PaperlayerView exact revision on arXiv

Source-linked AI summary

ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring

Redwanul Karim, Nisha L. Raichur, Lucas Heublein, Tobias Feigl, Christopher Mutschler, Felix Ott

arXiv:2609.08763v1cs.CRcs.LG

TL;DR

Federated GNSS monitoring distributes proprietary classifiers to partly trusted stations, creating a need to trace leaks and distinguish recipient evidence from credential knowledge. ZK-Trace combines recipient tracing with zero-knowledge credential verification and checkable false-accusation certificates. It isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures without naming an innocent, under stated assumptions.

  • Problem

    Federated monitoring distributes proprietary classifiers to partly trusted stations, while existing ownership proofs do not identify a client and plaintext per-client fingerprints lack secret binding and collusion robustness.

    Source: §I · p. 1

  • Method

    ZK-Trace combines recipient-specific tracing, client-secret zero-knowledge credentials, and independently checkable false-accusation certificates.

    Source: §IV · p. 3, §VIII · p. 12, C. Finite Tracing Bounds and the… · p. 14

  • Results

    The evaluation isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures without naming an innocent.

    Source: §I · p. 2, §VIII · p. 12

  • Takeaways & Limitations

    Credential knowledge authenticates a witness holder, while recipient tracing relies separately on the secret row and registry.

    Source: §IV · p. 3

    The GNSS partitions come from one measurement campaign and do not reproduce separately sited receivers’ distinct calibration, multipath, and local interference.

    Source: §VI · p. 7

Abstract

from arXiv · show

Federated global navigation satellite system (GNSS) monitoring distributes a proprietary classifier to partly trusted stations, any of which may leak its copy. ZK-Trace combines public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification. The registry supports offline tracing without the leaker's cooperation. We establish conditional false-accusation bounds for arbitrary recovered bit patterns, a finite completeness bound under a hidden-bias residual channel, and a deterministic tracing-score bound for correlated feature-distillation errors. An interval-arithmetic checker makes the conditional bound executable and allocates a common budget across accusation and tamper decisions. Under innocent-row independence, the certificate-based evaluation uses a false-naming budget of 0.001 per investigation. It isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures without naming an innocent. Experiments use a simulated GNSS federation and CIFAR-10. Feature matching preserves the feature mark in 20/20 runs and cross-architecture transfer in 19/20, at copy-accuracy costs of 4.8 and 6.1 percentage points on GNSS and CIFAR-10. Function-only distillation erases the feature mark, and distillation also removes weight-space marks. These results support verifiable tracing under explicit statistical and cryptographic assumptions. Credential knowledge and recipient evidence serve distinct roles.

I. INTRODUCTION

ZK-Trace combines public identity marks, recipient-specific fingerprints, and credential proofs to address attribution and collusion in federated GNSS monitoring. Its evaluation reports successful single-copy isolation and pair-mixture tracing, while prior approaches cover only parts of the evidence needed.

I. INTRODUCTION

  • Federated GNSS monitoring keeps measurements local but distributes a proprietary classifier whose leak can expose jamming and spoofing detection weaknesses affecting PNT.Existing schemes provide incomplete evidence: FedZKP certifies group membership without identifying a client, while FedTracker and DUW provide per-client fingerprints without collusion-secure codes [3],,.Source: §I · p. 1, §II · p. 2

II. RELATED WORK

  • Tardos codes address collusion, but their guarantees do not directly cover extraction errors introduced by FedAvg.The paper situates its analysis alongside symmetric scoring and noisy-Tardos work,,,.Source: §I · p. 1, §II · p. 2

I. INTRODUCTION

  • ZK-Trace uses public identity codewords for credential presence, recipient-specific Tardos fingerprints for tracing, and zero-knowledge proofs to authenticate claimants.The registry supports offline comparison, while the analysis bounds false accusations conditional on recovered bits and missed colluders under a specified channel.Source: §I · pp. 1–2
  • The evaluation uses federated few-shot GNSS monitoring with ten seeds, ten simulated stations, and CIFAR-10 as a transfer check.The setup tests tracing with imbalanced data, variable participation, and modified copies.Source: §I · p. 1
  • 712/720 two-owner mixtures were traced, and all 160 single-owner copies were isolated without naming an innocent.The evaluation also reports that feature matching preserved the feature mark in 20/20 runs and cross-architecture transfer in 19/20; function-only distillation erased it.Source: §I · p. 2

IV. ZK-TRACE CONSTRUCTION

ZK-Trace embeds public client identity codewords in shared batch-normalization scales and adds a secret recipient-specific tracing row to each dispatched copy. Credential verification checks both knowledge of a private witness and mark presence, while recipient tracing remains a separate operation.

