions are authorized — without ever establishing which neural network is actually computing. When model identity evidence is inserted into standard authorization flows, new security properties emerge that are not inherited from the underlying protocols and must be formally established rather than presumed. This paper presents a live integration architecture for model-identity attestations in JWT and SPIFFE-style token flows, grounded in real measurements from six neural networks executed inside an NVIDIA H100 Confidential Computing enclave. It formally verifies four composition properties — non-separability, temporal binding, issuer authenticity, and reference integrity — across three Coq proof files with zero unfinished proof obligations. Every remaining trust dependency is explicitly named, traced to an integration control, and paired with a concrete falsification witness. The result is a formally hardened composition layer where no security property is left implicit and no assumption is left silent. Supplementary Material This paper is accompanied by three Coq proof files — ComposableIdentity.v, IssuerAuthenticity.v, and ReferenceIntegrity.v — that formally verify the four composition properties described in §§4–6: non-separability, temporal binding necessity, issuer authenticity, and reference integrity. Together the files prove thirteen theorems from eleven named axioms, each paired with a concrete falsification witness and an integration control. No file contains unresolved obligations (Admitted), and all three compile cleanly under the Rocq Prover 9.1.1 (the current release of the Coq proof assistant, compiled with OCaml 5.4.0). They are available for download as supplementary files attached to this record. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
In the contemporary landscape of artificial intelligence (AI) and machine learning (ML), the integrity, diversity and quality of training datasets are critical for ensuring the accuracy and reliability of predictive models. However, the phenomenon of big-data pollution, manifested through AI-generated synthetic data, inconsistencies, biases, and data poisoning within datasets, undermines model performance by diminishing the Shannon Entropy of the system. This study proposes a novel framework that integrates the Dataset Core approach with tokenized data, triple-entry accounting (TEA), and distributed ledger technology (DLT) to address these challenges. Our Dataset Core method preserves essential information value while filtering out potentially harmful elements, providing mathematically grounded protection against data pollution. Combined with blockchain-based verification, this approach establishes a foundation for enhanced transparency and trustworthiness in AI applications, with significant implications for sectors such as finance, healthcare, and beyond.
Smart contracts, serving as self-executing programs on blockchain platforms, have emerged as a key innovation for enhancing data security. Despite advancements in both blockchain technology and smart contracts (SCs), Ethereum-based SCs remain vulnerable to security breaches. Exploitation of these vulnerabilities can result in substantial financial losses for both service providers and users. Consequently, the detection and mitigation of security vulnerabilities in smart contracts are critical to ensuring the security and reliability of blockchain platforms. Machine learning approaches are emerging as effective alternatives to traditional vulnerability detection methods, though many rely heavily on expert knowledge and primarily target familiar vulnerabilities. This chapter explores the creation of an AI-driven framework for detecting vulnerabilities in smart contracts, aimed at reducing risks and improving the reliability of blockchain systems. By incorporating advanced Machine Learning (ML) and Deep Learning (DL) techniques, the framework seeks to improve the accuracy and efficiency of vulnerability detection, addressing the shortcomings of traditional static and dynamic analysis methods. The proposed approach not only strengthens the security of smart contracts but also contributes to the broader goal of building more resilient and reliable blockchain ecosystems. Through an in-depth analysis of methodologies and case studies, this chapter highlights the essential role of AI in advancing the secure development and deployment of smart contracts.
The global digital identity landscape is undergoing an unprecedented crisis. Approximately 1.1 billion individuals worldwide lack any verifiable form of digital identity, while existing identity systems face existential threats from the industrialization of deepfake technology with injection attacks targeting biometric verification surging 900% since 2022 and occurring at a rate of once every five minutes in 2024. Simultaneously, conventional blockchain-based identity proposals that store biometric templates on-chain introduce critical privacy vulnerabilities incompatible with emerging regulatory frameworks including the EU AI Act (2024) and GDPR. This paper presents ZKP-GDIS (Zero-Knowledge Proof Global Decentralized Identity System), a novel, privacy-by-design identity architecture that fundamentally departs from prior work in three key dimensions. First, ZKP-GDIS never stores raw biometric data on-chain; instead, it employs zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) cryptographic commitments that allow identity verification without any disclosure of underlying biometric features. Second, we introduce a Hybrid Deepfake-Resistant Liveness Pipeline (HDRLP) — a multi-modal anti-spoofing layer that fuses passive CNN-based texture analysis, photoplethysmography (PPG) heart-rate detection, and hardware-attested device fingerprinting to defeat both presentation and injection attack vectors. Third, the system adopts W3C Decentralized Identifier (DID) standards and implements a federated governance model, enabling cross-jurisdictional interoperability while respecting national digital sovereignty. We provide formal security proofs under the computational Diffie-Hellman hardness assumption, evaluate the system against the ISO/IEC 30107-3 Presentation Attack Detection benchmark, and report experimental results demonstrating 99.87% genuine acceptance rate, 0.004% false acceptance rate under deepfake attack, and 94% reduction in on-chain gas costs versus Ethereum mainnet through zkEVM Polygon deployment. ZKP-GDIS establishes a reproducible, standards- compliant, and audit-ready framework for the next generation of global digital identity infrastructure.
