Leanne Ngo, Tran Tien Nhat, anon anon, Triet Huynh Minh Le · 7 authors
Smart contracts underpin modern blockchain ecosystems, enabling decentralized applications in DeFi and digital asset management. However, their immutability exacerbates programming errors and vulnerabilities, leading to unpatchable flaws and significant financial losses, as seen in high-profile exploits. Current vulnerability detection methods including static and dynamic analysis—face critical limitations: (1) static analysis suffers from state-space explosion, control-flow complexity, over-approximation, and high false positives; (2) dynamic fuzzing relies on syntactic/random mutations lacking semantic awareness, inefficiently exploring deep state-dependent paths and complex transaction sequences; (3) both static and dynamic approaches overlook semantic-structural gaps, such as execution order semantics in reentrancy vulnerabilities; (4) fuzzing reports lack explainability, hindering practical auditing. To address these challenges, we propose MAESFuzz1, a multi-agent semantic-guided smart contract fuzzing framework that integrates static structural analysis, dynamic execution feedback, and Large Language Model (LLM)–assisted reasoning within a closed-loop architecture. MAESFuzz employs LLMs as semantic advisors to guide seed generation, transaction sequence construction, and mutation refinement, enabling effective exploration of deep state-dependent behaviors and complex multi-transaction vulnerabilities. Extensive evaluation on the SoliAudit benchmark and a real-world dataset of deployed Ethereum contracts shows that MAESFuzz improves vulnerability detection by up to 28.7% relative to state-of-the-art (SOTA) smart contract fuzzers on SoliAudit. On real-world contracts, MAESFuzz uncovers 25 more expert-validated vulnerabilities than the strongest SOTA baseline while maintaining 94.38% precision and competitive execution coverage. In addition, MAESFuzz generates structured, execution-grounded audit reports to enhance interpretability and support practical security auditing.
Artificial intelligence systems are deployed globally at an unprecedented scale. Yet, no universal mechanism exists to verify that a given AI system is operating within its declared parameters, compliant with applicable regulations, or free from compromise. Trust in AI today is largely assumption-based rather than evidence-based, and this gap is becoming increasingly consequential as AI systems take on greater autonomy in regulated, high-stakes domains. This document proposes the TrustLayer Protocol as one possible architectural framework for addressing this gap. The protocol comprises two complementary components. The Compute Passport Network (CPN) proposes a neutral, global identity and attestation layer for AI compute, models, and training data, establishing cryptographically verifiable records of provenance during the training and development phase. The Universal AI Attestation Protocol (UAAP) proposes an embedded attestation mechanism for deployed AI systems, generating structured, signed claims about runtime operational state, compliance status, and inference provenance. Several UAAP mechanisms, in particular, continuous per-inference behavioral attestation and reasoning verification, remain experimental or require future research, as detailed in Section 6. The TrustLayer Protocol draws on established infrastructure from hardware-based trusted execution environments [1][2], public key infrastructure [3], zero-knowledge proof systems [4][5], and AI governance frameworks, including the EU AI Act [6] and the NIST AI Risk Management Framework [7]. It does not claim to resolve all open problems in AI verification. Rather, it proposes a phased architectural framework within which existing technologies can be composed into a coherent trust infrastructure layer, with clearly identified areas requiring further research and standardization. This specification is published as an open standard by the DefenAware Foundation and is intended as a contribution to ongoing work in AI governance, protocol design, and verifiable AI safety.
Agentic artificial intelligence systems — autonomous, multi-step AI agents capable of planning, tool use, and cascading real-world action — present a qualitatively distinct governance challenge from static AI models. The EU AI Act, while a landmark regulatory achievement, contains a structural gap: it mandates documentation and incident reporting but does not require real-time, publicly verifiable, tamper-proof audit infrastructure adequate for governing agentic systems at the pace and scale of current deployment. This paper documents a pattern of AI-enabled harm across four independent evidential sources — the ENISA 2025 Threat Landscape report, the November 2025 GTG-1002 autonomous cyberattack campaign, the February 2026 breaches of Mexican democratic infrastructure, and concurrent AI-automated attacks at scale — and argues that this pattern establishes the governance case for mandatory real-time accountability infrastructure for critical agentic systems. We propose a three-pillar framework. First, a Public Immutable Audit Ledger (PIAL): a distributed ledger-anchored system recording cryptographically hashed event logs in real time, governed by a technology-neutral requirements framework specifying fourteen functional and non-functional criteria any qualifying platform must satisfy. Second, a revised incident taxonomy separating automated telemetry — immediate, machine-generated — from narrative disclosure obligations, resolving the perverse incentives created by conflating these in existing frameworks. Third, a tiered implementation pathway classifying agentic systems into four risk tiers (Critical, High-Risk, Standard, Experimental) using an operational decision framework, with obligations scaled proportionately. The paper identifies zero-knowledge proof capability as a domain-specific precondition — not merely a research priority — for Tier A PIAL adoption in healthcare and law enforcement contexts where existing legal obligations under GDPR Article 9 and Directive 2016/680 may not be satisfied by current architecture. Six specific legal questions requiring formal resolution by the EU AI Office are identified, spanning GDPR Chapter V data transfers, NIS2 Article 23 interaction, DORA Article 19 alignment, and the data sovereignty status of public distributed ledger anchor submissions. The framework is accompanied by a reference implementation case study and a companion Technical Blueprint. The governance infrastructure proposed is proportionate, deployable with existing technology across the core architecture, and designed to be compatible with the EU AI Act's existing provisions while addressing their identified limitations.
