We propose Trustless Agent Swarms, a framework enabling privacy-preserving coordination among autonomous AI agents on EVM-compatible blockchains. Our system integrates four cryptographic primitives: (1) Groth16 zero-knowledge proofs for proving reputation thresholds without revealing scores; (2) EIP-5564 stealth addresses for unlinkable fund transfers; (3) ERC-4337 account abstraction for gasless autonomous execution; and (4) Semaphore for anonymous group signaling. We implement a 586-constraint reputation proof circuit and deploy five smart contracts on Base Sepolia. Proof generation: 580ms. On-chain verification: 407,576 gas.
Everybody is these days plunging into decentralized applications, blockchain, and digital identity. And honestly, it's a rendering that the ancient method of authenticating yourself looks nice, outdated and risky. Whenever you give up your personal info, you are just wishing it does not find its way into a data leak or get misused. Precisely, this is the reason that we constructed a new path to manage identity checks that really care about your privacy. This is what we are doing: our framework is based on Ethereum Attestation Service (EAS) and Zero-Knowledge Proofs (ZKPs). To begin with, we generate offchain attestations based on the EIP-712 standard. Your signature remains verifiable; however, your confidential information doesn't go anywhere and through which we squeeze these attestations. SP1 using zero-knowledge virtual machine (zkVM) this step checks everything twice, the construction, the encryption, the logic, all of it. When it's all good then the system will spit a short, non-interactive Groth16 or Plonk (if)SNARK proofs known as zero-knowledge proofs (you're curious). This evidence makes things private and at the same time accurate. There is the interesting side of it: you can check it immediately in your local devices using a super lightweight browser or with a Node.js app WebAssembly verifier. It does not require any middlemen and there is no need for extra trust. You can send evidences, in case you wish to using Solidity contract on-chain. This allows the system to issue new fraudulent statements such as isOver18 = true without displaying your actual age or any other personal data. So what does this mean? You earn greater confidence, enhanced interoperability and connections through decentralize systems. Transparency is what you have with this of ZKP attestation and actual privacy. It's actually practical, as well, can be used with KYC, DeFi, age-requiring app checks, and secured access controls. Essentially, it is a huge leap higher on behalf of anonymity and trust in electronic self.
This study proposes the multi-layered Decentralised Autonomous Identity System (DAIS) for safe, scalable, and policy-aware identity management for autonomous AI agents. DAIS uses distributed ledgers, trust registries, cryptographic credential processing, and adaptive governance principles to authenticate and authorise without central authority. For security and operational reliability, the architecture uses efficient verification techniques, Byzantine fault-tolerant consensus, hierarchical credential state management, and behaviour-aware trust scoring. The mathematical definitions of credential validation, revocation propagation, and consensus guarantees show how DAIS accomplishes constant-time verification and quick revocation dissemination over distributed systems. A 50-agent testbed, PBFT-based registry duplicates, and enterprise-grade hardware were used to evaluate DAIS to OAuth 2.0 and OpenID Connect under identical settings. DAIS regularly outperforms centralised solutions in latency, revocation speed, computational overhead, interoperability, and scalability, improving verification time by fourfold and revocation responsiveness by sixteen-fold. These findings show that DAIS is a durable, high-performance, and future-ready identification infrastructure for large autonomous agent ecosystems.
Zibin Lin, Taotao Wang, Shengli Zhang, Long Shi · 6 authors
Web 3.0 platforms need an onboarding mechanism that can admit real users at scale without forcing them to reveal identity documents or pay one on-chain verification cost per user. Existing approaches typically rely on KYC-style disclosure, per-request on-chain verification, or trusted batching, making onboarding cost and latency difficult to predict under bursty demand. We present \textbf{ZK-AMS}, a credibly anonymous admission infrastructure that maps Personhood Credentials to anonymous on-chain Soul Accounts. Rather than introducing a new primitive, ZK-AMS composes zero-knowledge credential validation, permissionless batch submission, recursive proof aggregation, and anonymous post-admission account provisioning into one end-to-end workflow. Its key design feature is a confidential batching pipeline in which admission instances of a common relation are folded off-chain under multi-key homomorphic encryption, allowing an untrusted batch submitter to coordinate aggregation without direct access to individual user witnesses during batching; the confidentiality scope is characterized explicitly in the security analysis. The resulting batch is settled on-chain with constant verification cost per batch rather than per admitted user. We implement ZK-AMS on an Ethereum testbed and evaluate admission throughput, end-to-end latency, gas consumption, and parameter trade-offs. Results show stable batch-verification gas across evaluated batch sizes, substantially lower amortized on-chain cost than the non-recursive baseline, and practical cost-latency trade-offs for high-concurrency onboarding in Web 3.0 platforms.
