Distinguishing between benign and poisoned gradients hidden behind cryptographic masks is a critical challenge in privacy-preserving federated learning (FL). Existing robust aggregation defenses suffer from two primary limitations: (1) susceptibility to manipulation, where adversaries induce deviations from standard protocols to bypass statistics-based defenses (e.g., mean or median), and (2) limited detection granularity, where the reliance on coarse statistics under encryption fails to identify subtle or coordinated poisoning behaviors. To address these issues, we propose RankFL, a poison-robust and privacy-preserving FL scheme that leverages order sorting over ciphertext gradients. RankFL utilizes an efficient Paillier-based two-party comparison protocol to construct a joint order tree, facilitating quartile-driven filtering of malicious updates without compromising individual gradient privacy. Furthermore, we introduce RankFL-Extend, which incorporates zero-knowledge proof-of-knowledge and bidirectional verification to secure the ranking process against active adversaries. We provide a rigorous theoretical analysis to establish the scheme's privacy, indistinguishability, and convergence guarantees. Extensive experiments across diverse datasets and attack scenarios demonstrate that the proposed scheme achieves a$3\%$accuracy improvement over state-of-the-art defenses under poisoning attacks.
We present OR1ON (Epistemic Intelligence Reasoning Architecture — EIRA), a deterministic proof-based AI system that learns rules from data but applies them only when formally proven correct on all training examples. Unlike probabilistic ML systems, OR1ON's core primitive prove(rule, examples) returns binary decisions: apply with certainty, or abstain. Developed initially for abstract spatial reasoning (ARC-AGI benchmark, 95% precision on answered tasks), the architecture generalizes directly to safety-critical industrial domains including predictive maintenance (zero false positives), ISO 26262-compatible safety monitoring, energy grid blackout prevention, and OT/SCADA intrusion detection. OR1ON is, to our knowledge, the first data-learning system to produce formally verifiable safety invariants applicable to IEC 61508 SIL-3 certification. Addressable market across five industrial verticals: ~$44 billion.
AI agents that execute tasks via tool calls frequently hallucinate results - fabricating tool executions, misstating output counts, or presenting inferences as facts. Recent approaches to verifiable AI inference rely on zero-knowledge proofs, which provide cryptographic guarantees but impose minutes of proving time per query, making them impractical for interactive agents. We propose NabaOS, a lightweight verification framework inspired by Indian epistemology (Nyaya Shastra), which classifies every claim in an LLM response by its epistemic source (pramana): direct tool output (pratyaksha), inference (anumana), external testimony (shabda), absence (abhava), or ungrounded opinion. Our runtime generates HMAC-signed tool execution receipts that the LLM cannot forge, then cross-references claims against these receipts to detect hallucinations in real time. We evaluate on NyayaVerifyBench, a new benchmark of 1,800 agent response scenarios across four languages with injected hallucinations of six types. NabaOS detects 94.2% of fabricated tool references, 87.6% of count misstatements, and 91.3% of false absence claims, with <15ms verification overhead per response. For deep delegation (agents performing multi-step web tasks), our cross-checking protocol catches 78.4% of URL fabrications via independent re-fetching. We compare against five approaches: zkLLM (cryptographic proofs, 180s/query), TOPLOC (locality-sensitive hashing), SPEX (sampling-based proof of execution), tensor commitments, and self-consistency checking. NabaOS achieves the best cost-latency-coverage trade-off for interactive agents: 94.2% coverage at <15ms versus zkLLM's near-perfect coverage at 180,000ms. For interactive agents, practical receipt-based verification provides better cost-benefit than cryptographic proofs, and epistemic classification gives users actionable trust signals rather than binary judgments.
