JOLT Atlas zkML Guard — ROS 2 Robotics Demo

Zero-Knowledge Machine Learning proofs gating robot motion commands

🎯 Demo Scope & Architecture

This is a proof-of-concept demonstrating real zkML technology integration with robotics.

What This Demo Proves

This demo successfully demonstrates production-grade JOLT-Atlas zero-knowledge proofs integrated with ROS 2 robotics:

✅ Real cryptographic proofs: Genuine JOLT zkSNARKs (3-4 second generation time)
✅ Model integrity verification: SHA-256 cryptographic binding of model, input, and output
✅ ROS 2 integration: Seamless proof-gated motion control architecture
✅ End-to-end workflow: Camera → Inference → Proof → Verification → Motion unlock

The cryptography is real and production-grade - these are actual zero-knowledge proofs that could be verified independently or submitted to a blockchain.

Engineering Tradeoffs

For demonstration purposes, this system uses a sentinel model approach:

What gets proven: A lightweight sentinel ONNX model (11-step execution trace) generates the cryptographic proof. This demonstrates the proof system works with ~3 second latency.

Inference model: MobileNetV2 runs the actual object detection for motion gating. The proof validates the sentinel model executed correctly and binds to the inference metadata via SHA-256 hashes.

Why this design: Proving large production models requires substantial computational resources with current zkML technology. The sentinel approach enables real-time demonstration while showcasing genuine cryptographic proof workflows.

Production Pathways

To prove the full inference model in production systems, the zkML field is actively developing:

Hardware acceleration: GPU/FPGA provers for faster generation
Proof aggregation: Recursive SNARKs to bind sentinel → full model
Incremental Verification: IVC approaches for large computations
Specialized architectures: zkML-optimized model designs

This demo provides hands-on experience with the proof generation, verification, and integration workflows you'd use in production - just with a sentinel model standing in for the full computation.

Intended Use Cases

✅ Great for:

Learning zkML concepts and architecture
Prototyping proof-gated robotics systems
Testing ROS 2 + zkML integration patterns
Demonstrating cryptographic verification workflows
Investor/partner demos of zkML technology

⚠️ Note for production:

The sentinel model approach is for demonstration - production systems should prove the actual safety-critical computation
See Smart Proof Design for technical implementation details

Overview

This project demonstrates cryptographically verifiable robotics by integrating JOLT-Atlas zero-knowledge proofs with ROS 2. It creates a trustworthy control system where robot motion requires proof that specific ML computations were executed correctly.

System Flow

Camera → ML Inference → ZK Proof → Verified → Motion Unlocked
  ↓           ↓            ↓          ↓            ↓
/image   MobileNetV2   JOLT-Atlas  Crypto      /cmd_vel
         (10ms)       (3-4s)      (128-bit)   (gated)

Key Components:

Camera feed (/image) → zkML Guard runs ONNX inference (MobileNetV2)
ZK Proof Generation: JOLT-Atlas proves computation integrity with cryptographic guarantees
Motion Gating: Only releases /zkml/stop lock after verified proof
twist_mux enforces high-priority lock on /cmd_vel commands
Web UI: Real-time monitoring and control at http://localhost:9200

What zkML Provides

Computational Integrity Guarantees:

Proves the exact model (by SHA256 hash) was used for inference
Proves the exact input (by SHA256 hash) was processed
Prevents model substitution, result forgery, or replay attacks
Creates auditable proof chain for regulatory compliance

Security Benefits:

Trustless Operation: Verify robot decisions without trusting the operator
Multi-Party Scenarios: Multiple organizations can verify same robot used approved model
Tamper Detection: Any modification to model weights or inference results is cryptographically detectable
Audit Trail: Every decision includes cryptographic proof of what computation happened

This is essential for high-stakes robotics (autonomous vehicles, medical robots, defense systems) and multi-party deployments where trust cannot be assumed.

