{"id":"ede876b6-da10-465f-857f-05bb0cb707bf","arxiv_id":"2510.23060","paper_version":4,"verdict":"REJECT","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"zkSTAR proves with zero-knowledge proofs that a utility's Kalman-filter-based attack alarms were computed correctly, keeping sensor data private.","lead":"zkSTAR is a system that uses zero-knowledge proofs so utilities can show regulators their cyberattack alarms were computed correctly, without revealing sensor data. Regulators would get a privacy-preserving compliance audit for power grids, water systems, and pipelines — if the system's security claims are correct.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central security claim conflates proof-of-computation with proof-of-physical-alarm: Eq. (9) never binds sensor inputs y_t to ground truth, so a compromised utility can inject false measurements and still emit verifying no-alarm proofs.","rationale":"The reader's weakest assumption identifies the same load-bearing gap: zk-SNARKs certify computation over prover-supplied data, not the authenticity of that data. My independent read of Equations (8)-(9), Definition 9, and Theorem 4.3 confirms that the security theorem is a tautological consequence of Halo2 knowledge-soundness once 'suppression' is defined relative to the relation R_t. The operational claim requires a relation that binds y_t to the physical process via authenticated sensing or a trusted measurement boundary; zkSTAR's relation omits this. This is not a manufactured concern: the paper's own threat model allows a compromised utility, and the experiments only compare detection curves against the non-ZKP version, never testing an adversary who changes the input stream. No amount of computational validation can close the gap, because the issue is in the formal modeling of the statement being proved. The paper does contribute an engineering exploration of expressing EKF and χ² checks in zk-SNARK circuits, and the reported timings may be reproducible, but the central regulatory guarantee—alarm suppression is cryptographically prevented—is not supported. The reader's REJECT verdict is therefore appropriate; my stress-test does not change it.","tokens_in":27180,"tokens_out":4608,"duration_ms":55897,"concrete_test":"Use the HAI attack window where the non-ZKP χ² statistic exceeds the UCL. Construct an alternative measurement stream y_t^* = h(hat{x}_{t|t-1}) + r_t^normal, or use a small optimizer to find perturbations δ_t such that ||U Σ^{-1/2}(y_t + δ_t - h(hat{x}_{t|t-1}))||_2^2 ≤ χ²_{m,α}, while the true readings yield a statistic above the UCL. Feed y_t^* through the same TC and SC kernels and keys used in Section 6 and check whether all proofs verify and the SC kernel returns ρ=0. If they do—as soundness of the circuit predicts—then zkSTAR verification does not imply that the physical alarm would have fired, confirming the concern.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing weakness is the mapping from zk-SNARK proof verification to the operational guarantee that an attack cannot be suppressed. Equation (9) defines the temporal-statistical consistency relation R_t over the prover-supplied tuple (Δ_in, Δ_out) and witness Ω. The only sensor-related component is y_t inside Δ_in, and no constraint anywhere ties y_t to the actual physical sensor readings. Definition 9 then defines detection suppression as Verify=1 while the extracted witness is outside R_t. Under Halo2 knowledge-soundness, Verify=1 already implies that some witness in R_t exists, so Theorem 4.3 is essentially a restatement of the proving system's soundness. It does not address the adversary that matters: a utility with a compromised OT layer can replace the true measurement stream y_t by a crafted y_t^* for which the EKF residual χ² statistic remains below the UCL. The proof for y_t^* verifies, ρ=0, and the regulator accepts a 'no alarm' result while the physical process is under attack. Thus the paper's formal model proves only that the reported alarm is the correct output of a computation over the reported data; it does not prove that the reported data correspond to reality. This is an application-boundary gap, not a flaw in Halo2, and it invalidates the abstract's claim that zkSTAR 'prevents suppression of alarms without visibility into utility-level data.' Sections 4.4 and 5.5 list assumptions about the CRS, model well-formedness, and channel integrity, but never assume authenticated, tamper-evident sensor inputs; the threat model of a breached IT-OT stack in the Introduction and Section 4.4 makes this omission consequential.