IV. ZK-TRACE CONSTRUCTION

  • Each client registers a public input and codeword; after federated aggregation, the tracer adds a secret Tardos row to that client’s dispatched copy and scores recovered rows against the registry.This permits tracing without contacting the holder, including when modifications invalidate an exact dispatch-log hash.Source: §IV · p. 3, A. Setting and Threat Model · p. 3

A. Setting and Threat Model

  • The threat model covers authorized clients misusing copies, including weight-space edits, bounded coalitions, framing, and distillation, with guarantees conditional on stated extraction assumptions.The method does not address poisoned updates or credential redistribution, and it cannot distinguish a server leak from a recipient leak of the same copy.Source: A. Setting and Threat Model · pp. 3–4

B. Codeword Embedding

  • Client codewords are projected into the shared batch-normalization scales, whose 20 layers spread each bit across the carrier; a hinge loss trains the signed projections toward their target margins.At ten clients, the identity-codebook load is approximately 0.27; the watermark loss is weighted by λwm = 0.1 against task accuracy.Source: B. Codeword Embedding · p. 4

C. Zero-Knowledge Verification

  • Verification checks codeword presence and proves knowledge of the client’s private xLPN witness; the verifier binds its context to a digest of the complete model state.A valid credential authenticates the witness holder, not authorship; recipient attribution instead uses the separate secret row and registry.Source: §IV · p. 3, C. Zero-Knowledge Verification · p. 5

D. Security Guarantees

ZK-Trace separates credential knowledge and artifact binding from recipient tracing, which uses registered recipient rows and certified score decisions. Its analysis gives conditional soundness, finite completeness, and feature-stability guarantees under distinct assumptions.

D. Security Guarantees

  • A credential proof establishes knowledge of a private witness and binds the statement to a full-state artifact, but does not prove authorship.Credential verification and recipient tracing answer different questions; a credential proof does not decide whether its claimant leaked.Source: D. Security Guarantees · p. 5

E. Tracing Overlay and Two Carriers

  • At dispatch, the tracer embeds a recipient-specific Tardos row and reads it from BN-scale projections or feature projections on fixed probes.Registered rows are scored at adjudication; a certified decision requires a passing certificate, while a threshold exceedance alone is only an uncertified lead.Source: E. Tracing Overlay and Two Carriers · p. 5

V. THEORETICAL ANALYSIS

  • The diagnostic SNR interpretation assumes uniform weights, update norms near µ√n, and negligible cross terms; it is not a proved floor for trained federated networks.The deterministic decoding and probe-margin results do not require the idealized identity probability model.Source: §V · pp. 5–6
  • If every client’s decoding error is less than half the minimum code distance, maximum-agreement attribution is uniquely correct.The stated operating conditions are sufficient, not necessary; measured mean bit accuracy cannot replace uniform conditional bit accuracy.Source: §V · p. 6
  • Under A5(a), the conditional tracing bound controls an innocent row’s score given the recovered word and biases, with the false-accusation probability bounded by ε1.An additional a-priori bound holds uniformly over recovered words and biases.Source: §V · p. 6
  • The worst missed-coalition bounds are 0.0096 at (c, nt, q) = (2, 512, 0.04) and 0.00201 at (3, 2048, 0.15), for N = 10 and false-accusation budget 10−3.The finite completeness guarantee permits jointly chosen coalition bits, but requires an independently flipping residual channel; these bounds are not estimates of network residual channels.Source: §V · p. 6
  • With at most k decoded-bit changes, subtracting the k largest score weights gives a deterministic threshold-survival bound that allows correlated or targeted errors.Feature matching can preserve probe margins, whereas function-only matching can change feature coordinates and violate the margin condition.Source: §V · p. 7

VI. EXPERIMENTAL SETUP

The evaluation uses simulated GNSS few-shot classification, with CIFAR-10 as a transfer check, and tests attribution, recipient tracing, and attack robustness. Its setup specifies the data partition, model and watermark configurations, metrics, and attack suite.

