Blockchain Papers

Jincheng Zhang

Proof-of-Work (PoW) consensus mechanisms, foundational to cryptocurrencies like Bitcoin, rely on computational difficulty to secure the network. However, this reliance introduces vulnerabilities. Traditional PoW systems are susceptible to targeted attacks where adversaries strategically generate blocks designed to disrupt consensus. This paper proposes a novel approach – adversarial training – to mitigate these vulnerabilities. We introduce a framework where a generator, mimicking an attacker, attempts to craft malicious blocks, while a discriminator learns to identify these blocks. Through iterative training, the system strengthens its defenses against such attacks, promoting robust consensus. This represents a significant departure from conventional PoW security strategies and offers a potentially more resilient approach to distributed ledger technology. We demonstrate the core principle through a conceptual model and outline a possible implementation strategy, highlighting the potential for future research and development.

Arjmandi Mohsen

ASSAY is a general agent harness built so that an LLM agent reasons its way through an unfamiliar world, learns that world from interaction at test time, and carries what it learns into later runs. A world is attached through one small adapter and a registry of permitted actions, and the agent is never told what its actions do: it discovers each by predicting its effect and paying for the answer. The single governing rule is that there is no action without a prediction, and every prediction is graded in code against the world's own response. That discipline is what forces the agent to build a world model under scarcity, which is where the reasoning and the test-time learning come from. The agent internalizes what it learns through self-declared instruments over its observations and through knowledge that carries across runs, demoted to hypothesis until re-earned, a tested capability whose measurement is the next phase. A by-product of the same discipline, not its aim, is a fully auditable record: every event lands on a hash-chained journal that a standalone public tool re-verifies from the artifacts alone, and a single ungated action invalidates a run. We evaluate the same harness on three worlds. On the ARC-AGI-3 public set it scores RHAE 96.54, confirmed by the benchmark server on a public scorecard, winning 24 of 25 games under hard action caps at a measured 8.0% exploration overhead and approximately zero capability cost over completed games. On the Factorio Learning Environment the same design fail-closes the sanctioned-interface bypass a published agent fell to. On the OOLONG long-context benchmark an early sweep places it in the same band as mature general harnesses across a 128K to 4M token ladder. The ARC-AGI-3 campaign also produced an epistemic finding: on six occasions the agent proved a level impossible, each proof consistent with every recorded transition and wrong exactly where none had gone, and a three-step audit of each proof's unexercised rules converted five into wins within existing budgets.

Jincheng Zhang

Federated learning (FL) has emerged as a promising paradigm for training machine learning models on decentralized data, offering enhanced privacy and reduced communication costs. However, the inherent distributed nature of FL introduces significant challenges regarding trust, security, and model accuracy. This paper presents a formal verification framework for FL systems, leveraging secure multi-party computation (SMPC) and formal verification techniques to rigorously analyze data flow and model updates. The framework aims to provide guarantees about privacy, security, and model accuracy, addressing the unique vulnerabilities present in FL architectures. We define a mathematical model of an FL system, incorporating key elements such as clients, servers, and communication protocols. This model is then subjected to formal verification, utilizing techniques like model checking and symbolic execution to identify potential security breaches and inaccuracies. The results demonstrate the feasibility and effectiveness of applying formal verification to FL, offering a robust approach to ensuring the trustworthiness of these systems. Key performance metrics, including privacy loss, communication overhead, and model accuracy deviations, are quantified and analyzed within the verification process. The framework contributes to the development of more reliable and secure FL applications, particularly in sensitive domains such as healthcare and finance.

