Engram Commitments introduce a cryptographically verifiable, substrate-rooted identity primitive for large language models. The method extracts engrams from differential execution behavior, aggregates them into an engram vector, compresses this representation using locality-sensitive hashing, and seals it inside a binding-and-hiding cryptographic commitment. Zero-knowledge proofs enable verification of identity continuity and lineage without revealing model parameters. The construction remains stable under non-destructive transformations and degrades predictably under destructive ones, supporting collapse-aware auditing, tamper-evident provenance, and regulator-verifiable attestation. This work unifies the engram calculus, identity ontology, collapse taxonomy, and cryptographic commitments into a single framework for AI provenance, governance, and safety.
A Software Bill of Materials (SBOM) is a key component for the transparency of software supply chain; it is a structured inventory of the components, dependencies, and associated metadata of a software artifact. However, an SBOM often contain sensitive information that organizations are unwilling to disclose in full to anyone, for two main concerns: technological risks deriving from exposing proprietary dependencies or unpatched vulnerabilities, and business risks, deriving from exposing architectural strategies. Therefore, delivering a plaintext SBOM may result in the disruption of the intellectual property of a company. To address this, we present VeriSBOM, a trustless, selectively disclosed SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs. Within VeriSBOM, third parties can validate specific statements about a delivered software. Respectively, VeriSBOM allows independent third parties to verify if a software contains authentic dependencies distributed by official package managers and that the same dependencies satisfy rigorous policy constraints such as the absence of vulnerable dependencies or the adherence with specific licenses models. VeriSBOM leverages a scalable vector commitment scheme together with folding-based proof aggregation to produce succinct zero-knowledge proofs that attest to security and compliance properties while preserving confidentiality. Crucially, the verification process requires no trust in the SBOM publisher beyond the soundness of the underlying primitives, and third parties can independently check proofs against the public cryptographic commitments. We implement VeriSBOM, analyze its security, and evaluate its performance on real-world package registries. The results show that our method enables scalable, privacy-preserving, and verifiable SBOM sharing and validation.
Open access
3 source records
Physical Unclonable Functions (PUFs) and Hardware Security
This paper presents a framework that integrates blockchain-enabled Federated Learning (FL) with consensus mechanisms to mitigate poisoning attacks in healthcare environments. The framework incorporates blockchain consensus mechanisms, with Proof-of-Work (PoW) used as a baseline and Proof-of-Stake (PoS) adopted as the proposed approach; both are evaluated independently within the same Secure Multiparty Computation (SMPC)-enabled federated learning architecture for privacy preservation. The proposed system is evaluated on the OCTMNIST and TissueMNIST datasets under both centralized and federated settings, including poisoning scenarios with 10% and 50% malicious clients. Results show that consensus-aware aggregation reduces the influence of unreliable client updates and improves the robustness of the global model under poisoning conditions. In addition, the framework prioritizes trustworthy client contributions during aggregation, supporting reliable model sharing in collaborative healthcare learning environments. Unlike prior blockchain-based federated learning defenses that introduce heavy cryptographic overhead, the proposed PoS-based aggregation explicitly balances robustness and computational efficiency, enabling practical deployment under high poisoning ratios.
Guilhem Repetto, Nojan Sheybani, Gabrielle De Micheli, Farinaz Koushanfar
Privacy concerns in machine learning systems have grown significantly with the increasing reliance on sensitive user data for training large-scale models. This paper introduces a novel framework combining Probably Approximately Correct (PAC) Privacy with zero-knowledge proofs (ZKPs) to provide verifiable privacy guarantees in trustless computing environments. Our approach addresses the limitations of traditional privacy-preserving techniques by enabling users to verify both the correctness of computations and the proper application of privacy-preserving noise, particularly in cloud-based systems. We leverage non-interactive ZKP schemes to generate proofs that attest to the correct implementation of PAC privacy mechanisms while maintaining the confidentiality of proprietary systems. Our results demonstrate the feasibility of achieving verifiable PAC privacy in outsourced computation, offering a practical solution for maintaining trust in privacy-preserving machine learning and database systems while ensuring computational integrity.