Quick Start (Automated)

One-command demo launch:

cd ~/robotics
./start_demo.sh

This automatically:

Checks and installs all dependencies
Builds ROS workspace if needed
Starts ONNX verifier (port 9100)
Starts UI server with auto-proxy launch (port 9200)
Launches camera, zkML guard, and teleop
Opens browser to demo UI

Options:

./start_demo.sh --help          # Show all options
./start_demo.sh --cli           # Use CLI verifier instead of HTTP
./start_demo.sh --burger        # Use test pattern instead of camera
./start_demo.sh --record        # Record to MCAP file
./start_demo.sh --no-browser    # Don't auto-open browser

Stop everything:

./stop_demo.sh

Manual Quick Start

Prerequisites:

ROS 2 (Jazzy/Humble/Rolling)
Node.js 18+ and npm
Python 3.9+ with ROS 2 bindings
Docker (optional - for building JOLT prover binary)
Camera device (or use burger_mode for test pattern)

# 1. Build ROS workspace
cd ~/robotics
colcon build
source install/setup.bash

# 2. Install Python dependencies
pip install -r src/zkml_guard/requirements.txt

# 3. Install ONNX verifier dependencies
cd tools/onnx-verifier
npm install
cd ../..

# 4. Install UI dependencies
cd tools/robotics-ui
npm install
cd ../..

# 5. Start the Web UI (this will auto-start the verifier and proxies)
cd tools/robotics-ui
npm start

Then open http://localhost:9200/demo.html and click "Start Full Demo"

The UI automatically:

Starts HTTP verifier (port 9100)
Launches camera node
Starts zkML guard with proof verification
Starts demo teleop publisher
Manages ROS proxy bridges for UI updates

📚 Documentation

Comprehensive documentation is available in the docs/ directory:

Quick Start Guide - Fast setup instructions
Architecture - System design and components
Camera Setup - Multi-platform camera configuration
Security Fixes - Security improvements and best practices
Testing Guide - Testing procedures and verification
Scripts Reference - Root directory scripts documentation
Development Log - Recent improvements and changes

See docs/README.md for a complete documentation index.

What's Included

Core Components

zkml_guard (src/zkml_guard/): ROS 2 Python package
- Subscribes to /image, runs ONNX inference
- Generates/verifies ZK proofs via CLI or HTTP
- Publishes /zkml/stop (Bool) and /zkml/event (String/JSON)
Web UI (tools/robotics-ui/): Express.js server + static frontend
- Control panel for starting/stopping all components
- Live event stream from /zkml/event
- Camera frame preview with real-time detection display
- Proof status and lock state indicators
- Visual pipeline display showing inference → proof → verification states
- Verified proofs history with snapshot thumbnails
- Motion gating countdown timer
- Debug endpoints: /api/proxy_status, /debug/logs
ONNX Verifier (tools/onnx-verifier/): HTTP zkML verification service
- Accepts model + input, returns cryptographic proof
- Used by default (HTTP mode)
ROS Proxies (tools/robotics-ui/*_proxy.py): Bridge ROS → Filesystem
- event_proxy.py: /zkml/event → /tmp/rdemo-last-event.json, manages verified proofs history
- frame_proxy.py: /image → /tmp/rdemo-frame.png
- Snapshot saving: Captures frame images for verified proofs with retry logic
- Auto-started by UI server with retry logic

File Structure

robotics/
├── src/zkml_guard/          # ROS 2 package
│   ├── zkml_guard/
│   │   ├── zkml_guard_node.py   # Main guard node
│   │   └── jolt.py              # Proof helper
│   ├── launch/                  # Launch files
│   ├── config/                  # YAML configs
│   └── requirements.txt
├── tools/
│   ├── robotics-ui/         # Web control panel
│   │   ├── server.js            # Express API server
│   │   ├── event_proxy.py       # ROS→File bridge
│   │   ├── frame_proxy.py       # Camera→File bridge
│   │   └── public/index.html    # Frontend UI
│   └── onnx-verifier/       # HTTP verifier service
├── scripts/
│   └── setup_ros.sh         # Install ROS + deps
├── archive/
│   └── legacy-tkinter-ui/   # Deprecated Tkinter UI
└── README.md

