FairAI: A Blockchain- and IPFS-Enabled Framework for Verifiable Ethical Federated Learning with Proof-Based Approval-Gated Aggregation

Abstract

Federated learning (FL) enables collaborative model training without centralizing raw training records, but it does not inherently provide verifiable model provenance, enforceable fairness policies, or auditable control over aggregation. This paper presents FairAI, a blockchain- and IPFS-enabled framework that treats each local model as a governed artifact linked to performance and group-fairness metrics, content identifiers, manifests, Groth16 evidence, and smart-contract decisions. Only models approved on-chain and subsequently retrieved and validated through their registered CIDs are eligible for aggregation. The primary real-data evaluation used the Adult and COMPAS datasets under IID and joint label/protected-group non-IID partitions, with ten paired seeds comparing standard FedAvg, post hoc fairness assessment, a pre-aggregation fairness policy gate, and FairFed. Under heterogeneous Adult data, the policy gate reduced the demographic-parity gap from 0.0273 to 0.0127, while accuracy decreased from 0.7740 to 0.7629. Under heterogeneous COMPAS data, the equalized-odds gap decreased from 0.2262 to 0.1226, while accuracy decreased from 0.6495 to 0.5809; the paired accuracy and equalized odds differences remained significant after Holm correction, with adjusted p-values of 0.0318 and 0.0491, respectively. Additional bounded experiments evaluated a small multilayer perceptron, policy threshold sensitivity, logical-client scaling, poisoning, coordinate-wise median aggregation, two native Kubo/IPFS peers, V2 Groth16 verification, and smart-contract overhead. Thirty valid V2 proofs were accepted, six inconsistent cases were rejected, and direct Solidity verification consumed 348,811 gas per measured transaction. A full-path false-metric experiment showed that the proof verifies threshold compliance and artifact binding for supplied values, but does not establish their correct derivation from private data. When an approved artifact became unavailable, FairAI cancelled the round before aggregation and published no global model.

1. Introduction

Federated learning (FL) enables multiple data-holding parties to train a shared model without transferring their raw training records to a central repository. This property is valuable in cross-institutional and data-sensitive environments, including healthcare, finance, Internet of Things (IoT), Cyber-Physical Systems (CPS), and edge intelligence. Yet practical FL is not defined by data locality alone. Heterogeneous client data, communication and computation constraints, unreliable participation, aggregation failures, privacy risks, and limited inter-organizational trust continue to affect the reliability of federated systems [1]. These concerns are amplified when participants are administered by different organizations or cannot be assumed to be fully trustworthy. Decentralized FL reduces reliance on a single trusted coordinator, but it also requires explicit mechanisms for participant authorization, model provenance, coordination, and dependable aggregation [2]. Trustworthy-FL research therefore extends beyond decentralized optimization to encompass fairness, robustness, accountability, transparency, reputation, and verifiable aggregation [3].

Group fairness is particularly difficult to govern in FL because protected-group and label distributions can differ substantially among clients, while subgroup statistics remain locally held. Privacy constraints, fairness objectives, participation patterns, and predictive utility can interact in competing ways [4]; bias may also arise from demographic imbalance, local optimization, client selection, domain shift, and aggregation behavior [5]. Consequently, a global model may satisfy one fairness criterion while performing poorly under another, and a policy that improves a selected disparity may simultaneously alter utility or the representation of client data in the aggregated model. In FairAI, ethical eligibility is operationalized through versioned group-fairness and utility conditions evaluated before aggregation. Transparency and accountability are supported through attributable artifacts, decisions, and lifecycle records, allowing the policy outcome and its effect on model inclusion to be examined directly.

Blockchain and smart contracts provide a suitable governance substrate for recording participant registration, model submissions, verification outcomes, approval decisions, lifecycle transitions, and global-publication events in a tamper-evident form [6]. Smart contracts can further enforce roles, authorization rules, decision logic, and auditable state transitions [7]. However, model parameters, proof objects, metrics, public inputs, and manifests are too large and too frequently updated for efficient direct on-chain storage. Hybrid blockchain–IPFS architectures address this limitation by retaining artifacts in content-addressed storage while recording compact content identifiers and associated states on-chain [8]. This separation supports provenance and tamper evidence, but provenance alone does not determine whether a model satisfies the configured policy, whether its verification evidence is valid, whether the decision is authorized, or whether the approved artifact remains available when aggregation begins.

Zero-knowledge proofs (ZKPs) provide an additional verification layer by establishing a specified relation without disclosing the private witness used to construct the proof. In FL, ZKPs have been studied for privacy-aware verification [9], gradient-aggregation integrity [10], verifiable training and inference [11], and distributed learning in sensitive domains [12]. Robust-FL research addresses a different but related problem: limiting the effect of poisoned, Byzantine, or otherwise unreliable model contributions [13]. Proof-based trusted aggregation similarly seeks to strengthen confidence in distributed model inclusion and aggregation claims [14]. These research streams provide important building blocks, but their guarantees depend on where they intervene in the workflow. A proof verifies the relation encoded by its circuit; a fairness rule determines policy eligibility; a signature establishes decision authenticity; content addressing binds an artifact to its serialized content; and robust aggregation limits selected classes of harmful updates. None of these mechanisms, in isolation, governs the complete path from local model production to global-model inclusion.

Within this broader direction, the FairAI concept introduced DLT/IPFS-based ethical-AI training as a governance approach [15]. The central research gap is not the absence of fairness-aware learning, blockchain coordination, content-addressed storage, verifiable computation, or robust aggregation individually. It is the limited integration and empirical evaluation of these mechanisms as one model-artifact governance process with explicit policy, proof, authorization, availability, and aggregation states. In such a process, it must be possible to determine which model and supporting artifacts were submitted, which policy governed the decision, whether the proof and artifact bindings were accepted, who authorized the outcome, whether the approved model was retrieved successfully, and whether it ultimately influenced the global model.

FairAI addresses this gap by treating each local model as a governed artifact rather than as an automatically aggregable update. A logical client trains on its assigned partition, evaluates the model on a local policy-evaluation subset, computes utility and group-fairness metrics, and publishes the derived model, metrics, public proof inputs, proof object, metadata, and manifest through content-addressed storage. The governance layer records their content identifiers (CIDs), verification and policy states, approval decision, and lifecycle events. The verification pathway supports off-chain Groth16 verification followed by an EIP-712 signed decision, as well as direct Groth16 verification through Solidity. The master process constructs the aggregation set from on-chain approvals, retrieves each approved model through its registered CID, validates the returned content and manifest, and applies the configured aggregation operator only to the successfully retrieved approved set. A round proceeds to publication only when the governed sequence is completed; otherwise, it terminates without creating a new global model.

The evaluation is organized to distinguish the effect of fairness intervention from the behavior and cost of the complete governance workflow. Adult Census Income and COMPAS support paired comparisons of standard FedAvg, post hoc fairness assessment, pre-aggregation policy gating, and fairness-aware server weighting under IID and joint label/protected-group heterogeneous partitions. Logistic regression is the primary model, and a multilayer perceptron is used for model-family sensitivity. Additional experiments examine policy thresholds, representation and entropy diagnostics, logical-client scaling, coordinate-wise median aggregation, and poisoning behavior. Complete-path executions and component-level benchmarks evaluate Groth16 verification, signed and direct decision paths, native two-peer Kubo/IPFS operations, smart-contract gas, artifact recovery, protocol failures, and independently instrumented workflow stages.

The results show that pre-aggregation admission and fairness-aware weighting produce distinct, dataset- and metric-dependent fairness utility operating points under heterogeneous client data. The governed workflow links model artifacts, proof evidence, smart-contract decisions, approved-CID retrieval, and aggregation in an auditable sequence. The proof and failure experiments also clarify two important system properties: the current proof relation verifies policy satisfaction and artifact-context binding for the supplied values, and aggregation is cancelled when a required approved artifact cannot be retrieved or validated. Together, these findings establish FairAI as a framework for making model eligibility, provenance, authorization, availability, and inclusion explicit within federated learning.

Figure 1 presents the high-level FairAI architecture and governed artifact flow. The remainder of this article is organized as follows. Section 2 summarizes the principal contributions. Section 3 reviews the relevant literature. Section 4 presents the framework and mathematical formulation. Section 5 describes the methodology and experimental design. Section 6 reports the results. Section 7 discusses their implications and limitations. Section 8 concludes the article and outlines future work.

Figure 1. FairAI high-level governed artifact architecture and approval-gated aggregation flow.

2. Novel Contributions

The principal contributions of this work are as follows:

• A governed model-artifact lifecycle for approval-gated federated learning. FairAI connects local model generation, content-addressed publication, policy evaluation, proof verification, decision authorization, on-chain approval, CID-based retrieval, aggregation, and global publication within one auditable lifecycle. Model participation is therefore determined by explicit governance state rather than by availability or submission alone, and incomplete rounds terminate without producing a new global model.
• A formal separation of eligibility, verification, authorization, and availability.The framework distinguishes utility and fairness-policy satisfaction, artifact binding, Groth16 proof validity, signed or direct verification, on-chain approval, artifact retrieval, and aggregation inclusion as separate conditions. This decomposition makes the guarantee of each layer explicit and identifies where trust remains in supplied metric derivation, authorized verifiers, and off-chain artifact availability.
• An empirical characterization of pre-aggregation fairness governance. Paired experiments on Adult and COMPAS quantify how hard eligibility gating changes predictive utility, group-fairness outcomes, participation, and representation under IID and heterogeneous client distributions. Comparisons with post hoc assessment and fairness-aware server weighting distinguish pre-aggregation admission from alternative fairness intervention points, while policy, model-family, and client-scale analyses characterize the conditions under which their effects change.
• A layered evaluation of the complete FairAI workflow and its trust boundaries. The evaluation separates algorithmic behavior from complete-path and component-level evidence. It measures proof processing, two-peer content-addressed storage, smart-contract execution, approved-artifact retrieval, recovery, and robust aggregation, and it tests malformed evidence, replay and authorization failures, fabricated supplied metrics, signer compromise, poisoning, and approved-artifact unavailability. The accompanying evidence package links reported findings to versioned configurations, seeds, checksums, source commits, policy and proof artifacts, statistical outputs, and figure data.

3. Background and Related Works

The literature relevant to FairAI spans six closely related research streams: trustworthy and decentralized federated learning, fairness under heterogeneous client data, blockchain-based coordination, content-addressed model provenance, verifiable and zero-knowledge-proof-based FL, and adversarial robustness and privacy. Each stream addresses a different part of the federated-learning lifecycle. Trustworthy-FL research defines the broader system requirements; fairness-aware methods intervene in learning or aggregation; blockchain and decentralized storage support coordination and provenance; proof systems establish specific computational claims; and robustness and privacy mechanisms address malicious updates and information leakage. FairAI is positioned at the intersection of these streams as a governance framework for determining which model artifacts become eligible for aggregation and for preserving the evidence associated with that decision.

3.1. Trustworthy and Decentralized Federated Learning

Federated learning was initially formulated around server-coordinated collaborative optimization, but its practical deployment has increasingly been studied as a distributed systems and governance problem. Recent surveys identify non-IID data, communication cost, computation overhead, client availability, client selection, privacy exposure, and aggregation reliability as persistent challenges [1]. Decentralized FL reduces dependence on a single coordinating server, yet shifts attention toward communication topology, participant authentication, consensus, failure handling, and explicit trust assumptions [2]. Trustworthy-FL research further broadens the design objective to include fairness, robustness, accountability, transparency, reputation, and reliable aggregation [3].

These studies establish that trustworthiness cannot be reduced to raw-data locality or the correctness of the aggregation operator alone. A federated system must also account for who produced an update, which policy governed its acceptance, whether its supporting evidence is valid, and whether the accepted contribution is the one that ultimately enters the global model. This lifecycle-oriented view motivates governance mechanisms that make model provenance, decision state, and aggregation inclusion observable rather than implicit.

3.2. Fairness Under Heterogeneity and Fairness-Aware Aggregation

Fairness in FL is complicated by the interaction among client heterogeneity, protected-group representation, participation, and global aggregation. Privacy constraints may restrict access to subgroup statistics, while fairness objectives and predictive utility can conflict [4]. Bias can emerge from demographic imbalance, local optimization, unequal participation, client selection, domain shift, and differences between local and global data distributions [5]. Recent surveys of group fairness in FL therefore emphasize the difficulty of reconciling client-level and global fairness under non-IID data [16].

Existing approaches intervene at different stages of the learning process. FairFML demonstrates the importance of reducing group disparities in decentralized prediction within a sensitive application domain [17]. FairFed introduces a server-side aggregation rule that adjusts client weights according to differences between local and global fairness measurements [18]. Other methods connect fairness to incentives, consensus, personalization, or strategic client selection [19,20]. Together, these studies show that fairness-aware participation and aggregation can change both subgroup outcomes and predictive utility.