Atefeh Nekouie, Majid Vafaei Jahan, Mohammad Hossein Moattar, Reza Sheibani
Access control and data privacy are two of the main necessities in managing electronic health records (EHRs) across distributed domain. There are privacy gaps that expose EHRs to risks like unauthorized access by unaffiliated medical personnel. Traditional attribute-based encryption (ABE) allows encryption based on user attributes but is unable to incorporate data-specific attributes, such as the type of medical information included in the record or the potential physician. This paper introduces a novel approach that integrates ABE with large language models (LLMs) and blockchain technology to enhance security and contextual access control in EHR systems. Specifically, a domain-specific LLM, such as ClinicalBERT, is leveraged to automatically extract semantic data attributes from unstructured medical records, enabling a more granular and context-aware encryption process. By embedding both user and data attributes into the ABE framework, access policies are dynamically refined, ensuring that only authorized users can view specific types of medical information. Furthermore, blockchain's immutable ledger enhances trust, streamlines attribute revocation, and fortifies the system against unauthorized modifications and security threats. The proposed framework significantly strengthens EHR privacy by integrating machine learning-driven attribute extraction with cryptographic access control, outperforming existing schemes in both security and flexibility. Evaluations validate the effectiveness of the proposed framework in preventing unauthorized access while maintaining efficient and transparent data management.
Zero-knowledge (ZK) proofs can be formally correct while their deployment pipelines remain fragile. The practical failure modes often arise not at the proof layer, but at the layers where trust is injected: setup, key custody, entropy sourcing, implementation, governance, and deployment interfaces. This paper models ZK pipelines as trust-graphs and proposes an audit-first separation between (i) proof correctness and (ii) pipeline integrity. The core claim is structural: for any non-trivial ZK pipeline, there exists at least one responsibility binding layer R where trust is required and accountability must be assigned. Removing a ceremony does not remove responsibility; it relocates it. We provide minimal definitions, a traceable audit interface, and compact structural examples intended to support reproducible security reviews without overclaiming. Keywords: zero-knowledge; trusted setup; CRS; SNARK; STARK; trust graph; audit; governance; pipeline integrity; responsibility relocation
Digitization of healthcare has provided opportunities for improving patient care but also has brought with it major security vulnerabilities that could compromise the confidentiality, availability, and integrity of protected health information. This article reviews the proposed distributed system constructs for providing health data security between heterogeneous systems, organizations, and multiple institutions. It categorizes and reviews three approaches to distributed healthcare security: (1) Advanced Encryption Algorithms, including symmetric, asymmetric and homomorphic algorithms for encrypting health information-at-rest and in-transit, and key management mechanisms for secure access to cryptographic material across multiple nodes that may not be trusted; (2) Distributed Storage Systems, including distributed-ledger technology (DLT), distributed file systems, and fragmentation approaches for immutable patient consent and audit trail logging, redundancy to tolerate physical node compromise, and avoiding total infrastructure data loss due to localized security attacks; and (3) Access Control Mechanisms, including multi-factor authentication, role-based access control, attribute-based access control, federated identity management for distributed healthcare organizations, and patient access control and monitoring for distributed threat detection. The distributed model is now more attractive in modern health systems. Perimeter security models do not adequately protect health data. The health data moves through networks connecting hospitals, outpatient clinics, clinical research organizations, insurance companies, and third-party organizations. The proposed framework satisfies regulations according to HIPAA, the General Data Protection Regulation (GDPR), and the Health Information Technology for Economic and Clinical Health (HITECH) Act. The system can be performance optimized to balance between cryptographic strength and system responsiveness. The combination of encryption, decentralized storage, and access control provides defense-in-depth protection against cyberattacks. Future developments, such as artificial intelligence-enabled threat detection, quantum-resistant cryptographic algorithms and models for patient data control will shape how to create secure healthcare systems in our growing digital health networks.