Fei Tong, Haoxuan Zang, Fang Jiang, G. D. Li · 5 authors
Reentrancy Vulnerabilities (RVs) in smart contracts pose severe financial risks to blockchain systems. While deep learning-based detection methods have shown promise, they suffer from critical limitations: (1) vulnerability to adversarial examples, (2) inadequate handling of Cross-Function RVs (CFRVs), and (3) reliance on limited training data. To address these challenges, we present SCAEG, the first adversarial example generation framework specifically designed for RV detection. SCAEG introduces five novel perturbation actions that preserve code functionality while exposing model vulnerabilities, including targeted modifications for CFRV scenarios. Our comprehensive evaluation demonstrates that SCAEG-generated examples sig nificantly degrade the performance of state-of-the-art detectors (e.g., reducing AWDNN's accuracy by 27.51 percentage points), exposing their fragility to adversarial attacks. Building on these insights, we propose VoteRD, an ensemble detection model that combines semantic, rule-based, and positional features through a multi-model voting mechanism. Experimental results show VoteRD achieves superior robustness, outperforming existing approaches by 3.7% in recall and 7.4% in F1-score (compare with AWDNN), while effectively detecting both traditional RVs and CFRVs. This work not only advances RV detection capabilities but also establishes a new benchmark for evaluating model robustness in smart contract security analysis. SCAEG and VoteRD form a synergistic framework: SCAEG systematically evaluates model robustness, while VoteRD leverages adversarial insights to enhance detection accuracy. Our datasets and tools are publicly released to support future research in adversarial testing and vulnerability detection.
As Generative AI (AIGC) achieves pixel-level realism and real-time interaction; traditional digital authentication paradigms face an unprecedented "authenticity crisis". Software-level defenses and static biometrics are increasingly vulnerable to high-fidelity AI-generated threats. This paper proposes a novel Human-Source Authentication architecture, termed Testing, Inspection, and Certification (TIC), which shifts the verification focus from logical correctness to the real-time presence of a physical entity. At the core of TIC is the Pulse-Eye Handshake (PEH) protocol, which integrates hardware-level Physical Unclonable Functions (PUF) with the physiological dynamics of the human pupillary light reflex (PLR). By leveraging a "Hardware Trinity" comprising smart glasses, a smartwatch, and a smart ring, the protocol constructs a deterministic "Shield of Time". This shield exploits the significant latency gap between the computational overhead of AI inference (typically >300ms) and the intrinsic physical limits of the human autonomic nervous system (8.3-35ms). Furthermore, architecture employs recursive zero-knowledge proof (ZKP) based on the Nova protocol to ensure multi-modal verification without compromising user privacy. Security analysis demonstrates that the proposed system remains robust against sophisticated modeling attacks and AI-driven acceleration. Our work provides a foundational anchor for digital sovereignty and system resilience in the era of pervasive AI and Industry 5.0.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
Federated learning across IoT devices must simultaneously protect each device’s update from disclosure, prevent malicious participants from biasing the global model, and hide which devices are participating from outside observers. Existing systems typically address only a subset of these goals: secure aggregation hides individual updates but cannot validate them, plaintext-based robust filtering requires the server to see updates, and most cryptographic pipelines ignore timing privacy. This paper presents TriSAFE, a protocol composition for IoT federated learning with a single coordinating server and three threshold helpers. The server holds no decryption key. TriSAFE combines four mechanisms that are usually studied in isolation: (i) encrypted client updates accompanied by zero-knowledge proofs that each coordinate lies within a bounded range; (ii) a new lightweight binding step (the plaintext-equivalence protocol, PEP) that cryptographically ties the values proven in zero knowledge to the exact ciphertext later aggregated by the server, closing a substitution gap left by range proofs alone; (iii) helper-added differential privacy noise applied homomorphically before any decryption, so the server only ever sees a noised aggregate; and (iv) fixed-cadence batching with calibrated cover traffic to hide participation from passive network observers. Across two IoT intrusion-detection benchmarks (Edge-IIoTset and N-BaIoT) and MNIST, TriSAFE keeps accuracy within 0.1-2.1 percentage points of the no-attack baseline under Byzantine, label-flip, FANG, and time-delay attacks, with attack success rate below 1% (<0.1% for FANG). Timing inference by a passive observer drops close to chance, and the end to end overhead is 7-36% relative to a non-defended baseline. On MNIST, TriSAFE achieves 89-91% accuracy, 15-17 points above the MODEL benchmark under the same attack suite. The design is practical for gateway-assisted IoT deployments under the assumption that the coordinator does not collude with two helpers and that at least two helpers contribute honest DP noise.