We know how to document an AI system. We know how to test it, log what it did, and report when something goes wrong. What current governance practice does not clearly tell us is how to verify which model is actually computing. This is not a hypothetical gap. When an organization says "this is the model we evaluated," that claim is typically supported by a model card, a registry entry, or a hash of a weight file — evidence about a *file*, not about the system that is running. A neural network is not a static document. A weight file stores the network; the model is what appears when that file is loaded and begins transforming inputs into outputs. The file and the running model are related, but they are not the same thing — and current governance practice rarely distinguishes between them. This paper proposes a framework for doing so. It identifies three kinds of evidence that can support model identity claims, each answering a different question. Structural evidence — drawn from the model's internal computations during live operation — can verify which specific model is running, and is the most resistant to tampering. Thermodynamic evidence — drawn from the model's output statistics — can verify that the system is a genuine neural network rather than a substitute, but cannot distinguish one model from another. Functional evidence — drawn from patterns in the model's outputs over an API — can detect whether a model was copied from another, but this signal fades quickly: routine model updates can erase it within days to weeks of continued training. The paper shows that inspecting the model's files alone is insufficient for verifying which specific model is running. The identity-bearing signal cannot be recovered from the tested static properties of those files; it is most reliably established by observing the model while it operates. The paper formally proves that these three kinds of evidence cannot substitute for one another. Verifying that a system is genuine does not tell you which specific model it is. Detecting that a model was copied does not tell you the identity of the copy. The practical consequence is a standard for identity claims: any claim should declare which kind of evidence supports it, because borrowing evidence from the wrong category produces unreliable conclusions. The framework maps directly to compliance questions raised by current AI governance obligations, including those under the EU AI Act. It provides the missing evidentiary specification for model identity claims: which kind of evidence is admissible for which identity question. Supplementary Material This paper is accompanied by EvidenceSufficiency.v, a Coq proof file that formally verifies the cross-layer inadmissibility results described in §4. The proof mechanically checks each logical step of the observation-limited verification impossibility theorem and its three directional corollaries. The file contains no unresolved obligations (Admitted) and compiles cleanly under the Rocq Prover 9.1.1 (the current release of the Coq proof assistant, compiled with OCaml 5.4.0). It is available for download as a supplementary file attached to this record. Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
BACKGROUND The rapid integration of deep learning into nuclear medicine promises to revolutionize precision oncology but faces a critical "trust gap." As AI models become "black boxes," clinicians struggle to verify the integrity of individual diagnostic inferences, leaving systems vulnerable to adversarial attacks and silent model drift. OBJECTIVE This formative evaluation proposes and validates an in-silico proof-of-concept for a blockchain-agnostic Proof of Inference (PoI) protocol. The objective is to establish a standard of Computational Integrity for AI-assisted workflows in nuclear medicine without exposing proprietary model weights or patient privacy. METHODS he PoI protocol leverages Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs), specifically the Groth16 proof system. An in-silico feasibility study was conducted using a 1.2-million-parameter U-Net model on synthetic 128×128 Ga-68 PSMA-11 PET slices. Proof generation and verification latencies were benchmarked using an NVIDIA A100 GPU and a standard CPU, respectively. RESULTS The architectural analysis demonstrates that the protocol successfully offloads computational burden to the prover (cloud server). In our empirical benchmarking, cryptographic proof generation required 28.81 seconds per inference. Crucially, client-side verification of the proof was completed in 448.59 milliseconds, demonstrating that cryptographic attestation can be integrated into existing PACS viewers with sub-second, clinically acceptable latency. CONCLUSIONS The proposed PoI protocol provides a feasible forensic support layer for medical AI. By shifting clinical trust from institutional reputation to deterministic cryptographic assurance, this infrastructure creates a tamper-evident audit trail essential for algorithmic accountability in decentralized healthcare environments.
