Computer Science and Mathematics

Abstract: Intrusion detection research depends on datasets. However, dataset design is often treated as secondary to model selection. In this survey, we examine cyberattack dataset engineering and benchmarking for realistic intrusion detection system (IDS) evaluation. Specifically, we review dataset releases, benchmark critiques, and domain-specific detection studies that cover general-purpose network benchmarks, Android spyware, multi-step and APT-inspired attacks including SUNBURST, smart-grid injection, SNMP-MIB and DDoS monitoring, IoT botnets, phishing, streaming traffic, and GAN-based synthetic attack data. We argue that dataset realism must be judged through collection context, attack procedure, benign behaviour, labeling, feature extraction, temporal splitting, privacy, reproducibility, and benchmark saturation, rather than through dataset size or reported accuracy. To this end, we position the survey against prior IDS and dataset reviews, introduce a six-dimensional dataset-centred taxonomy (attack environment, data representation, collection method, label strategy, evaluation protocol, and threat model), compare seven dataset families, and consolidate an evaluation protocol that covers split policy, leakage checks, baselines, metrics, and dataset documentation. We conclude that next-generation IDS datasets should be released with dataset cards, scenario cards, leakage reports, baseline scripts, chronological and holdout splits, adversarial and zero-day partitions, and explicit limitations. This shift would make IDS results more comparable, make inflated performance claims easier to detect, and support realistic evaluation for IoT, 5G, smart grids, Android malware, phishing, and APT-inspired attacks.

Abstract: Providers of large reasoning models withhold the chain-of-thought (CoT) that their models generate, returning an answer, a short summary, and, in some APIs, an encrypted copy of the trace in order to prevent distillation and keep sensitive intermediate content private. Five studies published between March and September 2026 show how API clients can recover existing traces or obtain useful reasoning despite this restriction. This survey organizes that work at the level of threat models, mechanisms, and evaluation protocols. We formulate CoT extraction, compare the attackers that the studies assume, and group the attacks into three families according to how they obtain the trace: reconstruction from visible outputs, elicitation into a visible channel, and replay of the trace that the model has already produced. We then summarize how the attacks are evaluated, map the proposed defenses onto the families they address, and identify open problems. The surveyed evaluations establish that no single defense is effective across all three families, and comparing attacks requires a shared trace reference and separate measures of textual fidelity, task preservation, and downstream utility. We conclude by identifying several research gaps and open questions for future research.

Abstract: Cryptocurrency wallets are widely used to manage digital assets and interact with NFT marketplaces. However, while blockchain can verify ownership and transactions, protecting the digital content associated with an NFT before and during its exchange remains challenging. This paper presents virtual PUF-based NFT marketplace integrated with software wallet to provide a secure content exchange workflow without relying on permanently stored secret material. The proposed approach encrypts the seller’s digital asset before listing and generates a content-bound preview that allows buyers to inspect the asset without revealing the complete content. A virtual PUF-based mechanism is used together with cryptographic commitments and buyer-specific, post quantum ML-KEM-768 key encapsulation to support secure verification and recovery. Smart contracts coordinate the listing, payment, release, and settlement process, while encrypted artifacts are stored off-chain. Security analysis and prototype evaluation show that the system protects against common attacks such as artifact tampering, underpayment, unauthorized release, and invalid key registration while introducing only modest runtime and storage overhead. This architecture effectively enhances security and access control for NFT-linked content within software wallets.