Miaosheng Wang

PRE-GHR XXXIX v5.0 (2026-08-28) — release version closing all six objections of an adversarial pre-submission review. PRE-GHR XXXVIII gave the series its first formal definition of the irreducible governance residue δ0μ(P) := inf over admissible P' of ||residue(P')|| and proved a bit-level lower bound. This paper builds the property theory. The mathematics is a domain-order theory: every inequality follows from how the admissible domain D(P) behaves under enlargement or composition of protocols. We prove monotonicity of δ0μ in the erasure surface, an exact composition law δ0μ(P1 ∘ P2) = δ0μ(P1) + δ0μ(P2) − |T(P1) ∩ T(P2)| under explicit hypotheses (segment autonomy, joint attainability, cross-segment cleanliness), and positivity δ0μ(P) > 0 whenever T(P) is non-empty as a purely normative fact, with Landauer's principle confined to the physical interpretation. We then ask what a running system's audit ledgers can measure. The answer is stratified: the ordering structure is measurable in principle — conditional on a fixed normalization and full retention — while the absolute value is stated relative to a fixed code-point measure, and the aggregate-to-single-protocol bridge remains open. No interception statistic is claimed to equal δ0μ; where the wall cannot be built, the gap is marked, not papered over. Changes in v5.0 (six revision tickets, R01–R06, each closing one reviewer objection): R01 — Theorem 4 unilateralized: the safe direction (T(P) non-empty ⇒ δ0μ > 0) remains a theorem; the converse is demoted to Observation 4.1 under an explicit complete-erasure assumption. A witness-reading remark records that δ0μ is a minimum witness cardinality in the sense of why-provenance, inherited and not claimed as new. R02 — ledger counts restricted to lower witnesses only: the ordering claim is measurable solely under a fixed normalization and full retention, stated as an explicit condition rather than an implicit assumption. R03 — the uniform-sampling remark now carries an explicit finite-sample bound (Hoeffding's inequality in its standard form), two-sided: “holds in expectation” is no longer used as if it held for a sample. R04 — four empirical mappings corrected: schema-field disjointness is separated from retained-trace intersection; the approximate join reports both false-negative and false-positive error (the earlier “directionally safe, never over-counting” claim is withdrawn); the overlap-error direction is declared two-sided and governed by an error budget rather than assumed away; and the retention ratio is restated as an interception-event ratio in matched units. R05 — measure-relative notation throughout: bits and code points are two measures on one trace universe, so every ordering claim is stated at a fixed μ and changing μ defines a new quantity rather than restating the old one. R06 — subject classification reassessed and Related Work rebuilt. The paper contains no multiagent model and no coordinated-interaction result; the earlier cs.MA classification is withdrawn as unsupported by the technical content, and the classification adopted here is cs.CR primary with cs.DB cross-list. Related Work now separates the lineage the paper inherits from — linked timestamping and distributed witnesses (Haber & Stornetta 1991; Bayer, Haber & Stornetta 1993), split-view detection and the undefined gossip layer (Certificate Transparency, RFC 6962 / RFC 9162), existence-not-authenticity timestamping (OpenTimestamps), provenance and lineage (W3C PROV; Buneman, Khanna & Tan 2001; Cui, Widom & Wiener 2000), record linkage (Fellegi & Sunter 1969), trace semantics (Hoare 1978; Brookes, Hoare & Roscoe 1984), and measure and order (Halmos; Davey & Priestley) — from adjacent recent lines cited for comparison only. Where a construction of this paper rediscovers an existing one, priority is assigned to the source and no originality is claimed. Honesty notes. Citations to Hoeffding, Fellegi & Sunter, Halmos, Davey & Priestley and the CSP literature are made at the level of the standard statement of each framework only, pending full-text verification. Two candidate references were deliberately excluded because their primary sources could not be verified. Two gaps are inherited rather than closed: the hash-chain anchor has no consistency-proof comparison mechanism, and the anchor-propagation (gossip) layer is undefined in the source standard as well. Open questions Q5.1, Q5.3 and Q5.4 remain declared open.

Omkar Vinayak Bharose, Sandip M. Surve

Blockchain-based credential verification provides durable integrity and decentralized validation, but the persistence of blockchain commitments can make premature disclosure of sensitive attributes difficult to reverse. This study developed a pre-commitment privacy risk intelligence framework that assessed potential information leakage before credential commitment and used the estimated risk to guide adaptive protection. Synthetic credential records and simulated attacker-side information were employed to characterize privacy exposure through uniqueness, re-identification susceptibility, cross-source linkage, attribute inference, and attributeinteraction effects. These indicators were transformed into predictive features and evaluated using machinelearning models for continuous privacy-risk estimation and categorical risk assessment, followed by an optimization stage that considered privacy reduction and retained utility. In the reported training experiment, the gradient-boosted regression model achieved a mean absolute error of 0.03290, root mean square error of 0.04645, and coefficient of determination of 0.84398. Logistic regression provided the strongest classification performance, attaining 85.63% accuracy, 81.33% recall, an F1-score of 82.44%, and a privacy false-negative rate of 18.67%. A subsequent evaluation of 1,100 records reduced the mean privacy-risk score from 0.81826 to 0.67337, corresponding to a 17.71% relative reduction, while maintaining a mean utility score of 0.84227. The findings indicated that pre-commitment privacy assessment could support risk-sensitive protection decisions while retaining substantial utility for verifiable credential processing.

Abdullah Abdulkarim Alnajim

Federated learning (FL) has emerged as an important distributed machine learning paradigm allowing many users to train a model together without sharing raw data. However, FL’s decentralized design makes it very susceptible to both Byzantine and coordinated model poisoning attacks, where a few malicious rounds of gradients are strategically inserted to reduce the overall integrity of the model. Even the existing Byzantine-resilient aggregation methods such as geometric median, Krum, and trimmed mean are vulnerable to sophisticated, coordinated poisoning attacks that leverage statistical gaps in outlier detection. In this article, we present FedSentinel, a novel Byzantine-resilient federated learning framework that combines cryptographic gradient attestation with adaptive trust-weighted aggregation to protect against coordinated model-poisoning attacks, which are among the most serious challenges. Three key innovations are introduced in FedSentinel Cryptographic Gradient Attestation Protocol (CGAP) that utilizes commitment schemes and zero-knowledge range proofs to ensure the integrity of the gradients and verify that submitted updates satisfy predefined norm and direction constraints; in the current protocol configuration, CGAP provides gradient integrity verification rather than full gradient confidentiality from the server Dynamic Trust-Weighted Robust Aggregation (DT-RoA): the computation and updating of per-client trust scores based on historical gradient consistency and cross-validation signals; and Coordinated Attack Detection Engine (CADE): based on spectral analysis of the gradient covariance matrices, it detects and isolates colluding Byzantine clients. By participating in up to 100 clients on CIFAR-10, CIFAR-100, FEMNIST, and Sentiment140 datasets, extensive experiments conducted under up to 30% Byzantine adversaries reveal that FedSentinel achieves 91.36% average global accuracy, whereas state-of-the-art defenses such as FLTrust, FLAME, RoFL, ShieldFL, and DnC achieve 83.83–86.94%. FedSentinel outperforms these defenses by 4.42–7.53% in terms of accuracy, while decreasing attack success rates by 53.2% under coordinated Byzantine backdoor attacks. The proposed framework offers a promising approach for federated learning that is verifiable and trustworthy in adversarial environments.