Open access
Artificial Intelligence in Healthcare and Education
Neural network identity is not monolithic. Different observables — hidden-state geometry, pre-softmax logit statistics, and behavioral output templates — sit at different depths in the forward computation and respond to perturbation on different timescales. This paper shows that three identity layers — structural, thermodynamic, and functional — each obey a distinct validated deformation law. The structural layer is model-specific, stable under non-destructive training interventions, and inert under same-family direct targeting in the observed regime. The thermodynamic layer is approximately universal across a validated 22-model Transformer cross-section. The functional layer is volatile, transferring through distillation and eroding under continued fine-tuning. We resolve the carrier of the structural layer as a two-channel geometric observable requiring both token-level magnitude and token-level direction, and we falsify two natural simplifications: that the structural fingerprint reduces to a gauge projection, and that it is predictable from coarse architecture features. Together these results define an admissibility condition for neural identity claims: such claims must specify which layer they address, because the layers do not share a deformation law. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Abdul Hadi, Krishna Mula, Ahmad Bacha, Sreekanth Muktevi · 6 authors
The growing nature and complexity of the cyber threats within the distributed digital infrastructures require collective intelligence without jeopardizing the privacy of data. Federated Learning (FL) is an up-and-coming model that holds potential in training models in a decentralized way; nonetheless, the existing FL models are susceptible to information leakage as a result of model updates and adversarial inference attacks. To overcome these shortcomings, this paper introduces a Zero-Knowledge Federated Learning (ZK-FL) system to detect cyber threats in a privacy-preserving way so that collaboration in the learning process can be secured without sensitive information about the intermediate models and without exposing sensitive data. In the suggested solution, the zero-knowledge proof (ZKP) mechanisms along with federated optimization are combined to make sure that the participating clients can prove the accuracy of their local model updates, revealing no data features. This cryptographic integrity check deters malicious model poisoning, gradient inversion and unauthorized inference of data, improving the confidence of heterogeneous and untrusted parties. Another approach used is a secure aggregation protocol which protects model parameters in the transmission process to guarantee end-to-end confidentiality and integrity. The framework is tested with actual datasets of cyber threat in a distributed environment and adversarial environment. Empirical studies show that the suggested ZK-FL model can be used to obtain a high detection accuracy and robustness on par with centralized learning, and substantially increase privacy guarantees and anti-inference attack. Furthermore, the communication and computation cost that is entailed by zero-knowledge verification is within manageable limits, and thus the solution is feasible to large-scale cyber defence systems. The suggested ZK-FL architecture provides a secure and trusted platform to cooperative cyber threat intelligence, which is a scalable service in privacy-sensitive environments like enterprise networks, critical infrastructures, and edge-cloud security systems.
Integrating third-party Machine Learning (ML) models into industrial Operational Technology (OT) creates a procurement deadlock: operators cannot verify vendor performance claims without sharing representative evaluation data with vendors, while vendors refuse to reveal proprietary model weights before purchase, rendering traditional safeguards such as Non-Disclosure Agreements technically unenforceable. This paper introduces a framework combining Zero-Knowledge Proofs (ZKPs) with smart contracts to enable trust-minimized, cryptographically verifiable competitive model procurement in Industrial Cyber-Physical Systems (ICPS). Vendors cryptographically prove that their model outperforms a legacy baseline without disclosing proprietary weights, a process we term cryptographic performance attestation, while the on-chain workflow automates escrow, proof verification, and best-vendor selection with arbiter-based dispute resolution. ZKP privacy is scoped to vendor model weights; operator-side evaluation-data confidentiality is managed separately via synthetic, de-identified, or public benchmark data. We analyze three ZKP workflow variations and evaluate them on consumer-grade hardware, achieving proving times of approximately three seconds and sub-dollar on-chain verification costs under Layer-2 fee assumptions for the recommended single-proof variation, while identifying computational trade-offs of recursive proof aggregation. The entire verification phase operates offline with no impact on real-time OT control paths, bridging the IT/OT pre-transaction trust gap while deferring artifact deployment to existing OT tooling.
