ZK-Trace: Certified Collusion Tracing with Zero-Knowledge Credentials for Federated GNSS Interference Monitoring
Redwanul Karim, Nisha L. Raichur, Lucas Heublein, Tobias Feigl, Christopher Mutschler, Felix Ott
Rigorous, novel synthesis of collusion-secure tracing, ZK credentials, and certified bounds, but application is niche and evaluation narrow, limiting broad impact.
Abstract
Federated global navigation satellite system (GNSS) monitoring distributes a proprietary classifier to partly trusted stations, any of which may leak its copy. ZK-Trace combines public identity marks, recipient-specific Tardos fingerprints, and zero-knowledge credential verification. The registry supports offline tracing without the leaker's cooperation. We establish conditional false-accusation bounds for arbitrary recovered bit patterns, a finite completeness bound under a hidden-bias residual channel, and a deterministic tracing-score bound for correlated feature-distillation errors. An interval-arithmetic checker makes the conditional bound executable and allocates a common budget across accusation and tamper decisions. Under innocent-row independence, the certificate-based evaluation uses a false-naming budget of 0.001 per investigation. It isolates all 160 single-owner copies and traces 712 of 720 two-owner mixtures without naming an innocent. Experiments use a simulated GNSS federation and CIFAR-10. Feature matching preserves the feature mark in 20/20 runs and cross-architecture transfer in 19/20, at copy-accuracy costs of 4.8 and 6.1 percentage points on GNSS and CIFAR-10. Function-only distillation erases the feature mark, and distillation also removes weight-space marks. These results support verifiable tracing under explicit statistical and cryptographic assumptions. Credential knowledge and recipient evidence serve distinct roles.
AI Impact Assessments
(1 models)Scientific Impact Assessment
Core Contribution. ZK-Trace addresses a concrete but under-served problem: how to trace which trusted station leaked a proprietary federated GNSS interference classifier, even when leakers modify their copies or collude. The novelty is architectural — it separates two questions ("which credentials are represented in the model" vs. "which recipient owns a leaked copy") and answers them with three composed layers: (1) public identity codewords in batch-norm scales (extending FedZKP), (2) a recipient-specific secret Tardos fingerprint embedded only at dispatch, and (3) a zero-knowledge Σ-protocol (xLPN/Stern) authenticating a claimant during disputes. The distinctive theoretical contributions are false-accusation bounds that do *not* assume independent extraction errors (Theorem 3), a finite completeness bound allowing coalition strategies that condition on the full row matrix (Theorem 4), and a deterministic score-stability bound for correlated feature-distillation errors (Theorem 5). An interval-arithmetic checker turns the conditional bound into an auditable, executable certificate with a shared error budget.
Methodological Rigor. This is one of the paper's clear strengths. The authors are unusually disciplined about separating statistical from cryptographic guarantees (Table XIII), and about flagging where premises are *idealized* rather than proven (e.g., the innocent-row independence assumption A5(a), the SNR quadrature diagnostic as "a diagnostic model, not a proved floor"). Baselines are appropriate and numerous — five federated watermarking methods (FedZKP, FedTracker, DUW, FedIPR, WAFFLE) plus a DeepMarks-BIBD collusion comparator evaluated on their native metrics. The attack suite (pruning, quantization, PGD, fine-tuning, several distillation variants, insider own-row erasure, hybrid escape, robust aggregation, covariate shift) is comprehensive. The certificate-based evaluation enumerates all pairs per seed rather than sampling. The proofs appear sound and are carefully attributed to established results (Fiat-Shamir knowledge error, Diaconis-Freedman sphere bounds). The main gap: the load-bearing independence premise is explicitly *not* empirically established, and the theory rests on single-round idealized models that repeated FedAvg training is not shown to satisfy.
Potential Impact. The work sits at a niche intersection (federated model IP protection × traitor tracing × applied GNSS security). Within the model-watermarking/fingerprinting subfield it is a solid, citable contribution that meaningfully advances the state of the art by handling FedAvg extraction noise that breaks DeepMarks-style exact-extraction codes. The GNSS/PNT framing is application-specific, but the core machinery generalizes to any federated deployment distributing proprietary models to partly-trusted parties. It is unlikely to reshape a field or become a widely reused primitive; its influence will be incremental within a specialized community.
Timeliness & Relevance. Federated learning IP protection and model ownership verification are active, growing concerns, and GNSS interference/spoofing is a genuine PNT-security problem (backed by German federal/DLR funding, Fraunhofer). The paper is well-positioned relative to very recent related work (FedPoP 2025, BlackCATT 2026), suggesting it engages a live research frontier.
Strengths & Limitations.
Other observations. Reproducibility is reasonably strong on paper (fixed seeds, full hyperparameters, promised artifacts) though code is not yet released. The interdisciplinary reach — cryptography, ML, and GNSS/PNT engineering — is real and broadens the potential audience. The paper's most durable value may be as a template for combining collusion-secure codes with cryptographic credential authentication under noisy extraction channels, rather than the specific GNSS instantiation.
Overall: a technically strong, careful, honestly-caveated paper making a meaningful but specialized contribution — likely to be built upon within its subfield but not field-changing.
Generated Sep 9, 2026
Comparison History (0)
Rigorous, novel synthesis of collusion-secure tracing, ZK credentials, and certified bounds, but application is niche and evaluation narrow, limiting broad impact.