Please use this identifier to cite or link to this item:
https://hdl.handle.net/10216/175783| Author(s): | Daniel Moreira Carneiro |
| Title: | Towards End-to-End Verifiable Integrity of Random Forest Classifiers |
| Issue Date: | 2026-07-09 |
| Abstract: | As Artificial Intelligence becomes more common in critical cybersecurity systems, maintaining the operational integrity of these models is essential. Modern Machine Learning often uses decentralised environments for performance, where the Model Verifier controls neither the data collection nor the model training. This separation creates an integrity gap, allowing attackers to perform data poisoning or model tampering. These subtle attacks can threaten security while still passing standard evaluation metrics. Therefore, there is a need for a secure method to verify correct training and model execution. This work aims to address this gap by creating an end-to-end verifiable Machine Learning architecture that protects a Random Forest model from poisoning attacks. To reach this goal, we first conducted a thorough literature review, comparing the strengths and weaknesses of existing cryptographic proof systems, circuit optimisations, and data origin checks. By highlighting an integrity gap, where current frameworks do not connect data, training, and transpilation verification into a single cryptographic chain for tree-based models, this review lays out the requirements and design criteria for the proposed architecture. To fix these weaknesses, this thesis presents an end-to-end verifiable architecture for Random Forest classifiers, based on a formal definition of integrity described as a determinism property. This property states that two honest executions of the same pipeline, using the same data, must produce identical circuits. This condition breaks down into three guarantees, enforced together within a single proof: model integrity, which ensures the circuit reproduces the trained model; data integrity, which checks that the training data remains unchanged; and data origin, which verifies its true source. Each architectural decision is made to uphold one of these conditions. Model integrity is maintained through a conversion from floating-point to integer, translating decision thresholds into integer inequalities, along with a standardised Hard-Voting mechanism, with equivalence guaranteed by an in-circuit predictive equivalence assertion. Data integrity and data origin are upheld by a Poseidon hash chain and by in-circuit EdDSA signature verification, respectively. Built using Python Machine Learning libraries and the ZoKrates cryptographic toolchain, the architecture enhances execution by replacing costly bitwise hashing with algebraic, SNARK-friendly Poseidon hashing. Finally, tests on a simulated sensor dataset and the CICIDS2017 network traffic benchmark show that the architecture successfully detects adversarial tampering. Compared to the baseline framework, the proposed method significantly lowers both the constraint count and the proving key size while verifying a structurally more complex model. |
| Description: | Context The exponential evolution and widespread integration of Artificial Intelligence (AI) and Machine Learning (ML) systems have fundamentally transformed industries, establishing AI as a central component in decision-making processes, task automation, and the optimization of complex operational pipelines. From healthcare diagnostics to financial forecasting and increasingly across critical cybersecurity infrastructure such as intrusion detection systems and malware classifiers, AI models are being deployed in environments where the correctness and authenticity of their outputs carry direct operational and safety consequences. Nevertheless, as the deployment of AI systems becomes widespread, the conditions under which these models are trained have evolved in a direction where the security landscape of them radically changes. The traaditional assumption of a centralized, fully controlled training environment, where a single trusted entity acquires data, trains the model, and deploys it, no longer reflects the reality of modern machine learning practice. The frequent use of remote sensing, federated learning and/or outsourced machine learning has introduced architectures where the entity that acquires the data, the entity that trains the model and the entity that ultimately relies on the model's output are three distinct and mutually distrusting parties. In a remote sensing scenario, sensors owned by a data provider transmit raw measurements to a training node that may be geographically or administratively distant. In a federated learning scenario, multiple decentralized devices train local models on their private data and submit the results to a central aggregator. In an outsourced learning scenario, a resource-constrained model sponsor delegates the training computation entirely to a third-party cloud provider. In all three cases, the common factor is the same: the model sponsor, the entity that is ultimately responsible for and dependent on the trained model, that does not control the data acquisition process, does not observe the training execution and has no native mechanism to verify that the model they receive is the result of the computation they requested, performed on the data they provided. This separation of control is the main focus addressed by this dissertation. It is not merely a theoretical concern: the literature has documented a wide range of attacks that exploit precisely this gap. When a malicious trainer substitutes data, alters labels, ignores some dataset's subsets or modifies model parameters, the resulting model