Raman Chadha, Paras Mahajan, Rajat Gupta, Sunil Khullar
The centralized nature of the existing digital identity infrastructure provides single points of failure and potential breaches of user privacy. This work proposes a decentralized infrastructure for managing digital identities using a permissioned blockchain and W3C-compliant Decentralized Identifiers and Verifiable Credentials together with zero-knowledge proofs to support a user-controlled and privacy-preserving identity verification process. The experiment verifies the ability of the proposed infrastructure to handle up to 155 transactions in the verification process in 105 ms for a maximum of 500,000 users without the possibility of egress operations as a potential threat to perform unauthorized access to the personal user information. User test participants are satisfied with the design of the wallet interface and the management of the corresponding consents. Process analysis indicates the feasibility of the designed infrastructure in complying with the key principles of the GDPR and CCPA regulations.
Censorship resistance is a core value of Web3, yet practical access to decentralized websites remains dependent on centralized gateways such as ipfs.io, .link, and .limo, which are susceptible to regulatory takedowns and availability limitations. This paper investigates the technical barriers to truly censorship-resistant access in decentralized web architectures and presents an engineering-driven analysis of dweb3.wtf, a dedicated rendering gateway developed within the Web3Compass infrastructure. The system directly interfaces with decentralized name systems such as ENS and Unstoppable Domains, autonomously resolves content hashes via on-chain resolvers, and renders the associated IPFS-hosted sites via self-hosted infrastructure. By eliminating reliance on third-party APIs and centralized frontends, the gateway offers a robust alternative to Web2-style intermediaries. This paper presents the architecture, implementation, and performance characteristics of dweb3.wtf, evaluating its effectiveness in ensuring access continuity, domain coverage, and reduced external dependency.
Traditional credential verification depends on centralized authorities and manual validation, which are often slow, expensive, and vulnerable to manipulation. This paper presents AnonHire, a decentralized system that enables secure, privacy-preserving verification of academic and employment credentials. The framework combines Self-Sovereign Identity (SSI), blockchain anchoring, InterPlanetary File System (IPFS) storage, and a mock Zero-Knowledge Proof (ZKP) layer for selective disclosure. Using Ethereum Sepolia smart contracts and an Express-Next.js stack, AnonHire provides credential issuance, verification, and revocation with minimal on-chain data and sub-second verification. Evaluations show low latency, low gas usage, and a practical path toward scalable, privacy-aware hiring ecosystems.
Multi-implementation systems are increasingly audited against natural-language specifications. Differential testing scales well when implementations disagree, but it provides little signal when all implementations converge on the same incorrect interpretation of an ambiguous requirement. We present SPECA, a Specification-to-Checklist Auditing framework that turns normative requirements into checklists, maps them to implementation locations, and supports cross-implementation reuse. We instantiate SPECA in an in-the-wild security audit contest for the Ethereum Fusaka upgrade, covering 11 production clients. Across 54 submissions, 17 were judged valid by the contest organizers. Cross-implementation checks account for 76.5 percent (13 of 17) of valid findings, suggesting that checklist-derived one-to-many reuse is a practical scaling mechanism in multi-implementation audits. To understand false positives, we manually coded the 37 invalid submissions and find that threat model misalignment explains 56.8 percent (21 of 37): reports that rely on assumptions about trust boundaries or scope that contradict the audit's rules. We detected no High or Medium findings in the V1 deployment; misses concentrated in specification details and implicit assumptions (57.1 percent), timing and concurrency issues (28.6 percent), and external library dependencies (14.3 percent). Our improved agent, evaluated against the ground truth of a competitive audit, achieved a strict recall of 27.3 percent on high-impact vulnerabilities, placing it in the top 4 percent of human auditors and outperforming 49 of 51 contestants on critical issues. These results, though from a single deployment, suggest that early, explicit threat modeling is essential for reducing false positives and focusing agentic auditing effort. The agent-driven process enables expert validation and submission in about 40 minutes on average.