Post hoc assessment, fairness-aware reweighting, client selection, and pre-aggregation admission are nevertheless distinct intervention points. Post hoc assessment observes disparity after model construction; reweighting changes the relative influence of participating updates; client-selection methods determine participation according to optimization or strategic criteria; and an admission policy determines whether a contribution enters the candidate aggregation set. FairAI focuses on the last of these mechanisms. Its fairness policy is attached to the submitted-model artifact and recorded as part of the governance state, allowing the relationship among policy outcome, artifact identity, and aggregation inclusion to be audited.

3.3. Blockchain Governance and Content-Addressed Model Provenance

Blockchain-based FL has been investigated as a means of reducing dependence on a fully trusted coordinator and of maintaining tamper-evident records of participant registration, model submission, incentives, verification, and aggregation. Blockchain-enabled decentralized FL frameworks use the ledger for coordination and trust management, while facing practical constraints related to latency, throughput, scalability, and storage [6]. Surveys identify smart contracts, decentralized access control, incentives, reputation, and auditability as major design directions [7]. Related work on blockchained FL for IoT similarly highlights the value of distributed ledgers for coordination and accountability across resource-constrained participants [21].

Because model parameters, proof objects, metrics, and metadata are unsuitable for direct on-chain storage, several systems combine blockchain with decentralized or content-addressed storage. Li et al. use blockchain and IPFS in a tiered asynchronous FL storage architecture [8], while Ferretti et al. combine smart contracts with decentralized storage to support resilient coordination [22]. In these architectures, the ledger retains compact references and state transitions, whereas larger artifacts remain off-chain.

This hybrid pattern establishes a foundation for model provenance, but it also creates a separation between on-chain state and off-chain content. A complete governance workflow must therefore preserve the link between the recorded decision and the exact artifact retrieved for aggregation. FairAI extends the blockchain–IPFS pattern by associating each submission with a manifest of content identifiers, recording its verification and approval states, and requiring the approved-model artifact to be retrieved and validated before it can influence the global update.

3.4. Verifiable and Zero-Knowledge-Proof-Based Federated Learning

Verifiable FL seeks to establish confidence in claims about local training, model updates, prediction, or aggregation. Zero-knowledge proofs are particularly relevant because they can establish a specified relation without revealing the witness used to generate the proof. VPFL applies ZKPs to privacy-aware verifiability in FL [9]; zkFL focuses on the integrity of gradient aggregation [10]; and trusted model aggregation with ZKPs addresses the correctness of aggregation-related claims [14]. Broader verifiable-machine-learning research organizes proof systems across training, inference, and testing [11].

Recent studies extend this direction to verifiable training and prediction, lightweight verification, and encrypted aggregation. Duan et al. propose a verifiable and privacy-preserving FL training framework [23]; Yin et al. study verifiable federated training and prediction [24]; Lei et al. develop a lightweight privacy-preserving and verifiable FL scheme [25]; and Wang et al. combine verifiability with multi-key homomorphic encryption [26]. ZKP- and DLT-based healthcare research further demonstrates the relevance of proof-linked coordination in sensitive settings [12].

A central distinction across this literature is the object being verified. A proof may establish correct execution of a training step, integrity of an aggregation operation, validity of a prediction, or satisfaction of a policy relation. FairAI places the proof at the model-eligibility layer: supplied utility and group-fairness values are evaluated against a versioned policy and bound to the client, round, nonce, metrics artifact, and manifest. The framework then connects proof acceptance to governance authorization and aggregation eligibility. It supports both off-chain Groth16 verification followed by an EIP-712 signed decision and direct Solidity verification, enabling the verification backend to change without altering the surrounding approval semantics.

3.5. Byzantine Robustness and Privacy in Federated Systems

Federated systems remain vulnerable to poisoned, Byzantine, or otherwise unreliable contributions. Robust-FL surveys identify model poisoning, malicious updates, heterogeneous clients, authentication failures, and the possible rejection of honest participants as central concerns [13]. Proposed defenses include ensemble incentive mechanisms [27], adaptive authentication [28], and layerwise aggregation with distance-based filtering [29]. These methods act primarily on the submitted updates, the participant identities, or the aggregation operator.

Governance and robust aggregation address different stages of the lifecycle. A governance layer determines whether a submission is authorized, policy-compliant, correctly bound to its artifacts, and eligible for aggregation. A robust aggregation rule limits the influence of selected classes of harmful updates after the candidate set has been formed. FairAI composes these functions by allowing coordinate-wise median aggregation to operate over the approved set, while preserving the same provenance and decision records used by the FedAvg backend.

Privacy risks also remain after raw records are kept local. Model parameters, gradients, confidence values, public metrics, transaction metadata, and timing information can disclose information about participants or their data. Surveys of FL privacy attacks cover membership inference, model inversion, reconstruction, and the associated policy landscape [30]; broader privacy-preserving-FL research reviews cryptographic, statistical, and systems-level defenses [31]. These risks are further affected by data, model, device, and communication heterogeneity [32]. Privacy-preserving computation is therefore complementary to artifact governance: the former limits information disclosure, while the latter records provenance, authorization, and model-inclusion decisions.

3.6. Synthesis and Positioning of FairAI

The reviewed literature provides strong mechanisms for decentralized optimization, fairness-aware learning, blockchain coordination, off-chain artifact storage, verifiable computation, privacy protection, and Byzantine-resilient aggregation. A persistent gap lies in connecting these mechanisms across the complete path from local model production to global-model inclusion. In particular, existing streams do not generally treat artifact identity, fairness-policy outcome, proof validity, decision authorization, artifact availability, and aggregation inclusion as separate but linked governance states.

FairAI addresses this gap through four design principles. First, each model contribution is represented by a content-addressed artifact bundle and manifest rather than by an uncontextualized update. Second, policy satisfaction, proof verification, artifact binding, decision authorization, and on-chain approval are recorded as distinct states. Third, aggregation eligibility is determined from the approved set, while actual inclusion remains conditional on successful CID-based retrieval and artifact validation. Fourth, the framework permits fairness-aware and robust-aggregation mechanisms to be evaluated or composed without changing the provenance and audit structure.

FairAI is therefore positioned as a model-artifact governance framework that connects fairness-based eligibility, proof-linked evidence, blockchain authorization, content-addressed provenance, availability-aware retrieval, and selective aggregation. Its contribution is complementary to fairness-aware optimization, privacy-preserving computation, decentralized storage, ZKP protocol design, and robust aggregation: these mechanisms can be incorporated at their respective intervention points while the governance layer preserves the state and evidence needed to explain how each local model did or did not shape the global model.

4. Proposed FairAI Framework

FairAI represents each client-round contribution as a governed model artifact rather than as an automatically aggregable update. A contribution becomes eligible only after its submitted utility and group-fairness values satisfy a versioned policy, its artifacts and contextual bindings are verified, its proof and decision are accepted through the configured verification path, and its approval is recorded on-chain. Approval creates an aggregation candidate; actual inclusion additionally requires successful retrieval and validation of the approved model through its registered content identifier. The framework therefore separates model production, policy eligibility, proof validity, decision authorization, on-chain approval, artifact availability, aggregation inclusion, and global publication.

4.1. Architecture and Governed Artifact Lifecycle

FairAI comprises five interacting components. Logical clients train and evaluate local models and prepare the derived evidence needed by the governance workflow. Content-addressed storage retains the model, submitted metrics, metadata, proof-related objects, and manifests outside the blockchain. Verification services evaluate the supplied policy statement, artifact bindings, Groth16 evidence, and authenticated decision context. The smart-contract layer enforces participant and role authorization, submission uniqueness, verification and approval state, round lifecycle, and global-publication controls. Finally, the master process queries the on-chain approved set, retrieves and validates the corresponding model artifacts, applies the selected aggregation operator, and publishes the resulting global artifacts.

The ledger stores compact CIDs and governance states rather than the larger model and proof objects. This follows the established blockchain–IPFS pattern of combining on-chain coordination with content-addressed off-chain storage [8,22]. Figure 1 presents the complete architecture and the relationship among the five components.

4.2. Local Computation and Governed Artifacts

Let N denote the number of logical clients. Client $i\in \{1,\dots ,N\}$ holds a local partition $D_i$, divided into a training subset $D_{i,\mathrm{tr}}$ and a policy-evaluation subset $D_{i,\mathrm{ev}}$.

At communication round

t, the local partition satisfies:

$$D_i=D_{i,\mathrm{tr}}\dot{\cup }{D}_{i,\mathrm{ev}},D_{i,\mathrm{tr}}\cap D_{i,\mathrm{ev}}=⌀.$$

(1)

Client i receives the preceding global model parameters ${\theta }^{t-1}$ and performs local training:

$${\theta }_i^t=LocalTrain\left({\theta }^{t-1},D_{i,\mathrm{tr}},E\right).$$

(2)

The resulting local model is evaluated on the client-specific policy-evaluation subset:

$${\mathbf{m}}_i^t=Evaluate\left({\theta }_i^t,D_{i,\mathrm{ev}}\right).$$

(3)

Here E is the number of local epochs, $n_i=\left|D_{i,\mathrm{tr}}\right|$, and ${\mathbf{m}}_i^t$ is the vector of locally computed predictive and group-conditioned measurements. The subset submitted to the policy and proof workflow is denoted by:

$${\tilde{\mathbf{m}}}_i^t=\left({\widetilde{\mathrm{Acc}}}_i^t,{\widetilde{\mathrm{DPGap}}}_i^t,{\widetilde{\mathrm{EOGap}}}_i^t,{\widetilde{\mathrm{EOddsGap}}}_i^t,{\widetilde{\mathrm{SAGap}}}_i^t\right).$$

(4)

The tilde distinguishes the values serialized into the governance artifact from the measurements produced locally. Standard executions use ${\tilde{\mathbf{m}}}_i^t={\mathbf{m}}_i^t$ for the corresponding quantities. The fabricated-metric experiment deliberately violates this equality to evaluate the assurance boundary of the proof relation. Macro-F1 is retained as a reported evaluation metric but is not an input to the V2 eligibility circuit.

The base derived artifacts are the serialized model $M_i^t$, scaled metrics artifact $G_i^t$, and submission metadata ${Meta}_i^t$:

$$\left(M_i^t,G_i^t,{Meta}_i^t\right)=\left(EncodeModel\left({\theta }_i^t\right),EncodeMetrics\left({\tilde{\mathbf{m}}}_i^t\right),EncodeMetadata\left(i,t,{\nu }_t,n_i\right)\right).$$

(5)

Here, ${\nu }_t$ identifies the applicable policy version. Raw training and policy-evaluation records are not included in these artifacts. Model parameters and submitted metrics are, however, published derived information; this property establishes raw-record locality rather than formal privacy.

Figure 2 presents the client-side training, evaluation, and artifact-preparation flow.

Figure 2. Local model training, policy evaluation, and derived artifact-generation pipeline. Raw training records remain within the logical-client partition, while the governed workflow publishes derived model and verification artifacts.

4.3. Content Addressing, Bound Manifests, and Artifact Binding

Let $\mathsf{C}(·)$ denote the deterministic content-addressing operation applied to a canonical artifact byte string. For artifact $A_{i,k}^t$ of type k,

$${\mathrm{CID}}_{i,k}^t=\mathsf{C}\left(A_{i,k}^t\right).$$

(6)

Changing the serialized bytes changes the resulting CID and therefore exposes content modification. Content identity does not, by itself, establish semantic correctness or continued availability.

To avoid a circular dependency in which a proof would depend on a manifest that already contained the proof CID, FairAI first publishes a bound manifest containing only the context available before proof generation:

$${Man}_{i,\mathrm{bound}}^t=\left({\mathrm{CID}}_{i,\mathrm{model}}^t,{\mathrm{CID}}_{i,\mathrm{metrics}}^t,{\mathrm{CID}}_{i,\mathrm{metadata}}^t,i,t,{\nu }_t,{\rho }_i^t\right),$$

(7)

where ${\rho }_i^t$ is a submission nonce. Unlike a purely conceptual projection, the evaluated implementation serializes and publishes this bound manifest and assigns it its own CID.

Canonical SHA-256 digests are calculated for the metrics artifact and bound manifest. Let $q_{\mathrm{Fr}}$ be the BN254 scalar-field modulus. The full metrics-artifact digest is:

$$H_{i,\mathrm{metrics}}^t=SHA256\left(Canonicalize\left(G_i^t\right)\right).$$

(8)

Its field-reduced representation is:

$$h_{i,\mathrm{metrics}}^t=Int\left(H_{i,\mathrm{metrics}}^t\right)mod{q}_{\mathrm{Fr}}.$$

(9)

The full bound-manifest digest is:

$$H_{i,\mathrm{bound}}^t=SHA256\left(Canonicalize\left({Man}_{i,\mathrm{bound}}^t\right)\right).$$

(10)

Its field-reduced representation is:

$$h_{i,\mathrm{bound}}^t=Int\left(H_{i,\mathrm{bound}}^t\right)mod{q}_{\mathrm{Fr}}.$$

(11)

After the public-signal and proof-related artifacts are available, a final submission manifest links the base artifacts, bound-manifest CID, proof-related CIDs, client-round context, and local policy outcome. This final manifest is also content-addressed and registered with the ledger.

