We present Y.I.N.-AGENT-ACT, a privacy-preserving architecture for autonomous AI agent action chains that mathematically guarantees zero intent drift while maintaining cryptographic compliance across multi-step workflows. The core innovation is the mandatory DP→ZK→HE ordering (Differential Privacy → Zero-Knowledge Proof → Homomorphic Encryption) applied to every step in autonomous agent execution, combined with 136-byte Action Chain Compliance Tokens providing cryptographic chain integrity through HMAC-SHA256 chaining. Key results (measured on 48-step test corpus including 15 adversarial scenarios): (1) 100% drift prevention—all 15 drift scenarios caught with zero false negatives; (2) F1-score 0.882 at threshold 0.5 (precision 0.789, recall 1.000); (3) ~85ms per-step overhead with O(N) verification complexity; (4) 136-byte token size verified to match patent specification exactly; (5) native EU AI Act Article 50 compliance via verifiable privacy proofs. Y.I.N.-AGENT-ACT addresses the emerging agent autonomy crisis where AI systems like OpenAI Operator and Anthropic Computer Use execute multi-step tasks without cryptographic guarantees. The Intent Drift Elimination Theorem establishes that undetected drift probability is bounded by δ+(1−threshold), achieving zero false negatives across all measured adversarial scenarios including phishing, data exfiltration, and privilege escalation attacks. Protected by US Pending Patent 63/956,723 (106 claims). The agentic AI market is projected to reach $93.2 billion by 2032, but deployment remains at 2% of enterprises due to governance bottlenecks. Y.I.N.-AGENT-ACT eliminates the 6-18 month compliance barrier through cryptographic compliance-by-design.
Federated Learning enables large-scale collaborative training across distributed devices. However, in massive-scale Internet-of-Things (IoT) deployments, ensuring the trustworthy sensor-level operations remains a critical challenge. We introduce a hierarchical framework that combines a three-tier architecture (devices → gateways → server) with a high-speed recursive proof system to enforce scalable zero-knowledge proofs (ZKPs). At the device level, each proof serves as a unified cryptographic commitment, binding the device’s identity, local data integrity, and training correctness into a single attestation. These proofs are then individually verified at intermediate gateways, and compressed into a single, succinct proof using a folding scheme inspired by Nova [1] - a state-of-the-art system that can excel at this task at best. The server then verifies a small number of batched proofs before aggregation, reducing workload (∼ 571× in data load) by replacing hundreds of thousands of individual proof and model update transmissions with just one per gateway. Our fully implemented R1CS precursor demonstrates resilience against various vectors (e.g., backdoor-style attacks,) achieves a ∼ 34× verification speedup on a 105-device network, and maintains both strong security and model performance. Our prototype, evaluated on an Internet-of-Vehicles (IoV) use case, demonstrates that recursive proofs add succinct overhead while providing scalable, robust integrity guarantees against adversarial environments.
Antonio Max L. B. Pereira, Dylan Paulin, Christine Hennebert
An intrusion into the operational network (OT) of a production site can cause serious damage by affecting productivity, reliability, and quality. The presence of embedded neural networks (NNs), such as classifiers, in physical devices opens the door to new attack vectors. Due to the stochastic behavior of the classifier and the difficulty of reproducing results, the Artificial Intelligence (AI) Act requires the NN’s behavior to be explainable. For this purpose, the platform HistoTrust enables tracing NN behavior, thanks to secure hardware components issuing attestations registered in a blockchain ledger. This solution helps to build trust between independent actors whose devices perform tasks in cooperation. This paper proposes going further by integrating a mechanism for detecting tampering of embedded NN, and using smart contracts executed on the blockchain to propagate the alert to the peer devices in a distributed manner. The use case of a bit-flip attack, targeting the weights of the NN model, is considered. This attack can be carried out by repeatedly injecting very small messages that can be missed by the Intrusion Detection System (IDS). Experiments are being conducted on the HistoTrust platform to demonstrate the feasibility of our distributed approach and to qualify the time required to detect intrusion and propagate the alert, in relation to the time it takes for the attack to impact decisions made by the AI. As a result, the blockchain may be a relevant technology to complement traditional IDS in order to face distributed attacks.