Protecting the intellectual property of large language models (LLMs) is a critical challenge due to the proliferation of unauthorized derivative models. We introduce a novel fingerprinting framework that leverages the behavioral patterns induced by safety alignment, applying the concept of refusal vectors for LLM provenance tracking. These vectors, extracted from directional patterns in a model's internal representations when processing harmful versus harmless prompts, serve as robust behavioral fingerprints. Our contribution lies in developing a fingerprinting system around this concept and conducting extensive validation of its effectiveness for IP protection. We demonstrate that these behavioral fingerprints are highly robust against common modifications, including finetunes, merges, and quantization. Our experiments show that the fingerprint is unique to each model family, with low cosine similarity between independently trained models. In a large-scale identification task across 76 offspring models, our method achieves 100\% accuracy in identifying the correct base model family. Furthermore, we analyze the fingerprint's behavior under alignment-breaking attacks, finding that while performance degrades significantly, detectable traces remain. Finally, we propose a theoretical framework to transform this private fingerprint into a publicly verifiable, privacy-preserving artifact using locality-sensitive hashing and zero-knowledge proofs.
v2: Corrected affiliation domain to pastoral.tech. This paper presents a unified framework for anticipatory cyber defense integrating eight convergent dimensions: adversarial machine learning countermeasures, supply chain and hardware implant analysis, quantum threat transition analysis, attribution resistance with deepfake forensics, autonomous defense game theory, zero-knowledge proof systems for operational security, temporal correlation at scale, and biological-physical security integration. We formalize the Mantis autonomous defense environment as a Gymnasium-compatible reinforcement learning system with self-play training, introduce Chameleon, a five-channel defensive steganography framework using dynamic key rotation and Shamir Secret Sharing, and develop a ZK-Evidence Ledger for cryptographic evidence chains with Merkle tree notarization and Circom-based inclusion proofs. The convergence of these systems produces an anticipatory architecture where offensive research (Helix synthetic organization detection), defensive operations (Mantis game-theoretic simulation), and attribution resistance (zero-knowledge Merkle proofs) form a closed operational loop.
Open access
4 source records
Adversarial Robustness in Machine Learning
Physical Unclonable Functions (PUFs) and Hardware Security
Gradient boosted decision trees, particularly XGBoost, are among the most effective methods for tabular data. As deployment in sensitive settings increases, cryptographic guarantees of model integrity become essential. We present ZKBoost, the first zero-knowledge proof of training (zkPoT) protocol for XGBoost, enabling model owners to prove correct training on a committed dataset without revealing data or model parameters. Naively re-executing XGBoost training in ZK would incur prohibitive costs, primarily due to the oblivious partitioning of training samples and unknown tree splits. Moreover, previous work on ZKP of training and inference had subtle security issues, such as leakage of tree topology and soundness gaps allowing cheating model providers to deviate from the correct execution of training and inference. We make two key contributions to address these challenges: (1) a generic zkPoT template for XGBoost that can be instantiated with any general-purpose ZKP backend, significantly improving prover costs compared to naive re-execution of the training process; and (2) a VOLE-based instantiation that overcomes the security issues of previous ZK proofs of training at minimal costs. To maximize efficiency, we develop a fixed-point version of XGBoost, which is particularly well suited for efficient instantiation of ZKP, and show it matches standard XGBoost accuracy to within 1\% on real-world datasets.
Muhammad Usama, Arshad Aziz, Nada Alasbali, Nazik Alturki · 6 authors
The growing deployment of the Internet of Things (IoT), especially in critical infrastructure, has increased the need for identity systems that are scalable and robust against attacks. However, existing centralized systems have fundamental weaknesses, especially where adversaries use artificial intelligence (AI)-based techniques, such as generative spoofing, model poisoning, and deepfakes to create fake identities. In this paper, we present a novel blockchain-based IoT security system that combines decentralized identity verification, zero-knowledge proofs, Byzantine-resistant federated learning, and formal verification of smart contracts. The proposed architecture eliminates single points of trust, allows device registration while preserving privacy, and provides defense against AI-driven attacks through formally modeled state transitions. Experimental results show that this method shows significant improvements over previous frameworks, including a 48% reduction in false acceptance rate during GAN-based spoofing and speedup the ZKP verification. This work provides a blockchain-enabled identity management system for IoT to encounter AI-based threats and maintain a balance between performance and security with the help of adversarial simulation, symbolic execution, and threshold cryptography.