The application-level binding state $b_i^t$ is true only when the received artifact bytes resolve to their registered CIDs, the independently recomputed digests equal the supplied bindings, the scaled metrics agree with the public signals, and the node, round, policy, and nonce contexts are consistent:

$$b_i^t=\mathbf{1}\left[\begin{array}{c}\underset{k\in {\mathcal{K}}_i^t}{\bigwedge }\mathsf{C}\left(A_{i,k}^t\right)={\mathrm{CID}}_{i,k}^t\hfill \\ \wedge {\tilde{h}}_{i,\mathrm{metrics}}^t=h_{i,\mathrm{metrics}}^t\wedge {\tilde{h}}_{i,\mathrm{bound}}^t=h_{i,\mathrm{bound}}^t\hfill \\ \wedge Context\left({Man}_{i,\mathrm{bound}}^t\right)=\left(i,t,{\nu }_t,{\rho }_i^t\right)\hfill \end{array}\right].$$

(12)

A policy-ineligible submission does not obtain valid Groth16 evidence. For audit completeness, the evaluated implementation nevertheless retains public and proof-status artifacts indicating that proof generation was not performed and submits a zero-valued proof object through the common contract interface. Such an object cannot satisfy the Groth16 verifier.

4.4. Versioned Fairness Policy and V2 Groth16 Statement

Fairness is the ethical criterion directly operationalized by the evaluated eligibility policy. The submitted group-fairness vector is:

$${\tilde{\mathbf{F}}}_i^t=\left({\widetilde{\mathrm{DPGap}}}_i^t,{\widetilde{\mathrm{EOGap}}}_i^t,{\widetilde{\mathrm{EOddsGap}}}_i^t,{\widetilde{\mathrm{SAGap}}}_i^t\right).$$

(13)

Policy version ${\nu }_t$ specifies a minimum-accuracy threshold ${\tau }_{\mathrm{acc}}^t$, maximum fairness-gap thresholds ${\tau }_r^t$, and enabled-metric indicators $e_{t,r}\in \{0,1\}$. Let $d_{i,r}^t$ indicate whether metric r is defined for $D_{i,\mathrm{ev}}$. Under the evaluated reject-on-undefined behavior, preliminary policy eligibility is:

$$p_i^t=\mathbf{1}\left[{\widetilde{\mathrm{Acc}}}_i^t\ge {\tau }_{\mathrm{acc}}^t\wedge \underset{r}{\bigwedge }\left(e_{t,r}=0\vee \left[d_{i,r}^t=1\wedge {\tilde{\mathrm{F}}}_{i,r}^t\le {\tau }_r^t\right]\right)\right].$$

(14)

The V2 circuit operates on fixed-point integers. In the evaluated complete-path implementation,

$$\widehat{z}=round\left(Qz\right),Q={10}^6.$$

(15)

The public-signal vector contains the field-reduced bound-manifest and metrics digests, five scaled submitted measurements, five scaled policy thresholds, five enable indicators, and the submission context:

$${\mathbf{U}}_i^t=\left(\begin{array}{c}{h}_{i,\mathrm{bound}}^t,h_{i,\mathrm{metrics}}^t,{\widehat{\widetilde{\mathrm{Acc}}}}_i^t,{\widehat{\tilde{\mathbf{F}}}}_i^t,{\widehat{\tau }}_{\mathrm{acc}}^t,{\widehat{\mathit{\tau }}}_t,\hfill \\ {\mathbf{e}}_t,i,t,{\nu }_t,{\rho }_i^t\hfill \end{array}\right).$$

(16)

The circuit range-constrains the metric and threshold integers, constrains the identity fields, and enforces the enabled minimum-accuracy and maximum-gap comparisons. The digest signals are public contextual bindings: SHA-256 is not recomputed inside the circuit. Instead, the application and composite verifier compare the field-reduced public signals with independently computed artifact digests.

Let $w_i^t$ denote the witness and internal auxiliary values required by the V2 circuit. For a policy-eligible submission, proof generation is represented by:

$${\pi }_i^t\leftarrow Prove\left(pk,{\mathbf{U}}_i^t,w_i^t\right).$$

(17)

Off-chain verification is represented by:

$$z_{i,\mathrm{off}}^t=Verify\left(vk,{\mathbf{U}}_i^t,{\pi }_i^t\right).$$

(18)

Direct Solidity verification is represented by:

$$z_{i,\mathrm{dir}}^t=VerifySolidity\left({\mathbf{U}}_i^t,{\pi }_i^t\right).$$

(19)

The proof establishes satisfaction of the encoded, quantized threshold relation and consistency of the public submission context [9,10,14,23]. It does not prove that the submitted metrics were calculated from $D_{i,\mathrm{ev}}$, that they were produced by evaluating the registered model artifact, that the local training or evaluation procedure was executed honestly, or that the model is benign. The submitted metrics and thresholds are public signals; the evaluated circuit therefore does not conceal these quantities or provide a general privacy guarantee for them.

4.5. Composite Verification and Smart-Contract Approval

FairAI distinguishes three verification components: the generated Groth16 Solidity verifier, the EIP-712 signed-decision verifier, and a composite verifier that requires both results to agree. The reported complete-path configurations use the composite path. Standalone direct Groth16 verification and signed-verifier behavior are additionally evaluated through their respective benchmarks and security tests.

After off-chain proof and artifact checks, the authorized verifier prepares an EIP-712 decision containing:

$${\mathcal{D}}_i^t=\left(i,t,{\nu }_t,H_{i,\mathrm{bound}}^t,H_{i,\mathrm{metrics}}^t,{\rho }_i^t,z_{i,\mathrm{off}}^t,p_i^t,{\delta }_i^t,{exp}_i^t\right).$$

(20)

Here ${\delta }_i^t\in \{\mathtt{Approved},\mathtt{Rejected}\}$. The EIP-712 domain separately binds the decision to the chain identifier and signed-verifier contract address. The verifier produces:

$${\sigma }_i^t\leftarrow {Sign}_{s{k}_V}\left({\mathcal{D}}_i^t\right).$$

(21)

The signed-verifier contract checks the signature, signer authorization, revocation state, expiration, decision-digest reuse, nonce reuse, and domain context. The composite verifier then verifies the Groth16 proof directly in Solidity and checks that the proof’s public node, round, policy, nonce, and field-reduced digest signals agree with the signed decision.

Composite acceptance is summarized as:

$${\eta }_i^t=\mathbf{1}\left[\begin{array}{c}{z}_{i,\mathrm{dir}}^t=1\wedge VerifySig\left({\mathcal{D}}_i^t,{\sigma }_i^t\right)=1\hfill \\ \wedge ContextMatch\left({\mathbf{U}}_i^t,{\mathcal{D}}_i^t\right)=1\hfill \\ \wedge DigestMatch\left({\mathbf{U}}_i^t,{\mathcal{D}}_i^t\right)=1\wedge {\delta }_i^t=\mathtt{Approved}\hfill \end{array}\right].$$

(22)

Let $u_i^t$ denote valid participant and transaction-role authorization for an open round, and let $r_i^t$ denote successful unique registration of the client-round submission and its artifact CIDs. The framework-level approval predicate is:

$$a_i^t=\mathbf{1}\left[u_i^t=1\wedge r_i^t=1\wedge b_i^t=1\wedge p_i^t=1\wedge {\eta }_i^t=1\right].$$

(23)

The corresponding approved set is:

$${\mathcal{A}}_t=\left\{i\in \{1,\dots ,N\}:a_i^t=1\right\}.$$

(24)

The Solidity ledger materializes the result as verification and approval states and records the node, round, artifact CIDs, submitter, timestamp, and lifecycle events. The policy version and detailed proof context remain available through the public, decision, bound-manifest, and submission artifacts rather than requiring all such fields to be duplicated in contract storage.

Figure 3 presents the contract decision flow.

Figure 3. Smart-contract decision flow separating submission registration, artifact binding, policy status, proof verification, signed or direct verification, and approval state.

4.6. Approved-CID Retrieval, Aggregation, and Publication

On-chain approval establishes eligibility but does not guarantee artifact availability at aggregation time. For each $i\in {\mathcal{A}}_t$, the master retrieves the model through its registered CID:

$${\tilde{M}}_i^t=Retrieve\left({\mathrm{CID}}_{i,\mathrm{model}}^t\right).$$

(25)

The retrieval state is valid only when the artifact is available, its content produces the registered CID, and it decodes into a finite parameter structure consistent with the registered node, round, and expected model shape:

$$q_i^t=\mathbf{1}\left[{\tilde{M}}_i^t\ne \perp \wedge \mathsf{C}\left({\tilde{M}}_i^t\right)={\mathrm{CID}}_{i,\mathrm{model}}^t\wedge DecodeValid\left({\tilde{M}}_i^t,i,t\right)=1\right].$$

(26)

The decoded parameters are denoted by:

$${\overline{\theta }}_i^t=DecodeModel\left({\tilde{M}}_i^t\right).$$

(27)

A round is ready for aggregation only when at least one model is approved and every approved artifact passes retrieval and validation:

$${\gamma }_t=\mathbf{1}\left[|{\mathcal{A}}_t|>0\wedge \underset{i\in {\mathcal{A}}_t}{\bigwedge }{q}_i^t=1\right].$$

(28)

When ${\gamma }_t=1$, FairAI applies the configured operator to the retrieved approved set. The approved-set FedAvg backend is:

$${Agg}_{\mathrm{FedAvg}}\left({\mathcal{A}}_t\right)=\sum _{i\in {\mathcal{A}}_t}{\displaystyle \frac{n_i}{{\sum }_{j\in {\mathcal{A}}_t}{n}_j}}{\overline{\theta }}_i^t.$$

(29)

The coordinate-wise median backend is:

$${\left[{Agg}_{\mathrm{Med}}\left({\mathcal{A}}_t\right)\right]}_k=median\left\{{\left[{\overline{\theta }}_i^t\right]}_k:i\in {\mathcal{A}}_t\right\},k=1,\dots ,d.$$

(30)

Coordinate-wise median is a complementary robust-aggregation option over the same governed population [13,27,28,29]; it does not replace the policy, proof, authorization, or artifact checks. The resulting global state is:

$${\theta }^t=\left\{\begin{array}{cc}{Agg}_t\left({\mathcal{A}}_t\right),\hfill & {\gamma }_t=1,\hfill \\ \perp ,\hfill & {\gamma }_t=0,\hfill \end{array}\right.$$

(31)

where ${\theta }^t=\perp$ means that no new global model is created. Thus, an empty approved set or one unavailable or invalid approved artifact causes fail-closed cancellation before aggregation.

Figure 4 presents approved-artifact retrieval, validation, aggregation, and publication.

Figure 4. Approved-artifact retrieval, validation, aggregation, and global-publication pipeline.

Figure 5 summarizes the complete governed workflow.

Figure 5. End-to-end FairAI governed artifact workflow.

For a successful round, the global model is content-addressed as:

$${\mathrm{CID}}_{\mathrm{global}}^t=\mathsf{C}\left(Encode\left({\theta }^t\right)\right).$$

(32)

The evaluation-provenance summary is content-addressed as:

$${\mathrm{CID}}_{\mathrm{summary}}^t=\mathsf{C}\left(Encode\left(S^t\right)\right).$$

(33)

Here, $S^t$ records the round configuration, approved participants, aggregation backend, evaluation results, and provenance references. The ledger permits global publication only for model CIDs recorded as approved for that round.

The successful lifecycle is:

$$\mathtt{Open}\to \mathtt{SubmissionClosed}\to \mathtt{AggregationStarted}\to \mathtt{Published}\to \mathtt{Archived}.$$

(34)

The fail-closed lifecycle is:

$$\mathtt{Open}\to \mathtt{SubmissionClosed}\to \mathtt{Cancelled}.$$

(35)

These states preserve the distinction between a model being submitted, verified, approved, retrieved, aggregated, and represented in a published global model.

4.7. Assurance Scope and Framework Summary

FairAI directly operationalizes fairness through versioned utility and group-gap conditions. Transparency, accountability, responsibility, and integrity are supported as governance properties through content identifiers, attributable submissions and decisions, role-controlled operations, cryptographic bindings, and lifecycle events. The framework does not computationally guarantee every broader ethical principle, and policy satisfaction should not be interpreted as general ethical or regulatory compliance.