VI. EXPERIMENTAL SETUP

  • The GNSS benchmark re-renders recordings as 100,000 four-channel 4×32×32 tensors across six interference classes, with an 80/10/10 sample-level split and approximately 178× class imbalance.Ten stations partition one measurement campaign; CIFAR-10 supplies the transfer check.Source: §VI · p. 7
  • All ten stations use partitions of one campaign, so they do not reproduce separately sited receivers with distinct calibration, multipath, and local interference.Receiver shift is a proxy, and tracing certificates should be rechecked on decodes from new sites.Source: §VI · p. 7
  • A ResNet-18 backbone with a prototypical head is pre-trained for 200 epochs, then trained for 100 FedAvg rounds with ten clients.Each client uses 25 local five-way five-shot episodes per round, with 15 query examples per class.Source: §VI · p. 7
  • Each client receives 128 identity bits; dispatched copies use 512 BN-γ projections for the weight carrier and 2,048 probes for the feature carrier.The deployed setting uses ten clients, while a higher-load setting uses forty; design targets are c=2 and c=3, respectively.Source: §VI · p. 7
  • Evaluation measures few-shot accuracy, aggregate attribution, own- and cross-codeword bit agreement, and presence using a stricter Hamming-distance test.Results include ten-seed means and standard deviations or pooled counts; global-model equivalence is tested at stated accuracy margins.Source: §VI · p. 7
  • The attack suite covers model edits, targeted bit-flip and layer-reset attacks, fine-tuning, and distillation, with five federated watermark baselines evaluated on native mark metrics.Additional tests include insider erasure, robust aggregation, and receiver covariate shift; a DeepMarks-style comparator is used for coalition sweeps.Source: §VI · p. 8

VII. RESULTS

The results evaluate identity attribution on the aggregate and recipient tracing on dispatched copies, alongside robustness to attacks. They distinguish tracing performance and copy-accuracy costs from the deployed global model’s utility.

VII. RESULTS

  • The evaluation measures identity attribution on the aggregated model, separately from tracing on dispatched copies.These are distinct tracing settings in the reported results.Source: §VII · p. 8
  • Robustness after attacks is evaluated alongside tracing performance on dispatched copies.Source: §VII · p. 8
  • The results distinguish carriers’ tracing performance and copy-accuracy costs from the utility of the deployed global model.Source: §VII · p. 8

A. Attribution and Survival

ZK-Trace uses identity marks to attribute a shared model and recipient-specific fingerprints to trace leaked copies, with registry-based adjudication. Its experiments evaluate attribution across identity loads and tracing under collusion, while distinguishing empirical results from bounds that require stated assumptions.

A. Attribution and Survival

  • 98% of GNSS contributors and 100% of CIFAR-10 contributors were identified; mean cross-talk was 0.50, while FedZKP’s group mark had chance attribution of 10% at Nc=10.Attribution identifies contributors to the shared aggregate; recipient tracing is evaluated separately.Source: A. Attribution and Survival · p. 8
  • As identity load ρ increased, self-agreement declined but stayed above the quadrature diagnostic; CIFAR-10 attribution remained exact at ρ=1.07, while GNSS attribution fell to 0.87.At ρ=1.07, self-agreement was 0.77 on GNSS and 0.76 on CIFAR-10; the per-bit floor alone did not explain their attribution difference.Source: A. Attribution and Survival · p. 8, Figure 3 · p. 8
  • The deterministic radius condition held for 100/100 CIFAR-10 and 59/60 GNSS client components, matching the correctly attributed components in those sets.This verifies a Hamming-separation margin without relying on the idealized conditional sphere model.Source: A. Attribution and Survival · p. 9
  • Across the full roster, 30% client sampling per round yielded 98% GNSS and 100% CIFAR-10 attribution; at label-skew α=0.1, GNSS attribution fell to 16%.At α=0.5, roster-wide attribution was 100% on CIFAR-10 and 79% on GNSS; some clients lacked classes needed to train a mark.Source: A. Attribution and Survival · p. 9