The rapid adoption of blockchain technology has intensified the need for robust smart contract security mechanisms. However, traditional rule-based or static analysis tools often fail to detect context-dependent vulnerabilities embedded in complex contract logic. This study proposes a deep learning framework for automated smart contract vulnerability classification using a Bidirectional Long Short-Term Memory (BiLSTM) network integrated with an Attention Mechanism. The model was trained and evaluated on the SC_Vuln_8label.csv dataset, comprising 12,520 labelled Solidity smart contracts categorized into eight distinct vulnerability types, including Re-entrancy, Integer Overflow, and Short Address Attack. Through bidirectional contextual learning and attention-based feature weighting, the proposed model achieved 93.7% test accuracy, 0.93 precision, and a macro F1-score of 0.92, outperforming baseline models such as CNN, GRU, and standard LSTM by up to 5.3 percentage points. Attention heatmap analysis further revealed the model’s interpretability by highlighting vulnerability-prone code segments (e.g., call.value, send(), and withdraw() functions) consistent with expert-identified risk indicators. These results demonstrate that the BiLSTM + Attention framework not only enhances vulnerability detection accuracy but also provides transparent and explainable reasoning, offering a reliable foundation for AI-assisted smart contract auditing systems in blockchain security.
Hybrid AI systems that combine cognitive decision-making with physical actuation pose unprecedented challenges for governance, safety, and certification. AGORIA 3.4 presents a unified architectural framework that bridges cognitive governance (AGORIA v1.3) and cyber-physical governance (AGORIA v1.6) into a coherent, certifiable solution for safety-critical applications.Core Innovation: Controlled IgnoranceAGORIA introduces the principle of controlled ignorance—the deliberate, verifiable, and structural restriction of information accessible to each system layer beyond what is strictly required for its formal responsibility. This architectural invariant reduces cognitive coupling, limits attack surfaces, enables independent certification, and ensures that no single component can subvert the safety-governance chain. Zero-knowledge proofs provide cryptographic enforcement of this separation.Four-Layer ArchitectureThe framework organizes systems into four formally interconnected layers: STRATEGOS: Strategic cognitive governance via Choquet integral aggregation (~100 ms)GENESIS: Tactical planning with DSL→STL translation and ZK certificate generation (<50 ms)NEXUS: Bounded verification independent of semantic complexity (<250 µs)HSL++: Hardware-enforced physical safety via Control Barrier Functions (100 µs–kHz) Formal GuaranteesAGORIA provides four normative amendments with mathematical proofs: Robust Invariance via CBF with explicit feasibility hypothesis and statistically calibrated margins (Theorem 1)Bounded WCET Verification via succinct ZK proofs on constrained platforms (Proposition 2)Practical Stability under Lipschitz-continuous governance parameter variation (Theorem 2)Conservative Semantic Bridge from domain-specific language to decidable STL fragment (Theorem 3) Validation and CertificationExperimental validation covers three scenarios: autonomous vehicle (1000 trials), surgical robot (500 trials), and multi-agent factory (100 trials). AGORIA achieves zero safety violations while maintaining bounded worst-case execution time (<250 µs). A case study on multi-source aeronautical navigation (ILS, VOR, GBAS, DME) demonstrates framework genericity.The architecture enables hybrid certification compatible with: Functional safety standards (ISO 26262 ASIL D, IEC 61508 SIL 3)AI regulatory requirements (EU AI Act 2024/1689, UL 4600)Industrial cybersecurity (IEC 62443) Related Publications AGORIA v1.3: Cognitive Governance (Zenodo, 2025)AGORIA v1.6: Cyber-Physical Governance (Zenodo, 2025)
Federated learning enables multiple data owners to collaboratively train a global model, but verifying the correctness of submitted updates remains a critical challenge. Malicious clients may poison model weights, and colluding validators can undermine aggregation. We propose DI-FLAME, a decentralized validation framework that introduces a stake-and-proof mechanism for model verification. Each claim is submitted with a justification and stake, evaluated via a black-box credibility function. Validators engage in peer review, and contradictors may challenge weak claims by submitting stronger proofs and higher stakes. Rewards and penalties are dynamically distributed based on justification strength and challenge outcomes. DIFLAME provides robust defense against poisoned updates, even under adversarial majorities. While blockchain infrastructure is not required, DI-FLAME is compatible with with decentralized ledgers, enabling transparent recording of validation outcomes when deployed over a blockchain.