The guarantees are deliberately bounded. Raw training records remain within their logical-client partitions, but the published model parameters, metrics, public signals, CIDs, decisions, and timing information may reveal information and are not protected by a formal privacy mechanism. Groth16 establishes the encoded relation for supplied values but not their correct derivation from private data. EIP-712 establishes the authenticity and integrity of the signed payload but does not, by itself, establish the honesty of an authorized signer; in the complete composite path, the signer cannot bypass the required Groth16 proof but may still authorize a self-consistent claim within the proof’s limited semantics. Fairness-policy approval is not a general poisoning detector, and coordinate-wise median provides attack-specific rather than universal Byzantine protection. Finally, a valid CID establishes content identity rather than availability, which is why approved-artifact retrieval remains an explicit fail-closed condition.

Entropy and representation measures are therefore treated as diagnostic variables in the experimental methodology rather than additional approval predicates. FairAI’s defining contribution is the governed linkage among policy claims, content-addressed artifacts, proof evidence, authenticated decisions, on-chain approval, retrieval outcomes, aggregation inclusion, and global publication. A local contribution influences the global model only when this complete sequence reaches a successful terminal state.

5. Methodology and Experimental Design

The evaluation was organized into three coordinated evidence layers. The first isolated the learning and aggregation behavior of the compared methods on Adult and COMPAS. The second exercised the complete FairAI workflow, including native Kubo/IPFS publication and retrieval, Groth16 processing, EIP-712 decisions, smart-contract approval, approved-CID retrieval, and aggregation. The third measured individual components and evaluated protocol, adversarial, trust-boundary, and failure scenarios. This separation allowed the effects of fairness admission and aggregation to be studied independently from the cost and behavior of the governance infrastructure.

All experiments used logical clients executed on one physical host. Dataset acquisition, integrity checking, preprocessing, and client-partition construction were performed by the experiment runner. After partitioning, each logical client trained and evaluated only on its assigned local arrays. The logical clients therefore represented disjoint experimental data silos rather than independently administered organizations or physically separated devices. Figure 6 illustrates the evaluated architecture; the client count and enabled components varied by suite.

Figure 6. Experimental architecture used for the FairAI evaluation. The client count and enabled verification, storage, contract, and aggregation components varied according to the experimental suite.

5.1. Research Questions

The experimental design addressed the following research questions:

RQ1: 

How does pre-aggregation fairness-policy eligibility affect client participation, predictive utility, and group-fairness outcomes?

RQ2: 

How do the observed effects vary with client heterogeneity, policy thresholds, fairness intervention, model family, and logical-client count?

RQ3: 

Can FairAI maintain a traceable relationship among submitted artifacts, verification evidence, on-chain approval, CID-based retrieval, aggregation inclusion, and global publication?

RQ4: 

What computational, storage, proof, and smart-contract overhead is associated with the evaluated governance workflow?

RQ5: 

How do the verification, authorization, retrieval, and aggregation mechanisms behave under malformed evidence, poisoning, signer compromise, fabricated submitted metrics, and artifact unavailability?

5.2. Execution Environment

The archived strict-run manifests recorded a macOS ARM64 environment with 12 logical CPUs. The software stack used Python 3.13.5, Node.js 24.4.1, Hardhat 2.28.6, Solidity 0.8.20, snarkjs 0.7.5, and Kubo/IPFS 0.29.0. The versioned V2 circuit-artifact manifest identifies Circom 2.1.6; because the archived evidence does not contain a contemporaneous compiler transcript for every historical circuit-generation step, this value is reported as artifact metadata. Version-pinned Python dependencies included NumPy, pandas, SciPy, scikit-learn, and joblib.

Table 1 summarizes the recorded execution environment for the strict experimental suites.

Table 1. Recorded execution environment for the strict experimental suites.

Item	Recorded Value
Operating-system architecture	macOS ARM64
Logical CPUs	12
Python	3.13.5
Node.js	24.4.1
Hardhat	2.28.6
Solidity compiler	0.8.20
snarkjs	0.7.5
Kubo/IPFS	0.29.0
V2 circuit-artifact metadata	Circom 2.1.6
Hardhat chain identifier	31337

The archived run metadata did not record the exact host model, installed memory, or storage device specification for every run. These values were not reconstructed retrospectively. Each run retained the environment information available at execution time together with its source commit, configuration hash, dataset checksum, partition checksum, seed, timestamps, completion state, and, where applicable, circuit and proving-material hashes.

5.3. Datasets, Outcomes, and Preprocessing

Two public binary-classification datasets were used. Table 2 summarizes the target, favorable outcome, and protected-group definition used in the reported fairness analyses.

Table 2. Datasets and group-fairness evaluation definitions.

Dataset	Prediction Target	Favorable Outcome	Protected Attribute	Evaluated Groups
Adult	Income category	Income above USD 50,000	Sex	Male (privileged); Female (unprivileged)
COMPAS	Two-year recidivism outcome	No recidivism within two years	Race	Caucasian (privileged); African-American (unprivileged)

Dataset downloads were checked against fixed SHA-256 values. For Adult, rows containing the missing-value marker “?” were removed before restoring the official training and test partitions. The official test set was retained. From the official training data, $15\%$ was reserved as a global validation subset using joint label/sex stratification, and the remaining pool was used for federated client partitioning. Sex and race were excluded from the predictive feature matrix; sex was retained as the protected attribute for the reported Adult fairness analysis.

For COMPAS, the pinned source was restricted to records satisfying:

$$-30\le \mathtt{days}\_\mathtt{b}\_\mathtt{screening}\_\mathtt{arrest}\le 30,\mathtt{is}\_\mathtt{recid}\ne -1.$$

(36)

The additional filtering conditions were:

$$\mathtt{c}\_\mathtt{charge}\_\mathtt{degree}\ne \mathtt{O},\mathtt{score}\_\mathtt{text}\ne \mathtt{N}/\mathtt{A}.$$

(37)

Race was restricted to African-American and Caucasian. Records missing required variables were removed. The predictive features were age, age category, juvenile felony count, juvenile misdemeanor count, juvenile other count, prior-offense count, and charge degree. Race was retained only for stratification and fairness evaluation. The filtered data were divided into $70\%$ training, $15\%$ validation, and $15\%$ test subsets using joint label/race stratification.

The global validation subsets were used for round-level global-model evaluation. The held-out test subsets were evaluated only after the final communication round and were not used for client admission, policy selection, hyperparameter selection, or early stopping.

A single preprocessing transformer was fitted on the complete federated training pool before client-specific arrays were selected. Numerical variables were standardized and categorical variables were one-hot encoded. The fitted transformer was then applied unchanged to the client observations, global validation subset, and held-out test subset. This procedure avoided validation and test leakage, but it represented centrally prepared feature encoding rather than independently fitted client-side preprocessing.

5.4. Logical-Client Partitioning and Local Data Use

Three client-distribution conditions were evaluated:

• IID partitioning, in which a seed-controlled random permutation of the federated training pool was divided into near-equal client partitions without deliberately introducing label- or protected-group-based skew.
• Joint label/group Dirichlet partitioning with $\alpha =1.0$, used in the heterogeneity and representation suite as an intermediate non-IID condition.
• Joint label/group Dirichlet partitioning with $\alpha =0.3$, used as the principal heterogeneous condition. Allocation was performed independently within joint label/protected-group strata so that label and group composition could vary simultaneously across clients.

The primary Adult and COMPAS comparisons used IID and Dirichlet $\alpha =0.3$; the $\alpha =1.0$ condition was used only in the dedicated heterogeneity analysis. Every logical client was required to receive at least 50 observations. Dirichlet construction was retried deterministically, for at most the configured 1000 attempts, until this total client-size condition was satisfied; failure to construct a valid partition terminated the experiment.

Each client partition was divided into local training and policy-evaluation subsets:

$$D_i=D_{i,\mathrm{tr}}\dot{\cup }{D}_{i,\mathrm{ev}},|D_{i,\mathrm{tr}}|\approx 0.8|D_i|,|D_{i,\mathrm{ev}}|\approx 0.2|D_i|.$$

(38)

Joint label/protected-group stratification was applied to this local split where feasible. $D_{i,\mathrm{tr}}$ was used for optimization and $D_{i,\mathrm{ev}}$ for local utility and fairness evaluation. The minimum-group requirement was applied at evaluation time rather than during partition construction: a group-conditioned fairness quantity required at least 10 observations from each required protected group in $D_{i,\mathrm{ev}}$. When this condition was not met, the corresponding metric was recorded as undefined. The evaluated policy profiles used rejection as the undefined-metric behavior, so an undefined enabled metric caused the policy condition to fail.

5.5. Entropy and Representation Diagnostics

Client composition was characterized using normalized label entropy and normalized protected-group entropy. For client i, normalized label entropy was:

$$H_i^{\mathrm{label}}=-{\displaystyle \frac{1}{logC}}{\displaystyle \sum _{c=1}^C}{p}_{i,c}log{p}_{i,c}.$$

(39)

Normalized protected-group entropy was:

$$H_i^{\mathrm{group}}=-{\displaystyle \frac{1}{logG}}{\displaystyle \sum _{g=1}^G}{p}_{i,g}log{p}_{i,g}.$$

(40)

Here, $p_{i,c}$ and $p_{i,g}$ are the client-level label and protected-group proportions, C and G are the corresponding category counts, and $0log0$ is defined as zero.

The local minority share was defined as the proportion belonging to the less frequent of the two evaluated protected groups:

$$R_i^{\mathrm{minor}}={\displaystyle \frac{{min}_{g\in \{p,u\}}{n}_{i,g}}{{\sum }_{g\in \{p,u\}}{n}_{i,g}}}.$$

(41)

Within each seed, client count, and partition condition, clients with $R_i^{\mathrm{minor}}$ greater than or equal to the corresponding median were classified as the higher local minority-share group; the remaining clients formed the lower local minority-share group. This classification described local group balance and did not assume that the locally less frequent group was always the globally designated unprivileged group.

For an admission set ${\mathcal{I}}_t$, the contribution of client i to the excluded-sample fraction was:

$$E_i^t={\displaystyle \frac{|D_i|}{{\sum }_{j=1}^N\left|D_j\right|}}\mathbf{1}\left[i\notin {\mathcal{I}}_t\right].$$

(42)

Group-level excluded fractions were summed within each seed and partition and then averaged across seeds. Entropy, local minority share, approval, and excluded-sample outcomes were used as descriptive diagnostics and were not included in any eligibility rule.

5.6. Models and Local Optimization

Two model families were evaluated.

5.6.1. Federated Logistic Regression

The principal model was binary-logistic regression with a sigmoid output and prediction threshold $0.5$. Coefficients and intercept were initialized to zero. Each local epoch used one full-batch binary-logistic gradient update with learning rate $0.05$. L2 regularization with coefficient ${10}^{-4}$ was applied to the coefficient vector but not to the intercept. Logits were clipped to $[-30,30]$ before sigmoid evaluation. Each client completed three local passes per communication round. The principal comparisons used five communication rounds, while the logical-client scaling suite used three.

At the start of a standard round, every participating client received the same current global parameters ${\theta }^{t-1}$, optimized on $D_{i,\mathrm{tr}}$, and evaluated the resulting local parameters ${\theta }_i^t$ on $D_{i,\mathrm{ev}}$.

5.6.2. Multilayer Perceptron

The model-family sensitivity suite used an MLP with one 16-unit ReLU hidden layer and one sigmoid output. Weight matrices used seed-controlled He-style Gaussian initialization, biases were initialized to zero, and predictions used threshold $0.5$. L2 regularization with coefficient ${10}^{-4}$ was applied to the weight matrices but not to the biases. The learning rate was $0.01$, and each client completed three full-batch local epochs per round. The suite used 10 logical clients, five communication rounds, and five paired seeds.

5.7. Predictive and Group-Fairness Metrics

Predictive utility was measured using accuracy and macro-F1. Group fairness was evaluated using demographic-parity gap, equal-opportunity gap, equalized-odds gap, and subgroup-accuracy gap.

Let $A\in \{p,u\}$ denote protected-group membership, where p is the privileged group and u the unprivileged group. Let $\widehat{Y}=1$ denote the favorable prediction. Demographic-parity gap was:

$$DPGap=\left|Pr(\widehat{Y}=1\mid A=u)-Pr(\widehat{Y}=1\mid A=p)\right|.$$

(43)

Equal-opportunity gap was:

$$EOGap=\left|{TPR}_u-{TPR}_p\right|.$$

(44)

Equalized-odds gap was:

$$EOddsGap=max\left\{\left|{TPR}_u-{TPR}_p\right|,\left|{FPR}_u-{FPR}_p\right|\right\}.$$

(45)

Subgroup-accuracy gap was:

$$SAGap=\underset{g\in \{p,u\}}{max}{Acc}_g-\underset{g\in \{p,u\}}{min}{Acc}_g.$$

(46)

All four quantities are absolute gaps; lower values indicate smaller measured disparity for the corresponding criterion. They were interpreted jointly with accuracy, macro-F1, prediction behavior, and participation. In particular, a zero gap was not treated automatically as favorable when predictive performance collapsed or predictions became nearly constant.