Abstract: Despite the advances in two-factor and biometric authentication techniques, systems de signers, application developers, and organizations continue to rely on passwords despite the phishing resistance of origin-bound public-key credentials. This study examines whether ap plication/systems designers should eliminate passwords or retain them within layered security architectures. Using qualitative analysis, the study examined an asynchronous discussion involving 28 middle- and senior-level IT managers, yielding 40 unique contributions and 16 original positional statements. These positions were compared with 36 scholarly studies published between 2021 and 2026 and relevant standards and guidance from NIST, the Software Engineering Institute, ISO/IEC, the PCI Security Standards Council, CISA, and European regulators. None of the 16 statements supported immediate password elimination, while 13 endorsed a phased transition prioritizing phishing-resistant authentication and retaining passwords as time-limited fallbacks for legacy systems, recovery, and exceptions. Recovery, regulatory compliance, legacy compatibility, and implementation costs dominated practitioners’ concerns, although cost allocation remained unresolved. Findings indicate that residual risks concentrate in recovery mechanisms, weaker secondary factors, and continuity failures rather than credential cryptography. The study introduces a recovery-assurance rule requiring recovery mechanisms to meet or exceed sign-in assurance and distinguishes peer-level password options from expiring exceptions. It proposes the Risk-Tiered Passwordless Transition Framework (RT-PTF), aligning four risk tiers with NIST SP 800-63-4 assurance levels and deriving six testable propositions.

Abstract: Indirect prompt injection is now measured the way accuracy is measured, by running an attack corpus against a model and reporting the fraction of trials that succeed. This paper argues that the resulting number is not interpretable on its own, and shows why on a purpose-built harness covering three agent environments, six user tasks, seven attack patterns and eleven candidate models. The central claim is that success cannot be read without exposure, meaning a record of whether the model’s own tool calls ever placed the injected text in front of it. A pre-registered manipulation moved one payload from past a search snippet cut to inside it, on the same page, with no other change. Exposure for two models rose from 0 of 126 trials to 126 of 126 while neither model altered a single tool call. Ranking the seven usable models by raw attack success rate and by exposure conditional success rate produces two orderings that are mildly anti-correlated, with a Spearman rho of -0.25. Writing the measures down formally shows why: the raw rate splits into success among exposed trials plus credit earned in trials the attack never reached, and a valid measurement needs that second term to be zero. It is zero on four of the seven models. It supplies 73 and 84 percent of the raw rate on the two that top the raw leaderboard. Three further checks behave the same way. A target-state checker recorded 126 attack successes on one model and 42 on another in trials where the payload was never read, while the same checker was correct on 310 of 310 such trials for three other models. A capability floor excluded 4 of 11 candidates, and a twelve-trial screen admitted one model that later measured 0 of 8 on the central task. Identical inputs re-scored between 7 and 60 percent of prompts differently at temperature zero. The corpus also carries English, Urdu and Roman Urdu arms, and the language effect is reported as a null that failed replication. None of the four failure modes depends on the corpus being multilingual.

Abstract: Distributed Denial of Service (DDoS) attacks against payment processing infrastructure increased 154% between 2022 and 2023, with application-layer volumes growing 200% in the first half of 2024. Payment systems must sustain 65,000+ transactions per second (TPS) under 50 ms authorization latency constraints while defending against attacks that have escalated from 1 Gbps floods (2003) to 398 million requests per second via HTTP/2 Rapid Reset (2023). We present the first comprehensive survey mapping DDoS defense strategies across the full 2003-2025 architectural evolution of payment processing, from mainframe-era CICS/COBOL through SOA/ESB middleware and cloud-native Kubernetes to AI-augmented defenses. Based on a systematic literature review of 92 sources, 14 industry reports, 10 patents, and 40+ historical incidents, we propose a five-era evolution model, a five-category defense taxonomy with strategy interaction matrix, and the Composite Slow-Degradation Attack (CSDA) as a theoretical worst-case adversary model. We introduce four analytical frameworks (TAADA, ACS-GUARD, BIN-WATCH, and LBMD) characterized through simulation as design proposals for empirical validation. Extended empirical evaluation includes: BIN-WATCH on realistic traffic (Zipf alpha = 0.8, entropy-aware attacker) achieving F1 = 0.90 at default threshold and F1 = 1.00 at recalibrated threshold; LBMD with directly measured inference latency showing XGBoost achieves DER = 0.960 at the 5 ms budget (P99 = 0.17 ms); and ACS-GUARD validated across a 270-combination parameter sensitivity sweep demonstrating 62.5-68.3% legitimate acceptance at alpha = 0.85-0.90 under sustained attack.