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes zkSTAR, a system that wraps a utility-level EKF-based anomaly detector and its chi-square hypothesis test in Halo2/ezkl zk-SNARKs. It defines temporal consistency (TC) and statistical consistency (SC) conditions, introduces a security model based on the relation R_t in Eq. (9), and claims that under the knowledge-soundness of the proving system a compromised utility cannot falsify or suppress alarms without being detected. The framework is evaluated on the HAI and ORNL-PS datasets, reporting detection quality, proof/key sizes, proof-generation time, memory usage, and verification latency.","tokens_in":27623,"tokens_out":7714,"duration_ms":78851,"significance":"If the security claim were valid, the architecture would be a valuable contribution to privacy-preserving regulatory oversight of ICS anomaly detectors. The engineering data — proof-generation times of roughly 66–82 s, verification under 1.5 s, and relatively modest key/proof sizes — are useful and suggest practical feasibility as a proof-of-computation layer. However, the central advertised guarantee, that regulators can verify correctness and prevent suppression of alarms without visibility into utility-level data, is not supported. The proofs certify only that the reported alarm is the correct output of a computation over prover-supplied data; they do not certify that those data correspond to physical sensor reality. The formal results are largely definitional restatements of Halo2 knowledge-soundness, and the matrix formulas used in the statistical kernel are internally inconsistent. The experiments do not exercise the adversarial suppression scenarios that the theorems address. The paper is best evaluated as an engineering prototype, not as a validated security mechanism.","major_comments":[{"comment":"The central security claim conflates proof-of-computation with proof-of-physical-alarm. In Eq. (9), R_t is a relation over the prover-supplied tuple (Δ_in, Δ_out) and witness Ω. The only sensor-dependent component is y_t inside Δ_in, and no constraint in R_t, in the TC/SC kernels, or in the assumptions of Section 5.5 binds y_t to the actual physical sensor readings. Definition 9 defines detection suppression as Verify=1 while the extracted witness is outside R_t. Under this definition, a compromised utility that replaces the true measurement stream y_t with a crafted y_t^* for which the EKF residual chi-square statistic remains below the UCL is not 'suppressing' at all: the reported tuple satisfies R_t and the proof verifies. Thus the abstract's claim that zkSTAR 'prevents suppression of alarms without visibility into utility-level data' does not follow from the model. The missing assump","section":"Section 4.4, Eq. (9), Definition 9, Section 5.5"},{"comment":"Theorem 4.3 is a definitional restatement of Halo2 knowledge-soundness rather than a substantive security result. Since Definition 9 already defines suppression as producing a verifying proof with a witness outside R_t, the inequality Pr[Verify=1 and witness ∉ R_t] ≤ negl(λ) is exactly the knowledge-soundness guarantee of the underlying proving system. The proof in Appendix B.4 writes down that inequality and then restates the TC/SC conditions; it introduces no argument specific to false sensor data or to the ICS application. In particular, it does not address the adversary who keeps the witness inside R_t by submitting false measurements, which is the attack that matters for a compromised OT layer.","section":"Theorem 4.3 and Appendix B.4"},{"comment":"Lemma 1 is false as stated, and Theorem 4.2 does not follow. Definition 1 defines probabilistic similarity only when both test statistics exceed the chi-square threshold, so two realizations that both fall below the UCL yield statistically consistent outcomes ρ=ρ=0 but are not probabilistically similar by the given definition; the necessity direction of Lemma 1 fails. More fundamentally, Theorem 4.2 asserts that temporal consistency implies statistical consistency. Temporal consistency chains state estimates and hash commitments across time steps; it does not relate the reported residual/alarm to the alarm that would be computed on genuine physical measurements. A false y_t that is internally consistent with the model will satisfy the hash chain and produce a verifying proof while ρ differs from the value computed on true data. The proof in Appendix B.3 relies on Lemma 1 and on the unsup","section":"Definition 1, Lemma 1, Theorem 