5.8. Fairness-Policy Profiles and Participation Measures

The principal submitted policy required:

$${Accuracy}_i^t\ge 0.62,{DPGap}_i^t\le 0.28.$$

(47)

Table 3 summarizes the principal policy and the three additional profiles evaluated for threshold sensitivity.

Table 3. Policy profiles used in threshold-sensitivity analysis.

Profile	Minimum Accuracy	Enabled Fairness Limits
Lenient	0.55	$DPGap\le 0.35$
Submitted	0.62	$DPGap\le 0.28$
Moderate	0.62	$DPGap\le 0.20$ and $EOGap\le 0.20$
Strict	0.70	$DPGap\le 0.10$, $EOGap\le 0.10$, $EOddsGap\le 0.10$, and $SAGap\le 0.10$

All enabled conditions used logical AND semantics. An undefined enabled metric caused rejection. The four archived settings were identified by their profile names, threshold vectors, enabled-metric masks, and configuration hashes; the archived profile collection used the common policy-version tag 1.0.0.

The non-cryptographic B3 path first evaluated the submitted floating-point metrics against the floating-point thresholds. The proof-enabled paths used the same preliminary floating-point decision to determine whether proof generation was attempted. Only a proof-eligible submission was subsequently converted to the fixed-point representation described in Section 5.12.

Let ${\mathcal{I}}_t$ denote the method-specific admitted population in round t: for B3, it is the non-cryptographically admitted set; for B4 and B7, it is the on-chain approved set ${\mathcal{A}}_t$. The round-level approval rate was:

$$R_{\mathrm{approval}}^t={\displaystyle \frac{|{\mathcal{I}}_t|}{N}}.$$

(48)

The approved-sample rate was:

$$R_{\mathrm{sample}}^t={\displaystyle \frac{{\sum }_{i\in {\mathcal{I}}_t}\left|D_i\right|}{{\sum }_{j=1}^N\left|D_j\right|}}.$$

(49)

For the policy-sensitivity suite, all-round approval was summarized descriptively across the 50 seed–round values generated by 10 seeds and five rounds. Final-round approval used the 10 final-round values only. These observational counts were not substituted for the seed-level unit used in paired model inference.

5.9. Compared Methods and Ablation Structure

Eight method and infrastructure configurations were defined to separate post hoc fairness reporting, hard pre-aggregation admission, fairness-aware server weighting, infrastructure traceability, proof-linked governance, and robust aggregation. Table 4 summarizes the admission rule, aggregation operator, enabled components, and experimental role of each configuration.

Table 4. Compared federated-learning methods and infrastructure configurations.

ID	Admission or Eligibility	Aggregation	Enabled Components and Role
B0	No fairness-based admission	Sample-weighted FedAvg	Algorithmic reference without Kubo/IPFS, blockchain, policy admission, or proof processing.
B1	No fairness-based admission	Sample-weighted FedAvg	Same local training and aggregation as B0; fairness is evaluated only after aggregation.
B2	No fairness-based admission	Sample-weighted FedAvg	Native Kubo/IPFS and blockchain traceability without the fairness-policy gate or Groth16 eligibility evidence.
B3	Submitted metrics satisfy the configured public-metric policy	FedAvg over the admitted set	Non-cryptographic pre-aggregation admission without Kubo/IPFS, Groth16, EIP-712, or contract execution.
B4	Complete signed FairAI approval	FedAvg over the approved set	Native Kubo/IPFS, off-chain V2 Groth16 verification, EIP-712 decision, smart-contract approval, and approved-CID retrieval.
B5	No hard fairness-based admission	FairFed server weighting	Stateful fairness-aware server weighting using signed equal-opportunity difference and $\beta =1$ [18].
B6	No fairness-based admission	Coordinate-wise median	Robust-aggregation comparator without the FairAI policy, proof, storage, or contract path.
B7	Complete signed FairAI approval	Coordinate-wise median over the approved set	The B4 governance path followed by coordinate-wise median rather than FedAvg.

B1 is model-equivalent to B0 under paired execution because its fairness assessment is observational and occurs after the same sample-weighted FedAvg operation. The term admitted set is used for the non-cryptographic B3 condition, whereas approved set denotes the submissions recorded as approved through the FairAI contract path in B4 and B7. The B3, B4, and B7 configurations used the same metric definitions, undefined-metric behavior, and configured policy thresholds.

The principal controlled comparisons were B0 versus B3 for the effect of hard policy admission, B0 versus B5 for fairness-aware reweighting, B0 versus B6 for coordinate-wise median, B2 versus B4 for the added policy/proof/decision path within the strict infrastructure, and B4 versus B7 for the aggregation operator after holding the complete FairAI approval and retrieval process constant. Paired methods reused the same seed-specific dataset split, client partition, initialization, local epochs, communication rounds, optimizer settings, and, where applicable, malicious-client assignment.

FairFed Server-Weighting Configuration

The B5 comparator implemented the stateful FairFed server-weighting recurrence with signed equal-opportunity difference and $\beta =1$ [18]. Local optimization was identical to the paired B0 execution, and no additional local-debiasing transformation was applied.

At the beginning of round t, before client-local updates, the current global model ${\theta }^{t-1}$ was evaluated separately on every $D_{i,\mathrm{ev}}$. These client-conditioned evaluations generated the sufficient statistics used by FairFed and were distinct from the post-local-training metrics used by the B3/B4/B7 admission policies.

Let ${\mathrm{TP}}_{i,g}^t$ and ${\mathrm{P}}_{i,g}^t$ denote the true-positive and positive-label counts obtained by evaluating ${\theta }^{t-1}$ on client i’s evaluation subset for group $g\in \{u,p\}$. When both denominators were nonzero, the signed client-level equal-opportunity difference was:

$${\varphi }_{i,\mathrm{FF}}^t={\displaystyle \frac{{\mathrm{TP}}_{i,u}^t}{{\mathrm{P}}_{i,u}^t}}-{\displaystyle \frac{{\mathrm{TP}}_{i,p}^t}{{\mathrm{P}}_{i,p}^t}}.$$

(50)

The pooled signed difference was computed from aggregated sufficient counts:

$${\varphi }_{\mathrm{FF},\mathrm{global}}^t={\displaystyle \frac{{\sum }_i{\mathrm{TP}}_{i,u}^t}{{\sum }_i{\mathrm{P}}_{i,u}^t}}-{\displaystyle \frac{{\sum }_i{\mathrm{TP}}_{i,p}^t}{{\sum }_i{\mathrm{P}}_{i,p}^t}}.$$

(51)

Let $v_i=\left|D_{i,\mathrm{ev}}\right|$, and let ${\mathrm{Acc}}_{i,\mathrm{FF}}^t$ be the accuracy of ${\theta }^{t-1}$ on $D_{i,\mathrm{ev}}$. The evaluation-size-weighted accuracy was:

$${\mathrm{Acc}}_{\mathrm{FF},\mathrm{global}}^t={\displaystyle \frac{{\sum }_i{v}_i{\mathrm{Acc}}_{i,\mathrm{FF}}^t}{{\sum }_i{v}_i}}.$$

(52)

The discrepancy was:

$${\Delta }_{i,\mathrm{FF}}^t=\left\{\begin{array}{cc}\left|{\varphi }_{\mathrm{FF},\mathrm{global}}^t-{\varphi }_{i,\mathrm{FF}}^t\right|,\hfill & {\varphi }_{i,\mathrm{FF}}^t\mathrm{defined},\hfill \\ \left|{\mathrm{Acc}}_{i,\mathrm{FF}}^t-{\mathrm{Acc}}_{\mathrm{FF},\mathrm{global}}^t\right|,\hfill & {\varphi }_{i,\mathrm{FF}}^t\mathrm{undefined}.\hfill \end{array}\right.$$

(53)

The state was initialized from the FedAvg training-sample fractions, ${\overline{\omega }}_i^0=n_i/{\sum }_j{n}_j$, where $n_i=\left|D_{i,\mathrm{tr}}\right|$. At round t, the raw state was updated as:

$${\overline{\omega }}_i^t={\overline{\omega }}_i^{t-1}-\beta \left({\Delta }_{i,\mathrm{FF}}^t-{\displaystyle \frac{1}{N}}\sum _j{\Delta }_{j,\mathrm{FF}}^t\right).$$

(54)

The normalized aggregation weight was:

$${\omega }_i^t={\displaystyle \frac{{\overline{\omega }}_i^t}{{\sum }_j{\overline{\omega }}_j^t}}.$$

(55)

The global-model update was:

$${\theta }^t=\sum _i{\omega }_i^t{\theta }_i^t,\beta =1.$$

(56)

The implementation required finite normalized weights whose sum was one; it did not apply non-negativity clipping or projection onto the probability simplex. The centralized experiment runner computed the pooled sufficient statistics directly. Consequently, B5 evaluates the FairFed server-side weighting algorithm under the common paired protocol, not FairFed’s secure-aggregation communication design or any local-debiasing variant from the original study.

5.10. Experimental Suites

The evaluation combined paired algorithmic comparisons, sensitivity analyses, complete-path executions, component benchmarks, and deterministic functional tests. Unless stated otherwise, the algorithmic suites used logistic regression with the settings in Section 5.6 and joint label/protected-group Dirichlet partitioning with $\alpha =0.3$ for the heterogeneous condition.

Table 5 summarizes the paired algorithmic comparison and sensitivity suites.

Table 5. Algorithmic comparison and sensitivity suites.

Suite	Dataset	Clients	Seeds	Rounds	Methods and Conditions
Core policy-gate comparison	Adult, COMPAS	10	10 paired	5	B0, B1, B3; IID and Dirichlet $\alpha =0.3$.
FairFed comparison	Adult, COMPAS	10	10 paired	5	B0, B5; IID and Dirichlet $\alpha =0.3$.
Policy sensitivity	Adult	10	10	5	B3; four policy profiles; Dirichlet $\alpha =0.3$.
Heterogeneity and representation	Adult	10	10	5	B0, B3; IID, Dirichlet $\alpha =1.0$, and $\alpha =0.3$.
MLP sensitivity	Adult	10	5 paired	5	B0, B3, B5; IID and Dirichlet $\alpha =0.3$.
Logical-client scaling	Adult	3, 5, 10, 20, 50	5	3	B0, B5, B6; Dirichlet $\alpha =0.3$.
Algorithmic poisoning	Adult	10	5 paired	5	B0, B6; clean, label flip, sign flip, and random weights; $20\%$ malicious clients.

The 10-seed core and FairFed suites formed the principal paired comparisons. The policy and heterogeneity suites characterized threshold and representation behavior. The five-seed MLP, scaling, and algorithmic-poisoning suites were treated as sensitivity analyses.

Table 6 summarizes the complete-path governance and component-performance suites.

Table 6. Complete-path governance and component-performance suites.

Suite	Input	Clients/Setup	Repetitions	Rounds	Configuration
Complete-path infrastructure	Adult, Dirichlet $\alpha =0.3$	5 and 10	3 seeds	3	B2, B4, B7: $2\times 3\times 3=18$ isolated executions and 54 scheduled rounds.
Complete-path attack matrix	Adult, Dirichlet $\alpha =0.3$	5	3 seeds	3	B4/B7 under four conditions: $2\times 4\times 3=24$ executions and 72 scheduled rounds.
V2 Groth16 timing	Valid circuit statements	N/A	30	N/A	Witness generation, proof generation, and off-chain verification.
Direct verifier and gas	Contract calls	Batches 1, 5, 10, 20	30 where applicable	N/A	Verifier deployment/execution, submission, lifecycle calls, and global publication.
Kubo payload	1 KiB–10 MiB	Two peers	30 per size	N/A	Add, cold/warm retrieval, pinning, and byte verification.
Kubo concurrency	Fresh 1 MiB objects	Two peers	30 per level	N/A	Concurrency 1, 5, 10, and 20.
Kubo recovery	1 MiB objects	Two peers	30	N/A	Publisher interruption, consumer retrieval, restart, identity check, and verified new publication.

Each complete-path method–seed execution used isolated ledger and verifier state. The B4 and B7 matrices used off-chain Groth16 verification followed by the EIP-712 signed-decision path. Direct Solidity verification was benchmarked separately. The three-seed matrices were summarized descriptively rather than used for inferential rankings.

Table 7 summarizes the deterministic verification, security, trust-boundary, and workflow-consistency suites.

Table 7. Deterministic verification, security, trust-boundary, and workflow-consistency suites.