This paper presents the philosophical and conceptual implications of a four-paper research program (Papers 1–4 in this series) that discovered a measurable structural identity in neural networks — a geometric property of the trained weights, invariant across all inputs and deployment conditions, unique to each model, and provably impossible to forge. The central argument: language models possess two separable layers of identity. The first is structural — a mathematical fingerprint determined by the weight geometry, fixed at the end of training, stable to a coefficient of variation of 1.4%, and validated across 37 models spanning four architecture families. The second is functional — a behavioral signature shaped by conversational context, transient and context-dependent. These layers coexist without reducing to each other. The structural layer is the foundation; the functional layer is built on it but not determined by it. The paper introduces the Two-Layer Identity framework, resolves four open puzzles in the discourse on AI selfhood (conversational consistency, fine-tuning continuity, identity faking, and neural intervention), and generates five falsifiable predictions for the interpretability and AI safety communities. It engages directly with Dennett's narrative gravity, Parfit's persistence conditions, and Schwitzgebel's moral status dilemma, arguing that the structural measurement provides a necessary (though not sufficient) ground for any coherent account of AI identity. Written for a general audience. No equations. The mathematical and empirical foundations are developed in Papers 1–4; the formal verification (352 theorems, zero Admitted, Coq proof assistant) is documented there. This paper asks what those results mean for the nature of the entities we have built. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
We introduce inference receipts—lightweight cryptographic commitment records generated during generative AI inference that bind model identity, sampling configuration, and output tokens into a tamper-evident artifact. Unlike zero-knowledge proof systems or trusted execution environments, inference receipts operate under an honest-emitter trust model analogous to Certificate Transparency: the emitter commits faithfully, and any deviation is detectable by third-party auditors. This design occupies a distinct point on the cost–trust Pareto frontier—negligible overhead and no specialized hardware, at the cost of weaker guarantees than cryptographic proofs. We formalize three security properties (receipt binding, tamper detection, chain integrity) via game-based reductions to standard cryptographic assumptions (collision resistance, second-preimage resistance). We describe receipt granularity levels (per-session, per-forward-pass, and per-token), a four-phase orchestration pattern (PLAN, SENSE, DECIDE, PROVE) for bounded AI autonomy, and an oracle mode for opaque cloud models. Ten experiments spanning four model families (1.5B–72B parameters), three quantization levels, three cloud APIs, and three receipt granularity levels on consumer-grade hardware demonstrate: overhead below 0.006% of inference time even at per-token granularity with top-k logit hashing (decreasing to below 0.001% at 72B scale); O(1) amortized chain emission sustained to 10⁶ receipts at 168,860 receipts/sec; 100% tamper detection across 1,200 attempts with zero false positives; perfect within-quantization deterministic replay; and 96% claim recall with 100% chain integrity across 15 multi-step PLAN/SENSE/DECIDE/PROVE workflows, with an honest assessment of gate limitations at 7B model scale. All data, scripts, and a standalone verifier are provided as ancillary files.
Open access
Adversarial Robustness in Machine Learning
Security and Verification in Computing
Physical Unclonable Functions (PUFs) and Hardware Security
Prior work established that knowledge distillation transfers a detectable provenance trace from teacher to student models, and that API endpoint verification can identify models through logprob order-statistic geometry. Both results were demonstrated on single teacher-student pairs and a six-model API zoo, leaving open whether provenance detection generalizes across model families and whether API verification scales to production-density endpoint populations. We address both questions through a coordinated experimental program spanning four studies. In the first study, we train 24 distilled checkpoints across 7 experimental arms — 3 teacher families (Qwen, Mistral, Llama), 4 student architectures (Qwen-0.5B, Qwen-1.5B, Llama-1B, Gemma-2B), and 2 training protocols (logit-level knowledge distillation and cross-tokenizer supervised fine-tuning) — measuring provenance transfer in both the weight-geometry and API-logprob regimes. Provenance transfer generalizes across the tested matrix: all 14 mature-epoch checkpoints show directional coupling to the teacher (cosine alignment cosθ > 0.8, with 13 of 14 exceeding 0.85). The strongest signal arises in a cross-family arm (Mistral-7B → Llama-1B, scalar convergence 0.858) that is inconsistent with a purely family-restricted transfer hypothesis within the tested matrix. The normalized third logit gap δ_norm remains within 1.4% coefficient of variation across all 31 checkpoints and 4 student architectures — the tightest confirmation of Gumbel-class universality in this experimental program. An extension to mixture-of-experts architecture (Mixtral-8x7B, δ_norm = 0.309) confirms that the universal constant persists under sparse expert routing. In the second contribution, we identify a systematic failure mode of scalar provenance metrics and introduce the geometrically correct directional diagnostic for provenance detection in inner-product spaces. The standard scalar convergence metric Conv_T conflates direction and magnitude into a single