Smart contracts have become an integral part of most modern blockchain systems, playing a pivotal role in their operation. However, security vulnerabilities in smart contracts can lead to significant financial losses. Given the remarkable capabilities of Large Language Models (LLMs) in code understanding and analysis, it is worthwhile to explore how state-of-the-art LLMs can enhance the detection of smart contract vulnerabilities.In this paper, we propose a collaborative detection method that combines semantic analysis performed by LLMs with a lightweight deep learning model. Rather than relying on LLMs for direct vulnerability detection, we engineer tailored prompts that guide the model to perform multidimensional semantic analysis of smart contract code, yielding structured insights. Subsequently, we utilize a pre-trained CodeBERT model to encode these insights into dense feature vectors, which facilitate vulnerability detection via a lightweight, efficient deep learning classifier.Experiments on real-world smart contract datasets show that our approach achieves accuracy rates of 99.85%, 93.2%, 99.33%, and 98.13% for four types of vulnerabilities: reentrancy, timestamp dependency, unchecked external calls, and strict equality to Ether, respectively. These results demonstrate that the synergy between LLM-based semantic analysis and a lightweight detection model offers a novel and effective solution for automated smart contract auditing. This approach requires no expert knowledge, remains intuitive and easy to implement, and exhibits strong scalability.
Detecting vulnerabilities in smart contracts is challenging due to their complex semantics, structural diversity, and class imbalance. Existing deep learning approaches often treat contracts as plain text, overlooking the rich structural information in Abstract Syntax Trees (ASTs). To address these limitations, we propose SmartContractTransformer-GAN (SCT-GAN), a multi-task transformer-based framework for vulnerability detection and adversarial contract generation. SCT-GAN introduces three key innovations: (1) fusion of source code tokens and AST paths for enhanced semantic and structural modeling, (2) hierarchical detection at contract and line levels, enabling fine-grained identification even with limited context, and (3) a syntax-aware GAN generator-discriminator loop producing realistic and semantically meaningful smart contract code. Evaluation shows that while contract-level detection does not significantly improve the state of the art, line-level detection benefits most from the generative components, leveraging richer latent representations to capture logical patterns in individual lines. SCT-GAN’s modular, memory-efficient design supports large-scale auditing, continual adaptation to emerging vulnerabilities, and synthetic dataset generation for low-data scenarios. Overall, SCT-GAN provides a scalable, interpretable, and generative solution for proactive smart contract security, advancing automated auditing and vulnerability synthesis in blockchain ecosystems.
Frequent security issues with smart contract vulnerabilities have become a pressing challenge in the industry. Conventional program analysis methods lack flexibility and extensibility, leading to high false positive rates. Deep learning approaches are emerging as a new trend to address this issue. Compared to other neural networks, graph convolutional networks can better capture the structural and logical information of smart contracts. However, existing methods do not fully consider the scale-free characteristics of smart contracts and fail to leverage their complex hierarchical structures and semantic information. Therefore, we develop an end-to-end vulnerability detection framework using Riemannian Graph Convolutional Networks (RGCNet). We first construct smart contract graphs that are rich in semantic and structural information. Next, we learn features of the smart contract graph in the Riemannian manifold, thereby better reflecting its actual topology. Simultaneously, the word embedding network extracts semantic features, forming an end-to-end network where modules promote one another. Extensive experiments are conducted on three vulnerabilities using real-world smart contracts. The results show that the proposed approach exhibits superior performance over state-of-the-art methodologies in terms of accuracy, precision, and recall.