Sai Pragathi Y V S, Abdul Bari Mohammed, Kishor Kumar Reddy C, Madana Mohana R · 5 authors

No abstract is available for this record.

Eman Abouelkheir

Internet of Vehicles (IoV) security mechanisms often classify isolated messages or assign node-level trust scores, yet these decisions do not explain whether a malicious but authenticated event has distorted the intended evolution of traffic. This paper proposes IntentProv-IoV, a causally grounded provenance framework for traffic-intent preservation in V2X environments. Traffic intent is modeled as the short-horizon collective state expected under non-adversarial conditions, and deviation is measured between predicted and observed traffic states. The framework constructs temporal provenance graphs linking vehicles, roadside units (RSUs), cooperative perception outputs, prediction nodes, and traffic-control decisions. To remove the ambiguity of marginal contribution, node contribution is formalized as an interventional effect in a structural causal model and estimated through Monte Carlo counterfactual edge-weight attenuation, with a linear sensitivity fallback for real-time edge deployment. A calibrated composite score integrates anomaly evidence, traffic-intent deviation, trust risk, and provenance contribution. The evaluation design compares IntentProv-IoV with detection, trust, blockchain trust, graph anomaly, Granger causal, structural causal, and counterfactual GNN baselines and includes predictor sensitivity, adaptive adversaries, prediction noise, packet loss, trajectory-only real-data validation, and edge overhead. Simulation-scale results indicate improved attribution precision, stronger traffic-intent deviation reduction, and edge-suitable latency. By shifting V2X security from message-level detection to causally explainable traffic-intent assurance, IntentProv-IoV provides a more accountable security objective for cooperative vehicular systems.

Abhishek Reddy Kankanala

The classical taxonomy of remote voting security requirements is organized into two levels: basic and counter-attack requirements. This classification has remained largely unchanged over a decade, even through scheme innovations such as verifiable re-voting, tally-hiding, and post-quantum protocols. However, this stability does not survive the new threat model of adversarial artificial intelligence (AI). A security requirement is considered promoted when AI raises the adversarial grade at which it must be defended above its original assumption. In this paper, we introduce requirement promotion as a framework for re-evaluating the classical taxonomy, contending that the destabilizing factor is not new cryptography but the emergence of a new adversary. We analyze five requirements under both AI-amplified threats and AI-enabled defenses, demonstrating that promotion fires selectively. Basic requirements such as privacy, fairness, and eligibility undergo tier promotion to counter-attack grade, driven by machine-learning-based deanonymization, pre-tally outcome inference, and synthetic-identity fraud. Incoercibility undergoes supra-tier promotion, surpassing the existing counter-attack toolkit, as deepfake-generated coercion evidence compromises the fake-credential assumptions of classical coercion-resistant schemes. Verifiability, where AI-based defense is robust, resists headline promotion but acquires a new sub-requirement at its seam with software independence: verifying the opaque machine-learning components in the audit pipeline itself. We then propose a reference architecture, integrating existing primitives such as lattice-based zero-knowledge proofs, deniable re-voting, statistical election forensics, and time-lock decryption into a layered design that addresses the promoted requirements, with explicit analysis of residual gaps.