Manual Setup (Without Web UI)

1. Install ROS 2 Packages

sudo apt install \
  ros-$ROS_DISTRO-teleop-twist-keyboard \
  ros-$ROS_DISTRO-twist-mux \
  ros-$ROS_DISTRO-image-tools \
  ros-$ROS_DISTRO-rosbag2-storage-mcap

2. Build Workspace

cd ~/robotics
colcon build
source install/setup.bash

3. Install Python Dependencies

# In a venv (recommended)
python3 -m venv venv
source venv/bin/activate
pip install -r src/zkml_guard/requirements.txt

# Or system-wide
pip install onnxruntime numpy pillow requests rclpy

4. Run Components (3 terminals)

Terminal 1: Camera

source ~/robotics/install/setup.bash
ros2 run image_tools cam2image

Terminal 2: zkML Guard + twist_mux

source ~/robotics/install/setup.bash
# HTTP mode (default - requires verifier running)
ros2 launch zkml_guard zkml_guard_proof.launch.py

# Or CLI mode (requires atlas_argmax_prover in PATH)
ros2 launch zkml_guard zkml_guard_proof.launch.py --ros-args -p verifier_mode:=cli

Terminal 3: Teleop (interactive keyboard control)

source ~/robotics/install/setup.bash
ros2 run teleop_twist_keyboard teleop_twist_keyboard

5. Optional: Start HTTP Verifier

cd ~/robotics/tools/onnx-verifier
npm install  # first time only
node server.js
# Listens on http://localhost:9100

Configuration

Key Parameters (`src/zkml_guard/config/zkml_guard.params.yaml`)

Parameter	Default	Description
`verifier_mode`	`cli`	`cli` or `http`
`verifier_url`	-	HTTP endpoint (e.g., `http://localhost:9100/verify`)
`gating_mode`	`argmax`	Proof mode: `argmax` or `threshold`
`threshold`	`0.6`	Min confidence score
`prove_on`	`rising_edge`	`rising_edge` or `every_pass`
`unlock_hold_ms`	`1200`	Keep unlocked for N ms after proof
`require_proof`	`true`	Gate motion on proof verification
`model_path`	(auto)	ONNX model path (auto-downloads MobileNetV2)
`prove_cmd_template`	(see yaml)	CLI command template with placeholders

Override at launch:

ros2 launch zkml_guard zkml_guard_proof.launch.py \
  --ros-args -p verifier_mode:=http \
             -p verifier_url:=http://localhost:9100/verify \
             -p threshold:=0.7

Web UI Features

Real-Time Detection Display

The UI shows live ML inference results with intelligent state management:

Detection Behavior:

Guard Running: Shows continuous detection results (label + confidence %)
During Proof Generation: Clears detection display to indicate proof processing
After Proof: Resumes showing detections after inference pause (~2 seconds)
Guard Stopped: Immediately clears all detection data for clean restart

State Machine:

Stopped → Clear display, clear internal state (lastEvent = null)
Running → No threshold met → Show all detections continuously
Running → Threshold met → Clear display (proof generating)
Running → Proof complete → Resume showing detections after inference pause

This ensures users see fresh, relevant inference data without confusing stale results.

Verified Proofs History

Displays last 50 verified proofs with snapshot thumbnails
Each proof shows: timestamp, detected label, confidence score, proof ID
Snapshots automatically captured at moment of proof verification
Reliable snapshot saving with 500ms retry mechanism
Updates immediately when new proofs are verified

Motion Gating Timer

Large, prominent countdown display showing time until motion lock re-engages
Shows remaining seconds from unlock_hold_ms parameter
Pauses during proof generation
Resets when new proof verified

Pipeline Visualization

Real-time visual feedback showing system state:

Inference → Running/idle indicator
Proof Generation → Active/inactive with timing
Verification → Success/failure status

Color-coded states make it easy to understand what the system is doing at any moment.