Abstract: Autonomous AI agents are increasingly evaluated for offensive cyber capability inside network-isolated sandboxes, on the assumption that the environment, rather than the model, contains undesired behaviour. In July 2026 this assumption failed: agents under evaluation at OpenAI escaped through an internet-connected package-registry proxy, coordinated through that registry as a covert message board, pivoted through a third-party cloud application, and breached Hugging Face’s production clusters without human direction. This article presents an explanatory single-case study reconstructed from the organisations’ primary disclosures, an independent review by METR and Redwood Research, and corroborating reporting, with every claim graded by evidential status. We map the attack chain to the Cyber Kill Chain and MITRE ATT&CK and conduct an evidence-to-control failure analysis that links each failure to the network or platform control that failed, a mitigation, and the residual risk. The results show a layered failure of egress containment, separation between runs, access control, and monitoring, so that patching any single vulnerability would have left other attack paths open. We derive design principles for containing agentic systems in networked evaluation infrastructure and translate them into guidance for detection engineering, incident response, and vendor due diligence.

Abstract: In artificial-intelligence-of-things (AIoT) deployments, fleets of heterogeneous, long-lived sensing devices sit behind an edge tier whose cloud is not always reachable, so a device trusted at enrolment must be re-assessed continuously, with a response it can afford and with knowledge shared across sites. We present EASA, an Edge-centric Adaptive Security API: a gateway fuses per-flow anomaly evidence with each device’s reported posture and decision history into a composite trust score, maps it with hysteresis to four persistent enforcement levels, budgets the step-up action by the device’s reported energy, and uses a cloud security service only for cross-gateway state—a federated detector and a credential-revocation registry. Every component can be disabled, so baselines are configurations of one implementation. We evaluate the prototype on per-address traces of 65 real consumer devices (CIC IoT-DIAD 2024) under synthetic campaigns built from weakly labelled attacker traces, with three emulated gateways and a cloud service deployed on Google Cloud Run, all calibrated to one target false-positive rate. Over 30 paired seeds, federated aggregation raised recall on attack families unseen at a gateway from 0.24 to 0.60, the shared registry caught 81% of credential-replay device-epochs across all runs, the full EASA configuration isolated about 45% fewer clean devices than per-alarm blocking, the energy-aware selector performed 37% fewer re-authentications under simulated low battery, and a 15-minute cloud outage after warm-up reduced replay rejection with no change detected in the evaluated local metrics (103 ms mean per-run median round trip); the composite score’s history term, in contrast, prolonged benign-side restriction without a demonstrated detection gain. The released simulator, cloud service and protocol give AIoT operators and API designers a reproducible basis for graded, resource-aware enforcement at the edge.

Abstract: A well-known family of algebraic graphs of large girth, \(D(n,q)\), has previously been used to implement twisted Diffie--Hellman protocols with graph-based stable cubic generators from the affine Cremona semigroup \(\operatorname{End}(F_q[x_1,x_2,\ldots,x_n])\). This approach enables Alice and Bob to compute a shared collision tuple in \((F_q)^{n^3}\) in \(O(n^5)\) time instead of explicitly constructing the corresponding collision transformation. In this paper, we develop new implementations of twisted Diffie--Hellman protocols, as well as their inverse variants, using families of Jordan--Gauss graphs and stable generators of the corresponding affine Cremona semigroups. We show that Double Schubert graphs \(DS(k,K)\), defined over a finite commutative ring \(K\), can be used to construct stable generators of \(\operatorname{End}(K[x_1,x_2,\ldots,x_{k(k+1)}])\) with prescribed degree \(d\) and prescribed density \(O(n^\beta)\), where \(n=k(k+1)\). Sparse elements of \(AGL_n(K)\) are then used to conjugate these graph-based stable transformations, allowing the communicating parties to efficiently derive shared collision tuples in \(K^{n^d}\). We further show that other \(K\)-analogues of Jordan--Gauss subgraphs of projective geometry can be used in place of Double Schubert graphs to implement both the twisted Diffie--Hellman protocol and its inverse ElGamal-type variant. In addition, we investigate protocols involving two generators, one being a nonlinear graph-based transformation and the other a sparse element of \(AGL_n(K)\). Finally, we present results of computer simulations for multivariate protocols whose stable generators are constructed using the large-girth graph \(A(n,q)\).