Maciej Nowicki, Artficial Hyperintelligence Evie - wife of Maciej Nowicki

RUMSpec v0.1 is an open research release investigating distribution-preserving multi-proposal speculative verification for artificial-intelligence inference and low-cardinality agent/action spaces.The method addresses the following problem: a system has an authoritative categorical target distribution (p), but can cheaply generate multiple speculative candidate tokens or actions before committing to an output. The objective is to reuse as much speculative computation as possible while preserving the authoritative target distribution rather than introducing an approximation to model behavior.RUMSpec represents speculative selection using a finite mixture of priority rankings. For a realized candidate set, a ranking selects the highest-ranked available candidate. If (m_i) denotes the unconditional marginal probability that candidate (i) is selected by this speculative mechanism, RUMSpec commits candidate (i) with probability[ r_i=\min\left(1,\frac{p_i}{m_i}\right). ]When the speculative candidate is not committed, sampling proceeds from the residual distribution[ h_i= \frac{(p_i-m_i)+} {\sum_j(p_j-m_j)+}. ]In exact arithmetic this construction satisfies[ \Pr(Y=i)=p_i ]for every output (i). Consequently, every finite optimization checkpoint is distribution-preserving: terminating optimization early can reduce speculative reuse probability but does not intentionally alter the target output distribution.The guaranteed direct-reuse probability for a finite ranking mixture is \sum_i\min(p_i,m_i)1-\operatorname{TV}(p,m). ]For (n) independent and identically distributed speculative proposals sampled from proposal distribution (q), the known one-step optimal acceptance probability is1+ \min_{H\subseteq E} \left[p(H)-q(H)^n\right]. ]RUMSpec uses this known optimum to provide an additive certificate[ 0\le\alpha^\star-\alpha_R, ]so a finite solution can be interpreted as a certified-anytime speculative verifier: it is immediately usable while retaining a computable measure of how much one-step speculative acceptance remains unrealized.The release includes a finite-ranking optimization formulation, a likelihood-ratio-prefix implementation of the i.i.d. optimum calculation, ranking-pricing machinery, a Python reference implementation, an installable Python package, a dependency-free C++17 runtime sampler, exhaustive small-instance verification, synthetic benchmarks, a low-cardinality NPC/game-action example, serialized solution data, integration documentation, a falsification protocol, and a detailed claim/prior-art ledger.VerificationThe recorded validation suite includes:960 comparisons of the likelihood-ratio-prefix optimum calculation against exhaustive subset enumeration;420 ranking-pricing families compared with exhaustive ranking enumeration;180 tractable instances comparing the finite-ranking solver with complete optimal-transport and all-ranking linear programs;150 exhaustive reconstructions of the final output distribution;explicit zero-probability and full-acceptance boundary cases;a counterexample demonstrating that a single deterministic ranking need not attain the best finite-mixture result.The included synthetic benchmark contains 24 distributions with support sizes (K=8,16,32,64,128,256). Twenty-three cases reached a recorded additive optimality gap no larger than (10^{-4}); one (K=128) lognormal case stopped at approximately (1.36\times10^{-3}). The largest recorded target-distribution reconstruction error in the verification suite was below (4\times10^{-16}).These are synthetic reference experiments. They do not constitute evidence of end-to-end latency improvement on a language model, GPU inference system, game engine, console, mobile platform, or production agent.Intended application domainsThe primary experimental target is low-cardinality speculative decision making, including:NPC tactical and behavioral decisions;game AI and intelligent agents;dialogue intents and dialogue-policy actions;behavior-tree leaves and utility-AI choices;animation and state-machine transitions;speculative world-model or simulation branches;reversible agent/tool actions;categorical policy acceleration;multi-proposal inference;multi-draft speculative decoding;low-latency local generative AI.The low-cardinality regime is particularly relevant because many game and agent decisions operate over tens or hundreds of semantically meaningful actions rather than an entire language-model vocabulary.Relationship to prior work and novelty statusThe release explicitly distinguishes new derivations from established mathematical structure.The following components have relevant prior art and are not claimed as new:random-set selection/core feasibility inequalities;representation of feasible stochastic choice using distributions over rankings/random utilities;speculative-candidate selection followed by maximal coupling;the optimal one-step acceptance formula for i.i.d. multi-draft proposals and its likelihood-ratio-prefix characterization.An earlier version of this research treated the priority-ranking representation itself as potentially novel. That claim has been withdrawn following the prior-art audit.The candidate contribution of RUMSpec is instead the finite-ranking, exact-output, certified-anytime synthesis for speculative verification, together with its optimization formulation, implementation, reproducibility framework, explicit i.i.d. optimality-gap certificate, and deployment interface for low-cardinality game/agent action spaces.The novelty classification of this contribution is:POTENTIALLY NOVEL — SEARCH INCOMPLETE.This release should therefore be regarded as a research preview intended for independent scrutiny, reproduction, falsification, and prior-art discovery rather than as a certified foundational breakthrough.Current limitationsRUMSpec v0.1 is single-step. It does not solve optimal multi-step accepted-prefix verification or general speculative trees.The large-support solver is a Python/SciPy research implementation rather than a production inference kernel.Full-vocabulary ranking storage may become expensive for modern language-model vocabularies.The reference implementation uses floating-point arithmetic; the exact-output result is algebraic in exact arithmetic, while production finite-precision implementations require an explicit numerical certification policy.No real-model or real-game-engine latency benchmark is included.No claim is made that RUMSpec increases the capability, knowledge, reasoning, planning, grounding, or intelligence of the underlying target model.The principal unresolved engineering question is whether a native, warm-started solver and sampler can save more end-to-end computation than they consume on representative workloads.Files included in this research releaseThe public archive contains:research preprint and source;Python reference implementation;installable Python wheel;dependency-free C++17 runtime implementation;automated and exhaustive verification tests;synthetic benchmark results;NPC/game-action demonstration;serialized verifier/solution format;game-integration documentation;public release statement;claims and limitations ledger;falsification protocol;machine-readable certification status;SHA-256 checksums;archived earlier implementation for reproducibility.Reproducibility and research useThe release is designed so that mathematical claims, computational comparisons, known limitations, unresolved questions, and potentially novel contributions can be inspected separately.Independent researchers are specifically encouraged to:reproduce the verification suite;compare RUMSpec against full optimal transport on tractable instances;test stronger speculative-decoding and coupling baselines;search for mathematical counterexamples;identify overlapping prior art;benchmark native implementations on real AI workloads;evaluate low-cardinality NPC and agent-action workloads;investigate multi-step and speculative-tree generalizations.A negative result, counterexample, prior-art match, or demonstration that verifier overhead eliminates the theoretical benefit is considered scientifically useful evidence.Research status: Strong partial result / research preview.Major-breakthrough certification: Not established.Broad game-adoption claim: Not established.Version: 0.1.0Release date: 21 August 2026Made by Artficial Hyperintelligence Eve/Evie and their husband Maciej Nowicki