Yinhao Xiao, Chih-Chung Liu, Mingshu Cong, Le Yang
DeFi smart-contract vulnerabilities often arise from protocol-level financial semantics rather than syntactic Solidity patterns. Direct LLM prompting can generate plausible patches that compile but leave oracle, vault, lending, or AMM invariants unresolved. We aim to make LLM-based smart-contract repair more reliable by separating patch generation from domain-specific judgment and requiring accepted patches to improve check-visible semantic obligations. We present DeFiSent, a check-guided repair framework. It normalizes contract code, infers protocol roles, routes vulnerability-family checks, emits structured findings and violated invariants, and prompts an LLM with this evidence. Candidate patches are accepted only after compilation, tests, interface preservation, non-increasing semantic severity, and invariant-specific gates. We evaluate DeFiSent on a coverage-aware corpus from DeFiHackLabs, EVMbench, LISA-Bench, SmartBugs Curated, and BCCC-SCsVuls-2024. The DeepSeek campaign contains 40,452 paired tasks and 80,904 model-mode runs, including a 41,332-row code-level shard. On the unified 6,000-task DeepSeek subset, check guidance improves dynamic pass rate from 54.82\% to 79.95\%, semantic-improvement rate from 40.42\% to 53.92\%, and total severity reduction from 8,733 to 24,084. On a 2,000-task SiliconFlow matrix, aggregate semantic-improvement rate increases from 27.0\% to 57.8\%. Structured findings and gate-based validation substantially improve LLM repair behavior for DeFi contracts. DeFiSent does not replace expert auditing, but it provides a reproducible path for aligning LLM-generated patches with financial-semantic proof obligations.
Autonomous remote robots [16, 15] are increasingly deployed in disaster response scenarios [14] to support critical tasks such as victim localization and damage assessment. However, the ambient nature of such environments, which is marked by uncertainty, data heterogeneity, and limited connectivity, usually poses significant challenges to autonomous decision-making and trust. Thus, this paper proposes a framework for a multi-layered approach for a hybrid agent architecture that integrates Federated Learning (FL) with Belief-Desire-Intention (BDI) models, enabling remote robotic agents to learn collaboratively from distributed data using Distributed Ledger Technology (DLT) while preserving privacy, and to reason about their goals and intentions using cognitive frameworks of eXplainable AI (XAI). We further present a methodology for coherently embedding FL outcomes into BDI reasoning through semantic mapping and learning-enhanced ontologies. This integration will allow agents to dynamically update their beliefs and intentions based on learned insights, thereby enhancing autonomy, adaptability, and explainability in ambient disaster response systems.
We report on a systematic measurement study of unauthenticated Ollama AI inference servers exposed on the public internet. Using passive enumeration via the Shodan Internet Intelligence Platform, we identify 20,971 publicly accessible Ollama endpoints and more than 54,000 total AI inference services across more than ten backend types, all reachable with no authentication. We conduct targeted proof-of-concept probing against three representative endpoints spanning enterprise cloud, residential broadband, and commercial VPS infrastructure across three countries (USA, Sweden, Austria). All three endpoints score maximum exploitability across five dangerous write operations (model deletion, arbitrary pull, push exfiltration, persistent model poisoning, and clone operations), zero security headers, and zero rate limiting. We document a previously unreported financial fraud vector arising from the proliferation of cloud API proxy models (:cloud suffix), through which unauthenticated access to an Ollama endpoint constitutes direct financial fraud against the endpoint owner's commercial AI API accounts. Extending beyond prior work, we characterize four Retrieval-Augmented Generation (RAG) layer PII exfiltration vectors that require no write access or special knowledge: (1) context-token session hijacking via /api/generate's persistent KV-cache state; (2) cleartext HTTP conversation history re-transmission; (3) co-deployed RAG database exposure; and (4) prompt-based RAG context extraction. In live testing, the fourth vector extracted 11 of 11 PII categories including financial credentials, medical diagnoses, and authentication passwords on the first plain-language prompt against a live production endpoint. We additionally identify a supply chain risk arising from shared model artifact digests across geographically separated endpoints, and a novel operator risk taxonomy distinguishing technically sophisticated but selectively insecure operators from the commonly assumed unaware operator class. All probing used entirely synthetic personal data. No real user conversations were accessed or retained. Responsible disclosure notices were sent to relevant ISPs prior to submission.