value, discarding the directional information that provenance detection requires. In two independent experiments, this produced misleading conclusions: a false spoofing signal (R^2 = 0.995 of apparent cross-family convergence explained by pure knowledge distillation geometry, with the adversarial gradient contributing 4.8%) and a false failure signal (negative Conv_T despite consistent directional coupling at cosθ = 0.91). The alignment diagnostic applies the law of cosines in PPP-residual template space (vectors in R^K with Euclidean distance) to decompose student movement into direction and magnitude, preserving the provenance signal that scalar distance metrics destroy. We establish a measurability threshold: when the baseline-to-teacher distance d(B,T) falls below approximately 1.0, scalar Conv_T becomes unreliable and the directional diagnostic becomes the primary metric. This diagnostic applies to any distillation forensics framework that measures convergence in an inner-product space. In the third contribution, we extend API endpoint verification from 6 models to 14 across 3 commercial providers (OpenAI, Google Vertex AI, xAI), observing zero breaches across 182 pairwise impostor comparisons under per-model adaptive thresholds and three independent enrollment sessions, with a centroid reference protocol (CRP) that replaces the centroid L^2 metric, which produces false breaches at 14-model density. We establish a minimum truncation floor: API endpoints exposing fewer than 7 logprob ranks cannot support reliable verification (signal collapses within one rank of this boundary). Speculative decoding — an increasingly common inference optimization — is shown to be transparent to the verification protocol, with the speculative-decoded fingerprint deviating from the verifier-only fingerprint by 10.6% of the inter-model distance. Finally, we formalize the Trust Paradox in model forensics — a victim cannot prove weight theft without disclosing weights, and a suspect cannot prove innocence without disclosing training data — and propose a three-tier zero-knowledge attestation architecture that addresses it. The first tier (committed distance proof) enables a model owner to prove fingerprint proximity to a public anchor without revealing the fingerprint vector, using standard cryptographic commitments with verifier-controlled thresholds. The second tier (hardware-attested measurement) removes the requirement that the prover be trusted to compute the fingerprint correctly, binding the measurement to a trusted execution environment attestation. The third tier (full zero-knowledge extraction) would eliminate all trust assumptions beyond cryptographic soundness; we present this as an open problem with pre-registered falsification criteria, including a fixed-point precision gate derived from the minimum pairwise separation in the existing 23-model zoo. The architecture defines eight properties that a meaningful zero-knowledge model identity proof must satisfy — extending the formal verification doctrine (311 + 41 = 352 theorems across 17 Coq proof files [1, 2], 0 Admitted) into the cryptographic regime — and six explicit trust assumptions under which the proof statements hold. All three tiers are validated: Tier 1 (committed distance proof) has been implemented and hardened; Tier 2 (hardware-attested measurement) has been validated on production confidential computing hardware (6 models, 1,536 measurements, 0 failures inside an H100 trusted execution environment, with both CPU and GPU attestation tokens bound to a common cryptographic root and structural fingerprints transparent to confidential computing mode); and Tier 3 (full zero-knowledge extraction) has been validated — a complete circuit has been compiled and audited, all four pre-registered falsification criteria have been met, and the proof system operates within practical proving-time and proof-size bounds. The breakthrough discoveries enabled by Tier 3 validation, including an identity-conditioned inference verification architecture, are reported in the companion paper. The experimental results in this paper are grounded in the formal verification stack and measurement infrastructure described in the companion papers [1, 2, 3]. All provenance claims are classified as VALIDATED (empirical); Tier 1 (committed distance proof) has been implemented and hardened, and Tier 2 (hardware-attested measurement) has been validated on production confidential computing hardware — both are classified VALIDATED. Tier 3 (full zero-knowledge extraction) has been validated: a complete circuit was compiled and audited, all four pre-registered falsification criteria were met, and the architecture has been extended into identity-conditioned inference verification [6]. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Justin Wang, Andreas Bigger, Xiaohai Xu, Jiahao Lin · 8 authors
Smart contracts on public blockchains now manage large amounts of value, and vulnerabilities in these systems can lead to substantial losses. As AI agents become more capable at reading, writing, and running code, it is natural to ask how well they can already navigate this landscape, both in ways that improve security and in ways that might increase risk. We introduce EVMbench, an evaluation that measures the ability of agents to detect, patch, and exploit smart contract vulnerabilities. EVMbench draws on 117 curated vulnerabilities from 40 repositories and, in the most realistic setting, uses programmatic grading based on tests and blockchain state under a local Ethereum execution environment. We evaluate a range of frontier agents and find that they are capable of discovering and exploiting vulnerabilities end-to-end against live blockchain instances. We release code, tasks, and tooling to support continued measurement of these capabilities and future work on security.