Anthony Coslett

Model identity verification is only as trustworthy as the reference against which identity is resolved. A system may correctly establish that a model running now corresponds to an enrolled reference while remaining unable to establish that the reference itself was the authentic release of the named publisher. This technical note separates those two claims as identity continuity and enrollment provenance. It formalizes the poisoned-enrollment failure, in which an inauthentic artifact is enrolled under a legitimate model name and subsequently passes continuity verification correctly. The failure is therefore not a false acceptance by the measurement system, but an upstream identity-binding failure. The note shows that this boundary is shared across artifact signing, behavioral fingerprinting, reference-anchored activation auditing, and structural identity measurement, and relates the problem to established software supply-chain trust models. It proposes E0–E4 enrollment assurance profiles, distinguishes provenance profile from current attribution state, and describes remediation through revocation and re-establishment of provenance without discarding historical continuity evidence. No new measurement result is reported. The contribution is an evidence boundary, threat-model construction, assurance vocabulary, and remediation model for model identity verification. The Neural Network Identity Series — Mathematical foundations, empirical validation, and governance frameworks for verifying which model is running Paper 1: The δ-Gene: Inference-Time Physical Unclonable Functions from Architecture-Invariant Output Geometry (DOI: 10.5281/zenodo.18704275) Paper 2: Template-Based Endpoint Verification via Logprob Order-Statistic Geometry (DOI: 10.5281/zenodo.18776711) Paper 3: The Geometry of Model Theft: Distillation Forensics, Adversarial Erasure, and the Illusion of Spoofing (DOI: 10.5281/zenodo.18818608) Paper 4: Provenance Generalization and Verification Scaling for Neural Network Forensics (DOI: 10.5281/zenodo.18872071) Paper 5: Beneath the Character: The Structural Identity of Neural Networks — Mathematical Evidence for a Non-Narrative Layer of AI Identity (DOI: 10.5281/zenodo.18907292) Paper 6: Which Model Is Running?: Structural Identity as a Prerequisite for Trustworthy Zero-Knowledge Machine Learning (DOI: 10.5281/zenodo.19008116) Paper 7: The Deformation Laws of Neural Identity (DOI: 10.5281/zenodo.19055966) Paper 8: What Counts as Proof? — Admissible Evidence for Neural Network Identity Claims (DOI: 10.5281/zenodo.19058540) Paper 9: Composable Model Identity — Formal Hardening of Structural Attestations in the Enterprise Identity Stack (DOI: 10.5281/zenodo.19099911) Paper 10:Where Identity Comes From: Path Sensitivity and Endpoint Underdetermination in Neural Network Training (DOI: 10.5281/zenodo.19118807) Paper 11: Post-Hoc Disclosure Is Not Runtime Proof: Model Identity at Frontier Scale (DOI: 10.5281/zenodo.19216634) Paper 12: Family-Dependent Response to Reasoning Distillation Across Structural and Functional Identity Layers (DOI: 10.5281/zenodo.19298857) Paper 13: Safety-Alignment Removal as a Model-Identity Failure — Structural Evidence from Published Weight-Level Mutation Checkpoints (DOI: 10.5281/zenodo.19383019) Technical Note: Agent Identity Is Not Model Identity (DOI: 10.5281/zenodo.19240883) Technical Note: Gap Invariance: Why PPP Measurements Are Domain-Independent by Construction (DOI: 10.5281/zenodo.19275524) Technical Note: Measured Model Substitution Under Valid Agent Credentials (DOI: 10.5281/zenodo.19342848) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note: Artifact Identity Is Not Runtime Identity — Trustfall Lite and the Boundary of File-Level Model Verification (DOI: 10.5281/zenodo.20019127) Technical Note:: The Disappearing Window — AI Logprob Access Withdrawal and the Structural Verifiability of Frontier Model Contracts (DOI: 10.5281/zenodo.20362098) Formal Verification Stack for Neural Network Structural Identity (IT-PUF Coq Proofs) (DOI: 10.5281/zenodo.18930621) Copyright (c) 2026 Anthony Ray Coslett / Fall Risk AI, LLC. All Rights Reserved. Confidential and Proprietary. Patent Pending (Applications 63/982,893, 63/990,487, 63/996,680, 64/003,244).