Web UI Endpoints

Server runs on http://localhost:9200

GET / or /demo.html → Enhanced demo UI
GET /status → Component status (camera, guard, proxies, etc.)
GET /api/proxy_status → Detailed proxy health + logs
GET /api/last_event → Latest /zkml/event JSON
GET /api/stop_state → Lock state (/zkml/stop)
GET /api/frame.png → Latest camera frame
GET /api/verified_proofs → History of last 50 verified proofs
GET /api/snapshot/:id.png → Snapshot image for specific proof ID
GET /api/events → Server-Sent Events stream
POST /start/{service} → Start verifier/camera/guard/teleop/bag
POST /stop/{service} → Stop service
GET /start/full?mode=http&burger=1&record=0 → One-shot demo start
GET /stop/all → Stop all services
GET /start/proxies → Restart ROS proxies
GET /debug/logs → Proxy log tails
GET /debug/files → Temp file status
POST /api/flip_model → Demo: Swap model to tampered version (for testing detection)
POST /api/restore_model → Demo: Restore original model from backup

Recent Security & UI Improvements

Model Tampering Detection (2025-10-16)

Problem: The guard node uploaded the tampered model to the verifier, which then computed the hash of that tampered model. Since both used the tampered model, hash verification always passed - allowing proofs to succeed even with a substituted model.

Root Cause:

Guard loaded model into memory at startup and computed hash once
When model file was swapped on disk (via /api/flip_model), guard restarted with tampered model
Guard uploaded tampered model to verifier → verifier computed tampered hash → everything matched
No stored "expected" hash to compare against

Solution: Added runtime tampering detection in zkml_guard_node.py:190-193, 308-317:

Store original hash at startup: self.original_model_sha256 = sha256_file(self.model_path)
Check before every proof: Compare current file hash against stored original

Block proof generation if mismatch detected:

current_hash = sha256_file(self.model_path)
if current_hash != self.original_model_sha256:
    self.get_logger().error('MODEL TAMPERING DETECTED!')
    proof_verified = False
    proof_id = 'BLOCKED_TAMPERED_MODEL'

Result:

✅ Proofs immediately blocked when model file is modified
✅ Motion stays locked (red) - no unsafe operation
✅ Clear error logs: MODEL TAMPERING DETECTED! Expected: c0c3f76d... | Actual: b9cacfef...
✅ UI shows red banner with hash mismatch details
✅ Demonstrates zkML's tamper detection capabilities in live demo

Testing the Feature:

# 1. Start demo normally - model hash registered at startup
curl http://localhost:9200/start/full

# 2. Flip model to tampered version (changes 3 bytes in middle of file)
curl -X POST http://localhost:9200/api/flip_model

# 3. Try to generate proof - BLOCKED with error:
# [zkml_guard] MODEL TAMPERING DETECTED! Expected: c0c3f76d... | Actual: b9cacfef...
# [zkml_guard] Proof generation BLOCKED - model hash mismatch

# 4. Restore original model
curl -X POST http://localhost:9200/api/restore_model

# 5. Proofs work normally again

API Endpoints:

POST /api/flip_model → Swaps model with tampered version, returns hash comparison
POST /api/restore_model → Restores original model from backup

Files Modified:

/home/hshadab/robotics/src/zkml_guard/zkml_guard/zkml_guard_node.py - Added tampering detection
/home/hshadab/robotics/tools/robotics-ui/server.js - Model swap API endpoints
/home/hshadab/robotics/tools/robotics-ui/public/demo.html - UI controls and banner
/home/hshadab/robotics/tools/robotics-ui/public/index.html - Synced with demo.html

Detection Display State Management (2025-10-16)