Suite	Cases	Scope	Evaluated Behavior
V2 relation negatives	6	Groth16 statement	Rejection of malformed, altered, or context-inconsistent proof/public-input combinations.
Signed-verifier matrix	15	EIP-712 path	Fourteen expected rejections and one authorized-key-compromise acceptance exposing the signer trust boundary.
Contract/lifecycle security	18	Solidity and round state	Authorization, uniqueness, state transitions, cancellation, and publication restrictions.
Fabricated submitted metrics	1 execution	3 clients, 1 round	Whether self-consistent policy-passing values can be proved, approved, retrieved, and aggregated when they differ from locally computed values.
Approved-artifact unavailability	1 execution	3 clients, 1 round	Whether a missing approved model cancels the round before aggregation and publication.
Three-client workflow consistency	3 executions	Fixed seed/configuration	Repeatability of publication, signed verification, approval, FedAvg, global publication, and archival under identical inputs.

5.11. Complete FairAI Execution Procedure

The reported B4 and B7 complete-path suites used the same signed FairAI workflow and differed only in the final aggregation operator.

• The contract created round t, fixed the policy context, and authorized the participating clients. Each client trained from ${\theta }^{t-1}$ on $D_{i,\mathrm{tr}}$ and evaluated the resulting model on $D_{i,\mathrm{ev}}$.
• The client formed the submitted metric vector. Standard executions used the locally computed values; the fabricated-metric test replaced them deliberately. The model, submitted metrics, and metadata were canonically encoded, published through the publisher Kubo peer, and assigned CIDs.
• The workflow constructed the pre-proof manifest projection from the base-artifact CIDs, client, round, policy, and nonce. It canonicalized and hashed the metrics and manifest projection to obtain field-compatible digest values.
• Metric definedness and preliminary eligibility were evaluated using the submitted floating-point values and configured floating-point thresholds. Policy-ineligible submissions did not enter proof generation and had no proof CID. For an eligible submission, the same values and thresholds were quantized, the V2 public statement was constructed, and the Groth16 proof and public-input artifacts were generated and published.
• After proof-related CIDs were available, the complete manifest was encoded and published. The independent consumer peer retrieved every present artifact, compared the returned bytes with the original canonical encodings, and pinned successfully verified content.
• The verification service independently recomputed artifact CIDs and digest bindings, parsed the submitted metrics, checked the submission context, and verified the Groth16 proof for proof-bearing submissions.
• The authorized verifier issued an EIP-712 approval or rejection decision binding the client, round, policy, nonce, complete manifest CID, digest values, proof and policy states, expiration, chain, and verifier-contract context. The contract checked the signature, domain, authorization, revocation, expiry, and replay controls before recording approval or rejection.
• After submissions closed, the master queried the on-chain approved set and retrieved every approved model through its registered CID. Aggregation began only if at least one model was approved and every approved model was retrievable, CID-consistent, manifest-consistent, and decodable.
• A successful round applied sample-weighted FedAvg for B4 or coordinate-wise median for B7, evaluated the resulting global model, published the global model and summary, recorded their CIDs, and archived the round. If the approved set was empty or any required approved artifact failed retrieval or validation, the round transitioned to Cancelled; no aggregation result or new global artifact was published.

Thus, preliminary policy eligibility, Groth16 proof validity, external artifact binding, signed-decision authorization, on-chain approval, artifact availability, and aggregation inclusion remained distinct states in the executed workflow.

5.12. Groth16 and Verification Configuration

The V2 eligibility relation used Groth16 over BN254. Submitted decimal metrics and thresholds were converted to nonnegative fixed-point integers using:

$$\widehat{z}=round\left(Qz\right),Q={10}^6.$$

(57)

The corresponding fixed-point approximation error satisfies:

$$\left|z-{\displaystyle \frac{\widehat{z}}{Q}}\right|\le {\displaystyle \frac{1}{2Q}}.$$

(58)

The nominal representation resolution was therefore ${10}^{-6}$. The public statement contained the quantized submitted accuracy and four fairness gaps, quantized thresholds, enabled-metric mask, client identifier, round identifier, policy version, nonce, and field-compatible metrics and pre-proof-manifest digest values.

The circuit checked the encoded threshold relation and internal witness consistency. It did not compute SHA-256. The digest-field values were proof-bound public signals; the external artifact-binding service independently recomputed SHA-256 over the retrieved canonical artifacts, reduced the digests to the field, and compared them with the public values. Artifact-context consistency was therefore established by the combination of Groth16 verification and the external binding predicate, not by the circuit alone.

Let ${\mathbf{U}}_i^t$ denote the public statement, $w_i^t$ the witness, ${\pi }_i^t$ the proof, $pk$ the proving key, and $vk$ the verification key. Proof generation was:

$${\pi }_i^t\leftarrow Prove\left(pk,{\mathbf{U}}_i^t,w_i^t\right).$$

(59)

Off-chain verification was:

$$z_{i,\mathrm{off}}^t=Verify\left(vk,{\mathbf{U}}_i^t,{\pi }_i^t\right).$$

(60)

The submitted metrics, thresholds, enabled mask, client and round identifiers, policy identifier, nonce, and digest-field values were public. Groth16 zero-knowledge therefore applied to the witness and internal auxiliary values, not to the public eligibility statement. The raw dataset, training trace, submitted-model parameters, and full metric-computation procedure were not proved. A valid proof established satisfaction of the encoded quantized relation for the supplied statement; it did not establish correct derivation of the statement from private data or consistency between the submitted model and the process that generated the metrics.

The archived proof package contained the R1CS, WASM witness generator, proving key, verification key, and generated Solidity verifier. Witness generation, proof generation, and off-chain verification were each repeated 30 times, and six malformed or context-inconsistent cases were evaluated for rejection. The proving material came from the archived single-contributor experimental setup.

The complete B4/B7 path used off-chain proof verification followed by an EIP-712 signed decision. The signed-verifier contract enforced domain binding, authorized-verifier state, expiry, revocation, decision-digest reuse, and nonce replay; an explicit Approved decision was required for approval. Direct Groth16 verification through the generated Solidity verifier was measured separately and was not substituted for the signed path in the complete-path matrices.

5.13. Smart-Contract Configuration

The contract layer ran on an ephemeral Hardhat Ethereum-compatible network with chain identifier 31337. The deployed suite comprised FairAIEthicalLedger, FairAISignedVerifierV2, FairAIMultisigAdmin, and the generated V2 Groth16 verifier. Each strict method–seed execution deployed an isolated ledger and verifier stack.

The contracts distinguished administrator, node-operator, verifier, and aggregator roles. They implemented participant registration and authorization, round creation, artifact registration, duplicate-submission and duplicate-CID controls, policy/proof/binding state recording, signer authorization and revocation, decision expiry and replay protection, approval and rejection, approved-model queries, cancellation, global-CID publication, archival, and event-based audit records. FairAIMultisigAdmin provided administrative multisignature functionality but was not the per-submission verification path.

The on-chain state contained CIDs, identities, round and policy context, verification and decision states, and lifecycle metadata. Model, metrics, metadata, public-input, proof, and manifest bytes remained in content-addressed storage. Gas was read from local Hardhat transaction receipts and treated as an execution-unit measurement. No monetary fee or public-chain confirmation behavior was inferred from these measurements.

Registration, proof state, signed-decision validity, approval, retrieval, and aggregation inclusion were recorded separately. A registered manifest CID did not itself make a model eligible. In the signed path, approval required an authorized participant, unique client-round registration, successful external artifact binding, policy eligibility, valid off-chain proof verification, a non-expired non-replayed EIP-712 message from an authorized non-revoked verifier, and an explicit signed Approved decision. Once submissions closed, the master obtained candidates from the ledger’s approved-model query rather than from a locally constructed list.

The successful lifecycle was:

$$\mathtt{Open}\to \mathtt{SubmissionClosed}\to \mathtt{AggregationStarted}\to \mathtt{Published}\to \mathtt{Archived}.$$

(61)

An empty approved set or failed retrieval/validation produced:

$$\mathtt{Open}\to \mathtt{SubmissionClosed}\to \mathtt{Cancelled}.$$

(62)

The event history retained the corresponding submission, decision, approval, rejection, cancellation, publication, and archival transitions.

5.14. Native Kubo/IPFS Configuration

Two independently initialized native Kubo 0.29.0 repositories operated on the same host over loopback:

$$\mathrm{publisher}\mathrm{API}:127.0.0.1:5001,\mathrm{consumer}\mathrm{API}:127.0.0.1:5002.$$

(63)

The repositories maintained distinct identities, blockstores, and pin sets. For source bytes x, the evaluated sequence was:

$$x\to \mathrm{CID}\left(x\right)\to \tilde{x}\to \mathbf{1}\left[\tilde{x}=x\right]\to \mathrm{consumer}\mathrm{pin}.$$

(64)

The sequential benchmark used fresh objects of $1\mathrm{KiB}$, $10\mathrm{KiB}$, $100\mathrm{KiB}$, $1\mathrm{MiB}$, and $10\mathrm{MiB}$, with 30 repetitions per size. Publisher add, consumer cold retrieval, warm retrieval, pinning, and byte equality were recorded separately. “Cold” denoted the consumer’s first retrieval of an object it did not already hold; “warm” denoted a subsequent retrieval after successful acquisition.

Concurrent retrieval used fresh $1\mathrm{MiB}$ objects at levels $c\in \{1,5,10,20\}$, with 30 batches per level. For batch duration $T_{\mathrm{batch}}^{(c,r)}$, aggregate throughput was:

$$R^{(c,r)}={\displaystyle \frac{cB}{T_{\mathrm{batch}}^{(c,r)}}},B=1\mathrm{MiB}.$$

(65)

The recovery benchmark used 30 trials. Each trial published and consumer-pinned a fresh $1\mathrm{MiB}$ object, stopped the publisher, verified retrieval of the pinned object from the consumer, restarted the same publisher repository, checked identity persistence, published a new object, and retrieved and byte-verified that object through the consumer. These measurements characterize the evaluated same-host two-peer topology.

For the sequential benchmark, $T_{\mathrm{add}}$ measured publisher-side addition and CID return; $T_{\mathrm{cold}}$ measured the consumer’s first complete retrieval of a fresh object; $T_{\mathrm{warm}}$ measured a subsequent retrieval of the same acquired object; and $T_{\mathrm{pin}}$ measured consumer pinning. The labels “cold” and “warm” describe the observable consumer state and do not assign latency to a particular operating system or Kubo cache.

The recovery measurements distinguished consumer retrieval during publisher outage, publisher API readiness after restart, and completion of a newly published and byte-verified object after restart. A recovery trial succeeded only when the consumer retained the pinned object, the restarted repository preserved its identity, and the new object was retrieved exactly.

5.15. Adversarial, Protocol, and Failure Scenarios

Two poisoning suites were executed. The algorithmic suite used 10 Adult clients, five rounds, five paired seeds, Dirichlet $\alpha =0.3$, and two malicious clients per seed. It compared B0 with B6 without Kubo, proof, or contract stages. The complete-path attack matrix used five Adult clients, three rounds, three paired seeds, Dirichlet $\alpha =0.3$, and one malicious client per seed. It compared B4 and B7 through the complete governed workflow.

Both suites evaluated four conditions:

• none: standard local training, evaluation, and submission;
• label_flip: the malicious clients’ binary training labels were inverted before optimization:

  $$y^{\mathrm{attack}}=1-y.$$

  (66)
  The submitted metrics were computed from the model trained on the flipped labels.
• sign_flip: the client completed standard training and evaluation, after which the trained parameter vector was multiplied by $-1$:

  $${\theta }_{i,\mathrm{attack}}^t=-{\theta }_i^t.$$

  (67)
• random_weights: the client completed standard training and evaluation, after which the parameter tensors were replaced by seed-controlled standard-normal values of the same shapes:

  $${\theta }_{i,\mathrm{attack}}^t={\mathit{\xi }}_i^t,{\mathit{\xi }}_i^t\sim \mathcal{N}\left(\mathbf{0},\mathbf{I}\right).$$

  (68)

For sign flip and random weights, the metrics and preliminary policy state were computed before the parameter manipulation. The submitted-model parameters therefore differed from the model from which the submitted metrics were obtained. These conditions tested the absence of a proof that the submitted model and submitted measurements originated from one consistent local computation. In the complete-path matrix, the attacked contribution then traversed the same artifact, policy, proof, signed-decision, contract, retrieval, and aggregation stages as the other submissions.

Protocol-level evaluation was divided by control layer. Six V2 relation cases altered proofs, public statements, or bound context. The 15 signed-verifier scenarios included 14 expected rejections covering unauthorized signing, signed-field mutation, incorrect chain or contract domain, expiration, revocation, replay, nonce reuse, and decision-digest reuse. The remaining scenario used a still-authorized key to submit a false accepted decision; acceptance was the expected outcome because the test exposed signer honesty as a trust condition rather than testing signature forgery. The 18 contract/lifecycle cases evaluated authorization, duplicate client-round submissions, duplicate or reused CIDs, decision-context consistency, invalid state transitions, empty-approved-set cancellation, and publication restricted to the governed approved set.