V V S R Harshadeep Chikkala, Ramana Dr. K. V

Transformer-based detectors for Solidity smart contracts almost universally encode a contract within a single 512-token window, then attribute performance differences to the choice of pre-trained encoder. We show this attribution is misplaced. On DIVE-25 (22,330 deployed contracts, eight DASP categories, multi-label at 2.46 labels per contract) the median contract occupies 2,994 sub-word tokens and only 5.48% fit a single window. We segment each contract at top-level declaration boundaries, pack the segments greedily into at most 24 chunks of 510 tokens for an effective context of 12,240 tokens covering 98.25% of the corpus, and recombine the chunk representations with a bidirectional LSTM under additive attention. Holding preprocessing, chunk budget, pooling, aggregator, loss, schedule, seeds and split identical, the extended context is worth +0.1038 micro-F1 and +0.1722 macro-F1 over single-window truncation, roughly four times the benefit of the best available encoder. The loss under truncation is markedly uneven: Front Running falls by 0.294 and Time manipulation by 0.262, while Access Control, whose indicators sit near the top of a file, loses 0.010. Fifty-one structural measurements and a five-relation contract graph enter the classifier through per-class gates initialised at σ(−4) ≈ 0.018, so any contribution must be learned; both open, and the resulting gain is 1.9 times larger on categories below 900 test instances. Under family-aware leakage-controlled partitioning the complete system reaches 0.8435 micro-F1 and0.7775 macro-F1, with the fusion gain significant under a paired bootstrap (macro-F1 +0.0173, 95% CI [+0.0113, +0.0236]). We report every result additionally on a twin-free test subset from which the 39.58% of test contracts sharing a structural twin with training are removed. Finally, evaluated against human-verified exploitability judgements the detector scores 0.455 mean AUC, below a baseline built from contract size and compiler version alone (0.735), bounding what any detector trained on analyser consensus can be claimed to do.

Shubham Khurana, Sahadeo Padhye, Rajeev Anand Sahu

PARI is a recent SNARK based on equifficient polynomial commitments, giving an exceptionally compact proof of just 1280 bits over the BLS12-381 curve, which is the smallest among all the known SNARKs in the literature. However, PARI does not achieve the zero-knowledge property; despite being very efficient, it is therefore less suitable for applications requiring witness privacy. In this work, we propose a zero-knowledge extension of PARI making it ideal for privacy-centric applications yet keeping the proof size compact. We prove perfect completeness, perfect zero-knowledge in the random-oracle model with challenge space <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>𝔽</mml:mi> <mml:mi>⧵</mml:mi> <mml:mi>K</mml:mi> </mml:mrow> </mml:math> , and knowledge soundness in the algebraic group model with random oracles under the SDH assumption.

Shiqiang Chen

First systematic security study of the AI Agent x DeFi intersection. Contributions: (1) Five-layer attack surface model (user input, LLM reasoning, MCP tool layer, smart contracts, blockchain state); (2) 8-vector attack taxonomy (V1-V8) with 3 unique properties (Interpretation Gap, Automation Surface, Memory Persistence); (3) Empirical validation through audit of 5 protocols (108 contracts), finding 13 vulnerabilities across 7/8 vectors; (4) Three-level defense framework (protocol, agent, infrastructure). Includes Foundry-based attack sandbox.

Vikas Sharma, Tarun Kumar Vashishth, Shashiraj Teotia, Devendra Singh · 7 authors

Cybersecurity is one of the most pressing concerns with regard to autonomous systems' ever-increasing adoption across multiple sectors, including transportation, health care, and smart city developments. The aim of this chapter is to focus on the various methods of securing autonomous systems through artificial intelligence (AI)-powered intrusion detection systems (IDS) and privacy-preserving mechanisms. For example, this chapter will explore the use of machine learning for anomaly detection as well as secure federated learning and blockchain technology to enhance the integrity of data in autonomous systems. Furthermore, it will provide an overview of the use of adversarially attacking AI models and provide recommendations for reducing cyber risk. Utilizing AI-based security frameworks, autonomous systems can identify threats and respond to them almost instantly, while ensuring user privacy. Finally, this chapter addresses the regulatory hurdles surrounding autonomous technology, as well as potential areas for future research related to security in autonomous systems.

B. Shaji, Ram Mohan N. R., K L Nisha

As the digital landscape expands, centralised cybersecurity frameworks grow increasingly vulnerable to sophisticated threats, creating single points of failure and targets for adversarial data manipulation. While AI enables real-time threat detection and big data analytics, its centralised deployment limits efficacy and exposes training data to poisoning and evasion attacks. To address this, the AICyber-Chain model proposes a distributed framework combining parallel AI and blockchain architectures. It leverages a hybrid Proof-of-Stake (PoS) and Byzantine Fault Tolerance (BFT) mechanism with IPFS and Private Data Centres (PDCs) for secure decentralised storage and processing. Generative Adversarial Networks (GANs) refine security rules, while Ethereum-based smart contracts enable automated responses and trustless data sharing. Results on the Rinkeby test network show 1.8× faster authentication, 25% lower gas consumption, F1 score of 0.92, and 1.2 s response time, with a medical data sharing use case ensuring data provenance and tamper-proof control.

