Manipulation-Proof Oblivious Audits against Deceptive Model Providers

When Can We Trust Fairness Audits? Identifying Reliability Boundaries of Third-party Audit Conclusions

Fairness Auditing: Lower Bounds on Company Manipulation

Fairness audits are increasingly mandated in high-stakes applications such as hiring, lending, and automated decision-making. Recent work has established fundamental impossibility results for black-box fairness auditing, showing that sufficiently expressive models can evade any auditing strategy. We complement these results by quantifying the extent of unavoidable post-audit manipulation under finite audit resources. We formulate fairness auditing as a min-max optimization between a computationally unbounded company and a budget-constrained auditor. We study two auditing regimes: (i) a budgeted auditor that certifies fairness using a fixed-size audit set, and (ii) a budgeted {\alpha}-tolerant auditor that additionally requires the audit set to estimate the fairness of the certified model within an {\alpha} approximation. For both settings, we derive explicit lower bounds on the worst-case post-audit demographic parity deviation as functions of the audit budget, group imbalance, and fairness tolerance. Finally, we empirically illustrate these theoretical limits using simple audit-set construction heuristics with linear and neural network classifiers. Our results demonstrate that increasing audit resources reduces, but does not eliminate, the scope for post-audit manipulation, highlighting fundamental limitations of finite-budget fairness certification.

Certified in Theory, Broken in Practice: Assumption Gaps in Cryptographic Model Certification

This work formalizes rigorous cryptographic security notions tailored to CMC frameworks, introduces a generic protocol template, and proves that it satisfies these requirements, which offer both cautionary evidence about existing approaches and constructive guidance for designing secure, privacy-preserving ML auditing protocols.

ExplainGuard: A Zero Trust Framework for Post-Hoc Explanation Integrity Guarantees in Blackbox XAI Models

As machine learning (ML) models are increasingly deployed in high-stakes environments, explainable AI (XAI) methods like SHAP and LIME have become essential for regulatory compliance and trust. However, the current auditing paradigm relies on an implicit"chain of trust"where third-party auditors are assumed to be trusted. Recent research demonstrates that this assumption is flawed and adversarial auditors can manipulate XAI explanations through manipulation attacks such as output shuffling or scaffolding out-of-distribution (OOD) to conceal model biases while maintaining high prediction accuracy aiming for fairwashed explanation. In this paper, we introduce a novel defense framework, ExplainGuard, that leverages a Zero-Trust architecture (ZTA) design to be incorporated within the XAI explanation supply chain and ensures the integrity of the generated explanation. This framework would help us to replace the ambiguous default assumption of"auditor is trustworthy,"with a continuous"verify-then-trust"approach. Our design architecture establishes a Policy Decision Point (PDP) that enforces three distinct pillars of verification before any explanation is released to the user: (1) asset integrity via behavioral fingerprint to detect model substitution, (2) semantic validity using axiomatic consistency checks to reject mathematically impossible explanations, and (3) feature faithfulness verification utilizing a ranking stability approach with minimal computational overhead. Finally, we evaluate how ExplainGuard can effectively neutralize state- of-the-art explanation manipulation attacks while transforming the auditing process into a verifiable operation.

Plausible Deniability Guarantees for Whistleblowers

Whistleblowers are a key safeguard against organizational wrongdoing, but the threat of retaliation deters reporting. Existing whistleblower-protection proposals lack formal privacy guarantees, and existing differential privacy mechanisms do not directly target the natural threat model -- one in which the audited organization itself observes auditor selection decisions and uses them to identify reporters. We formalize protection against a strong-adversary threat model as per-report $(0, \delta)$-differential privacy on the transcript of audit selections. Within this framework we prove that a natural approach -- randomized response applied at the selection step -- can never outperform uniform random auditing by more than $\delta$ at any horizon. We then give a generic mechanism that reduces private auditing to private continual counting: any $(0, \delta)$-DP continual counter plugs in by post-processing, and the audit transcript inherits the same per-report guarantee. Instantiating the reduction with a recent work in continual counting yields per-report $(0, \delta)$-DP with noise scaling as $O(\sqrt{\log T})$ across a horizon of $T$ audit decisions. A utility theorem shows that the selection error vanishes whenever the noisy report gap between the most-reported organization and the runner-up grows faster than $\sqrt{\log T}$. Simulations show a substantial improvement over randomized response.

SecuAudit: Integrity-Preserving Metadata Compliance Auditing for Secure Data Circulation in MCP-Enabled AI Agents

: AI agents frequently access external files, databases, and application programming interfaces (APIs) through the Model Context Protocol (MCP). However, these external resources typically lie outside the security boundary of the agent. During data circulation, attackers can not only tamper with the external data but also manipulate critical metadata, such as access permissions, validity periods, and authorization scopes. Even when the underlying data remains intact, such attacks can cause proxies to ingest expired or policy-violating resources, leading to severe privacy breaches and risks of unauthorized execution. To address these challenges, we propose SecuAudit, a privacy-enhancing decentralized data auditing scheme tailored for the MCP architecture. Leveraging Shamir’s Secret Sharing mechanism, key management is securely decentralized across multiple servers, effectively mitigating sub-threshold collusion attacks. Furthermore, by introducing a supervised hash mechanism, dynamic access policies and metadata constraints are cryptographically bound to the user’s private keys and file tags. Finally, based on a carefully designed randomized challenge-response protocol, third-party auditor (TPA) can efficiently verify both data integrity and metadata compliance without accessing the sensitive raw data. Security analysis demonstrates that SecuAudit can effectively resist data forgery, metadata tampering, and sub-threshold collusion attacks under the defined threat model. Experimental results obtained from our implementation under the evaluated configurations show that: (i) at ( t = 30, m = 59), SecuAudit reduces Keygen latency by 54.6% relative to our implementation of the Pedersen-based Threshold Label-Aggregating Remote Data Auditing scheme (Ped-TLARDA), while maintaining comparable online auditing performance; (ii) metadata binding introduces an average additional Signblock overhead of 2.5%; and (iii) the local EVM evaluation requires approximately 770 bytes of on-chain storage per file and 499,021 gas for the evaluated contract-interaction lifecycle; (iv) the theoretical cumulative detection probability for 1% data loss exceeds 99.9% after 23 independent audits, while all six implemented attack cases were detected in the controlled evaluation. These results indicate the feasibility of SecuAudit under the evaluated settings. In conclusion, SecuAudit establishes a feasible framework for secure data circulation under the evaluated deployment assumptions.