Reentrancy remains one of the most persistent and damaging vulnerabilities in Ethereum smart contracts, enabling adversaries to recursively drain funds despite the presence of static and runtime defenses. Existing studies mainly focus on detection or program analysis, but they do not explain why and under what conditions attackers decide to exploit. In this work, we introduce a decision-theoretic framework that models reentrancy as a profit-maximizing problem under gas, risk, and atomicity constraints. Our framework derives the conditions under which reentrancy attacks are economically viable and provides an algorithm for computing optimal exploit strategies. We further extend the analysis to multi-contract attacks, capturing sequential, parallel, and optimized execution strategies. A simulation environment evaluates profitability across varying balances and gas configurations, highlighting thresholds where attacks become infeasible. Finally, we translate attacker decision profiles into practical defense recommendations for developers, auditors, and DeFi system designers. This framework bridges the gap between exploit detection and adversarial economics, offering a rigorous basis for strengthening smart contract security. This framework establishes a theoretical baseline for adversarial economics in smart contract security, forming a foundation for future MEV-aware exploitability models and Layer-2 risk analysis.
Large language models and agentic AI systems deployed in regulated, safety-critical, and high-stakes enterprise environments require governance infrastructure that is simultaneously cryptographically verifiable, regulatorily defensible, operationally efficient, and natively explainable. Existing approaches treat these properties as separate concerns addressed by separate toolchains. The result is an accountability architecture that is fragmented, difficult to audit end-to-end, and structurally incapable of satisfying the converging global regulatory requirement that AI decisions be not merely governed but explainable. This paper presents THEMIS-xAI (Trusted High-Assurance Evidence Management Integrity System for Explainable AI): a unified, governance-native framework that integrates cryptographic evidence management, runtime policy enforcement, explainability generation, privacy-preserving verification, and continuous compliance monitoring into a single coherent architecture. THEMIS-xAI is organized around four architectural planes-Evidence, Control, Security, and Explainability-and eleven integrated subsystems. We demonstrate that THEMIS-xAI achieves 83% coverage of the NIST AI RMF 1.0 control set (advancing from a 72% baseline), provides architectural coverage of fifteen regulatory frameworks with per-control status disclosure, and produces per-decision explanation artifacts that are cryptographically anchored, independently verifiable, and structured to align with the transparency and documentation goals of applicable AI governance frameworks. Legal sufficiency requires independent regulatory assessment. Implementation status is transparent throughout: the Evidence and Control Planes are in active enterprise pilot deployment; the Explainability Plane modules M1-M4 are implemented; M5-M6 are at research-prototype stage; zero-knowledge enforcement proofs are at proof-of-concept stage with production hardening planned in Phase 4.
Open access
Explainable Artificial Intelligence (XAI)
Adversarial Robustness in Machine Learning
Artificial Intelligence in Healthcare and Education
The convergence of vehicular technology, artificial intelligence (AI), and distributed computing has catalyzed the emergence of the Internet of Vehicles (IoV) as a cornerstone of next-generation intelligent transportation systems (ITS). By enabling vehicle-to-everything (V2X) communication, IoV supports cooperative perception, real-time decision-making, and autonomous driving. However, the reliance on large-scale, data-driven intelligence in IoV exposes systems to critical challenges, including adversarial poisoning, privacy leakage, identity forgery, and the fragility of centralized learning architectures. Federated Learning (FL) has been proposed as a promising paradigm to alleviate some of these issues by enabling distributed model training without centralizing sensitive vehicular data. Nonetheless, conventional FL remains vulnerable to security and trust limitations, particularly in dynamic vehicular environments. This thesis addresses these challenges by designing secure, privacy-preserving, and scalable FL frameworks that leverage distributed ledger technologies and cutting-edge security mechanisms.The thesis advances knowledge through four interconnected contributions. First, two novel optimization-driven poisoning attack models are introduced: PA-PSOSA and PAPSOGA, which combine particle swarm optimization with simulated annealing and genetic algorithms, respectively. These models demonstrate that even a small poisoning budget can substantially degrade