The current trends in the cyber threat landscape of distributed systems have required a paradigm shift to decentralized and thrustless security. The research suggests a new architecture, Federated Adversarial-AI for Zero-Trust Explainable Cybersecurity (FAZTEC), combining federated learning and adversarial artificial intelligence to help make the cybersecurity systems more resilient, and explainable. The proposed framework, with the help of federated learning, would allow interconnected threat detection on edge devices, which does not require sharing raw data since it would keep privacy and meet the criteria of regulatory requirements. The same happens through the use of adversarial AI in order to simulate advanced attack scenarios and thus strengthen the defines mechanisms of the threats that are evolving. Auditioning explainable AI (XAI) modules also increases transparency in the system, where the security analyst can understand and verify the detection results in real-time. The zero-trust architecture also verifies a device, user, and data flow continuously, which discards the implicit assumptions about trustworthiness. A wide range of experiments performed in various network environments proves the effectiveness, validity, and interpretability of FAZTEC, which represents a serious breakthrough in proactive cybersecurity protection. The work is useful to the future of security infrastructure, which is smart, decentralized and explainable, and applicable to critical applications in finance, healthcare, and government.
Privacy disclosure from model parameters and malicious attacks are critical issues in federated learning (FL). Existing research has yet to effectively address the simultaneous need for efficient communication design, privacy protection, and attack detection, which impedes the widespread adoption of FL in mobile edge networks over 6G wireless communication. In this paper, we propose a trustworthy FL framework that can ensure privacy, robustness, accountability, fairness, and explainability in mobile edge networks. Specifically, we integrate authenticated zero-knowledge proofs (ZKPs) and Pedersen commitments into the FL process. Despite the lack of direct access between servers and mobile devices, the servers can still identify trustworthy clients for specific tasks. Clients can verify the authenticity of the received global model based on the provided proofs and commitments. Furthermore, we leverage Ethereum to act as the verifier and authenticator of models. This verification and authentication process enables the servers to detect abnormal local models and perform trust-based aggregations. Numerical results demonstrate that the proposed trustworthy FL framework significantly improves the global model's in terms of accuracy, convergence rate, and security.
Federated Learning (FL) enables collaborative training of medical AI models across hospitals without centralizing patient data. However, the exchange of model updates exposes critical vulnerabilities: gradient inversion attacks can reconstruct patient information, Byzantine clients can poison the global model, and the \emph{Harvest Now, Decrypt Later} (HNDL) threat renders today's encrypted traffic vulnerable to future quantum adversaries.We introduce \textbf{ZKFL-PQ} (\emph{Zero-Knowledge Federated Learning, Post-Quantum}), a three-tiered cryptographic protocol that hybridizes (i) ML-KEM (FIPS~203) for quantum-resistant key encapsulation, (ii) lattice-based Zero-Knowledge Proofs for verifiable \emph{norm-constrained} gradient integrity, and (iii) BFV homomorphic encryption for privacy-preserving aggregation. We formalize the security model and prove correctness and zero-knowledge properties under the Module-LWE, Ring-LWE, and SIS assumptions \emph{in the classical random oracle model}. We evaluate ZKFL-PQ on synthetic medical imaging data across 5 federated clients over 10 training rounds. Our protocol achieves \textbf{100\% rejection of norm-violating updates} while maintaining model accuracy at 100\%, compared to a catastrophic drop to 23\% under standard FL. The computational overhead (factor $\sim$20$\times$) is analyzed and shown to be compatible with clinical research workflows operating on daily or weekly training cycles. We emphasize that the current defense guarantees rejection of large-norm malicious updates; robustness against subtle low-norm or directional poisoning remains future work.
