Cüneyt Gürcan Akçora, Murat Kantarcioglu, Yulia R. Gel
In this chapter, you will learn about the privacy limitations of public blockchains such as Bitcoin and Ethereum, and how these limitations have led to the development of privacy-focused cryptocurrencies. You will study the motivations for privacy coins and the risks posed by government-issued digital currencies. The chapter introduces and compares three major privacy coins: Zcash, Dash, and Monero. For each, you will explore their underlying technologies, including zero-knowledge proofs (zk-SNARKs), CoinJoin-style mixing, and ring signatures with RingCT and stealth addresses. You will also learn about consensus protocols, supply models, and the trade-offs each project makes between privacy, usability, and scalability. Finally, you will analyze the comparative strengths and weaknesses of these systems and understand the broader implications of privacy on blockchains.
Cüneyt Gürcan Akçora, Murat Kantarcioglu, Yulia R. Gel
This chapter introduces blockchain network structures in both UTXO- and account-based systems. It begins with Bitcoin’s transaction and address graphs, showing how Satoshi Nakamoto’s design defines network topology and enables modeling through transaction graphs, address graphs, and chainlets. Privacy coins like Monero and Zcash extend this framework with ring signatures and zero-knowledge proofs that obscure data but still permit partial inference. Ethereum shifts focus to account-based networks, covering coin and token transactions, contract interactions, and trace analysis. Ripple concludes the chapter with credit networks built on trust lines and path-based settlements, showing how global credit flows can be modeled graphically.
This study examines the potential of Zero-Knowledge Protocols (ZKPs) as cryptographic mechanisms that enhance privacy and security in the context of advancing quantum technologies. Rather than accepting current legal safe guards and regulatory structures at face value, the study critically evaluates their effectiveness, particularly in healthcare environments where highly sensitive data frequently encounters inadequate protection. The methodology employs a multifaceted approach, integrating qualitative insights, legal case studies, and framework analysis. The findings indicate that zero-knowledge proof techniques can significantly enhance the protection of personal health information. A case study of NantHealth Inc.’s quantum-safe healthcare data protection framework illustrates the practical implementation of post-quantum cryptography and homomorphic encryption, demonstrating how health care organizations may proactively address quantum computing threats while enabling secure data collaboration. The study further demonstrates that incorporating these cryptographic methods into existing legal frameworks not only addresses immediate privacy concerns but also facilitates compliance with evolving data protection standards. The study also suggests that healthcare organizations should reconsider their data security approaches by implementing advanced cryptographic measures while maintaining regulatory compliance.
There Is No Nothing, Methods Paper 00 version 0.3.0, preserves the two inaugural premise-free results and publishes the shared two-layer roadmap for the Smithian Fold Theory knowledge tree: secure each branch foundation at its exact evidence boundary, then extend it across the full field without treating a publication as a permanent lock. Later branch laws remain separate admissions and are not retroactive premises. The accompanying standard-library-first Python repository implements one fail-closed admission engine for registration, dependency and provenance closure, zero-parameter and no-axiom enforcement, generated candidate enumeration, exactly-one-survivor forcing, minimality, named-shape uniqueness, adverse controls, cryptographic sealing, implementation-distinct recomputation, empirical target custody and publication gates. The engine and verification authority remain cryptographically sealed; an adverse or halted result cannot be converted into a pass by editing the authority surface. The paper gives full candidate, decision, proof, control, source, validator, seal and receipt identities; an engine threat model; the blind empirical protocol; the open licensing and Ernos Labs conformance model; a supersession ledger for prior SFT generations; and a file-level paper-to-evidence map. Version 0.3 publishes the ordered full-field roadmap through Chemistry while Materials remains outside this coordinated release. Branch completion always means dated current-evidence completion at a declared boundary and remains open to lawful extension, correction and falsification.
Privacy-preserving machine learning auditing protocols allow auditors to assess models for properties such as accuracy or fairness, without revealing their internals or training data. This makes them especially attractive for auditing models deployed in sensitive domains such as healthcare or finance. For these protocols to be meaningful in real-world audit settings, though, their guarantees must reflect how the model will behave once deployed, rather than merely certifying its behavior during an audit. Existing security definitions often miss this mark: most certify model behavior only on a fixed audit dataset, without ensuring that the same guarantees generalize to other datasets drawn from the same distribution. As we show, this gap allows a model provider to attack many cryptographic model certification (CMC) schemes built on secure zero knowledge proofs (ZKP) by carefully engineering training data, resulting in models that exhibit benign behavior during an audit, but pathological behavior in practice. For example, we empirically demonstrate that an attacker can certify that a model achieves over 99% accuracy on an audit dataset, but less than 30% accuracy on fresh samples from the same distribution. To address this gap, we formalize rigorous cryptographic security notions tailored to CMC frameworks, introduce a generic protocol template, and prove that it satisfies these requirements. Our results thus offer both cautionary evidence about existing approaches and constructive guidance for designing secure, privacy-preserving ML auditing protocols.
Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority, but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted $R_{CVA}$, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems (a distinction {not explicitly addressed by} current agentic security frameworks) and present a falsifiable research agenda for its resolution.
Madi Gali, Aray Kassenkhan, Y. Chinibayev, A. M. Abshukirova · 5 authors
Static, one-time authentication mechanisms such as passwords and PINs are increasingly inadequate for protecting mobile devices throughout an active session. Behavioral biometric continuous authentication (BBCA) addresses this gap by passively monitoring user-specific interaction patterns—keystroke dynamics, touch and swipe gestures, gait, and motion—to verify identity on an ongoing basis. This systematic review synthesizes 80 studies selected via a PRISMA-compliant protocol from IEEE Xplore, ACM Digital Library, Scopus, ScienceDirect, Web of Science, and SpringerLink (2017–2025). We examine behavioral and multimodal biometric modalities, machine learning approaches ranging from classical classifiers to deep sequence and transformer architectures, and their integration with intelligent personal agents, wearable devices, and IoT/edge infrastructures. Security analyses cover spoofing, adversarial and generative attacks, mimicry, and model-level threats including membership inference and reconstruction. Privacy-preserving mechanisms—cancelable biometrics, Bloom filter encodings, zero-knowledge proof protocols, federated learning, and blockchain-based identity management—are evaluated against practical trade-offs in energy consumption and latency on resource-constrained devices. Key research gaps are identified: the absence of standardized adversarial benchmarks, lack of end-to-end pipeline evaluations under simultaneous adversarial and privacy threat models, and limited user-centered studies on consent and acceptance of privacy-preserving mechanisms under frameworks such as GDPR. Recommended future directions combine adaptive multimodal fusion, privacy-preserving cryptography, energy-aware modality selection, and interdisciplinary human-centered evaluation to advance practical, resilient continuous authentication for mobile and assistant-enriched environments.
Zero-Knowledge Ethereum Virtual Machines (zkEVMs) secure Ethereum rollups by generating zero-knowledge proofs that guarantee off-chain execution correctness. However, subtle implementation bugs (e.g., incorrect gas accounting) can lead to valid proofs certifying semantically faulty states, thereby silently defeating cryptographic guarantees. Formal verification via SMT solvers can prevent this, but is bottlenecked by specification: current zkEVM development practice lacks automated methods to translate Rust opcode handlers into verification models. Current practices rely on unsustainable manual specifications, while LLM-based approaches suffer from hallucination and lack formal guarantees. To address this, we propose VeriSynth, a framework that synthesizes executable Python/Z3 verification models from Rust zkEVM code. VeriSynth enforces a hybrid paradigm: an LLM acts strictly as a formalization frontend to translate code into symbolic constraints, while an SMT solver serves as the correctness arbiter. To handle complex multi-component state transitions, VeriSynth integrates semantic decomposition, retrieval-grounded prompting, and verification-guided auto-repair into a closed-loop pipeline. We evaluate VeriSynth on the first source-level zkEVM verification benchmark, encompassing both correct and faulty opcode implementations. VeriSynth achieves a bug detection rate of over 90%, substantially outperforming direct and conversational LLM baselines, as well as a production-grade handwritten mutation-testing suite. Ablation studies confirm that each pipeline component is critical to the framework's overall effectiveness.