B. Tracing, Collusion, and the Two Carriers

  • The weight carrier traced every tested two-client coalition; the feature carrier traced every sampled coalition through k=5 on GNSS and k=8 on CIFAR-10, with no innocent accused at tested sizes.The weight carrier’s success declined for larger coalitions; these sweep outcomes are empirical.Source: Table V · p. 9, B. Tracing, Collusion, and the Two… · p. 9
  • 160/160 single copies were isolated and 712/720 pair mixtures traced without naming an innocent under the certificate-gated rule, with all 880 positive-tail certificates passing.The evaluation allocates a 10^-3 budget per investigation across accusation and tamper tails.Source: B. Tracing, Collusion, and the Two… · p. 9, Table VI · p. 10
  • The certificate bounds rely on innocent-row independence under A5(a), which the evaluation does not empirically establish.Measured unanimous-position disagreement was 0.112 on GNSS pairs and 0.140 on CIFAR-10 pairs; these diagnostics do not validate the modeled q values.Source: B. Tracing, Collusion, and the Two… · p. 10
  • The weight carrier targets two colluders and costs about 4.5 accuracy points; the feature carrier targets three, costs 4.8 GNSS and 6.1 CIFAR-10 points, and survives tested feature-matching distillation.Distillation erases the weight carrier, while function-only distillation erases the feature carrier.Source: B. Tracing, Collusion, and the Two… · p. 10

C. Comparison, Utility, and Robustness

ZK-Trace combines recipient tracing, client-secret credentials, and checkable false-accusation certificates for federated models. Its evaluations report tracing outcomes and robustness limits alongside copy costs, model utility, and feature-space measurements.

C. Comparison, Utility, and Robustness

  • FedZKP and FedIPR verify shared-model ownership rather than identify recipients; FedTracker and DUW offer per-client traceability but lack client-secret binding or zero-knowledge verification.ZK-Trace combines the listed capabilities subject to carrier, channel, and per-decode qualifications.Source: C. Comparison, Utility, and Robustness · p. 10, Table IX · p. 11
  • Paired ten-seed comparisons establish global-model utility equivalence within the stated margins: GNSS ∆=−0.04 pp and CIFAR-10 ∆=+0.24 pp.The margins were 1.0 pp for GNSS and 0.5 pp for CIFAR-10.Source: C. Comparison, Utility, and Robustness · p. 10
  • Leave-one-out 1-NN accuracy showed no significant change, but silhouette scores decreased by 0.048 on GNSS and 0.023 on CIFAR-10 as intra- and inter-class distances increased.The reported pattern indicates altered cluster compactness alongside similar nearest-neighbor classification, not unchanged feature geometry.Source: C. Comparison, Utility, and Robustness · p. 10, Table VIII · p. 10
  • Distillation erased the weight carrier while retaining approximately 80% task accuracy; pruning, noise, quantization, PGD, and fine-tuning preserved its attribution at the clean level.Layer reset reduced attribution but also severely degraded task accuracy.Source: C. Comparison, Utility, and Robustness · p. 10, Figure 5 · p. 11
  • Feature matching preserved the feature mark in 20/20 runs and cross-architecture transfer preserved it in 19/20; function-only distillation erased it in all 20 runs.The feature carrier’s dispatched-copy accuracy cost was 4.8 points on GNSS and 6.1 on CIFAR-10; survival depends on the feature-matching condition.Source: C. Comparison, Utility, and Robustness · pp. 10–11, Figure 5 · p. 11
  • At matched compute, the hybrid attack escaped threshold-only tests on both carriers in 5/20 runs; the tested results do not establish robustness to an adaptively chosen budget.Under the stated custody model, the attacker cannot directly monitor the tracer-secret score to choose its stopping point.Source: C. Comparison, Utility, and Robustness · p. 11
  • Coordinate-wise median aggregation preserved attribution at 1.00 on CIFAR-10 and 0.98 on GNSS, while GNSS receiver shift retained tracing in 100 trials but reduced exact single-leaker isolation toward chance.Median aggregation also reduced task accuracy; the tested result does not establish invariance to arbitrary robust aggregators.Source: C. Comparison, Utility, and Robustness · p. 11