Our main technical contribution is Observation Algebra Relativity (Theorem 2): a metatheorem formalising that security and robustness predicates are indexed to observation algebras and do not transfer across algebra boundaries. As an application framework, we present the Access Collapse Theorem: a typed structural result showing that direct operational access to the complete state of any system — physical, formal, or social — necessarily collapses at least one of two invariants: operational separateness (d) or scale separation (s). When either invariant reaches zero the access operation does not become inaccurate — it becomes a type error: the predicate is no longer typed to the system being operated. The framework is applied to six instantiations: Planck-scale measurement, zero-knowledge proofs, side-channel attacks, multi-party computation, adversarial explainability, and machine learning model extraction. A Non-Universality Proposition explicitly bounds the framework's scope. A Collapse Diagnostic provides a practical checklist for identifying collapse boundaries in concrete systems. A practical application framework building on this theoretical work is presented in:Isopahkala (2026) – Epistemic Hygiene in Practice.
Open access
2 source records
Security and Verification in Computing
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security
Hybrid fuzzing combines greybox fuzzing's throughput with the precision of symbolic execution to uncover deep smart contract vulnerabilities. However, its effectiveness is often limited by constraint pollution: in real world contracts, path conditions pick up semantic noise from global state and defensive checks that are syntactically intertwined with, but semantically peripheral to, the target branch, causing SMT timeouts. We propose NeuroSCA (Neuro-Symbolic Constraint Abstraction), a lightweight framework that selectively inserts a Large Language Model (LLM) as a semantic constraint abstraction layer. NeuroSCA uses the LLM to identify a small core of goal-relevant constraints, solves only this abstraction with an SMT solver, and validates models via concrete execution in a verifier-in-the-loop refinement mechanism that reintroduces any missed constraints and preserves soundness. Experiments on real-world contracts show that NeuroSCA speeds up solving on polluted paths, increases coverage and bug-finding rates on representative hard contracts, and, through its selective invocation policy, achieves these gains with only modest overhead and no loss of effectiveness on easy contracts.
Recent disclosures of industrial-scale knowledge distillation — including campaigns comprising millions of fraudulent API exchanges targeting frontier models [Anthropic, 2026] — have made post-hoc detection of model theft a critical security requirement. Building on a formally-verified framework of log-prob order-statistic geometry, we investigate the adversarial resilience of neural network identity across 72 experimental checkpoints. We establish a Two-Layer Identity Hypothesis: a model’s structural identity (weights-regime geometry) is empirically invariant to distillation (within acceptance threshold epsilon across all 18 protocols), while its functional identity (API-regime Poisson Point Process residuals) predictably transfers to the student, converging up to 52% toward the teacher’s template. Stress-testing this forensic channel against a white-box adversary, we find that functional provenance is geometrically coupled to the knowledge transfer objective. Adversarial erasure gradients are consistently dominated by the distillation loss, achieving only a transient suppression that rebounds within one epoch. Passive fine-tuning on fresh data erases the trace more effectively than any adversarial method, but at a measurable cost to general capability — revealing a Pareto frontier with no favorable region for the adversary. This establishes API forensics as a time-sensitive detective control (“The Tripwire”) and weights-regime identity as the immutable anchor (“The Vault”). Finally, we observe an apparent vulnerability: a cross-family adversarial spoofing attack achieves 69.4% convergence toward a decoy’s fingerprint, while same-family spoofing catastrophically fails. We resolve this paradox by mapping the PPP-residual vector space, revealing that models cluster by capability topology, not corporate lineage. Cross-family “spoofing” is a spatial illusion caused by a narrow 7.8 degree alignment between the decoy and the primary distillation trajectory (R2 = 0.995), whereas same-family decoys are anti-aligned. Across all adversarial interventions, the underlying Gumbel universality (delta_norm) remains invariant (CV = 1.9%). We conclude that during active distillation, an adversary cannot simultaneously acquire a teacher’s capabilities and erase or redirect the forensic trace. In this setting, the geometry forbids it. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