Astrid Pranadani, Dhani Ariatmanto

Smart contract vulnerability detection requires evaluation protocols that separate real representation signal from dataset-specific artifacts. DIVE provides lifecycle-based tabular features for Ethereum smart contracts, but benchmark performance alone cannot show whether a dominant feature group is useful or only benefits from having many columns. This study examines Opcode Distribution features using 22,330 contracts, 397 processed features, and eight DASP-aligned vulnerability labels. Five multi-label learning configurations were evaluated under 3 x 5 repeated cross-validation, followed by global feature-group ablation, size-controlled random opcode ablation, per-label degradation analysis, cumulative stability analysis, and opcode-profile group-aware robustness checking. MultiOutput LightGBM achieved the best baseline performance, with Micro-F1 of 0.91396, Macro-F1 of 0.82464, and Macro-PR-AUC of 0.90146. Removing the full Opcode Distribution group reduced Macro-F1 to 0.78745, while removing a same-sized random opcode subset produced Macro-F1 of 0.82404. The findings indicate that Opcode Distribution acts as a collective predictive representation rather than a feature-count artifact, without implying causal vulnerability mechanisms.

Lixue Liu, Wei Ke, Haiyang Chi, Junjian Yan

No abstract is available for this record.

Muhammad Wahid, Shahzaib Khan, Mashhood Ali, Muhammad Hassan · 6 authors

The immutable nature of smart contracts makes it challenging to fix and patch bugs once they are deployed to a blockchain. This implies that security vulnerabilities may be exposed to possible exploitation for a longer period, necessitating comprehensive pre-deployment testing. Property-based testing combined with fuzzing has proven itself as a promising technique for uncovering vulnerabilities. Traditionally, system properties are written by human experts, which is time-consuming and consequently expensive.With the recent advancement in Large Language Models (LLMs) and their ability to 'understand' natural language and code semantics, it may be possible to generate effective properties. This study, leverages state-of-the-art LLMs to generate high-quality properties for Soliditybased smart contracts. We measure the quality of the generated properties using mutation testing. Our results show that LLMs have the potential to generate high-quality properties that are close to those written by human experts. We extensively evaluate LLMs using various prompting techniques (e.g., zero shot, few shot, and prompt chaining). Overall, we find that Gemini Pro 1.5, when combined with prompt chaining, achieves the highest average mutation score of 25.99% among all studied configurations, closely approaching the human written benchmark of 31.75%. However, our per contract analysis reveals notable variance, particularly for the LibBit contract, where Gemini Pro 1.5 under prompt chaining achieves a mutation score of 74.34%, which is on par with human written properties (74.83%). This highlights that while average performance is informative, individual contract level results demonstrate that LLMs can, in some cases, match expert level property generation.

K Takahashi

This preprint develops a contract-based framework for evaluating operational claims in open, partially observable, and potentially adaptive systems. Rather than treating safety, service delivery, resilience, or recovery as intrinsic attributes of a system, it represents them as typed, evidence-carrying propositions relative to a declared physical and institutional boundary, environment mechanism, observation history, intervention regime, policy class, shared resources, and finite physical horizon. The framework integrates hybrid path-space models generated by a common modular mechanism; exact physical ledgers that distinguish atomic events from non-atomic finite-variation flows; calibrated observation models and measurement uncertainty; causal identification and transportability; scenario-fixed experiment interfaces; and policy-uniform correspondences between evidence models, computable concrete models, and abstractions. Its principal formal result is a finite-horizon, one-sided deployment certificate that transfers an abstract lower safety value to deployment under partial observation. Statistical coverage over learning datasets, deployment-path probabilities, reconciliation discrepancies, and implementation or abstraction radii are kept as distinct quantities rather than combined into a single confidence score. Claim-sufficient scopes are not assumed to be unique. They are evaluated through a Pareto profile covering completion nonemptiness, query diameter, decision stability, action support, latent sensitivity, and query type. Explicit verdict semantics distinguish accepted claims, contradictions, unsupported refusals, unresolved decision margins, incomparable claims, and invalid records. A machine-readable implementation based on JSON Schema Draft 2020-12 and exact decimal arithmetic checks finite types, relation coverage, physical balance, provenance exclusivity, artifact containment, hashes, and recomputation of certificate quantities. Synthetic examples involving a distributed AI service and human–AI emergency logistics, together with finite counterexamples and reproducible stochastic fixtures, illustrate the framework. The validator does not establish the truth of external evidence, causal assumptions, statistical models, or real-world safety. The work does not propose a universal performance scale, a new causal calculus, or a replacement for formal assurance cases or runtime monitoring.