One of these financial crimes, which seem to sound like a concept straight out of a dream until you get a sense of the magnitude of the issue, is money laundering. According to the United Nations, Between $800 billion and $2 trillion in illicit money is transacted through the world financial system each and every year. The problem with this approach is that the criminals seldom use only one bank. They thread their way across five, ten, and sometimes dozens of institutions, all seeing merely a harmless nugget. In isolation, looking at his or her own transaction logs, no single bank will easily know that there is a problem. This paper is about a system, called AMLNet, which tackles this blind spot. Unlike the traditional approach, which would allow banks to share their customers' data with each other,AMLNet trains a detection model on customers' data within each bank, and shares only what the detection model learned from the data, not the data itself. All collaborative training is documented in a blockchain ledger, making it transparent and tamper-proof. With a Zero-Knowledge Proof, each bank is able to prove cryptographically that it is acting honestly, but not disclose anything private. A graph of transaction data (accounts as nodes, transfers as edges) is used to extract structural features, which are compressed by PCA before being input to a Multi-Layer Perceptron (MLP) risk-scoring classifier of each account. Together they increase fraud recall by approximately 20% over any single institution operating alone, while maintaining a low false positive rate, and that the overall computation time is less than 10 minutes on an average laptop.
This dataset accompanies the paper An Architectural and Empirical Study of Root-Only Zero-Knowledge Verification and contains the scripts, intermediate artifacts, and published results used to reproduce the empirical evaluation. The repository is organized around two experiment groups: Blockchain-Side Deployment and Verification: deployment and Groth16 proof verification on Ethereum Sepolia and zkSync Sepolia, including contract sources, Merkle-tree inputs, Groth16 proofs, and blockchain measurement CSVs and figures. ZKP proving and off-chain verification: Constraint-count comparison — Groth16 R1CS constraint counts and expanded PLONK gate counts for Merkle-tree depths 5–15, with measurement scripts and summary CSVs/figures. Proving-time comparison — off-chain Groth16 and PLONK proving benchmarks across depths 5–15, including proving scripts, generated witness/proof/key artifacts, and benchmark CSVs/figures.
Autonomous AI agents now hold funds, delegate authority to other agents, and transact at machine speed; the governance apparatus meant to constrain them—policies, audits, compliance—remains documentation-based and human-latency. This mismatch cannot be closed by better monitoring or filtering: compliance must become a runtime, compositional, proof-carrying property of computation itself. We call the resulting discipline computational jurisprudence. This article surveys the four literatures the discipline must synthesize: object-capability security; verifiable, proof-carrying, and zero-knowledge computation; policy-as-code and computational law; and agentic AI with its emerging payment protocols. Each supplies a mature mechanism the others lack; none supplies a complete normative substrate. The synthesis is organized in three pillars: (i) a delegation calculus under which authority can only attenuate as it propagates between agents; (ii) runtime compliance proofs, a three-tier evidence regime (attested, optimistic, and zero-knowledge); and (iii) sealed delegation chains with graduated attribution, which reconcile the privacy of capability-based authority with the accountability that adjudication requires. A case study on agentic payment protocols grounds the architecture and reports first measurements: capability verification versus a centralized policy decision point, end-to-end enforcement on the x402 payment path, and accumulator-based revocation. Seven open problems define the research agenda.
Contemporary AI governance regimes (GDPR, the EU AI Act, NIST AI RMF) operate declaratively: they mandate outcomes but provide no computational mechanism by which compliance can be verified at execution time without exposing the underlying data. This produces a structural verification asymmetry, the cost of proving integrity is borne by the auditor, who must inspect raw data the operator cannot lawfully or commercially disclose. We propose ZEGA (Zero-Knowledge Execution Governance Architecture), a governance layer in which execution logs are committed cryptographically at capture time, anomaly predicates are evaluated inside zero-knowledge circuits, and regulators verify a succinct proof of integrity without observing a single record. We formalize an Integrity Debt metric ID, quantifying accumulated unverified execution mass, and specify an empirical pipeline over Google BigQuery public datasets (GitHub Archive, 2011–present; >8 billion events) that operationalizes ZEGA’s anomaly-filtering and commitment stages at planetary scale. Executed over a 30-epoch window of 112 million real execution events, the pipeline demonstrates that predicate evaluation is tractable within commodity cloud infrastructure at a stable anomaly base rate of 0.0137% (CV = 0.269). A seven-year longitudinal extraction (2020–2026; 25.4 million events) shows execution volume persistently concentrated in the top decile of actors (66.2% mean share, CV = 0.097), establishing that the baseline ZEGA predicates are calibrated against is structural, not seasonal. We further execute a live zero-knowledge instance over a committed one-hour epoch (45,674 actors), proving the anomaly-rate predicate with a real BN128-curve argument that discloses a single verdict bit and survives forgery and tamper tests, establishing ZK verification with proof size O(log N) and verification time independent of N. ZEGA converts governance from attestation to mathematics: the regulator’s question changes from “show us your data” to “show us your proof.”