4.2, Appendices B.2–B.3"},{"comment":"The SVD and chi-square formulas contain matrix-order errors. In Section 3.2, the paper states S_t = U_t Σ_t U_t^T and then writes τ_t = (S_t)^{-1/2} r_t = U_t Σ_t^{-1/2} r_t. For a symmetric S with that eigendecomposition, S^{-1/2} = U Σ^{-1/2} U^T, so the expression is missing a U^T factor. Algorithm 4's SVD reconstruction check compares (U Σ^{-1/2})^T (U Σ^{-1/2}) with S^T S; for S = U Σ U^T this compares Σ^{-1} with U Σ^2 U^T, which is not a valid reconstruction check. Algorithm 5 then computes T = ||U Σ^{-1/2} r||², which is not the chi-square statistic for the stated residual covariance. If the SC circuit enforces these formulas, the 'statistical consistency' certificate is for a different statistic, and the comparison to χ²_{m,α} in the security analysis is not meaningful.","section":"Section 3.2, Eq. (8), Algorithm 4, Algorithm 5"}],"minor_comments":[{"comment":"The prior covariance update is written as P_{t|t−1} = G_t P_{t|t−1} G_t^T + Q_{t−1}, with the same symbol on both sides. The RHS should be P_{t−1|t−1}.","section":"Eq. (3)"},{"comment":"The condition in Definition 1 is duplicated: it states '˜T_t > χ²_{p,α} and ˜T_t > χ²_{p,α}' with no condition on T_t. This looks like a typo, but as written it does not define a symmetric relation.","section":"Definition 1"},{"comment":"There is a syntax error: 'if T_{χ²,W} > χ²_{m,α} then ρ_W ← 1 then' contains a stray 'then'. Also, the computation uses U Σ^{-1/2} r rather than the correctly transposed form noted in the major comment.","section":"Algorithm 5, line 8–9"},{"comment":"The text says the TC circuit grows exponentially with the detection-window size, but Table 3 shows roughly linear growth in circuit size as D increases from 1 to 32. The wording should be corrected.","section":"Section 5.1 and Table 3"},{"comment":"The notation for the extractor changes from E_U in Definition 9 to E_A in the proof of Theorem 4.3. This should be made consistent.","section":"Appendix B.4"},{"comment":"The experimental section measures detection quality and resource usage but does not test the security claim: there is no adversarial experiment in which a compromised prover attempts to suppress an alarm by submitting false sensor data. Since the theorems are the paper's main claim, such an experiment (or a clear statement that it is out of scope) is needed.","section":"Section 6"}],"recommendation":"reject","confidential_remarks":"The engineering evaluation is solid and the topic is timely, but the central security contribution is not supported: the formal model proves only correctness of computation over prover-supplied data, not authenticity of sensor measurements. This is not a small fix; it would require either a different trust model with authenticated measurement sources or a substantially narrowed statement of what the framework guarantees. I would encourage the authors to resubmit a version that explicitly separates 'proof of computation' from 'proof of physical alarm' and, if possible, adds attestation or authenticated-sensor assumptions to bridge the gap."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Top line: zkSTAR is a real attempt to make EKF-based chi-squared ICS detection verifiable with zk-SNARKs, and the engineering is serious — but the headline security claim doesn't survive contact with the threat model. The paper proves, at most, that the reported alarm is the correct output of a computation over the reported data; it does not prove the data correspond to physical process.\n\nWhat's genuinely new: I haven't seen anyone wrap a residual-based chi-squared detector in a zk-SNARK for regulatory auditing before. The TC/SC kernel decomposition — KRC, EKF, TC, SVD, and hypothesis-test kernels — is a concrete way to keep circuits manageable, and the experimental section is the strongest part. The measurements on HAI and ORNL-PS show detection quality close to the non-ZKP baseline across D and PSF, and the speedup numbers for larger TC intervals are consistent with the design. Verification under 1.5s and setup in the 2–3-minute range make the lazy, on-demand proof generation look plausible.\n\nThe soft spot is load-bearing. Equation (9)'s consistency relation R_t only constrains the computation over the prover-supplied tuple (Δ_in, Δ_out) and witness Ω. Nothing ties the sensor measurement y_t to ground truth. Section 5.5 lists assumptions about CRS, model well-formedness, honest-but-curious verifier, and channel integrity, but never authenticated, tamper-evident sensor inputs. So a utility that can compromise the OT layer can replace y_t with crafted values that keep the chi-squared statistic below the UCL, produce a valid no-alarm proof, and the regulator accepts it. The abstract's claim that zkSTAR 'prevents suppression of alarms' is not supported.