Front-running attacks have become a threat to blockchain security. By exploiting transaction ordering, attackers use front-running to gain profits on Ethereum-based blockchains. Existing heuristics and ML approaches fail to capture the complex relational dependencies in these attacks. We propose a novel framework by leveraging instruction-tuned large language models, Llama-3.2-3B and Gemma-2-2B, for multi-class front-running detection on Ethereum. Through parameter-efficient fine-tuning with LoRA and an enriched dataset augmented with blockchain metadata from Alchemy and Chainstack, our models achieve up to 96.4 % macro accuracy, surpassing the baseline approach by 8.7 %. We further identify that 256 tokens is the optimal input length while discussing the trade-offs between runtime efficiency and performance. Our findings demonstrate that LLMs are a powerful tool for learning complex transactional patterns, which is crucial for blockchain security.
Existing smart contract vulnerability datasets exhibit over 34% train–test overlap due to repeated function-level code, causing models to favor structural memorization over semantic generalization. To mitigate this issue, we construct a benchmark dataset with zero function overlap between the training and test partitions. Furthermore, we introduce GraphFusionDetect (GFD), a novel approach that integrates fine-tuned CodeBERT embeddings with Graph Neural Networks (GNNs) to capture inter-function dependencies. GFD achieves F1-scores of 80% for detecting reentrancy vulnerabilities and 89% for timestamp dependency vulnerabilities, surpassing baseline methods and enabling more robust and generalizable vulnerability detection.
The EU AI Act (Regulation 2024/1689) imposes strict transparency and human oversight obligations on high-risk AI systems, specifically under Article 14. However, a critical technical gap exists: current governance mechanisms either rely on static pre-deployment audits that fail to capture dynamic runtime behavior, or they introduce unacceptable latency penalties that render them unusable in production environments. This paper presents RuntimeGuard-AI, an asynchronous governance architecture that separates lightweight inline policy enforcement from batch cryptographic attestation.Our design fundamentally resolves the tension between compliance and performance. By decoupling the critical inference path from the heavy cryptographic machinery required for proofs, we achieve a median latency overhead of just 2.3–4.1%, while enabling cryptographically rigorous, tamper-evident audit trails. Theoretically, we formalize the property of Latency Separationand prove that our architecture satisfies it. Empirically, we implement a complete Zero-Knowledge (ZK) attestation pipeline using the Groth16 proving system on the bls12-381 curve. We measure a witness generation time of 62 msand a total proving time of 1,389 msfor 50,000 constraints on a standard CPU. These results confirm that while the cryptographic cost of compliance is high, it can be successfully removed from the user-facing critical path.To our knowledge, this paper provides the first open-source reference implementation of a compliance architecture designed specifically for Article 14. We contribute: (1) a formalized threat model for AI auditing, (2) the RuntimeGuard protocol for sharded Merkle compliance logging, and (3) a systematic evaluation demonstrating that rigorous regulatory compliance is achievable at scale without compromising the user experience.