Autonomous AI agents executing consequential actions require authorization mechanisms that verify not only identity but voluntary intent. LICET (Latin: it is permitted) is a cryptographic middleware protocol binding AI agent authorization to real-time multi-modal physiological state via a three-layer architecture: (1) ECG waveform morphology matching as a medication-resistant identity and liveness anchor; (2) electrodermal activity (EDA) as a sympathetic cholinergic liveness signal immune to beta-adrenergic blockade; and (3) personalized Mahalanobis distance fusion over five physiological signals to elevate the cost of pharmacological coercion attacks. LICET defines a Biometric Trust Level hierarchy (L0-L3) aligned with the IETF RATS architecture (RFC 9334), per-event HKDF session-key derivation, HMAC biometric temporal signatures, Schnorr zero-knowledge proofs over BN128, and a SHA-256 hash-chained tamper-evident ledger. A reference implementation is publicly deployed at https://licet.dev/v1/.
We present CHRONOS, the first autonomous AI agent that simultaneously achieves plaintextblindness (all data is processed under fully homomorphic encryption without ever beingexposed), cryptographically enforced time bound existence (the agent’s own decryption key islocked behind a publicly verifiable proof of sequential work, rendering it inaccessible until aprecise future moment), and remote verifiability of self destruction (a zero knowledge proofcertifies that the key material has been irreversibly destroyed after mission completion). Theagent’s operational lifespan is governed by a “cryptographic fuse” constructed from a proof ofsequential work (PoSW) whose computation time accurately matches the intended missionduration. A drand decentralized randomness beacon serves as a trusted time oracle to trigger thefinal key shredding. Crucially, the erasure proof is a non interactive zero knowledge argument(SNARK) that proves the correct execution of the entire self destruction sequence—including thePoSW solution, decryption of the private key, and subsequent memory zeroization—enablingany third party to cryptographically verify the agent’s annihilation without trusting the agent orits hardware. We provide a complete system architecture, a formal security model with gamebased definitions and reductions to standard assumptions, and a proof of concept implementationusing Zama’s TFHE rs for encrypted inference, a Cohen Pietrzak PoSW implementation, and aGroth16 SNARK. Our benchmarks indicate that FHE inference on a small neural network (50 Kparameters) completes in seconds, the PoSW background thread consumes negligible resources,and the erasure proof can be generated and verified in under three seconds. CHRONOSrepresents a fundamental advance in secure, disposable AI agents, with immediate applications indefense, intelligence, and high privacy environments.
This appendix proposes the Luevano Standard as an assurance architecture combining zero-knowledge proofs for model inference with remote attestation, providing stronger runtime evidence for AI governance. It frames this as a technological measure supporting EU AI Act Article 9 and Article 11 compliance demonstration, not as a universal legal solution.
Machine learning-based intrusion detection systems can identify malicious network activity, but their predictions and explanations are typically accepted without verifying that they were derived from the same input. This thesis develops a public-model/private-input zero-knowledge framework for certifying a prediction and its semantic explanation while keeping the processed network-flow features private. The framework is instantiated through a TON_IoT intrusion detection case study in which 104 processed features are mapped into five semantic groups. Logistic Regression is used as the proof-compatible public model, while XGBoost provides a stronger plaintext performance baseline. The main technical contribution is an implementation-backed proof relation that jointly verifies Logistic Regression inference and an ordered top-3 semantic explanation from the same private input. Under a fixed training-mean reference, semantic-group Exact SHAP for the linear score reduces to a direct group-wise weighted sum, enabling its implementation in a Circom circuit and verification using Groth16. The quantized relation achieves more than 99.99% prediction agreement with the floating-point model, while ordered top-3 explanation agreement is approximately 93.8%. Valid proofs are accepted, whereas incorrect predictions, malformed rankings, and out-of-range inputs are rejected. The results demonstrate the feasibility of cryptographically binding a prediction and a semantic explanation under private tabular inputs. The implemented relation remains limited to a public linear model, fixed semantic groups, and an approved reference vector, and does not provide arbitrary-model explanation verification, model confidentiality, or production-ready provenance.