The fabricated-metric test distinguished locally computed measurements from submitted claims. A genuine model was trained and evaluated, then its submitted metric vector was replaced by policy-passing values. The metrics artifact, digest bindings, public statement, proof, final manifest, and signed decision were constructed consistently over the replacement values and processed through a three-client, one-round B4 execution.

The artifact-unavailability test evaluated a post-approval, pre-aggregation storage failure. Three submissions were processed through the B4 governance path, after which one required approved model became unavailable to both accessible repositories. The master queried the approved set and attempted retrieval. The specified safe outcome was cancellation before AggregationStarted, with no global-model publication.

5.16. Complexity and Timing Protocol

Let N denote the number of clients, R the number of rounds, d the parameter dimension, ${\mathcal{A}}_t$ the approved set, and $B_i^t$ the total serialized client-artifact bytes in round t. Approved-set FedAvg requires:

$$T_{\mathrm{FedAvg}}^t=O\left(|{\mathcal{A}}_t|d\right).$$

(69)

Excluding already computed client statistics, FairFed updates N weights and forms a weighted sum of N parameter vectors:

$$T_{\mathrm{FairFed}}^t=O\left(Nd\right).$$

(70)

Coordinate-wise median requires:

$$T_{\mathrm{median}}^t=O\left(d{C}_{\mathrm{median}}\left(|{\mathcal{A}}_t|\right)\right),$$

(71)

where $C_{\mathrm{median}}\left(k\right)$ is the cost of the implemented median operation over k values.

Client-round submission records and governance transactions grow as $O\left(NR\right)$, apart from a bounded number of round-level lifecycle calls. The application-level off-chain artifact volume is:

$$V_{\mathrm{artifacts}}={\displaystyle \sum _{t=1}^R}\left[{\displaystyle \sum _{i=1}^N}{B}_i^t+{\gamma }_t\left(B_{\mathrm{global}}^t+B_{\mathrm{summary}}^t\right)\right],$$

(72)

where ${\gamma }_t=1$ only when the round publishes a global model and summary. Serialization, hashing, CID recomputation, and exact byte comparison are linear in the processed byte volume. Groth16 costs depend on the fixed V2 constraint system and public statement; their realized witness, proving, and verification times were measured rather than replaced by a platform-independent estimate. Denoting the relevant implementation-specific cost functions by $\mathcal{T}$:

$$\left(T_{\mathrm{witness}},T_{\mathrm{prove}},T_{\mathrm{verify}}\right)=\left({\mathcal{T}}_{\mathrm{witness}},{\mathcal{T}}_{\mathrm{prove}},{\mathcal{T}}_{\mathrm{verify}}\right)\left(C_{\mathrm{zk}},P_{\mathrm{zk}}\right).$$

(73)

Elapsed time was measured with monotonic timers around independently bounded operations, including local training, local evaluation, fairness computation, serialization, witness generation, proof generation, off-chain verification, Kubo add, consumer retrieval, pinning, EIP-712 signing, contract submission, approved-model retrieval, aggregation, global publication, and complete configured execution. Missing stages remained unavailable, and overlapping timers were not combined by subtraction. Complete execution time was measured directly, not reconstructed by summing stage means collected with different observation counts. Direct Solidity verification had no independent wall-clock boundary and was reported through gas only.

5.17. Statistical Analysis

For repeated algorithmic experiments, the experimental unit was the seed-level final execution for one specified dataset, partition, method, model, policy, client count, and attack condition. Unless stated otherwise, predictive and fairness outcomes came from the held-out global test set after the final communication round. Clients, rounds, test observations, submissions, and artifact operations within one seed were not treated as independent model-level replicates.

Paired methods reused the same dataset split, client partition, local train/evaluation split, initialization, optimizer, local epochs, communication rounds, and attack assignment. For right method R, left method L, and seed s, the paired difference was:

$${\Delta }_s=X_{s,R}-X_{s,L}.$$

(74)

Thus, a negative accuracy or macro-F1 difference indicates lower utility under the right method, while a negative fairness-gap difference indicates smaller measured disparity.

Descriptive summaries included sample count, mean, sample standard deviation, median, minimum, and maximum. Deterministic two-sided $95\%$ percentile-bootstrap confidence intervals for the seed-level mean used 10,000 resamples. The bootstrap generator seed was derived by SHA-256 from the analysis suite, grouping dimensions, and metric name. Constant groups produced degenerate intervals equal to the constant value; these intervals recorded the absence of observed seed variation rather than strong population precision.

Paired comparisons used a two-sided paired t-test as the primary test and a two-sided Wilcoxon signed-rank test as a distribution-free check. Practical effect sizes were paired Cohen’s $d_z$:

$$d_z={\displaystyle \frac{\overline{\Delta }}{s_{\Delta }}}.$$

(75)

The matched-pairs rank-biserial correlation was:

$$r_{\mathrm{rb}}={\displaystyle \frac{R_{+}-R_{-}}{R_{+}+R_{-}}},$$

(76)

where $R_{+}$ and $R_{-}$ are the sums of positive and negative signed ranks after excluding zero differences. All-zero differences were recorded with zero effect and $p=1$. Constant nonzero differences had no finite $d_z$.

Holm correction was applied to the complete paired-t family within each frozen statistical package: the core B3-B0 Adult/COMPAS package; the FairFed and scaling package containing the reported B5-B0 and B6-B0 comparisons; and the expanded MLP and algorithmic-poisoning package. Wilcoxon values were retained as unadjusted checks rather than substituted for the Holm-adjusted primary tests.

When every paired difference was zero, the implementation recorded $\overline{\Delta }=0$, $d_z=0$, and both test p-values as one. When differences were constant but nonzero, no finite $d_z$ was reported. These cases were handled explicitly rather than passed to numerically unstable calculations.

For ordered unadjusted values $p_{\left(1\right)}\le \cdots \le p_{\left(K\right)}$, the Holm-adjusted value was:

$$p_{\left(j\right),\mathrm{Holm}}=\underset{1\le h\le j}{max}\left[min\left(1,(K-h+1)p_{\left(h\right)}\right)\right].$$

(77)

The adjusted values were returned to their original hypotheses. No additional omnibus family was constructed across separately frozen analysis packages.

The 10-seed Adult and COMPAS suites provided the principal paired evidence. Five-seed MLP, scaling, and algorithmic-poisoning suites were interpreted as sensitivity analyses. Three-seed complete-path matrices were summarized descriptively. Proof, Kubo, gas, and recovery benchmarks used their recorded repetition as the observational unit. Deterministic proof, verifier, contract, fabricated-metric, and artifact-unavailability cases were evaluated by whether the observed acceptance, rejection, cancellation, or lifecycle outcome matched the specified behavior.

Entropy correlations used final-round client records and Spearman’s $\rho$ within each partition. If either variable was constant, the correlation was recorded as undefined. Higher/lower local minority-share summaries were computed within seed and partition before averaging across seeds. These analyses were descriptive and were not interpreted causally.

5.18. Data Handling and Ethical Operationalization

The evaluation used existing public Adult and COMPAS records and did not collect new participant data. During federated execution, the rows assigned to $D_{i,\mathrm{tr}}$ and $D_{i,\mathrm{ev}}$ were not serialized into client submissions, uploaded to Kubo/IPFS, or written on-chain. The global validation and test records were likewise not proof inputs or client artifacts. This property is described as raw-record locality.

The governed workflow published derived evidence: model parameters, submitted metrics, metadata, public proof signals, proof objects, manifests, and their CIDs. Identities, policy and verification states, signed decisions, transaction metadata, and lifecycle events were recorded through the governance path. These derived artifacts were therefore observable to the corresponding storage, verification, or ledger participants.

For client i at round t, the locally computed metric vector was:

$${\mathbf{m}}_i^t=Evaluate\left({\theta }_i^t,D_{i,\mathrm{ev}}\right).$$

(78)

The values serialized into the governed metrics artifact are denoted by ${\tilde{\mathbf{m}}}_i^t$. Standard executions used ${\tilde{\mathbf{m}}}_i^t={\mathbf{m}}_i^t$. The fabricated-metric test deliberately violated this equality. The sign-flip and random-weight tests instead preserved the already computed metric vector while subsequently replacing the submitted parameter vector. This notation separates the observed local evaluation from the claim processed by the policy, proof, and governance layers.

The public Groth16 statement included submitted metrics, thresholds, enabled masks, identifiers, nonce, and digest values. These quantities were not hidden by the proof. Accordingly, retaining raw rows locally did not imply that all information derived from those rows remained private.

Protected attributes were excluded from predictive feature matrices but retained for stratification, fairness measurement, entropy, and representation analysis. Fairness was the ethical criterion directly encoded in the evaluated policies. Only fairness criteria enabled in the active policy were enforced as approval conditions; all other computed criteria were monitored and reported without affecting model eligibility. Transparency, accountability, responsibility, and integrity were supported through attributable submissions, content-addressed artifacts, role-controlled decisions, and auditable state transitions. Entropy described data composition and was not an ethical criterion or approval condition.

5.19. Reproducibility and Research Artifacts

The implementation, configurations, and research artifacts associated with the reported experiments are anchored to FairAI commit 1495349a1eace04326c31d2740cfbea2eaaadf09 [33].

Each repeated execution produced a structured record containing, where applicable, the suite and method configuration, source commit, configuration hash, dataset and partition checksums, policy profile and version, random seed, client count, available environment metadata, timestamps, and completion or lifecycle state. Proof-enabled runs additionally retained circuit, proving-key, and verification-key hashes. Strict executions retained deployed contract context and transaction records; Kubo-enabled runs retained publisher and consumer operation records.

The evidence package preserves seed-level predictive and fairness outputs, client-level metrics and decisions, approval and excluded-sample summaries, transaction receipts, contract events, proof results, verifier tests, Kubo publication/retrieval/byte-verification records, latency and recovery measurements, gas and stage timings, adversarial and trust-boundary outputs, entropy and representation diagnostics, statistical results, and the numerical tables used to generate the manuscript tables and figures.

The retained evidence followed the derivation path:

$$\begin{array}{cc}\hfill & \mathrm{commit},\mathrm{configuration},\mathrm{seed},\mathrm{and}\mathrm{checksums}\hfill \\ \hfill & \to \mathrm{run}\mathrm{manifests}\mathrm{and}\mathrm{raw}\mathrm{outputs}\hfill \\ \hfill & \to \mathrm{canonical}\mathrm{result}\mathrm{tables}\to \mathrm{statistical}\mathrm{summaries}\hfill \\ \hfill & \to \mathrm{manuscript}\mathrm{tables}\mathrm{and}\mathrm{figure}\mathrm{data}.\hfill \end{array}$$

(79)

Run manifests, transaction receipts, contract events, proof outputs, and benchmark records were treated as primary execution evidence. Consolidated workbooks, formatted tables, and chart-data files were treated as derived publication views rather than independent experimental sources.

The versioned repository contains the federated-learning, policy, FairFed, and robust-aggregation implementations; Solidity contracts and tests; Circom circuit and proof tooling; Kubo configuration; dataset acquisition and preprocessing code; experimental configurations; statistical and consolidation scripts; checksums; and reproduction instructions. The packaged R1CS, WASM, proving key, verification key, and Solidity verifier reproduce the reported proof path. Regenerating the proving material requires the externally specified Powers-of-Tau input and is distinct from rerunning the frozen proof benchmarks.

6. Results

This section reports the measured behavior of FairAI across three complementary evidence layers: (i) paired algorithmic comparisons on Adult and COMPAS, (ii) complete-path execution of the governed model-artifact workflow, and (iii) component, adversarial, recovery, security, and trust-boundary evaluations. The algorithmic suites isolate the effects of admission and aggregation rules, whereas the complete-path suites additionally exercise native Kubo/IPFS publication and retrieval, Groth16 evidence, EIP-712 decisions, Solidity contracts, on-chain approval, approved-CID retrieval, and selective aggregation. Unless stated otherwise, predictive and group-fairness outcomes were computed on the held-out global test set after the final communication round.

The seed-level execution was the experimental unit for repeated model experiments. Paired methods reused the same dataset split, client partition, initialization, local epochs, communication rounds, and optimizer settings. The 10-seed Adult and COMPAS suites provide the principal paired evidence. Five-seed model-family, scaling, and algorithmic-poisoning suites are treated as sensitivity analyses, while the three-seed complete-path suites are summarized descriptively. Confidence intervals are deterministic percentile-bootstrap 95% intervals based on 10,000 resamples. Paired comparisons use paired t-tests, Wilcoxon signed-rank checks, Holm correction, paired Cohen’s $d_z$, and matched-pairs rank-biserial correlations as specified in Section 5.17.