Sundara Srivathsan M, Lighittha P. R., Prithivraj S., R. Suganya · 5 authors
Web3 platforms face a critical challenge: once unsafe content is minted on-chain, it becomes immutable and irrevocable. Traditional NSFW classifiers operate off-chain without cryptographic guarantees, leaving blockchain ecosystems vulnerable to harmful content. We present VisionGuard, a unified moderation framework that integrates cost-sensitive AI decision-making with blockchain-based enforcement. Our system combines calibrated NSFW classification, abstention-based triage for uncertain cases, perceptual hashing for near-duplicate detection, and on-chain k-of-n quorum attestation using EIP-712 signatures. We establish formal guarantees for: (i) Bayes-optimal cost-sensitive thresholds minimizing asymmetric error costs, (ii) optimal abstention intervals for human review, (iii) monotone false-negative reduction under classifier-pHash fusion, (iv) quorum compromise bounds, and (v) end-to-end unsafe-mint probability. Empirical validation on a zero-shot NSFW task demonstrates 82% accuracy (AUC =0.88), with the Bayes-optimal threshold (τ∗=0.1) reducing expected cost to 27,520 versus 54,942 at the F1-optimal threshold—a 50% improvement. Calibrated abstention further lowers harm (cost =10,649.5), while a 3-of-5 quorum with oracle compromise p=0.1 yields break probability Pbreak<1%. Together, VisionGuard bridges decision theory, adversarial robustness, and cryptographic enforcement, providing the first provably safe AI moderation pathway for blockchain content.
We investigate whether sophisticated deep learning architectures justify their computational cost for short-term cryptocurrency price forecasting. Our study evaluates a 2.1M-parameter (M represents millions (e.g., 2.1M = 2,100,000 parameters), with all RMSE values reported in USD) wavelet-enhanced transformer that decomposes the Fear and Greed Index (FGI) into multiple timescales before integrating these signals with technical indicators. Using Diebold–Mariano tests with HAC-corrected variance, we find that all models—including our wavelet–transformer, ARIMA, XGBoost, LSTM, and vanilla Transformer—fail to significantly outperform the O(1) naive persistence baseline at the 1-day horizon (DM statistic = +19.13, p<0.001, naive preferred). Our model achieves an RMSE of USD 2005 versus USD 1986 for naive (ratio 1.010), requiring 3909× more inference time (2.43 ms vs. 0.0006 ms) for a statistically worse performance. These results provide strong empirical support for the Efficient Market Hypothesis in cryptocurrency markets: even sophisticated multi-scale architectures combining wavelet decomposition, cross-attention, and auxiliary technical indicators cannot extract profitable short-term signals. Through systematic ablation, we identify positional encoding as the only critical architectural component—its removal causes 30% RMSE degradation. Our findings carry important implications, as follows: (1) short-term crypto forecasting faces fundamental predictability limits, (2) architectural complexity provides negative ROI in efficient markets, and (3) rigorous statistical validation reveals that apparent improvements often represent noise rather than signal.
Abstract With the growing implementation of multi sensor Internet of Things (IoT) and edge AI systems, the concerns over data reliability,privacy, and verifiability have been intensified. Conventional fusion architectures rely on deep learning models that deliverhigh accuracy. However, they fail to ensure that inferences are provably correct or tamper resistant under missing, noisy, oradversarial data conditions. To address these challenges, this paper introduces the Zero-Knowledge Privacy Assured SensorFusion (ZK-PAS Fusion) framework. ZK-PAS Fusion integrates convex bounded imputation, attention driven multi sensorfusion, BiLSTM based temporal modeling, and recursive zero-knowledge proof aggregation within a unified architecture. Theframework assures correctness, privacy, and robustness through cryptographic commitments and circuit level verifiability.Experimental evaluation is performed on two large scale clinical datasets, namely, MIMIC-IV and eICU-CDR. The modeldemonstrates a superior performance and achieves 99.45 % accuracy, 99.57 % F1-score, and an AUROC of 0.989, surpassingstate of the art transformer and diffusion based baselines by up to 5.4 % in accuracy and 6.2 % in F1-score. The proof moduleattains a 40 ms average proving time, 0.4 KB proof size, and ≈ 46 % lower energy consumption compared to state of the art(SOTA) models. These results establish ZK-PAS Fusion as a verifiable, memory efficient, and privacy preserving AI frameworkfor real time, safety critical edge IoT deployments.