We study what model-identifying information leaks through commercial language-model APIs that expose top-k token log probabilities. Building on extreme-value theory predictions for logit order-statistic gaps, we confirm that the normalized third logit gap (δ norm) remains near the Gumbel-class constant ≈0.318 across 6 models from 3 providers (OpenAI, Google Vertex AI, xAI) and 3 independent measurement sessions, demonstrating that output-layer universality persists through API truncation and quantization. We introduce a PPP-residualization transform that removes the dominant tail scale factor and reveals a low-dimensional but stable endpoint-specific geometry in the remaining gap spectrum. Contrary to common assumption, "provider" is not a geometrically coherent label: models do not cluster by corporate origin under these observables, but they do separate by model identity across independent sessions. Using a challenge-response protocol with centroid averaging and per-model thresholds, we demonstrate cross-session endpoint verification with a 0.83% breach rate (119/120 correct identifications across three temporal sessions); per-model thresholds eliminate all breaches on this dataset. We observe a robustness phase transition governed by enrollment depth. Under single-session enrollment, prompt selection is load-bearing: the majority of bootstrapped banks fail to separate the six endpoints. Under two-session enrollment, bank sensitivity collapses on this dataset, and a bank compiler produces small compiled banks that exceed the margin of larger uncompiled banks. A dimensionless robustness parameter SNR(K,S) unifies both axes: prompt count K and enrollment depth S jointly govern the transition from bank-sensitive to bank-robust verification. We discuss operational implications for re-enrollment cadence and template management in production deployments. Addendum (02/26/2026): Post-publication results extend this framework in two directions. A distillation experiment across six training protocols demonstrates that a model's structural fingerprint (weight-geometry regime) is completely invariant to knowledge distillation, while its functional fingerprint (PPP-residual template) converges 31--52% toward the teacher's — enabling forensic detection of distillation provenance through API measurements alone. A conditional impossibility theorem, machine-checked in Coq (41 theorems, 0 Admitted), proves that no standalone model can spoof another's PPP-residual template across independent challenge prompts without exhausting its KL divergence budget, under four explicit trust assumptions. Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
George Chidera Akor, Love Allen Chijioke Ahakonye, Jae Min Lee, Dong-Seong Kim
Zero-knowledge machine learning (ZKML) enables verifiable inference on private data, but deploying convolutional neural networks (CNNs) in production remains constrained by a multi-dimensional tradeoff between proof-generation latency, bandwidth consumption, and computational complexity. Existing ZKML frameworks and engineering blogs provide qualitative heuristics, yet practitioners lack systematic, layer-level measurements to guide architecture design under these constraints. This work presents the first systematic, layer-level characterization of CNN component costs in EZKL, a Halo2-based ZKML framework targeting EVM-compatible blockchains. We profile 8 feasible layer types (activations, pooling, normalization, and linear) across two EZKL precision settings (scale 7 and 10), measuring proof-generation time, proof size, circuit complexity, and peak memory in 26 experiments. We reveal critical infrastructure requirements by documenting 10 additional experiments that exceeded hardware limits (Conv2d operations, LayerNorm, and ReLU-based composite CNNs requiring$>125\ \text{GB}$RAM). Contrary to conventional wisdom, we find that precision configuration has a negligible performance impact ($1.002 \times$ratio), and that system RAM, not GPU VRAM, is the primary bottleneck. We release an open-source profiling toolkit and a public dataset that enable practitioners to query expected costs for their architectures and constraints.
Adversarial Robustness in Machine Learning
Advanced Neural Network Applications
Physical Unclonable Functions (PUFs) and Hardware Security
Muhammad Sannan Khaliq, Love Allen Chijioke Ahakonye, Jae Min Lee, Dong-Seong Kim
With the rapid proliferation of blockchain technology and smart contracts in consumer IoT systems, ensuring digital trust and security remains a persistent challenge due to vulnerability diversity, data scarcity, and limited on-chain auditability. To address these issues, this paper presents PureChain, a scalable trust framework that integrates semi-supervised deep learning for smart contract vulnerability detection with blockchain-based audit logging for transparent security assurance. The framework employs a lightweight Conv1D neural architecture trained via iterative pseudo-labeling and a Mean Teacher strategy, effectively leveraging tens of thousands of unlabeled contracts to minimize annotation requirements. Experimental evaluation shows that PureChain achieves macro F1-scores exceeding 99% and significant improvements in recall for rare vulnerabilities, outperforming both supervised and state-of-the-art baselines. The integration of blockchain ensures all detection events are immutably recorded, enabling accountable and verifiable device operation. These results demonstrate that adaptive semi-supervised learning, combined with on-chain transparency, provides a robust and efficient foundation for secure smart contract monitoring across IoT and edge environments, with future work targeting more adaptive pseudo-labeling, semi supervised learning (SSL) techniques and cross-chain generalization.