\n\nThe formal section matches this reading. Lemma 1 is mis-stated — the definition of probabilistic similarity as written requires both test statistics to exceed the threshold, which isn't similarity — and its necessity direction doesn't hold for no-alarm outputs. Theorem 4.2's proof treats reported and real sensor measurements as interchangeable exactly where they aren't. Theorem 4.3 is largely a restatement of Halo2 knowledge soundness wrapped around Definition 9, which defines suppression as producing a proof with a witness outside R_t; by construction that's infeasible. The real suppression vector — false sensor data — is defined out of the model. There's also a small matrix-order bug in Algorithm 4: the SVD check compares (UΣ^{-1/2})^T(UΣ^{-1/2}) with S^T S rather than S itself.\n\nNone of this kills the engineering contribution. No code or data is shipped, but the reported benchmarks are reproducible in principle and the kernel decomposition is worth stealing. Readers working on verifiable ML pipelines or ICS compliance will get useful architecture and benchmarks; security researchers should not take the theorems at face value. The paper needs either authenticated sensor inputs or a reframed claim — verifiable computation over provider-supplied data, not alarm-suppression prevention. That's a major revision, not a trivial fix, but it's the right kind of problem to put in front of a serious referee.","headline":"Genuinely new application and solid engineering, but the central security claim collapses: the proof never binds sensor readings to physical reality, so a compromised utility can still suppress alarms.","tokens_in":28110,"tokens_out":4863,"would_cite":false,"duration_ms":49297,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper presents zkSTAR, which lets regulators verify that industrial-control attack alarms are temporally and statistically consistent, and proves a compromised utility cannot suppress alarms without exposing utility data.","keywords":["Zero-Knowledge Proof","zk-SNARK","Industrial Control Systems","Critical Infrastructure","Attack Detection","Extended Kalman Filter","Regulatory Compliance","Chi-Square Hypothesis Test"],"falsifier":"Simulate a data-driven attack at the sensor layer where the adversary replaces the sensor measurements with values that keep the detector's test statistic below the alarm threshold, and have the utility generate a proof for that window; if the proof verifies while the attack is underway, the claim that verification rules out detection suppression is refuted.","tokens_in":27081,"feed_emoji":"🔐","tokens_out":16054,"duration_ms":144335,"temperature":0.7,"pith_summary":"zkSTAR targets a regulatory blind spot in critical infrastructure: utilities run their own attack detectors, but regulators cannot audit the raw data behind each alarm without invading operational privacy. The paper claims that zero-knowledge proofs can close this gap. It wraps an extended-Kalman-filter-based chi-squared attack detector in two zk-SNARK circuits — succinct cryptographic proofs that reveal nothing beyond the truth of the statement — one proving temporal consistency of state estimates over time and one proving that the alarm follows from a valid hypothesis test. If the proofs verify, a regulator can trust the reported alarm status, including the absence of an alarm, even though the underlying sensor readings, residuals, and model parameters stay private. The paper further argues that, under the proof system's knowledge-soundness property — meaning an adversary cannot produce a verifying proof unless the statement is true — a compromised utility cannot forge or suppress detections.","feed_headline":"Prove it: zero-knowledge blocks alarm suppression in utilities","feed_subtitle":"zkSTAR wraps utility attack detection in two cryptographic proofs so regulators verify alarms without seeing sensor data","key_machinery":"The load-bearing object is the temporal-statistical consistency relation, enforced by two zk-SNARK circuits. A zk-SNARK is a succinct cryptographic proof that a computation was performed correctly without revealing its inputs. The temporal-consistency circuit runs batched extended-Kalman-filter steps for each time interval, checks Kalman-gain reconstruction against the state covariance, and