Smart contract security is paramount, but identifying intricate business logic vulnerabilities remains a persistent challenge because existing solutions consistently fall short: manual auditing is unscalable, static analysis tools are plagued by false positives, and fuzzers struggle to navigate deep logic states within complex systems. Even emerging AI-based methods suffer from hallucinations, context constraints, and a heavy reliance on expensive, proprietary Large Language Models. In this paper, we introduce Heimdallr, an automated auditing agent designed to overcome these hurdles through four core innovations. By reorganizing code at the function level, Heimdallr minimizes context overhead while preserving essential business logic. It then employs heuristic reasoning to detect complex vulnerabilities and automatically chain functional exploits. Finally, a cascaded verification layer validates these findings to eliminate false positives. Notably, this approach achieves high performance on lightweight, open-source models like GPToss-120B without relying on proprietary systems. Our evaluations demonstrate exceptional performance, as Heimdallr successfully reconstructed 17 out of 20 real-world attacks post June 2025, resulting in total losses of $384M, and uncovered 4 confirmed zero-day vulnerabilities that safeguarded $400M in TVL. Compared to SOTA baselines including both official industrial tools and academic tools, Heimdallr at most reduces analysis time by 97.59% and financial costs by 98.77% while boosting detection precision by over 93.66%. Notably, when applied to auditing contests, Heimdallr can achieve a 92.45% detection rate at a negligible cost of $2.31 per 10K LOC. We provide production-ready auditing services and release valuable benchmarks for future work.
Changhao Wu, Luyu Chen, Kai Wang, Weili Han · 5 authors
Occurring approximately once or twice in each block, sandwich attacks threaten Ethereum’s ecosystem by manipulating prices through strategically placed buy and sell transactions around pending user trades. Existing detection methods primarily rely on rigid heuristic rules, limiting their ability to detect increasingly sophisticated and dynamic attack variants, particularly those residing only in the mempool or spanning multiple blocks. In this paper, we propose SandWatch , a novel Ethereum sandwich attack detection framework that integrates a dual-task graph neural network (Dual-GNN) with heuristic methods. The framework comprises three main components. (1) An order-independent heuristic that captures fundamental token transfer patterns, reducing transaction volume by over 94% for subsequent graph analysis. (2) A Dual-GNN that simultaneously classifies sandwich attack transactions and DEX nodes, dynamically updating an address label pool to enhance accuracy and generalizability. (3) A positive-unlabeled learning strategy to leverage large-scale unlabeled data effectively. We first evaluate Dual-GNN on a benchmark dataset derived from publicly available Ethereum sandwich attack data, achieving an F1-score of 99.78%, outperforming the single-task baseline by 0.93 percentage points. We then deploy SandWatch on Ethereum transactions collected through blockchain interfaces and mempool pre-execution from January to May 2024. SandWatch detects 563,453 sandwich attacks, including 24,404 multi-attack, 4,902 cross-block, and 1,057 pool-failure variants, achieving an overall recall of 98.63% compared to the state-of-the-art benchmark platform. These results demonstrate the robustness of SandWatch in detecting sophisticated sandwich attacks within the real-world Ethereum ecosystem.
Jinghan Liu, Hui Zhao, Chenyang Lin, Dan Wang · 5 authors
The current security problem of smart contracts is becoming a common concern for researchers and developers. Existing smart contract vulnerability detection methods rely heavily on fixed expert rules, resulting in low detection accuracy. In order to cope with complex and changing smart contract application scenarios, we chose to use graph neural networks to detect vulnerabilities. In this paper, we proposed a vulnerability detection model called ESA based on the enhanced sequential algorithm. During the coding process, the contract function source code is described as a contract graph, which increases the model&rsquo;s global insight into node features during the learning process and reduces the number of noise nodes unrelated to vulnerabilities while retaining sufficient contextual semantic features. Compared to the cutting-edge methods, our model has significantly improved the accuracy of reentrant and timestamp dependency vulnerabilities, with detection accuracies of 89.09% and 88.49%, respectively.
This technical disclosure describes methods for defending smart contracts against automated analysis tools through intentional semantic incoherence. The disclosed techniques include state incoherence patterns, behavioural incoherence mechanisms, structural incoherence implementations, and signal pollution strategies. These methods cause automated analysis tools to malfunction when attempting to analyse protected contracts, providing a novel defensive layer against reconnaissance and attack planning. This document is published as a defensive publication to establish prior art and prevent third parties from obtaining patent protection for similar approaches.