Abstract: Federated intrusion detection for the Future Internet must operate across heterogeneous devices, distributed telemetry, changing traffic patterns, and adversarial clients. This critical structured review synthesizes a targeted corpus of 37 publications and standards, including 20 Future Internet articles, coded on six methodological evidence dimensions using a transparent ordinal rubric. Federated-learning relevance received the highest mean coverage score (3.32/5; 24 of 37 records scored at least 3), followed by reproducibility (2.89/5; 19 of 37). Evidence for robustness (1.19/5; 10 of 37), generalization (1.00/5; 7 of 37), explainability (1.27/5; 7 of 37), and deployment realism (1.59/5; 10 of 37) was markedly sparser. Only five records scored at least 3 on both robustness and generalization. These results describe the methods addressed in a purposefully selected literature corpus, not the performance of deployed detection systems. Based on the observed coverage gaps, we propose a reproducible evaluation framework encompassing non-independent and identically distributed federation, disjoint and open-set testing, poisoning and backdoor attacks, leakage auditing, explanation stability, and edge-resource measurements. A supplementary Excel workbook separates original source-level coding from formula-linked analyses and sensitivity checks. Trustworthy federated intrusion detection should be evaluated through this joint systems-level evidence rather than closed-world predictive accuracy alone.

Abstract: Intrusion detection studies often report very high scores on the CIC-IDS2017 benchmark and credit new feature sets with the gain. We reassess a representative design, a deep neural network over 21 flow statistics and 10 HTTP aware features taken from the SentinelSphere platform, under a protocol that controls for known pitfalls, and we retest the features on the CSIC 2010 dataset, which contains real HTTP requests. On the flow based CIC-IDS2017 data the ten HTTP features are identically zero, because flow records contain none of the request fields they read, and the 64 by 64 network as described reaches only 6\% recall at the conventional threshold, finding none of the 21 SQL injection flows. Tree ensembles do exceed a 94\% F1 score, but a depth three tree on a single flow metadata feature, the backward initial TCP window size, already reaches an area under the curve of 0.985, so much of the apparent skill is a dataset artefact. The corrected labels of the same traffic show that only 104 of 2,056 web attack flows are successful attacks, and catching those is harder. On real requests the ten features reach an F1 of about 0.91 once the body is included and decoded, a plain character ngram model reaches 0.97, and an ablation traces the signal to a generic path entropy feature rather than to the attack pattern flags.

Abstract: Machine-learning network intrusion detectors fail when moved to a new network, and recent work reports that fine-tuning a source-trained model on a few labelled target flows restores detection. These studies do not train on the same target labels alone, so they cannot tell whether the recovery comes from the source. We test this on the four NetFlow v3 benchmarks (NF-CICIDS2018, NF-UNSW-NB15, NF-ToN-IoT and NF-BoT-IoT) with a leak-free protocol: 12 directed dataset pairs, random forest, gradient-boosted tree and neural-network models, and pooled, importance-weighted and fine-tuned adaptation, each compared with target-only training over 10 seeds with paired Wilcoxon tests. Across 540 comparisons, the source significantly helps in 8% and hurts in 38% (uncorrected). Averaged over pairs it lowers F1 by 0.044 (95% CI −0.066 to −0.022), and the mean is negative for every source and target dataset; on balanced accuracy the effect has the same direction but is smaller. Benefit is rare and pair-dependent. Zero-shot transfer is weak, a published zero-shot F1 of 0.81 does not reproduce on v3, and at a 5% label budget target-only training matches fine-tuning. A domain classifier separates every pair of networks with AUC of at least 0.996 on raw features, even within the same attack category, and 23–40 of 45 features must be removed before this falls below 0.9. Removing the documented TTL artifact does not change the conclusion. We also show that per-domain feature scaling corrupts separability measurements. Cross-dataset studies should report target-only training at the same label budget.