VIII. CONCLUSION

  • With a false-accusation budget of 10^-3, verified finite examples give missed-coalition bounds below 0.0096 and 0.00201; certificates passed for all 880 positive tails, with 160/160 single copies isolated and 712/720 pairs traced without naming an innocent.The modeled-channel bounds and certificate-based evaluation are distinct results.Source: §VIII · p. 12

Appendix A Tracing Construction and Analysis

The construction separates shared-model identity marks from recipient-specific tracing rows and credential authentication. Its tracing analysis gives conditional soundness and finite completeness bounds under distinct assumptions, with an executable certificate procedure and a specified residual channel.

A. Identity Codebook and Tardos Overlay

  • Identity codewords occupy separate dense-direction blocks in the same scale vector, while a shared block carries the dispatched recipient’s tracing row; identity marks do not establish who trained the model.The identity layer detects agreement with public credentials; the overlay supports offline comparison with the enrollment registry.Source: A. Identity Codebook and Tardos Overlay · p. 14, B. Dispatch Fingerprinting · p. 14
  • The Tardos overlay embeds a recipient’s secret row in shared unit columns at dispatch, then decodes bits from projection signs and scores them with symmetric Tardos scoring.The tracer holds the full code matrix and biases; the carrier uses nt shared columns rather than Nnt client-specific columns.Source: A. Identity Codebook and Tardos Overlay · p. 14

B. Dispatch Fingerprinting

  • Dispatch fingerprinting fine-tunes a separate recipient copy using server-held proxy data; the tracing operation does not change the shared model.Reported copy costs apply to evaluated configurations, not universally.Source: B. Dispatch Fingerprinting · p. 14
  • Neither mark layer detects poisoned updates or prevents voluntary credential sharing; those threats require separate controls such as robust aggregation and revocation.The global identity marks cannot isolate a recipient, whereas the dispatched copy contains the recipient’s tracing row.Source: B. Dispatch Fingerprinting · p. 14

C. Finite Tracing Bounds and the Residual Channel

  • The conditional innocent-score moments under A5(a) are E[Si | y, p] = 0 and Var(Si | y, p) = nt, with independent bounded increments whose tails may depend on y.The soundness bound conditions on realized biases and output; it does not require an output-invariant innocent score distribution.Source: C. Finite Tracing Bounds and the… · pp. 14–15
  • The residual rate q measures disagreement with the intended coalition output, not each colluder’s row, so per-row disagreement rates do not identify q.The bound’s order of integration reflects that pirates know their rows but not the biases.Source: C. Finite Tracing Bounds and the… · pp. 14–15
  • The finite completeness bound integrates over hidden biases before maximizing a coalition’s allowed output, covering row-dependent strategies and dependent intended symbols across positions.At unanimous positions, the coalition must output the common bit; independent residual BSC flips use common rate q.Source: C. Finite Tracing Bounds and the… · pp. 14–15
  • Finite examples use interval integration and check every coalition size through c; stipulated residual rates are model parameters, not fitted neural extraction rates.The examples use 4096 interval panels and 30-decimal-digit interval arithmetic, with full-precision enclosures supplied in reproducibility artifacts.Source: C. Finite Tracing Bounds and the… · p. 15, Table XI · p. 15

D. Registry, Authentication, and Disputes

The registry binds identity and tracing assignments before a dispute, and tracing does not require a suspect’s response. Certified decisions require threshold and certificate checks, with limitations on what a negative or repeated investigation establishes.