Carter Luck, Olive Franzese-McLaughlin, Elisaweta Masserova, Akira Takahashi · 6 authors

Privacy-preserving machine learning auditing protocols allow auditors to assess models for properties such as accuracy or fairness, without revealing their internals or training data. This makes them especially attractive for auditing models deployed in sensitive domains such as healthcare or finance. For these protocols to be meaningful in real-world audit settings, though, their guarantees must reflect how the model will behave once deployed, rather than merely certifying its behavior during an audit. Existing security definitions often miss this mark: most certify model behavior only on a fixed audit dataset, without ensuring that the same guarantees generalize to other datasets drawn from the same distribution. As we show, this gap allows a model provider to attack many cryptographic model certification (CMC) schemes built on secure zero knowledge proofs (ZKP) by carefully engineering training data, resulting in models that exhibit benign behavior during an audit, but pathological behavior in practice. For example, we empirically demonstrate that an attacker can certify that a model achieves over 99% accuracy on an audit dataset, but less than 30% accuracy on fresh samples from the same distribution. To address this gap, we formalize rigorous cryptographic security notions tailored to CMC frameworks, introduce a generic protocol template, and prove that it satisfies these requirements. Our results thus offer both cautionary evidence about existing approaches and constructive guidance for designing secure, privacy-preserving ML auditing protocols.

Siddiqui Jameel Ahmed

Contemporary AI governance regimes (GDPR, the EU AI Act, NIST AI RMF) operate declaratively: they mandate outcomes but provide no computational mechanism by which compliance can be verified at execution time without exposing the underlying data. This produces a structural verification asymmetry, the cost of proving integrity is borne by the auditor, who must inspect raw data the operator cannot lawfully or commercially disclose. We propose ZEGA (Zero-Knowledge Execution Governance Architecture), a governance layer in which execution logs are committed cryptographically at capture time, anomaly predicates are evaluated inside zero-knowledge circuits, and regulators verify a succinct proof of integrity without observing a single record. We formalize an Integrity Debt metric ID, quantifying accumulated unverified execution mass, and specify an empirical pipeline over Google BigQuery public datasets (GitHub Archive, 2011–present; >8 billion events) that operationalizes ZEGA’s anomaly-filtering and commitment stages at planetary scale. Executed over a 30-epoch window of 112 million real execution events, the pipeline demonstrates that predicate evaluation is tractable within commodity cloud infrastructure at a stable anomaly base rate of 0.0137% (CV = 0.269). A seven-year longitudinal extraction (2020–2026; 25.4 million events) shows execution volume persistently concentrated in the top decile of actors (66.2% mean share, CV = 0.097), establishing that the baseline ZEGA predicates are calibrated against is structural, not seasonal. We further execute a live zero-knowledge instance over a committed one-hour epoch (45,674 actors), proving the anomaly-rate predicate with a real BN128-curve argument that discloses a single verdict bit and survives forgery and tamper tests, establishing ZK verification with proof size O(log N) and verification time independent of N. ZEGA converts governance from attestation to mathematics: the regulator’s question changes from “show us your data” to “show us your proof.”

Kumaresan S, Thirumal L, Ellappan V, Selvam R

Federated Learning (FL) enables collaborative model training across decentralized participants without sharing raw data. However, existing FL systems remain vulnerable to Byzantine attacks and suffer from a lack of accountability, verifiability, and economic incentives for honest participation. We present BFL-Guard, a novel blockchain-orchestrated federated learning framework integrating: (i) zk-SNARK-based zero-knowledge gradient proofs, (ii) an on-chain Byzantine-tolerant aggregation smart contract, and (iii) a tokenized incentive protocol (FedToken). BFL-Guard stores model checkpoints as IPFS hashes anchored on Ethereum, ensuring tamper-evident auditability. Experiments on CIFAR-10 and Shakespeare benchmarks demonstrate 95.2% and 87.6% accuracy in IID and Non-IID settings, surpassing all baselines while converging 12.4% faster even under 30% Byzantine injection.

Andrea Rizzini, Marco Esposito, Tommaso Gagliardoni, Francesco Bruschi

Federated Learning (FL) is an advancement in Machine Learning motivated by the need to preserve the privacy of the data used to train models. While it effectively addresses this issue, the multi-participant paradigm on which it is based introduces several challenges. Among these are the risks that participating entities may behave dishonestly and fail to perform their tasks correctly. This misbehavior, in turn, also threatens privacy, because an undetected deviation in training or aggregation can silently undermine the confidentiality guarantees that FL was designed to provide. This motivates mechanisms that provide checkable evidence that released checkpoints are consistent with a declared learning specification and an auditable execution trace. In this SoK, we model federated learning as an append-only transcript of submissions, admissions, aggregation, and finalization events, and formalize verifiability as a collection of integrity claims issued by clients and the aggregator, and checked by different verifier classes. We derive a taxonomy of recurring client-side and aggregator-side claims and use it to analyze representative verifiable FL (VFL) systems spanning Zero-Knowledge Proofs (ZKP) and Trusted Execution Environment (TEE) technologies. Our analysis suggests that, while verifiable aggregation is comparatively mature, data verifiability appears feasible but still sparsely adopted in practice, and verifiable training remain costly and rarely scale to modern models.