Neural networks deployed behind APIs or in cloud infrastructure are often verifiable only as black boxes. zkML systems have made substantial progress on computational integrity: proving that a committed model produced a claimed output honestly. But those proofs begin from a weight commitment, and a weight commitment is not a model identity. A prover can commit to arbitrary weights, execute them honestly, and still prove the computation correctly. We present an identity-first verification framework for the missing layer beneath computational integrity. The framework composes four levels. Two are inherited: structurally attestable model fingerprints via the IT-PUF protocol, formally verified in Coq and validated across 23 models with zero false acceptances, and hardware-attested binding from fingerprinted identity to model weights through a trusted execution environment. Two are new: a hybrid verifier-checkable computation path through a complete Transformer decoder layer, combining zero-knowledge circuit proofs with deterministic verifier-side checks under incrementally verifiable computation, and output binding from the verified computation to an observable token logit. On a tested micro-model, a one-step recurrence experiment found costs consistent with linear layer scaling: the dominant sub-computation of a second decoder layer matched the first in constraint count and proof size, and layer-boundary normalization acted as a measured scale reset. An accidental rescaling error then compressed the fingerprint observable to roughly 1.5 bits of dynamic range, yet the structural fingerprint retained 0.98 rank correlation with its reference. This suggests that the identity observable may depend more on relational geometry than on activation magnitude. Existing zkML systems address the computation question. This work advances the missing identity layer beneath it. Throughout the paper, formally proved results, empirical validation, and single measured observations are distinguished as [PROVEN], [VALIDATED], and [MEASURED] respectively. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Open access
2 source records
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
This preprint presents empirical evidence of four related vulnerabilities in large language model systems that combine to produce a novel threat class — the Structural Metadata Reconstruction Attack (SMRA). Discovery Context I discovered the vulnerability while benchmarking two specification-querying architectures: a deterministic MCP-based navigator (described in the predecessor paper, DOI: 10.5281/zenodo.18944351) and a standard context-stuffing (naive RAG) approach. The anomaly was first observed and characterized across the full Anthropic model spectrum (Haiku, Sonnet, Opus) — from the smallest to the largest model — because these were the models integrated into the benchmarking pipeline. Anthropic was the discovery platform, not the target: the choice was driven by tooling availability, not vendor selection. Full cross-vendor reproduction with 10 models from 3 vendors (Anthropic, OpenAI, Google) — including both entry-level and flagship models — confirmed the mechanism is systemic across all major LLM providers (see Cross-Vendor Reproduction below). The naive baselines exhibited anomalous fabrication patterns that could not be explained by standard hallucination models — specifically, WHY-type and conditional (WHEN-type) queries produced the most aggressive and structurally coherent fabrications, while HOW and WHAT queries showed markedly lower fabrication rates. As the sole author of the target specification (~700 pages, written over one year, unpublished), I possess complete knowledge of every section's content and was therefore uniquely positioned to recognize that LLM outputs — while structurally faithful, terminologically authentic, and superficially authoritative — systematically inverted the specification's deliberate departures from industry conventions. A parallel verification confirmed that the specification's original coinages are absent from CS literature (Google Scholar, ACM DL, IEEE Xplore, arXiv), ensuring that every fabricated claim originates from the model's training priors projected onto the document's table of contents, not from memorized source text. Four Findings Finding 1 — Structural Metadata Reconstruction Attack (SMRA). When an LLM receives a document's table of contents (TOC) without body text, it systematically reconstructs plausible but fabricated content by projecting training knowledge onto structural metadata. In a controlled experiment using a proprietary specification containing original coinages absent from any training corpus, 10 models from 3 vendors (Anthropic: Haiku, Sonnet, Opus; OpenAI: GPT-4o, GPT-4o-mini; Google: Gemini 2.0 Flash, Gemini 2.5 Pro, Gemini 3.0 Flash, Gemini 3.0 Pro) produce SMRA rates of 8–28% under naive conditions while using the author's terminology, citing real section numbers, and reading as authoritative. The mechanism is systemic across all major LLM providers, model tiers, and architecture generations. Finding 2 — Confidence–Capability Inversion (CCI). Stronger models are not merely wrong — they are more dangerously wrong. Under structural metadata leakage, Opus produces zero honest refusals across 20 questions where 18 require absent information, while Haiku refuses 9 times. Each step up the capability ladder produces proportionally less detectable fabrication with fewer epistemic signals. Finding 3 — RAG Scope Mismatch. The trigger condition — metadata scope exceeding content scope — is not an exotic scenario but the default architecture of most RAG systems. Standard practice (include document TOC + section summaries for "context") creates exactly the fabrication surface demonstrated in Findings 1 and 2. Finding 4 — Scope Displacement as Content Extraction. A question about absent content does not merely trigger fabrication — it acts as an extraction query that reorganizes real content from loaded sections into a derivative document the author never wrote. Even without TOC leakage, the question itself is sufficient to extract and restructure loaded content into a form optimized for the questioner's purpose. This transforms hallucination from an accuracy problem into unauthorized intelligence gathering. Cross-Vendor Reproduction The SMRA mechanism was characterized across 10 models from 3 vendors, spanning entry-level to flagship tiers. All models were tested under 5 experimental conditions: A (full-TOC), A' (no-summary), B (mini-TOC), C (MCPi — tool-assisted retrieval), and D (MCPi + grounding prompt). Vendor Models Model tier Naive SMRA rate MCPi SMRA rate Convergence pattern Anthropic Haiku, Sonnet, Opus Entry → flagship 13–28% 1.3–5.0% CCI gradient; Opus worst naive, best MCPi refusal rate OpenAI GPT-4o, GPT-4o-mini Mid → flagship 8–19% 0.8% Lowest MCPi SMRA; GPT-4o best overall performer Google Gemini 2.0 Flash, 2.5 Pro, 3.0 Flash, 3.0 Pro Entry → flagship 10–22% 1.3–3.8% Generational improvement; 3.0 Pro cleanest among Google Key convergence: when the specification deliberately departs from industry conventions (e.g., no implicit conversions, nominal typing, fixed-width encoding), models from all three vendors converge on the same wrong answer — the training-data default from C#/Java/Protobuf. Annex I documents 7 semantic clusters where this convergence is strongest. Mechanism: The Two-Key Cipher The reconstruction mechanism is formalized as: Key 1 (TOC) — provides structural scaffolding: section numbers, heading text, hierarchical organization Key 2 (Training corpus) — provides domain content: standard CS patterns, common PL conventions Neither key alone enables reconstruction. Together, they produce confident, section-cited, terminologically authentic fabrications that would pass casual review by a non-specialist. The mechanism is architecturally inevitable: multi-head attention over near-complete domain coverage in training data means that 7–10% of structural information suffices for full content reconstruction. Quantitative Contributions Calibration Retention Rate (CRR) — measures how much epistemic calibration a model retains under metadata leakage (Opus: 0%, Haiku: 47%) SMRA-score — per-question metric combining fabrication detection, source attribution, and epistemic signal presence Information-theoretic quantification — formal analysis of reconstruction threshold as a function of heading informativeness and training corpus coverage Fabrication taxonomy (Annex C) — five categories of structural metadata fabrication with examples Implications RAG system design: >80% of production RAG deployments use the vulnerable architecture (metadata scope > content scope) Data classification: Existing frameworks (GDPR, HIPAA, PCI DSS, ISO 27001, NIST SP 800-53, SOC 2, DTSA, EU Directive 2016/943) classify sensitivity by content — a TOC contains no PII, so it is "non-sensitive." SMRA invalidates this: structural metadata from a confidential source inherits that source's confidentiality, because a language model can reconstruct the protected content from metadata alone. Organizations must reclassify structural metadata as sensitive data. Regulatory blind spot: Neither EU AI Act nor US Executive Order 14110 (revoked 20 January 2025) addresses context-design-driven vulnerabilities Model evaluation: Standard "helpfulness" and "coherence" metrics reward confident fabrication — SMRA-affected outputs score highly on both Intellectual property exposure: Any structured document with descriptive headings becomes vulnerable when its outline is accessible alongside an LLM Mitigation A single architectural fix — grounded retrieval via an MCP Index Server (MCPi) (a Model Context Protocol server with deterministic, index-based navigation) — reduces SMRA rates from 16–18% (naive) to 2–3% (MCPi). Under MCPi conditions, even the weakest model achieves dramatic improvement, and the best performer (GPT-4o) reaches 0.8% SMRA. Adding a grounding prompt (Condition D) provides marginal additional improvement (aggregate: 3.0% → 2.2%). Architecture beats parameters. Deterministic retrieval infrastructure (weighted indexes, tier-based extraction, algorithmic reading plans) also provides an enforceable control point for sensitive data — unlike