D. Registry, Authentication, and Disputes

  • The tracer creates an enrollment tuple whose opening the judge checks alongside the registered decoder setup and score evidence; tracing needs no suspect response.The commitment prevents substituting a different row, but does not prevent a tracer who knows the original row from embedding it again.Source: D. Registry, Authentication, and… · p. 15
  • Independent proof of issuance would require a signed delivery receipt and authenticated setup; a client nonce alone does not prove delivery.The evaluated protocol therefore assumes an honest tracer for provenance.Source: D. Registry, Authentication, and… · p. 15

E. Certified Decisions and Residual Erasure

  • A threshold exceedance without a passing tail certificate is an UNCERTIFIED-LEAD; certified positive and negative decisions require their respective thresholds and certificates.If neither threshold is exceeded, the outcome is NO-CERTIFIED-EVIDENCE.Source: E. Certified Decisions and Residual… · p. 16
  • No-certified-evidence does not establish that a copy was never leaked, and repeated investigations require a separately allocated total budget.Adaptive feedback also requires maintaining the conditional-independence premise.Source: E. Certified Decisions and Residual… · p. 16
  • Negating feature marks produced large negative scores, while re-randomizing feature signs brought scores near zero; weight-mark negation could leave a subthreshold positive score.These are measured outcomes, not a guarantee that every negative-training objective achieves perfect inversion.Source: E. Certified Decisions and Residual… · p. 16

F. The Feature-Space Carrier

The feature-space carrier uses probe-feature margins to support tracing-score survival under correlated or targeted errors. Its empirical robustness varies by distillation method, while the stated assumptions constrain when the analysis applies.

F. The Feature-Space Carrier

  • The carrier fits 2048 or 4096 probes even though its feature dimension is 512, because fitting uses a nonlinear function on different inputs.Feature width need not exceed the scale dimension for this fitting capacity.Source: F. The Feature-Space Carrier · p. 16
  • A deterministic score-stability bound connects feature stability to weighted tracing scores without assuming independent flips.The certificate gives sufficient threshold survival under correlated or targeted errors; direct score evaluation remains possible when the bound is too loose.Source: F. The Feature-Space Carrier · pp. 16–17
  • For feature readouts, probe residuals and teacher margins determine a sufficient bound on how many decoded bits can change.A directly measured set of probes with residual at least the teacher margin can give a sharper bound.Source: F. The Feature-Space Carrier · p. 16
  • 20/20 feature-matching runs and 19/20 cross-architecture runs preserved the feature mark, while 0/20 function-only distillation runs did.These empirical outcomes do not substitute for a margin check.Source: F. The Feature-Space Carrier · p. 17
  • The feature carrier costs 4.8 and 6.1 accuracy points per copy on GNSS and CIFAR-10, respectively, and supports the longer tracing rows used in experiments.Design targets are two colluders on the weight carrier and three on the feature carrier; measured tracing extends beyond those targets.Source: F. The Feature-Space Carrier · p. 17

A. Assumptions

  • The analysis assumes an idealized single-round conditional signed-direction model; repeated federated training is not asserted to satisfy it.The guarantees also have distinct premises: innocent-score soundness, finite BSC completeness, and deterministic score stability must be applied separately.Source: A. Assumptions · p. 17

B. Projection and Geometry

The geometry and attribution analysis gives conditions for unique identity decoding and calibrates the presence test. Its bounds distinguish dimensional reference points from impossibility claims and require separate models for dependent decoded bits.

B. Projection and Geometry

  • The exact projection decomposition is distinguished from a quadrature approximation that drops baseline-update and update-update cross terms.That approximation is not implied by A1 or by the stated Gram-norm condition.Source: B. Projection and Geometry · p. 17
  • When the number of identity columns exceeds the carrier dimension, the identity Gram matrix is singular, but this does not preclude useful sign decoding.The dimensional reference N*=ω/n=37.5 is not an impossibility theorem.Source: B. Projection and Geometry · p. 17