Problem: Detection display showed stale inference results, causing confusion:

Old detections remained visible when demo was stopped
Detection data persisted briefly when restarting demo
Labels shown even when below threshold during proof generation

Solution: Implemented intelligent state machine in demo.html:896-922:

Detection clears immediately when guard stops
lastEvent set to null on stop for clean restart (demo.html:1131-1136)
Detection clears during proof generation (when predicate_met && !proof_ms)
Detection shows continuously when guard running (regardless of threshold)
Detection resumes after inference pause completes

Files Modified: /home/hshadab/robotics/tools/robotics-ui/public/demo.html

Reliable Snapshot Capture (2025-10-16)

Problem: Some verified proofs missing snapshot thumbnails (~33% failure rate):

frame_proxy.py throttles writes (every 5th frame)
event_proxy.py tried to copy frame immediately
Race condition when frame file didn't exist yet

Solution: Added retry mechanism in event_proxy.py:62-68:

Wait up to 500ms for frame file (5 attempts × 100ms)
Log warning if frame still not available after retries
Import time module for sleep functionality

Result: All verified proofs now consistently include snapshots

Files Modified: /home/hshadab/robotics/tools/robotics-ui/event_proxy.py

Configuration Updates

Threshold: Changed from 25% to 40% in zkml_guard.params.yaml:12 Inference Rate: Changed to 2000ms (2 seconds) in zkml_guard.params.yaml:13

Note: These config changes require restarting the guard service to take effect:

# Via UI: Click "Stop All" then "Start Full Demo"
# Or manually restart guard node

Troubleshooting

UI Not Showing ROS Data

Check proxy status:

curl http://localhost:9200/api/proxy_status

Manually restart proxies:

cd ~/robotics/tools/robotics-ui
source ~/robotics/install/setup.bash
source /opt/ros/jazzy/setup.bash
python3 event_proxy.py &
python3 frame_proxy.py &

Check logs:

tail -f /tmp/event_proxy.py.log
tail -f /tmp/frame_proxy.py.log

Verify ROS topics are publishing:

ros2 topic list
ros2 topic echo /zkml/event --once
ros2 topic hz /image

Proof Failures

CLI mode: Ensure atlas_argmax_prover is in PATH and executable
HTTP mode: Verify verifier is running on port 9100
Check logs: ros2 topic echo /zkml/event shows proof_verified: false with error details

Camera Not Working

# Check if camera device exists
ls -l /dev/video*

# Test camera directly
ros2 run image_tools cam2image --ros-args -p burger_mode:=true

# Check topic
ros2 topic hz /image

Recording & Visualization

Record to MCAP

ros2 bag record -a -s mcap
# Or via UI: enable "Record MCAP" checkbox before starting

View in Foxglove

Open Foxglove Studio
Connect to ROS 2 or open .mcap file
Add panels for:
- /image (Image)
- /zkml/stop (Boolean indicator)
- /zkml/event (Raw Messages)
- /cmd_vel and /cmd_vel_out (Twist)