Junhong Liu, Qinfei Long, Alex Pengfei Zhao, X Zhong · 7 authors
Multi-region unit commitment with reserve sharing requires coordinated optimization across jurisdictionally distinct system operators, exposing sensitive cost curves, topology, and dispatch decisions to inference attacks. The accelerating progress of quantum computing further compounds this threat. As quantum hardware matures, current classically-encrypted data flow becomes vulnerable to retrospective decryption. To enable post-quantum-secure distributed optimization, we propose a customized Benders decomposition-based approach with the global summation structure to share aggregated cuts and variables. By exploiting this structure, we further develop a multi-layer quantum-resilient secure aggregation protocol comprising additive masking for information-theoretic content privacy, affine variable transformation hiding individual sensitive data flows, and reveal-bound lattice-based zero-knowledge proofs providing resilience against active adversaries. Simulation results show that the proposed approach achieves the mean suboptimality of 0.09%-0.22% with lightweight computational overhead, recovers up to 51% of system cost via inter-regional reserve sharing, and imposes no measurable cost-quality trade-off, whereas the noisy ADMM degrades monotonically under tightening privacy budgets and becomes structurally infeasible on combinatorially dense systems.
G. Indirapriyadarsini, Sireesha Guttapalam, Ramyasri Mogarala, Kalpeshkumar L. Guptha
Background Maintaining optimal youth nutritional health is an urgent socio-economic imperative that underpins long-term human productivity and rights-based development. However, modern youth cohorts face unique dietary threats caused by the widespread availability of ultra-processed foods, targeted digital marketing, and complex food labeling protocols. Although Artificial Intelligence (AI) presents innovative avenues for personalized dietary profiling, existing systems remain largely technocentric and detached from statutory frameworks or behavioral realities. Objective This study bridges this interdisciplinary divide by evaluating a rights-based, technology-driven framework to improve youth nutritional health. It aims to: (1) empirically evaluate the “Knowledge-Attitude-Practice” (KAP) gap linking statutory consumer rights to real-world eating habits; (2) present the engineering design of a non-commercial Progressive Web Application (PWA) built to translate legal safeguards into daily behavioral changes; and (3) triangulate these findings using data from youth surveys and expert legal and nutritional panels. Methods Using a cross-sectional approach based on non-parametric power constraints, a validated survey instrument was completed by a target sample of Indian youth ( n = 354, aged 15–25 years). Concurrently, data matrices were compiled from regional legal experts ( n = 12) and public nutrition professionals ( n = 12) to cross-verify structural bottlenecks. Group variances, demographic dependencies, and rank associations were analyzed using robust non-parametric tests, including One-Way ANOVA, Kruskal-Wallis (H), Welch’s t-test, and Kendall’s Tau ( τ ) correlation coefficients. Results Inferential analysis revealed unexpected demographic trends: undergraduate status predicted significantly higher FSSAI safety awareness than post-graduate status ( p = 0.0037), while subjective health ratings exhibited a non-linear relationship with household income ( p = 0.0004), peaking in the lower-middle financial tier. Crucially, rank correlation testing revealed that the relationship between statutory knowledge and actual dietary actions is functionally non-existent ( τ = −0.001). This near-zero correlation provides clear empirical proof of a pronounced Knowledge-Action Gap, confirming that passive legal literacy fails to influence food selection in modern environments. Conclusion By framing automated behavioral interventions within the constitutional protections of Article 21 of the Constitution of India and the Consumer Protection Act, 2019, this study shows how the open-access PWA (nutrition-zb.pages.dev) can bridge this behavioral gap. This shifts the focus of consumer health informatics from basic self-tracking to a rights-based, systemic public health intervention.