As the United States Department of Defense (DoD) transitions toward Zero-Trust Architecture, the hardware and software supply chain remains a critical vulnerability. Current provenance models rely on centralized, siloed databases that lack the transparency required to counter sophisticated state-sponsored interdiction. This paper proposes a novel framework: AI-Enhanced Trust Graph Analytics over Distributed Ledgers. The architecture utilizes a permissioned Distributed Ledger Technology (DLT) substrate to host an immutable record of component lifecycles, anchored by Hardware Roots of Trust (RoT) through Physically Unclonable Functions (PUFs). By mapping silicon fingerprints to Software Bill of Materials (SBOM), the system constructs a multi-dimensional Trust Graph. We employ Graph Neural Networks (GNNs) to detect structural anomalies indicative of subversion, while Federated Learning enables inter-agency intelligence sharing without compromising operational security. Our findings demonstrate that this integrated approach significantly reduces the time to detect compromised assets in air-gapped and tactical environments, providing a strategic roadmap for an autonomous, self-healing supply chain.
Open access
3 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Hasina Andriambelo, Hery Zo Andriamanohisoa, Naghmeh Moradpoor
Federated learning enables collaborative model training without sharing raw data, but practical deployments increasingly require verifiable guarantees that clients compute updates correctly. Zero-knowledge proofs can provide such guarantees, yet existing approaches face scalability limits due to the combined cost of polynomial commitments and fast Fourier transform (FFT) intensive verification. Pairing-based schemes offer compact proofs but incur high prover and verifier overhead, while hash-based constructions reduce algebraic cost at the expense of rapidly growing proof sizes. This paper proposes Hybrid-Commit, a polynomial commitment architecture for Binius zero-knowledge proofs that aligns cryptographic primitives with the algebraic structure of federated learning workloads. The scheme separates verification into additive and multiplicative phases: linear aggregation is handled using batched additive commitments optimized for binary fields, while non-linear constraints are verified via hash-based commitments over sparsely selected FFT domains. Proofs from multiple clients are combined through recursive aggregation while preserving non-interactivity. Experiments demonstrate scalability in prover time and proof size (near-constant prover time across 4–11 clients; 160 bytes per client representing 341× and 813× reductions vs. FRI-PCS and Orion), although verification time (762 ms per client) does not scale favorably, making the scheme suitable for bandwidth-constrained scenarios. The scheme achieves under 2% end-to-end training overhead with no impact on model accuracy, indicating that workload-aware commitment design can improve specific scalability dimensions of zero-knowledge verification in federated learning systems.
The promulgation of Regulation (EU) 2024/1689 (the EU AI Act) establishes the world's first comprehensive legal framework for AI governance. However, a critical gap remains between the Act’s legislative intent and the technical reality of probabilistic AI systems. This working paper introduces Ternary Moral Logic (TML), a cryptographic governance architecture designed to operationalize the Act’s requirements for High-Risk AI systems. Unlike binary architectures that obscure uncertainty, TML enforces a tri-state logic—Proceed (+1), Pause (0), Refuse (-1)—mapped directly to the Act's risk categories. We demonstrate how this "Sacred Pause" mechanism satisfies Article 9 (Risk Management) and Article 14 (Human Oversight) by mechanically preventing action under high ethical uncertainty. Furthermore, we detail the implementation of "Immutable Moral Trace Logs" utilizing Merkle-batched storage on Layer-2 blockchains (Polygon zkEVM) to satisfy Article 12 (Record Keeping) and Article 61 (Post-Market Monitoring). This paper provides a complete technical specification for the TML framework, including logic gate definitions, smart contract architectures for three-party escrow, and zero-knowledge proof circuits for GDPR-compliant auditing. Comparative analysis demonstrates that this architecture reduces compliance latency to ≤2ms for inference and <500ms for logging, proving that rigorous regulatory enforcement is compatible with high-performance AI deployment. Interactive Report: A live, interactive version of this architecture is available at https://github.com/FractonicMind/TernaryMoralLogic/blob/main/Research_Reports/The%20Executable%20Architecture%20for%20the%20EU%20AI%20Act.html