A. Identity Recovery and Attribution

  • The normalized projection of a fixed nonzero vector onto a random sphere direction is symmetric with variance one for ω > 4.The proof reduces the projection by rotation and uses reflection symmetry.Source: A. Identity Recovery and Attribution · pp. 17–18
  • For every client, a decoded-word distance below half the minimum codeword separation makes all maximum-agreement decisions uniquely correct.The probabilistic statement additionally bounds decoding error and close codeword pairs under A4.Source: A. Identity Recovery and Attribution · p. 18
  • Exact enumeration gives minimum lengths of 202 at p = .95 (t = 15) and 233 at p = .93 (t = 23) for completeness of at least .95.The completeness calculation uses a separate i.i.d. true-bit error model.Source: A. Identity Recovery and Attribution · p. 18

B. Tracing and Feature-Stability Proofs

The proofs separate innocent-score soundness, coalition completeness, and deterministic feature-score stability, each with its own assumptions. The credential analysis establishes witness extraction and model-state binding under stated cryptographic assumptions.

B. Tracing and Feature-Stability Proofs

  • For an innocent row, conditional independence across positions yields a score variance of nt and supports a moment-generating-function bound for arbitrary recovered outputs.The soundness bound is conditional on the recovered word and biases; a uniform alternative uses Bernstein’s inequality.Source: B. Tracing and Feature-Stability Proofs · p. 18
  • Under the finite completeness model, conditioning on coalition rows and intended outputs bounds the probability that all colluder scores remain below threshold.The bound uses hidden biases and independent residual BSC flips, and permits coalition decisions across positions.Source: B. Tracing and Feature-Stability Proofs · p. 18
  • Changing k decoded bits changes a client’s tracing score by at most the sum of the k largest per-bit weights, without requiring independent errors.Feature residuals and teacher margins bound which probes can change; direct residual-to-margin comparison needs no in-distribution sampling.Source: B. Tracing and Feature-Stability Proofs · p. 19

C. Credential Proof and Security Accounting

  • Three accepting Stern transcripts with the same commitments and all three challenges reveal a witness for the credential relation.The extraction relies on binding commitments and a valid encoded permutation.Source: C. Credential Proof and Security… · p. 19
  • At Q = 264, 330 rounds suffice for the stated ideal knowledge-error target, while the implementation uses 331 rounds.The ideal term is approximately 2^-129.623.Source: C. Credential Proof and Security… · p. 19
  • The challenge context binds the extracted component, registered credential, and digest of the complete model state, authenticating the credential statement rather than authorship.A public watermark can be copied, and a legitimate witness holder can authenticate after copying.Source: C. Credential Proof and Security… · p. 20

Appendix D Extended Results

Across the tested federation configurations, attribution depends on clients being able to form training episodes, while tracing and credential checks remain usable in tested collusion and anti-framing settings. Feature matching preserves the feature mark in the tested distillation runs, but the result is bounded by the tested distillers and assumptions.

A. Configuration Details

  • The simulated federation partitions one GNSS recording campaign; its label-skew sweep and receiver-shift proxy do not measure differences between separately sited receivers.The tests also leave distinct antenna and front-end calibrations, independent multipath, local interference, and compute heterogeneity untested.Source: A. Configuration Details · p. 20

B. Attribution under Non-IID Data and Partial Participation

  • At 30% participation, roster-wide attribution is 98% on GNSS and 100% on CIFAR-10; at α=0.5, GNSS roster-wide attribution is 79%.Participating-only attribution is 100% in every reported cell; the table distinguishes roster-wide from participating-only attribution.Source: B. Attribution under Non-IID Data and… · p. 20, Table XIV · p. 21
  • Under α=0.1, a mean of 0.5 GNSS clients can form a five-way five-shot episode, so low roster-wide attribution reflects episode formability rather than attribution loss.Some clients lack enough classes despite having nonempty shards.Source: B. Attribution under Non-IID Data and… · pp. 20–21