Open access
Nutrition, Genetics, and Disease
Mobile Health and mHealth Applications
Artificial Intelligence in Healthcare and Education
The rapid digital transformation has made verifiable professional digital skills essential for workforce competitiveness, yet traditional resumes and certificates suffer from high fraud rates (50–70%), lengthy manual verification, and failure to recognize non-traditional pathways. This paper investigates SSI-, DID-, and W3C VC-based digital skills wallets as a solution to restore cryptographic trust in HR recruitment. Adopting the Design Science Research Methodology (DSRM), we conducted a PRISMA 2020 systematic review of 42 high-quality sources (2022-early 2026). The review established the technical maturity of SSI/VC technologies for micro-credentials and Learning and Employment Records (LERs) while revealing critical gaps in enterprise HR integration and emerging-market (particularly China) applications. We designed a modular, blockchain-optional digital skills wallet architecture fully compliant with W3C Verifiable Credentials Data Model v2.0, 1EdTech Comprehensive Learner Record, and China’s RealDID national identity infrastructure. The artifact supports lifelong credential aggregation, selective disclosure via BBS+ zero-knowledge proofs, and instant cryptographic verification (<3 seconds). The design was demonstrated through three China-specific recruitment use cases and empirically validated via a mixed-methods survey with 42 HR professionals and recruiters from major technology companies in Beijing, Shanghai, Shenzhen, and Guangzhou. Results indicated strong perceived utility: credential fraud was rated a major issue (M = 4.69), the wallet was expected to substantially reduce verification time (M = 4.57) and increase confidence in candidate claims (M = 4.45), with positive willingness to pilot or adopt (M = 4.19), especially when integrated with RealDID. These findings demonstrate that SSI-based digital skills wallets can near-eliminate resume fraud, collapse verification from weeks to seconds, expand talent pools through skills-first matching, and ensure privacy-preserving selective disclosure while aligning with national digital identity strategies. The study contributes a replicable DSRM template bridging verifiable credentials and skills-based talent management literatures, together with practical recommendations for HR leaders, ATS integration, and policy development.
This dataset accompanies the paper An Architectural and Empirical Study of Root-Only Zero-Knowledge Verification and contains the scripts, intermediate artifacts, and published results used to reproduce the empirical evaluation. The repository is organized around three experiment groups: On-chain verification — deployment and Groth16 proof verification on Ethereum Sepolia and zkSync Sepolia, including contract sources, Merkle-tree inputs, Groth16 proofs, and blockchain measurement CSVs and figures. Constraint-count comparison — Groth16 R1CS constraint counts and expanded PLONK gate counts for Merkle-tree depths 5–15, with measurement scripts and summary CSVs/figures. Proving-time comparison — off-chain Groth16 and PLONK proving benchmarks across depths 5–15, including proving scripts, generated witness/proof/key artifacts, and benchmark CSVs/figures. Shared setup files include Circom circuits, Merkle-tree preparation scripts, circuit inputs, and compiled circuit artifacts. Most of the generated data is produced by the provided scripts and does not need to be included separately if the reproduction pipeline is documented.
Open access
2 source records
Formal Methods in Verification
Physical Unclonable Functions (PUFs) and Hardware Security
Secure, interconnected, and compatible data sharing of Electronic Health Records (EHRs) across healthcare domains is essential for timely patient care and improved adaptability in healthcare infrastructures. Current challenges must be addressed, including centralization threats, fragmented standards, and threats from quantum computing. This paper proposes a blockchain-based EHR framework using post-quantum cryptography and HL7 FHIR standards for secure, interoperable data sharing. It employs smart contracts for patient-centric access control and HotStuff BFT consensus, achieving 928 TPS with 2.1-second finalization. Zero-knowledge proofs enable privacy-preserving authentication, and dynamic accumulators improve revocation storage efficiency by 89%. On a 20-node testbed, the system sustains 620 TPS at 500 ms latency, with under three-second access grants and 95% storage efficiency via cryptographic pointers. Compared to current systems, it offers 20× higher throughput and resists quantum threats. Multi-hop exchange across three hospitals reduced normalization efforts by 40%. Comprehensive assessment on the system outcomes reveals that our framework significantly enhances security, scalability, and interoperability for decentralized healthcare networks.
Federated Learning (FL) enables collaborative model training across decentralized participants without sharing raw data. However, existing FL systems remain vulnerable to Byzantine attacks and suffer from a lack of accountability, verifiability, and economic incentives for honest participation. We present BFL-Guard, a novel blockchain-orchestrated federated learning framework integrating: (i) zk-SNARK-based zero-knowledge gradient proofs, (ii) an on-chain Byzantine-tolerant aggregation smart contract, and (iii) a tokenized incentive protocol (FedToken). BFL-Guard stores model checkpoints as IPFS hashes anchored on Ethereum, ensuring tamper-evident auditability. Experiments on CIFAR-10 and Shakespeare benchmarks demonstrate 95.2% and 87.6% accuracy in IID and Non-IID settings, surpassing all baselines while converging 12.4% faster even under 30% Byzantine injection.