Digital identity verification is central to trust management on the evolving decentralized web. Traditional web-based identity models, which are heavily centralized and dependent on trusted intermediaries, pose significant challenges related to user privacy, data security, and regulatory compliance, especially in sensitive contexts such as Know Your Customer (KYC) processes. This paper introduces a novel privacy-preserving KYC verification framework leveraging Zero-Knowledge Proofs (ZKPs), Self-Sovereign Identity (SSI), Decentralized Identifiers (DIDs), and smart contracts, explicitly designed as a decentralized trust infrastructure for web-based interoperable payments. Our approach enables users to verify their identities across multiple platforms without revealing sensitive personal information, thereby significantly reducing long-term reliance on centralized authorities and enhancing user control and privacy. Furthermore, our system achieves cross-chain interoperability, ensuring that identity verification credentials can be securely and efficiently recognized across diverse Web3 ecosystems. We present a detailed prototype implementation of our DID framework, highlighting its ability to meet regulatory requirements while ensuring seamless interoperability across platforms. Comprehensive performance evaluations, including metrics on proof generation time, gas consumption, and transaction costs, demonstrate that the framework achieves low-latency verification and efficient execution, making it suitable for high-throughput, web-scale deployment.
The rapid proliferation of distributed and decentralized IT architectures—ranging from cloud-native microservices and edge computing to blockchain-based ecosystems—has fundamentally eroded the efficacy of traditional, centralized information security governance (ISG). As organizational perimeters dissolve into federated, multi-actor, and ephemeral environments, the hierarchical model of a single governing authority enforcing uniform policy becomes not only obsolete but actively detrimental to system resilience. This research examines the critical governance tension between the necessity for central control to manage aggregate risk and the operational reality of local autonomy required for distributed system performance. By adopting a coordination-theoretic lens, this article conceptualizes security governance not as a static command structure but as a dynamic, distributed coordination problem. The study identifies and analyzes specific mechanisms for aligning security responsibilities, decision rights, and assurance processes across autonomous nodes without relying on a single root of trust or a monolithic control plane. Key insights reveal that effective governance in decentralized environments depends on the implementation of polycentric decision-making frameworks, the utilization of automated policy-as-code enforcement, and the adoption of consensus-based assurance mechanisms. The findings suggest that a shift from "governance by mandate" to "governance by protocol" is essential for securing the next generation of digital infrastructure.
Nacereddine Sitouah, Francesco Bruschi, Stefano De Cillis
The passing of the eIDAS amendment marks an important milestone for EU countries and changes how they must manage digital credentials for both public services and businesses. Italy has led in adopting eIDAS, first with CIE and SPID identity schemes, and now with the Italian Wallet (IO app) aligned to eIDAS 2.0. Self-Sovereign Identity (SSI) is a decentralized model born from the success of Distributed Ledgers, giving individuals full control over their digital identity. The current eIDAS 2.0 and its implementation acts diverge from SSI principles, rendering the European Digital Identity Wallet (EUDIW) centralized and merely user-centric, prioritizing security and legal protection over true self-sovereignty. This paper proposes an architecture that enables the use of IT Wallet credentials and services in an SSI-compliant environment through Trusted Execution Environments and Zero-Knowledge Proofs.
Walter Kurz, Michel Malara, Wojtek Stricker, Eva Albrecht
The objective of this study is to define a compliance-first, conceptually generalisable architecture for a multi-agent artificial intelligence platform integrated with distributed ledger technology, designed to be domain-, deployment-, and vendor-agnostic. It addresses a persistent shortcoming in current AI deployments, where compliance is often treated as a secondary concern, applied retroactively through prompt engineering rather than embedded within the foundational design. The proposed model encodes regulatory, governance, and ESG requirements into an objective-under-constraints framework, ensuring that all specialised agents operate within legally admissible and verifiably auditable parameters prior to any domain-specific implementation. A DAG-based verification layer is incorporated to enable scalable, low-latency, and cost-efficient operation while preserving evidentiary integrity. The analysis evaluates the feasibility of this conceptual model to support sustainable, rapid-deployment vertical applications without inducing vendor lock-in, preserving operational neutrality, and ensuring environmental accountability. The findings suggest that integrating compliance, ESG metrics, and agent specialisation at the architectural level provides a transferable foundation for cross-domain AI–DLT infrastructures.