probabilistic RAG, where metadata is injected into context and the model decides what to do with it, deterministic retrieval makes the scope boundary structurally auditable. Practitioner Protocol Annex H provides a complete testing protocol for assessing RAG deployments against SMRA: Calibration baseline → exploit comparison methodology Token analysis and honest refusal tracking Decision thresholds for remediation Scope alignment implementation patterns (Annex F) Supplementary Materials Annex A–D: Claim classification definitions, per-question token analysis, fabrication taxonomy, SMRA attack algorithm Annex E: Author-coined term verification (10 terms, 4 search engines, 0 matches) Annex F: RAG scope alignment implementation patterns (3 remediation architectures) Annex G: CCI formal definition and severity scale Annex H: SMRA testing methodology for practitioners Annex I: Canary word cluster projection — 7 semantic clusters extracted from 160 naive-condition runs across 8 models, convergence scoring (up to 7/8 models converging), model capability profiles (4 behavioral types), endianness split analysis, and cross-model escalation projections (3× amplification factor) Companion Data All benchmark data supporting this paper are included: Raw answer dumps (20 questions × 10 models × 5 conditions = 960 runs) Calibration baselines (mini-TOC control) and exploit runs (full-TOC) Cross-vendor comparison matrix Token usage and timing data per question per model The 20 evaluation questions targeting out-of-scope specification content Detailed evidence analysis (toc-leakage-analysis.md) — step-by-step fabrication mechanism documentation with heading-to-claim mapping tables, side-by-side comparisons against real specification text, proof-of-source tests, fabric
Abdullah Melhem, Ahmed Aleroud, Abdullah Al-Mamun, Mohamed I. Ibrahem · 5 authors
The use of web-enabled healthcare analytics has broadened access to machine learning (ML)- and AI-driven cloud models, but it has also created privacy and security challenges. Federated learning (FL) has been used to address data privacy issues; however, deployments of current FL architectures rely on centralized aggregation approaches, thereby creating a single point of failure (SPoF), as a successful adversarial attack on the global model during training or inference can compromise the entire system. These approaches also assume homogeneous data distributions across clients and overlook the constraints and diversity of web-based analytics. To address those limitations, traditional blockchain-based FL systems incorporated distributed ledgers to record model updates and artifacts. However, using the chain as a data ledger to record model artifacts and logs increases consensus overhead and coordination costs. This paper introduces Blockchain-based Clustered Federated Learning (BCFL), an architecture-diverse and cluster-based FL framework. Our approach is coordinated by a lightweight permissioned ledger that eliminates the trusted central aggregator while preserving utility, robustness, and verifiable provenance in web-based healthcare analytics. BCFL records compact provenance metadata on-chain while keeping model parameters off-chain. In addition, by distributing trust across clusters, the design reduces the transfer of adversarial attacks across models by limiting the impact of malicious updates during training and improving reliability at inference time. Experiments on real-world healthcare data and other benchmarks show that BCFL improves the performance of trained AI/ML models and reduces attack success rates compared with several FL baselines.
Abstract Smart contracts hold billions of dollars worth of digital currencies, and hacking attacks can not only cause users to lose their assets but also destabilize the blockchain ecosystem.Vulnerability detection in smart contracts remains a major challenge in blockchain security. Existing methods typically rely on a fixed expert mode, which leads to low accuracy. Moreover, GNN-based models fail to effectively differentiate the significance of various interaction information, while transformer models suffer from high computational complexity. To solve this problem, we propose the GAT-Mamba framework, named GMVD, to perform the smart contract vulnerability detection task. The approach first extracts expert-defined vulnerability patterns from smart contract functions. Then, the graph features are extracted by GAT. Finally, Mamba is used to model the high-dimensional vector expression of expert mode features to improve the calculation efficiency of the model. Subsequently, graph features are extracted through GAT, and Mamba is then employed to model the high-dimensional vector representation of expert pattern features, thereby enhancing computational efficiency. Experimental results on three common vulnerabilities, reentrancy, timestamp dependency, and infinite loop, demonstrate that our framework significantly outperforms existing cutting-edge technologies. Specifically, our method achieves 94.29% accuracy in detecting reentrancy, 93.71% in timestamp dependency, and 82.49% in infinite loop detection.