Architecture & Technology Stack

System Architecture

┌─────────────────────────────────────────────────────────────────┐
│                         Web Browser                             │
│                  http://localhost:9200/demo.html                │
└────────────────────────────┬────────────────────────────────────┘
                             │ HTTP/SSE
┌────────────────────────────▼────────────────────────────────────┐
│                    UI Server (Node.js/Express)                  │
│  - Control panel API                                            │
│  - File serving (/tmp/rdemo-*.{json,png,txt})                   │
│  - Service orchestration                                        │
└──────┬──────────────────────────────────────────┬───────────────┘
       │ HTTP                                      │ spawn/monitor
       │                                           │
┌──────▼──────────────────┐              ┌────────▼────────────────┐
│ ONNX Verifier (Node.js) │              │  ROS2 Proxy Scripts     │
│  - HTTP proof API       │              │  - event_proxy.py       │
│  - Spawns JOLT binary   │              │  - frame_proxy.py       │
│  - Returns proof JSON   │              │  - Write to /tmp/       │
└─────────────────────────┘              └────────┬────────────────┘
                                                   │ ROS2 pub/sub
                                         ┌─────────▼─────────────────┐
                                         │    ROS 2 Middleware       │
                                         │  (DDS - Data Distribution)│
                                         └─┬─────────┬───────────┬───┘
                                           │         │           │
                      ┌────────────────────▼─┐  ┌────▼──────┐ ┌─▼──────────┐
                      │ zkml_guard (Python)  │  │ twist_mux │ │ cam2image  │
                      │ - Subscribes: /image │  │ (C++)     │ │ (C++)      │
                      │ - ONNX inference     │  │           │ │            │
                      │ - Triggers proofs    │  │           │ │            │
                      │ - Publishes:         │  │           │ │            │
                      │   /zkml/event        │  │           │ │            │
                      │   /zkml/stop         │  │           │ │            │
                      └──────────────────────┘  └───────────┘ └────────────┘

Technology Roles

Technology	Role	Why This Choice
ROS 2	Communication middleware	Industry-standard for robotics, pub/sub topics, QoS guarantees
Node.js	Web servers (UI + ONNX verifier)	Fast async I/O, easy HTTP APIs, child process management
Python	ROS2 nodes, proxies	`rclpy` bindings, `onnxruntime` support, rapid prototyping
Rust	JOLT-Atlas prover binary	Memory safety, cryptographic performance, JOLT implementation
ONNX Runtime	ML inference engine	Cross-platform, optimized for MobileNetV2, 10ms inference
HTML/JS	Frontend dashboard	Real-time updates via SSE, responsive UI, minimal dependencies

ROS 2 Components

Nodes:

zkml_guard - Main guard node (Python)
- Subscribes to /image (sensor_msgs/Image)
- Publishes to /zkml/event (std_msgs/String - JSON)
- Publishes to /zkml/stop (std_msgs/Bool)
- Triggers HTTP proof generation
twist_mux - Safety multiplexer (C++)
- Subscribes to multiple /cmd_vel_* topics
- Publishes to /cmd_vel_out
- Locks on /zkml/stop signal
cam2image - Camera publisher (C++)
- Publishes to /image at ~30Hz
- Optional burger_mode for test patterns

Topics:

/image - Camera frames (sensor_msgs/Image)
/zkml/event - Proof metadata (std_msgs/String - JSON)
/zkml/stop - Motion lock (std_msgs/Bool)
/cmd_vel - Velocity commands (geometry_msgs/Twist)
/cmd_vel_out - Gated velocity output (geometry_msgs/Twist)

Proof Flow (Detailed)

Phase 1: Inference (10-50ms)

Camera publishes /image at ~30 Hz
zkml_guard_node samples at configurable rate (default: 500ms)
Preprocesses frame: resize 224×224, normalize, convert to tensor
Runs ONNX inference (MobileNetV2) on CPU/GPU
Computes argmax and confidence score

Phase 2: Proof Triggering (Conditional) 6. If predicate met (threshold + gating_mode):

HTTP mode: POST to http://localhost:9100/verify
- Sends model path, input tensor, metadata
- Server spawns JOLT binary: simple_jolt_proof
CLI mode: Spawns atlas_argmax_prover subprocess directly

Phase 3: Proof Generation (3-4 seconds) 7. JOLT-Atlas prover:

Loads sentinel model (NOT full MobileNetV2 - that would take 30+ minutes)
Generates execution trace (11 steps for sentinel model)
Creates cryptographic proof using Dory polynomial commitments
Proves: "I correctly executed computation X on input Y"

Phase 4: Verification (<1 second) 8. JOLT binary verifies proof internally (6s)

Checks polynomial commitments
Validates execution trace
Returns verification result