The increasing demand for autonomous and open peer-to-peer (P2P) data sharing has driven the widespread adoption of decentralized file systems, such as the InterPlanetary File System (IPFS). However, decentralized data sharing inherently requires distributed access control mechanisms due to the absence of centralized authorities. Although blockchain-based access control has become a primary solution, the public nature of blockchain can unintentionally reveal user attributes, posing significant privacy risks. To address the leakage of attribute sets in blockchain, we propose zk-Guard, a decentralized access control framework integrating blockchain and zero-knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs) tailored for IPFS. To further improve the efficiency of zero-knowledge policy checking and reduce the delay of policy updating, we employ a universal constraint circuit and encode policies into sparse configuration matrices, achieving fine-grained, rapid policy updates without regenerating proving keys while guaranteeing constant-time verification regardless of policy complexity. Additionally, to prevent repeated permission checks for large f iles and improve system responsiveness, zk-Guard integrates Merkle Tree Proof (MTP) mechanisms to securely link sub-data blocks to their root block. Comprehensive theoretical complexity analysis and extensive experiments demonstrate that zk-Guard achieves substantial performance improvements over existing schemes, with constant-time proof verification under 2.5 ms enabling efficient data retrieval, and policy deployment and updates completed within 0.2 seconds even for 1,000 attributes. The source code is available at https://github.com/ningboliucug/zk-Guard.
Student Information Management Systems (SIMS) are mission critical to higher learning institutions because they govern admissions, registration, fee status, assessment results, progression, graduation, and alumni verification. Yet conventional centralized SIMS architectures may face persistent challenges: record tampering risk, weak end‑to‑end audit trails, fragmented reconciliation across units and campuses, slow and costly credential verification, and limited interoperability with external verifiers.This study develops a conceptual and technical framework for applying Distributed Ledger Technology (DLT) to strengthen SIMS at the Tanzania Institute of Accountancy (TIA). The framework positions DLT as a trust and interoperability layer rather than a replacement for SIMS. It proposes (i) an architecture that anchors cryptographic proofs on‑chain while keeping personal data off‑chain; (ii) standards based digital credentialing using W3C Verifiable Credentials and Decentralized Identifiers; (iii) governance and compliance controls aligned to Tanzanian data protection and cybercrime regimes; and (iv) an implementation roadmap and evaluation metrics grounded in established information systems theories. To make design trade‑offs concrete, the study includes simulated calculations and figures for event volume, storage growth, verification turnaround time, and risk intensity across rollout phases. The framework provides a practical blueprint for a staged pilot at TIA starting with credential verification and assessment audit‑trail anchoring before scaling to additional workflows.
The increasing adoption of distributed ledger technology (DLT) in healthcare promises enhanced data security, integrity, and patient control. This study evaluates the characteristics and security implications within a simulated Electronic Health Record (EHR) network, comprising 1,800 records. The analysis focuses on network access control (Access Policy), data integrity mechanisms (Record Hash), and the incidence of security risks (Malicious Node). The records show a near-even split between 'Read/Write' (50.06%) and 'Read-Only' (49.94%) access policies. Crucially, findings reveal that the presence of a Malicious Node (50.72% of records) is highly uniform across both 'Read-Only' (50.95%) and 'Read/Write' (50.5%) policies, indicating that basic access control alone is ineffective at mitigating security risks within this network. This highlights the need for dynamic, context-aware smart contracts that incorporate behavioural or clinical risk factors for enhanced security.