links intervals through randomized hash fingerprints. The statistical-consistency circuit validates an offline singular-value decomposition and computes the chi-square statistic against a pre-committed upper control limit. Expensive linear algebra is done offline and checked inside the circuit with small","core_discovery":"The central claim is that correct execution of a standard residual-based attack detector can be made publicly verifiable in zero knowledge. Concretely, zkSTAR defines a temporal-statistical consistency relation for each detection window: the extended Kalman filter output must follow from the previous state through the committed model, successive state estimates must be linked by matching hashes, and the standardized residual statistic must be compared with a chi-square upper control limit. Any proof artifact that verifies against this relation certifies the alarm or no-alarm decision. The paper proves that under the knowledge-soundness property of the proving system, detection suppression oc","pith_inferences":["Editorial inference: the guarantee is about computational integrity, not physical authenticity. The sensor readings entering the detector are supplied by the utility, so the real-world ceiling on attack suppression is whatever protects sensor data before it enters the detector; adding hardware attestation at the sensor boundary would close that gap.","Editorial inference: the same two-circuit pattern (a temporal-consistency proof plus a statistical-decision proof) could be applied to other residual-based monitors by swapping the chi-square check for the corresponding hypothesis test.","Editorial inference: the paper's on-demand proof model lets a regulator tune audit frequency per utility; raising frequency tightens deterrence against suppression at the cost of prover compute, a trade-off the paper does not quantify."],"forward_implications":["Regulators can audit detection outcomes on demand without receiving operational sensor data, replacing full-data audits with proof verification.","A utility under active attack cannot suppress or rewrite alarms without violating proof verification or the temporal-statistical consistency relation.","Detection quality in the zero-knowledge version matches the non-zero-knowledge detector on real-world industrial-control datasets across varying interval sizes and precision scale factors.","Proof generation can be batched across temporal intervals with speedups that grow with interval size, and regulator-side verification completes in roughly one to one-and-a-half seconds."],"fun_headline_variants":["Zero-knowledge proofs let regulators verify ICS alarms—no data shown","Regulators can validate attack alarms via zero-knowledge, keep data private","zkSTAR: zero-knowledge proofs for verifiable, private ICS alarm checks","Prove alarm correctness without sharing sensor data: zkSTAR","Zero-knowledge detection verification: regulators see proof, not utility data"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the sensor readings entering the detector are authentic physical measurements; the proof only certifies the arithmetic performed on data the utility supplies, so an attacker who can feed fake readings can keep the alarm off and still produce a verifying proof.","fun_headline_variants_meta":{"raw":{"variants":["Zero-knowledge proofs let regulators verify ICS alarms—no data shown","Regulators can validate attack alarms via zero-knowledge, keep data private","zkSTAR: zero-knowledge proofs for verifiable, private ICS alarm checks","Prove alarm correctness without sharing sensor data: zkSTAR","Zero-knowledge detection verification: regulators see proof, not utility data"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001583,"raw_usage":{"total_tokens":6153,"prompt_tokens":747,"completion_tokens":5406,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":491,"completion_tokens_details":{"reasoning_tokens":5311}},"tokens_in":491,"tokens_out":5406,"duration_ms":37286,"temperature":1.0,"reasoning_tokens":5311,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T07:59:40.077778+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Simulate a data-driven attack at the sensor layer where the adversary replaces the sensor measurements with values that keep the detector's test statistic below the alarm threshold, and have the utility generate a proof for that window; if the proof verifies while the attack is underway, the claim that verification rules out detection suppression is refuted.","supporting_citations":[],"review_version":1}