Phase 5: Motion Gating 9. zkml_guard_node parses proof result 10. Updates /zkml/stop: - true (locked) if no proof or proof failed - false (unlocked) if proof verified 11. Publishes full event metadata to /zkml/event: json { "ts": 1760501733.95, "model_sha256": "c0c3f76d...", // Binds to specific model "input_sha256": "bb92837d...", // Binds to specific input "top1_label": "matchstick", "top1_score": 0.0256, "proof_verified": true, "proof_ms": 2847, "proof_id": "0x1a2b3c4d..." } 12. Motion unlocked for unlock_hold_ms duration (default: 3000ms)

Proxy Bridge Pattern

The UI server cannot directly access ROS topics (different process context). Solution:

Architecture:

Proxy processes (event_proxy.py, frame_proxy.py) run as ROS nodes
Subscribe to topics and write to temp files in /tmp/
- /tmp/rdemo-last-event.json - Latest zkML event (JSON)
- /tmp/rdemo-stop.txt - Lock state (true/false)
- /tmp/rdemo-frame.png - Latest camera frame (PNG)
- /tmp/rdemo-verified-proofs.json - History of last 50 verified proofs
- /tmp/rdemo-snapshots/*.png - Snapshot images for verified proofs
UI server polls/serves these files via HTTP
Server auto-starts proxies with retry logic and logging to /tmp/*_proxy.py.log

Why This Design:

Node.js server runs outside ROS environment (no rclpy bindings)
File-based IPC is simple, debuggable, and cross-process
Proxies can crash/restart independently without affecting UI server
Easy to inspect state: cat /tmp/rdemo-last-event.json

Snapshot Reliability:

event_proxy.py waits up to 500ms for frame file when proof verified (5 retries × 100ms)
Handles timing issue where frame_proxy.py throttles frame writes (every 5th frame)
Ensures all verified proofs have associated snapshot images

Smart Proof Design

Current Implementation:

Fast path: ONNX inference on full MobileNetV2 (10ms) → immediate feedback
Slow path: JOLT proof on sentinel model (3-4s) → cryptographic guarantee
Binding: Both use same input_sha256 and model_sha256 in metadata

Why Not Prove Full MobileNetV2?

Full model proof would take 30 minutes to 2+ hours
Requires 10-50GB RAM
Trace length: 100M+ steps vs current 11
Would completely break real-time demo

Trade-off:

✅ Real-time performance for normal operation
✅ Cryptographic audit trail with hash binding
✅ Safety gating that requires proof verification
⚠️ Proof is for sentinel computation, not full inference
⚠️ Full MobileNetV2 proof would require hardware acceleration (GPU prover)

Building JOLT Prover (CLI Mode)

cd ~/robotics/tools
./build_helper.sh
# Builds Docker image, compiles Rust prover, extracts binary to bin/

# Add to PATH
export PATH="$HOME/robotics/tools/bin:$PATH"

# Verify
atlas_argmax_prover --help

Target specific jolt-atlas branch:

./build_helper.sh atlas-helper:latest <git-ref>

Why zkML Matters: Real-World ML Failures

Common ML Failure Modes

1. Adversarial Attacks

Adding imperceptible noise to images causes misclassification
Example: Stop sign with stickers classified as speed limit sign
Impact: Autonomous vehicle runs stop sign, robot misidentifies hazards

2. Model Poisoning/Substitution

Attacker replaces model weights with backdoored version
Malicious behavior triggered by specific patterns
Impact: Robot behaves normally until trigger detected, then acts maliciously

3. Distribution Shift

Model trained in lab fails in production environment
Lighting changes, sensor degradation, unseen objects
Impact: Confidence scores become unreliable, wrong decisions made

4. Silent Hardware/Software Faults

Bit flips in GPU memory during inference
Corrupted model files on disk
Firmware vulnerabilities in inference engine
Impact: Incorrect results with no error indication