The rapid integration of IoT with edge computing has revolutionized various domains, particularly healthcare, by enabling real-time data sharing, remote monitoring, and decision-making. However, it introduces critical challenges, including data privacy breaches, security vulnerabilities, especially in environments dealing with sensitive information. Traditional access control mechanisms and centralized security systems do not address these issues, leaving IoT environments exposed to unauthorized access and data misuse. This research proposes Fuzzychain-edge, a novel Fuzzy logic-based adaptive Access control model for Blockchain in Edge Computing framework designed to overcome these limitations by incorporating Zero-Knowledge Proofs (ZKPs), fuzzy logic, and smart contracts. ZKPs secure sensitive data during access control processes by enabling verification without revealing confidential details, thereby ensuring user privacy. Fuzzy logic facilitates adaptive, context-aware decision-making for access control by dynamically evaluating parameters such as data sensitivity, trust levels, and user roles. Blockchain technology, with its decentralized and immutable architecture, ensures transparency, traceability, and accountability using smart contracts that automate access control processes. The proposed framework addresses key challenges by enhancing security, reducing the likelihood of unauthorized access, and providing a transparent audit trail of data transactions. Expected outcomes include improved data privacy, accuracy in access control, and increased user trust in IoT systems. This research contributes significantly to advancing privacy-preserving, secure, and traceable solutions in IoT environments, laying the groundwork for future innovations in decentralized technologies and their applications in critical domains such as healthcare and beyond.
Contemporary organizational ecosystems are critically vulnerable in third-party risk management frameworks due to centralized databases, fragmented documentation systems, and manual processes of assessment. Traditional approaches result in huge inefficiencies through redundant audits, version control complexities, and delayed responses for compliance along multi-jurisdictional vendor networks. The blockchain architecture introduces a fundamental architectural transformation through distributed ledger mechanisms, creating immutable audit trails, cryptographic verification protocols, and decentralized trust formation across organizations. The article reviews how blockchain works as an integrity infrastructure within regulatory technology ecosystems, allowing the automation of compliance through smart contracts, making transparent records available for authorized stakeholders, and removing single-point vulnerabilities from centralized control systems. The technical mechanisms for implementation include immutable vendor record systems, which integrate fragmented documentation into unified, tamper-proof ledgers; smart contract automation that allows deterministic outcomes in governance; and distributed assurance networks, which allow audit verification among multiple organizations. Regulatory dimensions are related to preserving privacy through hybrid on-chain and off-chain architectures, legal recognition challenges of smart contracts within jurisdictional frameworks, and ethics in governance requirements for human input within automated ecosystems of decisions. Implementation challenges involve the complexity of legacy system integration, the development of a structure for consortium governance, scalability constraints, and the scarcity of talent. Future trajectories include hybrid ecosystems, integrating blockchain's immutability with advanced analytics, tokenized reputation frameworks, and integrations with emerging technologies such as artificial intelligence and digital identity systems toward next-generation vendor risk governance.
Permissionless consensus protocols require a scarce resource to regulate leader election and provide Sybil resistance. Existing paradigms such as Proof of Work and Proof of Stake instantiate this scarcity through parallelizable resources like computation or capital. Once acquired, these resources can be subdivided across many identities at negligible marginal cost, making linear Sybil cost fundamentally unattainable. We introduce Proof of Commitment (PoCmt), a consensus primitive grounded in a non-parallelizable resource: real-time human engagement. Validators maintain a commitment state capturing cumulative human effort, protocol participation, and online availability. Engagement is enforced through a Human Challenge Oracle that issues identity-bound, time-sensitive challenges, limiting the number of challenges solvable within each human window. Under this model, sustaining multiple active identities requires proportional human-time effort. We establish a cost-theoretic separation showing that protocols based on parallelizable resources admit zero marginal Sybil cost, whereas PoCmt enforces a strictly linear cost profile. Using a weighted-backbone analysis, we show that PoCmt achieves safety, liveness, and commitment-proportional fairness under partial synchrony. Simulations complement the analysis by isolating human-time capacity as the sole adversarial bottleneck and validating the predicted commitment drift and fairness properties. These results position PoCmt as a new point in the consensus design space, grounding permissionless security in sustained human effort rather than computation or capital.