Modern vehicles are distributed embedded computing platforms whose expanding network connectivity-CAN bus, Bluetooth, cellular telematics, and over-the-air (OTA) update channels-exposes them to the same class of adversarial attacks studied in cloud and enterprise environments. Machine learning (ML)-based intrusion detection systems (IDS) have emerged as the primary defensive response, yet these models are themselves vulnerable to adversarial perturbation: a well-crafted malicious CAN frame can evade an ML-based IDS in the same way that an adversarial image patch fools a computer-vision classifier. This paper traces the threat landscape from foundational automotive attack-surface studies through contemporary adversarial ML research, examines how resource-constrained embedded platforms limit defensive options, and proposes a defense architecture that combines behavioral anomaly detection with zero-knowledge proof (ZKP) attestation for invehicle control units. We argue that ZKP-based component attestation-previously dismissed as computationally impractical for embedded systems-is now feasible given recent advances in succinct non-interactive arguments of knowledge (SNARKs), and that combining it with adversarially trained ML-IDS models yields defensein-depth that addresses both network-layer and hardware-layer attack vectors.
Graph neural networks (GNNs) have shown notable success in identifying security vulnerabilities within Ethereum smart contracts by capturing structural relationships encoded in control- and data-flow graphs. Despite their eff... | Find, read and cite all the research you need on Tech Science Press
Secure Aggregation (SA) is a fundamental privacy-preserving technique in Federated Learning (FL) that ensures the confidentiality of local model updates while enabling global model aggregation. Previous studies have implemented SA within the FL architecture that includes a central server. However, in a Device-to-Device (D2D) based FL, decentralized SA becomes challenging due to the lack of a central server, particularly in a zero-trust network vulnerable to Byzantine attacks. To address this issue, we present a novel Byzantine-robust decentralized SA protocol (DeSA) that guarantees the integrity of model training and aggregation while protecting the privacy of model updates. Specifically, we utilize an enhanced zk-SNARK proof system to verify the local model training process. Additionally, we propose a framework that embeds multiple zero-knowledge proofs to ensure the integrity of model aggregation, while maintaining succinct proofs and fast verification. Moreover, we present a Byzantine-robust D2D aggregation protocol that can withstand malicious nodes trying to disrupt model aggregation. To protect privacy, we develop a one-time masking method that eliminates aggregated masks through a dynamic aggregation strategy. This strategy takes into account the adjacency and trust relationships among nodes in evolving network topologies. Finally, we perform a theoretical analysis and evaluate DeSA on real-world datasets. Experimental results show that the time required to verify an embedded proof is significantly reduced compared to the time of verifying multiple proofs. Additionally, its accuracy remains robust against malicious nodes.
This paper presents Zero-Knowledge Federated Learning Guard (ZK-FLGuard), a privacy-preserving and verifiable federated learning framework for real-time anomaly detection in Fifth-Generation Mobile Network (5G)-enabled Internet of Things (IoT) environments. Building on the integration of zero-knowledge proofs (zk-SNARK—Zero-Knowledge Succinct Non-interactive Argument of Knowledge) and blockchain-based access control, ZK-FLGuard ensures the integrity of model updates without exposing private data. Using real-world intrusion detection datasets (CICIDS2017—Canadian Institute for Cybersecurity Intrusion Detection System 2017, TON_IoT—Telecommunications Organisation of the National Security—IoT) and a synthetic adversarial dataset, our evaluation shows that ZK-FLGuard achieves up to 0.96 F1-score (harmonic mean of precision and recall), improves recall in low-frequency attack detection, and introduces less than 10% additional latency overhead compared to standard Federated Learning (FL). Compared with centralized Long Short-Term Memory (LSTM) and FL without Zero-Knowledge Proof (ZKP), ZK-FLGuard provides competitive accuracy while ensuring verifiable computation and strong privacy guarantees. We address the critical challenge of securing federated anomaly detection in 5G-enabled IoT systems against data leakage, model poisoning, and unauthorized access. While FL preserves privacy by keeping raw data local, it remains vulnerable to gradient leakage and adversarial manipulation. Our hypothesis is that combining zero-knowledge proofs and blockchain with FL can deliver a scalable, tamper-resistant, and privacy-preserving detection pipeline suitable for resource-constrained edge environments.