may appear functionally correct on standard evaluation metrics while being systematically compromised for specific classes of input, an attack vector particularly dangerous in cybersecurity applications where a model that has been quietly trained to misclassify a specific type of malicious traffic provides no observable anomaly until the attack it was designed to hide occurs. Problem and Motivation The main motivation of this dissertation can be addressed as follows. Given a sensor, that produces a set of data points in a given time frame, or a dataset owned by a data provider and a model computed by a model trainer from that data, the model sponsor wants to ensure that the trained model is the result of executing a known training process over the complete and authenticated dataset $D_t$. That is, all data points in $D_t$ and only those data points were used as the training set. No modifications were made to those points or their labels and the obtained model is indeed the result obtained from the execution of the agreed training algorithm. This guarantee cannot be provided by standard Machine Learning procedures, like accuracy, precision or F1-score. A malicious trainer can submit a model that passes all the standard evaluation metrics on benign inputs while maintaining a targeted misclassification on a specific attack pattern. The only way to close this gap is to make the training process itself verifiable by requiring the trainer to produce and submit a cryptographic proof that is mathematically impossible to forge without having correctly executed the agreed computation on the authenticated data. This verification challenge comes together with a second problem, the \emph{model integrity gap} that exists between a trained model and its deployed representation. Even if the training process was all validated, the model must subsequently be transpiled and deployed into a certain non-ML format. In the context of this dissertation, this gap is particularly sensitive, the Python model trained by the data scientist must be translated into a ZoKrates arithmetic circuit for zero-knowledge proof generation, a process that involves converting continuous floating-point decision boundaries into discrete integer arithmetic. If this translation introduces a small inversion in a comparison operator or a shifted threshold values, the deployed circuit will produce systematically different predictions from the intended model and standard testing may not surface the discrepancy. The literature has proposed cryptographic solutions to the verifiable training but has largely left the second problem unaddressed. The foundational work by Keshavarzkalhori et al. demonstrated that it is possible to construct a pipeline combining hash chains, digital signatures and zero-knowledge proofs to verify that a simulated Naive Bayes classifier was trained on authenticated sensor data. Their implementation, built on the ZoKrates toolset, provided a proof-of-concept that the building blocks exist for end-to-end training verification. However, scaling this approach from a simple probabilistic classifier to a more complex, non-linear ensemble model, in this specific case, a Random Forest, introduces severe architectural bottlenecks that their work explicitly identified as open problems: the computational overhead of bitwise hashing inside arithmetic circuits, the floating-point to integer translation problem and the absence of any mechanism to verify that the transpilation of the model into the circuit was performed faithfully. This dissertation directly addresses these open problems. It proposes, implements and evaluates an end-to-end verifiable machine learning architecture for Random Forest classifiers that provides mathematical guarantees over three distinct integrity boundaries: the origin of the training data, the correctness of the training computation and the fidelity of the model's translation into a verifiable circuit. The framework is evaluated on both a simulated sensor dataset used by Keshavarzkalhori et al. and the CICIDS2017 network intrusion detection benchmark, the real-world cybersecurity dataset used by the most directly comparable prior work, demonstrating that the proposed integrity guarantees are achievable at practical computational cost for cybersecurity-relevant workloads. Research Questions The main objective of this thesis was to build a framework capable of protecting the overall AI Models from data and model poisoning attacks. In alignment with the goal, four research questions were set: Research Question 01: What state-of-the-art mechanisms exist to verify the integrity of AI models across the training pipeline? Research Question 02: What threats exist against AI models integrity? Research Question 03: What computational overhead do integrity verification mechanisms introduce across the AI modeling pipeline and how does this overhead scale with model complexity? |
| Subject: | Engenharia electrotécnica, electrónica e informática Electrical engineering, Electronic engineering, Information engineering |
| Scientific areas: | Ciências da engenharia e tecnologias::Engenharia electrotécnica, electrónica e informática Engineering and technology::Electrical engineering, Electronic engineering, Information engineering |
| URI: | https://hdl.handle.net/10216/175783 |
| Document Type: | Dissertação |
| Rights: | openAccess |
| Appears in Collections: | FEUP - Dissertação |
Files in This Item:
| File | Description | Size | Format | |
|---|---|---|---|---|
| 786895.pdf | Towards End-to-End Verifiable Integrity of Random Forest Classifiers | 2.97 MB | Adobe PDF |  View/Open |
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.