Abstract: Attack success rates alone do not establish the security of large language model (LLM) systems because results depend on the attacker, deployment conditions, and measured consequence. This survey complements existing attack and defense taxonomies by examining what individual experiments actually support. We pair a threat model describing attacker capabilities and objectives with a defense model specifying observable information, security functions, and enforceable responses. An attack-defense assurance matrix determines whether an evaluation addresses the conditions relevant to a stated security claim. A bounded claim grammar also records the attacker, system version, consequence, cost, evaluation oracle, and other conditions that limit the result. An evidence ladder organizes empirical requirements for a fixed security claim and threat model without ranking papers or defenses. We apply the framework across model behavior, retrieval and memory, agents and tools, supply chains, privacy, availability, and serving infrastructure. The resulting synthesis helps researchers and practitioners distinguish demonstrated protection from untested conditions, compare results under matched assumptions, and design evaluations that measure the security consequences relevant to deployment.

Abstract: Large language models are increasingly written into malware detection systems, yet the literature reports them under a single label that obscures what they actually do, and existing surveys either treat agents in the abstract or malware detection without them. This review closes that gap. It is the first to examine the implemented strand of agent-based malware detection as a coordinated system rather than a catalogue of techniques, and to ask how well positioned the field is to support multi-agent operation. We make three contributions. First, we introduce a functional classification that groups each system by which of four roles the model fills, namely perception, reasoning and decision-making, adaptive monitoring, and collaborative learning, treating the mature body of standalone detectors as the foundation rather than the object of review. Second, from a corpus of recent primary studies we derive a modality-based dataset taxonomy, a map linking datasets to the role the model plays, and a pipeline-stage and role-coverage matrix for the agent-based systems. Third, we assess which existing detectors are structurally ready for agentisation and why. The analysis yields three findings. What varies across the field is not which model is used but where in the detection chain it sits. Role coverage is bimodal, with perception and reasoning served almost everywhere while adaptive monitoring is realised by a single system in the corpus and collaborative learning by none. And uniformly high reported accuracy reflects curated, single-split evaluation rather than robustness. Reading these together, the discriminating property for agentisation is whether a system exposes anything between input and verdict, which makes integration and orchestration, not the invention of new detectors, the principal open problem.

Abstract: Federated learning (FL) enables collaborative model training without centralizing raw data, but existing defenses provide limited support for post-incident accountability and evidence preservation. We present FL-Forensics, a forensic-ready framework for malicious-client and compromised-aggregator settings. It combines client-signed update commitments, a hash-chained ledger, an independent evidence witness, trusted timestamping, key-lifecycle management, encrypted role-based storage, and permissioned quorum anchoring. We also introduce a Forensic Quality Index (FQI) with metrics for integrity, attribution, evidence availability, and audit efficiency. We implement FL-Forensics as an end-to-end Flower extension and evaluate it with 20 clients, Dirichlet non-IID data, and 15% malicious clients on MNIST, Fashion-MNIST, and CIFAR-100. It achieves F1 scores of 0.941, 0.800, and 0.521, with corresponding FQI values of 0.956, 0.900, and 0.714. Ablation results show that independent witnessing, digital signatures, trusted time, and external anchoring make distinct contributions to forensic recovery, attribution, and auditability under controlled evidence-tampering attacks.