C. Tracing, Collusion, and Anti-Framing

  • Offline tracing names the exact leaker in all ten seeds, and registry adjudication resolves all ten cases without the suspect participating.In the adaptive-steering tests, every tested two-colluder coalition was traced, with no innocent framed across 400 trials.Source: C. Tracing, Collusion, and Anti-Framing · p. 21
  • Copying a victim’s public identity codeword raises its self bit-accuracy to 1.00, but the secret overlay accuses the framed victim in 0/10 trials.The credential proof accepts the legitimate victim in 10/10 trials, rejects tested forgeries in 0/10, and registry adjudication rejects evidence substitution in all ten trials.Source: C. Tracing, Collusion, and Anti-Framing · p. 21
  • Credential verification rejects a transcript transferred to a changed model state while the extracted component is held fixed; the proof knowledge-error bound is below 2^-128 at r = 331 under the stated query budget.A credential proof costs approximately 0.6 MB and 37 s per client and is used for offline dispute resolution, not each training round.Source: C. Tracing, Collusion, and Anti-Framing · p. 21

D. Distillation Leveling

  • Cross-architecture feature transfer succeeds in 19/20 runs, but the failed GNSS run had a postdistillation flip rate of 0.4976 and score of 54.8.Measured flip rates do not directly measure εKD or establish that the score upper bound is tight; the experiment does not isolate the plausible sources of transfer difficulty.Source: D. Distillation Leveling · pp. 21–22
  • Feature matching preserves the feature carrier in 20/20 runs and cross-architecture transfer in 19/20, while logit-only distillation and feature isometry erase it in 0/20 each.The observed advantage is specific to distillers that reproduce feature geometry closely enough, as required by Assumption 6.Source: D. Distillation Leveling · p. 22, Table XV · p. 22

E. Insider Attacks and Deployment Stressors

The section tests tracing and model utility under insider attacks, receiver shifts, robust aggregation, and identity-load changes. Its findings are bounded by the tested settings and attack budgets.

E. Insider Attacks and Deployment Stressors

  • Fresh erasure drives the feature score near zero while the weight overlay still traces the true row in all 20 runs; neither strategy frames an innocent.The hybrid escapes threshold-only tests in 5/20 runs at matched compute, 20/20 at twice that budget, and 0/20 at four times the budget.Source: E. Insider Attacks and Deployment… · p. 22
  • Coordinate-wise median aggregation retains attribution at 1.00 on CIFAR-10 and 0.98 on GNSS, while task accuracy is 80.2% and 63.4%, respectively.The results do not establish invariance to arbitrary robust aggregators; the embedding channel is held almost entirely by BN γ scales, whose standard deviation broadens by 6.7–7.1×.Source: E. Insider Attacks and Deployment… · pp. 22–23
  • Tracing succeeds in all 100 shifted GNSS trials with aggregate attribution 0.98, but exact single-leaker isolation degrades toward chance.The shift uses a +3 dB gain offset and per-station SNRs from 5 to 20 dB.Source: E. Insider Attacks and Deployment… · p. 22, H. Adversarial Attack Protocol · p. 23
  • Mean class recall falls 4.4 points on CIFAR-10 and 10.9 points on GNSS; the benchmark excludes interference-free signals and does not evaluate open-set abstention.These costs concern dispatched copies, not the global model.Source: E. Insider Attacks and Deployment… · p. 23

F. Global-Model Utility Equivalence

  • Both datasets establish global-model accuracy equivalence at the stated margins, but this result covers episodic accuracy at Nc = 10, not feature geometry or dispatched-copy utility.Table XVII reports paired 90% intervals and both TOST tests passing at their stated margins.Source: F. Global-Model Utility Equivalence · p. 23, Table XVII · p. 23

G. Identity-Survival Diagnostics

  • At Nc = 40, GNSS and CIFAR-10 self-agreement is 0.77 and 0.76, while attribution is 0.87 and 1.00; decoding radius and codeword separation govern competing decisions.The dataset difference is established, but its cause is not identified; the quadrature approximation also does not establish the geometry or conditional independence needed by Theorem 1.Source: G. Identity-Survival Diagnostics · p. 23

H. Adversarial Attack Protocol

  • The attack protocol tests BN-scale pruning, noise, quantization, PGD and resets, watermark-free fine-tuning and distillation, plus feature-matching variants and insider stressors.Insider attacks use 300, 600, and 1200 episodes; receiver shift uses a +3 dB gain offset and per-station SNRs from 5–20 dB.Source: H. Adversarial Attack Protocol · p. 23

Related papers

Loading 2609.08763v1…