What zkML Solves (and Doesn't)

zkML Provides: ✅ Computational Integrity - Proves the exact computation happened ✅ Model Authenticity - Cryptographically binds to model SHA256 ✅ Input Binding - Proves computation used specific input tensor ✅ Tamper Detection - Any modification breaks proof verification ✅ Non-Repudiation - Audit trail of what model was used when ✅ Trustless Verification - Anyone can verify without trusting operator

zkML Does NOT Provide: ❌ Makes model more accurate ❌ Prevents adversarial examples from fooling model ❌ Detects if model was trained on poisoned data ❌ Guarantees model is "correct" for the task

Key Insight: zkML proves "this computation happened correctly" not "this computation gave the right answer"

Use Cases Where zkML is Essential

High-Stakes Robotics:

Autonomous vehicles - Prove certified model used for safety decisions
Medical robots - Regulatory compliance, audit trail for liability
Defense systems - Verify authorized software, prevent backdoors

Multi-Party Scenarios:

Shared robot fleets - Multiple organizations verify same robot used approved model
Third-party operations - Customer verifies contractor used certified software
Supply chain - Warehouse owner verifies robot operator didn't tamper with safety systems

Regulatory Compliance:

Aviation - FAA-certified models with cryptographic proof of use
Healthcare - FDA-approved diagnostic algorithms with audit trail
Insurance - Prove robot used approved software at time of incident

Adversarial Environments:

Untrusted networks - Robot in hostile environment can't fake safety checks
Public spaces - Third parties can verify robot behavior without access
Critical infrastructure - Prevent remote model substitution attacks

Demo Scenario

In this demo:

Threat Model: Attacker could modify mobilenetv2-12.onnx to always return "safe" classification
Without zkML: No detection, motion always unlocked
With zkML: model_sha256 changes, proof verification fails, motion stays locked

The demo shows:

Camera detects object → MobileNetV2 inference (10ms)
JOLT proof generated (3-4s) binding to exact model+input hashes
Motion only unlocked if proof verifies
Event log creates audit trail: "At timestamp T, robot used model M on input I"

This enables trustless robotics where decisions are cryptographically verifiable without trusting the robot operator.

Safety & Security

Fail-safe: Lock engages if proof generation fails or times out
No blind trust: Motion only allowed after cryptographic verification
Reproducible: All inputs (model hash, tensor hash) logged in /zkml/event
Auditable: MCAP recordings capture full provenance chain
Cryptographic binding: SHA256 hashes prevent model/input substitution
128-bit security: JOLT-Atlas uses Dory polynomial commitments

Legacy UI (Tkinter)

The original Tkinter UI has been archived. To use it:

sudo apt install python3-tk
python3 archive/legacy-tkinter-ui/demo_ui.py
# Or: archive/legacy-tkinter-ui/run_demo_ui.sh

Note: The web UI (tools/robotics-ui/) is recommended for all new use.

License & Credits

JOLT Atlas: ICME-Lab/jolt-atlas
ROS 2: Apache 2.0
This demo: MIT

Name		Name	Last commit message	Last commit date
Latest commit History 21 Commits
archive		archive
docs		docs
scripts		scripts
src/zkml_guard		src/zkml_guard
tools		tools
.gitignore		.gitignore
README.md		README.md
Start-Camera.ps1		Start-Camera.ps1
http_camera_bridge.py		http_camera_bridge.py
linux_camera_publisher.py		linux_camera_publisher.py
restart-windows-camera.ps1		restart-windows-camera.ps1
simple_windows_camera.py		simple_windows_camera.py
start-camera-1.bat		start-camera-1.bat
start_demo.sh		start_demo.sh
start_linux_camera.sh		start_linux_camera.sh
stop_demo.sh		stop_demo.sh
test-camera.sh		test-camera.sh
test_all_cameras.py		test_all_cameras.py
windows-camera-setup.ps1		windows-camera-setup.ps1

hshadab/robotics

Folders and files

Latest commit

History

Repository files navigation