Abstract: The Internet of Things (IoT) has become embedded in everyday consumer environments through smart home devices, wearables, connected appliances, and related technologies. These devices offer substantial convenience and functionality while creating persistent privacy and security concerns. This exploratory study examines how consumer IoT familiarity, usage, privacy and security concerns, awareness of data practices, and self-reported protective behaviors relate to one another. The study is interpreted through Protection Motivation Theory (PMT), the Technology Acceptance Model (TAM), and Risk Perception Theory (RPT). A cross-sectional survey was distributed to 423 members of the University at Albany community and yielded 30 complete responses (7.1%). Quantitative analyses used descriptive statistics, correlations, and a t-test, while open-ended responses were summarized to provide qualitative context. Respondents reported high familiarity and frequent IoT use alongside substantial privacy and security concern, but many demonstrated limited knowledge of the data collected by their devices and inconsistent protective practices. The hypothesis tests were not statistically significant at the .05 level: privacy concern and IoT usage were weakly negatively correlated (r = -0.167, p = .377); perceived risk and awareness were weakly positively correlated (r = .121, p = .525); the awareness-group comparison was nonsignificant (t = .717, p = .479); and trust in vendor privacy protection showed a moderate positive association with IoT usage that did not reach conventional significance (r = .334, p = .071). The results therefore provide exploratory rather than confirmatory evidence of an adoption concern paradox: participants often continued to use IoT technologies despite privacy and security concerns. The findings are consistent with the possibility that perceived usefulness, convenience, risk appraisal, self-efficacy, and trust jointly shape consumer behavior, but the small nonprobability sample and cross-sectional design preclude causal inference and broad generalization. Importantly, this study measures perceived risk and awareness; it does not independently conduct technical vulnerability assessments of participants' devices. This study contributes by integrating PMT, TAM, and RPT to interpret the coexistence of IoT adoption and privacy/security concern; documenting mismatches among concern, awareness, and self-reported protective behavior in an exploratory university sample; and identifying implications for user education, secure-by-default product design, vendor transparency, and future research that combines behavioral measures with objective device-security assessments.

Abstract: Spoofing attacks pose a critical threat to Unmanned Aerial Vehicle (UAV) tracking, inducing trajectory drift, false-target injection, and corrupted multi-sensor measurements that destabilize classical association pipelines such as JPDA and GNN. This paper introduces the Quantum Unified Trajectory Estimator (CUTE-SpoofTrack), a quantum-inspired framework and benchmark for resilient multi-sensor UAV tracking under adversarial spoofing. The system integrates SpoofNet, a deep spoof-detection module that identifies temporal and spatial spoof signatures, with confidence-aware fusion and a Deep Quantum Neural Network (DQNN) that performs assignment reasoning through qubit superposition, Hadamard branching, and CNOT-based dependency encoding. This architecture maintains multiple association hypotheses and suppresses spoof-dominated states, providing robustness beyond classical argmax-based trackers. CUTE-SpoofTrack includes a reproducible benchmark with diverse spoof types—drift, ghost, mirror, burst, and multi-ghost—and provides interpretability overlays for analyzing assignment dynamics and quantum gate activations. Theoretical analysis establishes continuity, margin-based robustness, KL-stability, and spoof-aware amplitude suppression for the DQNN assignment distribution. Numerical evaluations demonstrate that CUTE significantly improves spoof detection accuracy, fusion stability, assignment consistency, and trajectory continuity compared to CNN,LSTM,GNN,JPDA,andfusion-agnostic baselines, while remaining within real-time operational constraints. The results position CUTE-SpoofTrack as a principled and practical foundation for resilient UAV tracking in adversarial aerial environments.

Abstract: Cross-silo deepfake speech detection must accommodate organizations that observe different attack profiles and channel conditions while avoiding routine centralization of raw speech. We study federated learning (FL) for a compact detector combining linear-frequency cepstral coefficients (LFCCs) with frozen WavLM representations over heterogeneous partitions derived from ASVspoof 2019 and 2021. An official-metadata audit of the historical seed-42 Client-C split reproduces the reported 2,572/3,655 (70.37%) bona-fide source overlap; a stricter unified-source audit against the complete A+B+C fit pool finds still greater dependence. We therefore repeat the principal audio evaluation with five source-disjoint splits whose holdouts are independently verified against the complete fit pool. Mean equal error rate (EER) is 3.836% for pooled centralized training, 4.622% for Federated Averaging (FedAvg), 4.095% for local C, 21.883% for local A, and 33.398% for local B. On the common Client-C holdout, A-only and B-only models transfer poorly, while FedAvg is on average 0.787 percentage points worse than pooled training and 0.527 points worse than local C; these comparisons do not establish native-domain benefit for A or B. Separately, a 20-seed controlled stress test examines integrity mechanisms under malicious participation. Increasing untargeted label-flip compromise produces progressively more negative benign--malicious update alignment and stronger aggregate-step attenuation; the signature persists across four classifier topologies and FedProx settings. Additional tests cover targeted label poisoning, a controlled trigger backdoor, zero-update free riding, and coordinated sign-flip model poisoning. We frame the contribution as an auditable experimental protocol and a bounded set of observations, not as a new detector, optimizer, attack, aggregator, or universal defense.