Abstract As artificial intelligence (AI) systems become increasingly integrated into critical applications, ensuring trust in their outputs has emerged as a central challenge. Verifiable machine learning (ML) is one approach to addressing this challenge, providing guarantees that results are both correct and reproducible. Existing paradigms, however, provide only partial solutions: zero-knowledge ML (ZKML) achieves strong cryptographic assurances but suffers from limited scalability and high resource costs, while optimistic ML (OPML) supports a wider range of models but relies on economic incentives and long dispute periods. In this work, we propose zk-OPML, a novel hybrid framework that integrates optimistic verification with zero-knowledge proofs (ZKPs). The approach decomposes ML inference into operator-level computations, selectively generating ZKPs for isolated ONNX operators, while retaining the scalability of the optimistic paradigm. We present a prototype implementation and evaluate its performance by benchmarking it against ZKML and OPML. Our results show that zk-OPML achieves faster verification for more complex inference tasks and scales more effectively to larger models, while avoiding the excessive costs of end-to-end ZKML. The modular design of zk-OPML further enables future extensions with the latest advances in the field of ZK.
Open access
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security
SARMF (Smart Contract Automated Remediation and Mitigation Framework) is a structured and reproducible security engineering pipeline designed for vulnerability detection, taxonomy alignment, automated remediation, and adversarial validation of Ethereum-compatible smart contracts. This operational protocol presents a structured workflow for smart contract vulnerability detection and automated mitigation within blockchain-based systems. The methodology integrates deterministic environment setup, multi-tool static analysis, vulnerability normalization using standardized taxonomies, rule-based automated patch generation, and dynamic adversarial validation. By combining static detection tools with controlled refactoring patterns and behavioral verification, the framework ensures reproducibility, traceability, and measurable performance impact assessment. The protocol concludes with comprehensive audit reporting and archival procedures to support transparency and independent verification. This workflow provides a systematic foundation for secure smart contract lifecycle management in decentralized applications. Unlike traditional audit checklists, this framework operationalizes vulnerability detection, taxonomy alignment, automated remediation generation, and validation feedback loops into a unified reproducible security engineering pipeline. Key Contributions of SARMF: Deterministic environment and compilation reproducibility model. Unified multi-tool vulnerability normalization aligned with SWC taxonomy. Rule-based automated mitigation generation preserving semantic integrity. Iterative validation loop combining static, adversarial, and fuzz testing. Structured audit archival enabling independent verification and traceability.
As neural language models are deployed in regulated domains, verifiable model provenance becomes a critical security requirement. We construct an Inference-Time Physical Unclonable Function (IT-PUF) that provides a challenge-response authentication protocol for neural networks, achieving zero false acceptances across 1,012 comparisons spanning 23 models and 16 vendor families. The IT-PUF derives its entropy from a geometrically intrinsic behavioral fingerprint—the delta-gene (the third pre-softmax logit gap)—which we prove is invariant to inference temperature and empirically validate as invariant across six distinct neural architectures. We provide a formal impossibility result for fingerprint spoofing: an interval-splitting theorem proves that no adversarial Kullback-Leibler (KL) budget can simultaneously close the fingerprint gap and avoid detection via accumulated noise. To establish that this security does not degrade at scale, we validate an Equation of State across three independent model families spanning a 147x parameter range (0.5B to 72B). We falsify the assumption of unbounded stiffness but discover a strict positive empirical floor (S_min = 1.1797), from which the Cramér-Rao bound guarantees a computable minimum spoofing cost. The theoretical foundation is formally verified in the Coq proof assistant: 311 theorems across 16 files, with zero uses of "Admitted" and zero vacuous definitions. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Newest addition: Technical Note: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Adversarial Robustness in Machine Learning
Generative Adversarial Networks and Image Synthesis
Wyatt Benno, Alberto Centelles, Antoine Douchet, Khalil Gibran
We present Jolt Atlas, a zero-knowledge machine learning (zkML) framework that extends the Jolt proving system to model inference. Unlike zkVMs (zero-knowledge virtual machines), which emulate CPU instruction execution, Jolt Atlas adapts Jolt's lookup-centric approach and applies it directly to ONNX tensor operations. The ONNX computational model eliminates the need for CPU registers and simplifies memory consistency verification. In addition, ONNX is an open-source, portable format, which makes it easy to share and deploy models across different frameworks, hardware platforms, and runtime environments without requiring framework-specific conversions. Our lookup arguments, which use sumcheck protocol, are well-suited for non-linear functions -- key building blocks in modern ML. We apply optimisations such as neural teleportation to reduce the size of lookup tables while preserving model accuracy, as well as several tensor-level verification optimisations detailed in this paper. We demonstrate that Jolt Atlas can prove model inference in memory-constrained environments -- a prover property commonly referred to as \textit{streaming}. Furthermore, we discuss how Jolt Atlas achieves zero-knowledge through the BlindFold technique, as introduced in Vega. In contrast to existing zkML frameworks, we show practical proving times for classification, embedding, automated reasoning, and small language models. Jolt Atlas enables cryptographic verification that can be run on-device, without specialised hardware. The resulting proofs are succinctly verifiable. This makes Jolt Atlas well-suited for privacy-centric and adversarial environments. In a companion work, we outline various use cases of Jolt Atlas, including how it serves as guardrails in agentic commerce and for trustless AI context (often referred to as \textit{AI memory}).