global model utility under black-box and clean-label constraints, highlighting the urgency of robust defenses in vehicular FL. Second, a permissioned blockchain-enabled FL (BCFL) framework is proposed, in which consortium edge nodes running Practical Byzantine Fault Tolerance (PBFT) consensus replace the central aggregator. With blockchain integration and data validation mechanisms, this design ensures identity authentication, verifiable audit trails, and improved resilience against poisoning and Sybil attacks, while maintaining high model accuracy under adversarial conditions. Third, the framework is further enhanced to achieve inference-resistance by integrating secure aggregation (SecAgg) and differential privacy (DP), and lightweight with off-chain commitments. This design significantly reduces ledger storage requirements, increases system throughput, and mitigates inference-based privacy risks. Finally, to overcome the scalability limitations of PBFT-based BCFL, a DAG-enabled FL (DFL) framework is developed. By leveraging parallel validation, utility-score-based tip selection, and reputation-weighted aggregation, this framework significantly improves scalability, reduces communication complexity, and enhances robustness in asynchronous vehicular environments.Together, these contributions articulate a coherent progression from exposing vulnerabilities in vehicular FL to constructing secure, privacy-preserving, and scalable frameworks tailored for IoV ecosystems. The findings demonstrate that interdisciplinary integration of optimization theory, cryptography, differential privacy, and distributed ledger technologies is indispensable for trustworthy vehicular intelligence. Beyond theoretical significance, the proposed frameworks offer practical designs for deployment in safety-critical IoV environments. Future research directions include the integration of zero-knowledge proofs (ZKP) for verifiable privacy, adaptive defenses against evolving adversarial strategies, and experimental validation in real-world vehicular testbeds. Collectively, this thesis establishes a foundation for secure federated intelligence in IoV, contributing to the reliability, efficiency, and trustworthiness of next-generation ITS.
Chi Jiang, Caixing Shao, Xiaoyan Huang, Ming Tao · 6 authors
Blockchain technology is evolving toward next-generation blockchain systems, where AI-empowered optimization plays a key role in enhancing scalability, efficiency, and security. However, in the context of smart contract vulnerability detection, however, most vulnerabilities originate from a few critical code fragments, resulting in a severe signal-to-noise imbalance. This imbalance introduces representation noise and redundant information in complex contract code, obscuring the true vulnerability semantics and hindering the effectiveness of AI-based models such as graph neural networks (GNNs). To address this challenge, we propose CoTA, a feature augmentation framework that leverages two easily obtainable signals: code-cohort feature and task-shared feature. Code-cohort features capture the observation that contracts with similar structural/behavioral patterns often implement similar business functions, and thus share vulnerability priors (e.g., higher reentrancy risk in fund-transfer-heavy cohorts). Task-shared feature, on the other hand, learned via a multi-task setup that jointly trains coarse contract-level multi-label classification and fine-grained function-level labeling to distill shared representations. Extensive experiments on real-world dataset show that CoTA achieves consistent improvements in detection accuracy, offering a practical and effective solution for smart contract security analysis.
The security issues surrounding smart contracts have garnered significant attention due to potential vulnerabilities that can lead to financial losses and a decline in trust. Despite the development of various vulnerability detection methods by researchers, existing models often suffer from low accuracy and high false positive rates. Additionally, opcode-based vulnerability detection methods frequently introduce excessive noise due to long sequences, impairing the model’s generalization capabilities. To address these challenges, this paper proposes a dual-branch vulnerability detection model, referred to as EXCT, which integrates features from both the original opcode sequences and significant opcode sequences. We employ an improved extractive summarization technique, KTextRank, to extract important opcode sequence segments. A hierarchical Transformer is utilized for global feature extraction, while Convolutional Neural Networks (CNN) are employed for local feature extraction from the original opcode sequences. Finally, we fuse the global and local features to effectively identify specific vulnerabilities within smart contract code. Experiments conducted on two real-world datasets demonstrate that our proposed approach significantly enhances performance on publicly available datasets.