ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring
Redwanul Karim, Nisha L. Raichur, Lucas Heublein, Tobias Feigl, Christopher Mutschler, Felix Ott
cs.CR · cs.LG
Quick verdict
Tardos fingerprints + ZK credentials for leak tracing in federated GNSS; certified bounds are rigorous, but soundness rests on untested independence.
Summary
ZK-Trace targets model-leak tracing in federated learning for GNSS interference monitoring: when any of ten partly trusted stations can leak its dispatched classifier, the operator must identify the leaker. The system layers three mechanisms: public identity codewords derived from each client's xLPN credential (extending FedZKP), a secret recipient-specific Tardos fingerprint written into each dispatched copy (weight-space BN-scale carrier for two colluders; feature-probe carrier for three), and zero-knowledge credential verification. Tracing works offline without the leaker's cooperation. The theoretical core is certificate-based adjudication: an interval-arithmetic checker verifies conditional false-accusation bounds (Theorem 3) per decode under innocent-row independence, a finite completeness bound under a stipulated residual channel (Theorem 4), and a deterministic score-stability bound for correlated feature errors (Theorem 5), with a 10^-3 false-naming budget per investigation. On a simulated ten-station federation (real GNSS recordings re-rendered) and CIFAR-10 with ResNet-18 prototypical networks, all 160 single-owner copies are isolated and 712/720 two-owner mixtures traced with no innocent named, versus 50-58% framing by a DeepMarks-BIBD comparator. The feature mark survives feature-matching distillation 20/20 and cross-architecture transfer 19/20, at copy-accuracy costs of 4.8 (GNSS) and 6.1 (CIFAR-10) points. Main limitations: the independence premise is not empirically established; function-only distillation and a hybrid negation attack still evade tracing; all stations come from one recording campaign.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- ZK-Trace composes public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification to enable offline, cooperation-free tracing of leaked federated model copies.
- Conditional false-accusation bounds (Theorem 3) and finite completeness bounds under a stipulated residual channel (Theorem 4) are executable via interval arithmetic with a 10^-3 per-investigation false-naming budget.
- Empirically, all 160 single-owner copies are isolated and 712 of 720 two-owner mixtures traced with no innocent named, whereas a DeepMarks-BIBD comparator frames innocents in 50-58% of coalitions.
- The feature carrier survives feature-matching distillation in 20/20 runs and cross-architecture transfer in 19/20 at copy-accuracy costs of 4.8 (GNSS) and 6.1 (CIFAR-10) percentage points, while the weight carrier is erased by distillation.
- Function-only distillation and a hybrid negation attack remain explicit evasion routes, and all soundness certificates are conditional on an innocent-row independence assumption the paper does not empirically establish.
Strengths
Executable, auditable decisions rather than raw thresholds
The interval-arithmetic checker (4096 panels, 30-decimal digits) verifies a conditional false-accusation exponent per decode (Theorem 3, Remark 1), allocates one budget across tails and carriers via epsilon/(2K) (Corollary 2, Prop. 3), and explicitly separates CERTIFIED-ATTRIBUTE/TAMPER from UNCERTIFIED-LEAD — a decision discipline absent from prior federated watermarking work (Table IX).
Collusion-secure tracing validated against a real comparator
160/160 single-owner copies isolated and 712/720 two-owner mixtures traced with zero innocents named, while DeepMarks-BIBD frames innocents in 50% of plain coalitions and 58% within its design resilience (Sec. VII-C, Fig. 4). Design targets c=2 (weight, nt=512) and c=3 (feature, nt=2048) are stress-tested to k=8, and zero framing holds across 400 adaptively steered trials.
Unusual candor about failure modes
Strong experimental hygiene
Clean separation of security quantities
Weaknesses
All soundness certificates are conditional on an untested premise
Known evasion routes remain open
Single-campaign simulation limits the GNSS deployment story
Dispatched-copy utility cost concentrates on hard classes
Artifact not yet available; honest-tracer custody gap
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
ZK-Trace (arXiv 2609.08763v1, IEEE-format manuscript under review; Fraunhofer IIS / UTN Nürnberg) addresses recipient tracing for leaked model copies in federated GNSS interference monitoring. It composes three mechanisms: (1) public identity codewords derived from per-client xLPN credentials and embedded in BatchNorm scales (extending FedZKP [3]); (2) recipient-specific secret Tardos fingerprints written into each dispatched copy — a weight carrier (nt=512 BN-gamma projections, design target c=2) and a feature-probe carrier (nt=2048 probes, c=3); (3) a Stern/xLPN Sigma-protocol credential proof (r=331 rounds) bound to a digest of the full model state. Central claims: conditional false-accusation certificates executable per decode (Theorem 3, Prop. 3; budget 10^-3), finite completeness under a stipulated residual channel (Theorem 4), deterministic score stability under correlated feature errors (Theorem 5), and empirical tracing of 160/160 single-owner copies and 712/720 two-owner mixtures with zero innocents named.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What problem does ZK-Trace solve?
When a federated-learning operator distributes model copies to semi-trusted GNSS monitoring stations and one of them leaks its copy, ZK-Trace identifies which station leaked it — even if several stations average their copies to collude — while the operator verifies credentials via zero-knowledge proofs and can trace offline, without the leaker's cooperation.
Does ZK-Trace survive model distillation attacks?
Partly. The weight-space mark is erased by 80-epoch distillation while the model keeps roughly 80% task accuracy. The feature-space mark survives feature-matching distillation (20/20 runs) and ResNet-34 transfer (19/20), but function-only distillation erases it too, and a hybrid negation attack escapes the threshold tests for part of the tested compute range.
Can ZK-Trace falsely accuse an innocent station?
The certified decision rule bounds false naming at 0.001 per investigation, but only under an innocent-row independence assumption the authors state is not empirically verified. In their experiments (160 single copies, 720 two-owner mixtures), no innocent was ever named, while a DeepMarks-BIBD comparator framed innocents in 50-58% of coalitions.
Is the ZK-Trace code available?
Not at the time of this review. The paper states that code, per-seed artifacts, and table-reproduction scripts 'will be released upon publication'; the GNSS tensors are re-renderings of interference recordings publicly released by their original authors.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The provided text is a sampled excerpt with marked [...sampling gap...] sections: the contents of Tables III-VII and portions of Sec. IV-B-D and the Appendix C proofs were not directly inspected; numbers cited in this review all come from the visible prose and tables.
- Review is based on arXiv v1 (2609.08763, 8 Sep 2026), a manuscript marked 'under review'; revised versions may differ.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.