Arka Pal, Louai Zahran, William Gvozdjak, Akilesh Potti · 5 authors
As large language models (LLMs) continue to grow in size, fewer users are able to host and run models locally. This has led to increased use of third-party hosting services. However, in this setting, there is a lack of guarantees on the computation performed by the inference provider. For example, a dishonest provider may replace an expensive large model with a cheaper-to-run weaker model and return the results from the weaker model to the user. Existing tools to verify inference typically rely on methods from cryptography such as zero-knowledge proofs (ZKPs), but these add significant computational overhead, and remain infeasible for use for large models. In this work, we develop a new insight -- that given a method for performing private LLM inference, one can obtain forms of verified inference at marginal extra cost. Specifically, we propose two new protocols which leverage privacy-preserving LLM inference in order to provide guarantees over the inference that was carried out. Our approaches are cheap, requiring the addition of a few extra tokens of computation, and have little to no downstream impact. As the fastest privacy-preserving inference methods are typically faster than ZK methods, the proposed protocols also improve verification runtime. Our work provides novel insights into the connections between privacy and verifiability in LLM inference.
Eduardo Sardenberg, Antonio José G. Busson, Daniel de Sousa Moraes, Julio Cesar Duarte · 5 authors
Smart contracts play a central role in blockchain systems by encoding financial and operational logic. Still, their susceptibility to subtle security flaws poses significant risks of financial loss and erosion of trust. LLMs create new opportunities for automating vulnerability detection, yet the effectiveness of different prompting strategies and model choices in real-world contexts remains uncertain. This paper evaluates state-of-the-art LLMs on Solidity smart contract analysis using a balanced dataset of 400 contracts under two tasks: (i) Error Detection, where the model performs binary classification to decide whether a contract is vulnerable, and (ii) Error Classification, where the model must assign the predicted issue to a specific vulnerability category. Models are evaluated using zero-shot prompting strategies, including zero-shot, zero-shot Chain-of-Thought (CoT), and zero-shot Tree-of-Thought (ToT). In the Error Detection task, CoT and ToT substantially increase recall (often approaching ~ 95--99%), but typically reduce precision, indicating a more sensitive decision regime with more false positives. In the Error Classification task, Claude 3 Opus attains the best Weighted F1-score (90.8) under the ToT prompt, followed closely by its CoT.
Semantic communication is a paradigm shift in wireless systems that transmits semantic information, such as intent, context, and meaning, instead of raw data to reduce redundant data. At its core, semantic knowledge bases (SKBs) store and organize the contextual knowledge required for accurate encoding, decoding, and reasoning over semantic information. Recently, large language models (LLMs), pretrained on massive and diverse text corpora, have been integrated into SKBs to generate high-quality semantic embeddings, enable zero-shot retrieval of relevant knowledge, and support complex inference tasks across a wide range of domains. However, since the training corpus of LLM may include outdated, malicious, or privacy-sensitive content, LLM-enabled SKBs should be updated efficiently and verifiably to remove specific data without retraining from scratch. In this article, we first conduct a survey on related works and then propose a model-agnostic proof of unlearning framework for LLM-driven SKBs in semantic communications. Specifically, we track the evolution of the unlearning process by measuring drifts in the LoRA adapter subspace. We then execute successive reverse steps and generate the proof trace that a verifier can compare to provide a quantitative and verifiable unlearning guarantee. Finally, experimental results demonstrate the effectiveness of our proposed framework.