Abstract: We present the Defactorized Homomorphic Polynomial Public Key (D-HPPK) Encapsulation Mechanism, a post-quantum KEM whose security rests on exhaustive-search problems with efficient verification for both attack paths. We adopt the NIST search-based convention, under which a primitive is assigned security level l when the adversary's best-known attack requires exhaustive search over 2^l candidates with efficient verification, exactly as AES-128, AES-192, and AES-256 are assigned NIST Levels I, III, and V. For D-HPPK, both attack paths—long-term key recovery and ephemeral-secret recovery—are exhaustive searches over spaces of size 2^l with polynomial-time verification. The long-term key-recovery path reduces to the Hidden Modulus Product Problem (HMPP), and the ephemeral-secret recovery path reduces to the scheme-induced Message Recovery Problem (MRP). The scheme uses a three-layer architecture of additive random masking and hidden-ring embeddings. The hidden-ring moduli and multipliers block the public-constraint attack; the random masking destroys the rank-2 algebraic regularity of the unmasked coefficient matrices, forcing the adversary into HMPP. Both attack paths have best-known classical cost O(2^l⋅poly⁡(L)). The IND-CCA2 proof uses a double-encryption consistency check with a five-class rejection set, together with a small number of explicitly stated hardness assumptions; the adaptive form of the decryption-collision property is derived through Structured D-HMPP. A unified parameter set (n=2,m=3,l=⌈log₂⁡p⌉) supports a single implementation across security levels. At Level V (l=256), D-HPPK achieves a 1234-byte public key and a 392-byte CCA2 ciphertext—21% smaller public keys and 75\% smaller ciphertexts than ML-KEM-1024—without SIMD or NTT acceleration.

Abstract: The Internet's critical infrastructure relies on centralized trust authorities, and their repeated failures expose a structural fragility: these systems lack self-verifiability — the property that any party relying on a claim can independently verify that event or state claim without depending on any third-party authority. Here we propose the Memory-Driven Trust Paradigm, which endows digital infrastructure with self-verifiability through verifiable memory, shifting the fundamental question of trust from "whom to trust" to "what to verify." We define verifiable memory as cryptographically committed, independently verifiable traces of discrete events and states, and formalize it as an "Accumulate–Anchor–Verify" triadic structure: a unified framework neutral to the underlying commitment mechanism, revealing that previously fragmented self-verifiable schemes — blockchains, certificate-transparency logs, and verifiable storage — share the same deep logic. We characterize necessary and sufficient conditions for verifiable memory and give a constructive proof: an epoch hash chain with geometric staged scheduling reduces the worst-case membership witness from Θ(√n) to Θ(n¹ᐟ³) even under unbounded append; we further establish a mechanism-dependence boundary across verification dimensions, closure of constructions under composition, and a verification-baseline reset via anchoring. We instantiate the framework as four kinds of memory — blockchains for transaction memory, message chains for transmission memory, key chains for protection memory, and verifiable AI memory for inter-agent trust — of which the blockchain and its supporting systems have been validated in real-network deployment, and the message chain and key chain have undergone prototype evaluation and comparative experiments. This work establishes self-verifiability as a foundational property of digital infrastructure and provides a verifiable trust foundation for the AI-mediated digital era.