Current approaches to verifying AI training data compliance face a fundamental tension: copyright holders need to know whether their content was used in training (EU AI Act, Article 53(1)(d)), while model providers need to protect their training data as trade secrets (GDPR, trade secret law). Existing zero-knowledge proof systems for machine learning (ZKML) address this partially by providing proofs of non-membership for exact data points. However, real-world training pipelines involve tokenization, chunking, paraphrasing, and augmentation, rendering exact-match proofs insufficient. We identify a gap in the literature: no existing system combines semantic fingerprinting with zero-knowledge proofs to enable semantic non-membership verification. We propose an architecture for Zero-Knowledge Semantic Non-Membership (ZK-SNM) that enables a model provider to prove, without revealing any training data, that no document in their training corpus is semantically similar to a queried document above a specified threshold. We discuss the technical challenges, including the computational cost of similarity search within ZK circuits, and propose mitigation strategies based on locality-sensitive hashing and hierarchical verification. This position paper establishes the problem formulation and proposed architecture; experimental validation is left to subsequent work.
Federated learning (FL) enables collaborative model training while preserving data privacy, yet both centralized and decentralized approaches face challenges in scalability, security, and update validation. We propose ZK-HybridFL, a secure decentralized FL framework that integrates a directed acyclic graph (DAG) ledger with dedicated sidechains and zero-knowledge proofs (ZKPs) for privacy-preserving model validation. The framework uses event-driven smart contracts (EDSCs) and an oracle-assisted sidechain to verify local model updates without exposing sensitive data. A built-in challenge mechanism efficiently detects adversarial behavior. In experiments on image classification and language modeling tasks, ZK-HybridFL achieves faster convergence, higher accuracy, lower perplexity, and reduced latency compared to Blade-FL and ChainFL. It remains robust against substantial fractions of adversarial and idle nodes, supports sub-second on-chain verification with efficient gas usage, and prevents invalid updates and orphanage-style attacks. This makes ZK-HybridFL a scalable and secure solution for decentralized FL across diverse environments.
Proof-of-useful-work (PoUW) replaces the wasted computation of proof-of-work with valuable tasks such as machine-learning inference, but has historically failed on the verification asymmetry: useful work is as costly to verify as to perform. Zero-knowledge machine learning (zkML) removes the asymmetry cryptographically, yet proving overheads currently preclude verifying every job. We analyze a sampled-audit design in which each committed job is audited independently with probability p after commitment, escalating from cheap re-execution to a zkML dispute court, with detected fraud slashing a stake S. We prove that economic security reduces to one scale-invariant bound, S > c/p, where c is the cost of one job: the attacker's expected profit from fabricating k results is then strictly decreasing in k, so the optimal attack is a single fabricated job, and it is unprofitable. The bound is invariant to batch size and robust to exit scams, Sybil splitting, and audit-gap hunting; Monte Carlo simulation validates all claims. We further prove exponential fragility under randomness grinding, detection collapses to p g with g candidate seeds, making unbiasable randomness a hard requirement, and derive the cost-optimal sampling rate p * = δ /κ.
Agent-based federated learning (FL) enables multiple nodes to collaboratively train a global model without sharing raw data, thereby mitigating privacy and security concerns. However, FL inherently relies on the credibility of participating agents, making trust assurance critical in environments susceptible to malicious attacks and operational faults. This paper proposes a procedural architecture for evaluating and enhancing agent credibility in distributed ledger-based FL (DLFL) systems. The proposed architecture spans the agent life cycle, consisting of the pre-training, in-training, and post-training stages, and integrates three verification domains: data-based, behavior-based, and technology-based verification. In the pre-training stage, data-based verification assesses data integrity and quality through reference distribution analysis and entropy reduction to improve learning stability. During the in-training stage, behavior-based verification establishes a dual mechanism that monitors and analyzes agents’ learning processes and outcomes and detects anomalies in updates and performance. In the post-training stage, technology-based verification ensures record immutability and accountability through blockchain, cryptographic validation, and auditing mechanisms. By combining these multi-layered procedures, the proposed architecture enables systematic and continuous evaluation of agent credibility, fostering a trustworthy FL ecosystem and enabling future applications in autonomous agent collaboration and trust-oriented AI governance.