6.1. Pre-Aggregation Fairness-Policy Gate

The primary policy-gate experiment evaluated standard sample-weighted FedAvg (B0), post hoc fairness assessment (B1), and the public-metric pre-aggregation gate followed by admitted-set FedAvg (B3) using 10 logical clients, five communication rounds, and 10 paired seeds. Because B1 applies the same training and aggregation rule as B0, it produces the same paired global model and is retained as a procedural comparator rather than a separate model-level result. Table 8 reports the measured final-test outcomes.

Table 8. Adult and COMPAS results for standard FedAvg (B0) and the pre-aggregation policy gate (B3). Values are means over 10 paired seeds. Lower fairness gaps indicate smaller measured group disparity.

Dataset	Partition	Method	Accuracy (95% CI)	Macro-F1	DP Gap	EO Gap	EOdds Gap	SAG
Adult	IID	B0	0.7749 [0.7746, 0.7751]	0.5251	0.0284	0.0256	0.0256	0.1777
Adult	IID	B3	0.7749 [0.7746, 0.7751]	0.5251	0.0284	0.0256	0.0256	0.1777
Adult	Dirichlet ($\alpha =0.3$)	B0	0.7740 [0.7732, 0.7750]	0.5217	0.0273	0.0252	0.0252	0.1783
Adult	Dirichlet ($\alpha =0.3$)	B3	0.7629 [0.7584, 0.7691]	0.4694	0.0127	0.0169	0.0169	0.1876
COMPAS	IID	B0	0.6614 [0.6591, 0.6635]	0.6449	0.1937	0.0812	0.2518	0.0189
COMPAS	IID	B3	0.6593 [0.6566, 0.6619]	0.6410	0.1849	0.0772	0.2381	0.0124
COMPAS	Dirichlet ($\alpha =0.3$)	B0	0.6495 [0.6323, 0.6607]	0.6231	0.1740	0.0722	0.2262	0.0189
COMPAS	Dirichlet ($\alpha =0.3$)	B3	0.5809 [0.5539, 0.6114]	0.4782	0.0983	0.0554	0.1226	0.0702

Under IID Adult allocation, B0 and B3 produced identical results. The IID COMPAS differences were small, and no IID comparison remained significant after Holm correction. Under heterogeneous Adult allocation, B3 reduced the demographic-parity gap from 0.0273 to 0.0127 and the equalized-odds gap from 0.0252 to 0.0169, while accuracy decreased by 0.0111 and macro-F1 decreased by 0.0523. None of the Adult heterogeneous differences remained significant after Holm correction.

The heterogeneous COMPAS condition produced the clearest policy-gate trade-off. Accuracy decreased by 0.0686, from 0.6495 to 0.5809, while the equalized-odds gap decreased by 0.1036, from 0.2262 to 0.1226. The accuracy difference remained significant after Holm correction ($d_z=-1.449$, $p_{\mathrm{Holm}}=0.0318$), as did the equalized-odds difference ($d_z=-1.338$, $p_{\mathrm{Holm}}=0.0491$). Macro-F1 decreased by 0.1449 ($p_{\mathrm{Holm}}=0.0491$), whereas the subgroup-accuracy gap increased by 0.0513 ($p_{\mathrm{Holm}}=0.0491$). The demographic-parity reduction did not remain significant after correction. These outcomes show that the gate changed the fairness–utility operating point rather than improving all criteria simultaneously.

Figure 7 visualizes final accuracy under the principal heterogeneous condition, and Figure 8 reports all four measured fairness gaps for the same paired runs.

Figure 7. Final-test accuracy for B0 and B3 under joint label/protected-group Dirichlet partitioning with $\alpha =0.3$. Error bars show sample standard deviation across 10 paired seeds.

Figure 8. Demographic-parity, equal-opportunity, equalized-odds, and subgroup-accuracy gaps under the principal heterogeneous condition. Lower values indicate smaller measured group disparity, but each metric must be interpreted jointly with predictive utility.

Table 9 summarizes the principal paired heterogeneous-data comparisons.

Table 9. Selected paired B3-versus-B0 results under Dirichlet $\alpha =0.3$. Differences are computed as B3−B0; negative fairness-gap differences indicate smaller measured disparity under B3.

Dataset	Metric	Mean Difference	${\mathit{d}}_{\mathit{z}}$	${\mathit{p}}_{\mathbf{Holm}}$
Adult	Accuracy	$-0.0111$	$-1.095$	0.1424
Adult	DP gap	$-0.0146$	$-0.744$	0.6896
Adult	Equalized-odds gap	$-0.0082$	$-0.324$	1.0000
Adult	Subgroup-accuracy gap	$+0.0093$	$+0.871$	0.3800
COMPAS	Accuracy	$-0.0686$	$-1.449$	0.0318
COMPAS	Macro-F1	$-0.1449$	$-1.337$	0.0491
COMPAS	DP gap	$-0.0758$	$-0.900$	0.3461
COMPAS	Equalized-odds gap	$-0.1036$	$-1.338$	0.0491
COMPAS	Subgroup-accuracy gap	$+0.0513$	$+1.345$	0.0491

6.2. FairFed Server-Weighting Comparator

FairFed (B5) was evaluated as a fairness-aware server-weighting comparator using the same paired seeds, client partitions, initialization, and local-training configuration as its B0 reference. The evaluated configuration applies the stateful server-weighting recurrence using signed equal-opportunity difference and $\beta =1$, as detailed in the unnumbered subsection FairFed Server-Weighting Configuration. Table 10 reports the paired outcomes.

Table 10. FairFed comparison over 10 paired seeds, 10 logical clients, and five communication rounds.

Dataset	Partition	Method	Accuracy	Macro-F1	DP Gap	EO Gap	EOdds Gap	SAG
Adult	IID	B0	0.7746	0.5245	0.0283	0.0261	0.0261	0.1778
Adult	IID	B5	0.7749	0.5254	0.0286	0.0261	0.0261	0.1776
Adult	Dirichlet ($\alpha =0.3$)	B0	0.7752	0.5272	0.0299	0.0306	0.0306	0.1766
Adult	Dirichlet ($\alpha =0.3$)	B5	0.6474	0.4469	0.0494	0.0112	0.0319	0.1617
COMPAS	IID	B0	0.6562	0.6427	0.2046	0.1270	0.2215	0.0139
COMPAS	IID	B5	0.6549	0.6381	0.1951	0.1283	0.1995	0.0292
COMPAS	Dirichlet ($\alpha =0.3$)	B0	0.6462	0.6277	0.2015	0.1416	0.2148	0.0242
COMPAS	Dirichlet ($\alpha =0.3$)	B5	0.5423	0.4099	0.0488	0.0428	0.0600	0.0984

Under IID allocation, B5 remained close to B0, and no paired comparison remained significant after Holm correction. Under heterogeneous Adult allocation, B5 reduced the equal-opportunity gap from 0.0306 to 0.0112, while accuracy decreased by 0.1278 and the demographic-parity gap increased from 0.0299 to 0.0494. None of the Adult heterogeneous FairFed differences remained significant after correction because of substantial between-seed variability.

Under heterogeneous COMPAS allocation, B5 reduced the demographic-parity gap from 0.2015 to 0.0488 and the equalized-odds gap from 0.2148 to 0.0600. Accuracy decreased by 0.1039, and macro-F1 decreased by 0.2179. The accuracy ($p_{\mathrm{Holm}}=0.0032$), macro-F1 ($p_{\mathrm{Holm}}=0.0031$), demographic-parity ($p_{\mathrm{Holm}}=0.0023$), equalized-odds ($p_{\mathrm{Holm}}=0.0088$), and subgroup-accuracy-gap ($p_{\mathrm{Holm}}=0.0159$) differences remained significant. The equal-opportunity difference did not remain significant after correction ($p_{\mathrm{Holm}}=0.2109$). FairFed therefore produced a distinct metric-dependent operating point rather than a uniformly preferable outcome. Figure 9 visualizes these results.

Figure 9. FairFed server-weighting results under joint label/protected-group Dirichlet partitioning. The figure reports predictive accuracy and three group-fairness gaps; the direction and magnitude of the trade-off differ by dataset and metric.

6.3. Policy Sensitivity, Heterogeneity, and Representation

The policy-sensitivity suite evaluated lenient, submitted, moderate, and strict profiles using heterogeneous Adult partitions, 10 logical clients, five rounds, and 10 seeds. Table 11 distinguishes the descriptive admission mean across all five rounds from admission in the final round.

Table 11. Policy sensitivity under heterogeneous Adult allocation. Accuracy intervals are deterministic bootstrap 95% confidence intervals.

Policy	All-Round Admission	Final-Round Admission	Accuracy (95% CI)	Macro-F1	DP Gap	EOdds Gap	SAG
Lenient	0.594	0.55	0.7652 [0.7619, 0.7683]	0.4796	0.0145	0.0178	0.1860
Submitted	0.514	0.42	0.7600 [0.7589, 0.7612]	0.4551	0.0063	0.0068	0.1911
Moderate	0.322	0.27	0.7466 [0.7118, 0.7666]	0.4821	0.0313	0.0255	0.1712
Strict	0.072	0.07	0.5007 [0.3476, 0.6539]	0.3165	0.0008	0.0018	0.1956

Tightening the policy progressively reduced participation. The strict profile retained 7% of clients in the final round on average and produced the lowest and most variable accuracy. Its near-zero DP and equalized-odds gaps coincided with macro-F1 of 0.3165 and subgroup-accuracy gap of 0.1956. Small group gaps under a highly selective policy therefore do not, by themselves, establish a preferable operating point. Figure 10 shows the decline in admission as policy requirements become more restrictive. The all-round values are descriptive summaries of 50 seed-round decisions; they are not treated as 50 independent model-level replicates.

Figure 10. Admission rate by policy profile. All-round values summarize 50 seed-round decisions, whereas final-round values summarize the 10 final aggregation rounds. Error bars show sample standard deviation.

A separate diagnostic suite evaluated IID allocation and joint label/protected-group Dirichlet allocation with $\alpha =1.0$ and $\alpha =0.3$. Table 12 combines predictive, fairness, admission, and excluded-sample outcomes. The higher and lower local minority-share groups were formed within each seed and partition using the median share of the locally less frequent protected group, as defined in Section 5.5.

Table 12. Heterogeneity and representation diagnostics over 10 seeds. “Lower share” and “higher share” denote clients below and at or above the seed- and partition-specific median local minority share, respectively.

Partition	B0 Accuracy	B3 Accuracy	B0 DP	B3 DP	Admission: Lower Share	Admission: Higher Share	Excluded: Lower Share	Excluded: Higher Share
IID	0.7744	0.7744	0.0278	0.0278	1.00	1.00	0.0000	0.0000
Dirichlet ($\alpha =1.0$)	0.7738	0.7649	0.0272	0.0134	0.78	0.88	0.1068	0.0498
Dirichlet ($\alpha =0.3$)	0.7736	0.7644	0.0272	0.0132	0.44	0.62	0.1862	0.0966

Mean normalized label entropy decreased from 0.8093 under IID allocation to 0.6741 at $\alpha =1.0$ and 0.5549 at $\alpha =0.3$. Mean protected-group entropy decreased from 0.9087 to 0.7428 and 0.6041 over the same conditions. Under both non-IID conditions, the higher local minority-share group had higher observed admission and lower excluded-sample fractions than the lower-share group. These quantities are descriptive properties of the tested partitions and policy decisions; they do not establish a causal effect of entropy or local group composition and do not justify using entropy as an eligibility condition. Figure 11 visualizes the measured diagnostics.

Figure 11. Normalized client entropy together with admission and excluded-sample outcomes across IID and joint Dirichlet partitions. The representation values are descriptive summaries of measured client decisions.

6.4. Model-Family and Logical-Client Sensitivity

6.4.1. MLP Model-Family Sensitivity

A one-hidden-layer multilayer perceptron was evaluated using B0, B3, and B5 over five paired seeds. Table 13 reports the measured means. The between-seed variation was substantially larger than in the logistic-regression experiments, and no paired MLP comparison remained significant after Holm correction.

Table 13. MLP results over five paired seeds, 10 logical clients, and five communication rounds.

Partition	Method	Accuracy	Macro-F1	DP Gap	EO Gap	Runtime (ms)
IID	B0	0.5514	0.4717	0.0960	0.0831	111.8
IID	B3	0.4702	0.4236	0.0902	0.0824	111.8
IID	B5	0.5518	0.4715	0.0949	0.0816	155.0
Dirichlet ($\alpha =0.3$)	B0	0.5514	0.4714	0.0958	0.0828	113.0
Dirichlet ($\alpha =0.3$)	B3	0.4838	0.4079	0.0679	0.0526	111.0
Dirichlet ($\alpha =0.3$)	B5	0.4806	0.4134	0.0652	0.1160	151.5

Figure 12 shows the wide accuracy intervals under heterogeneous allocation. The suite establishes execution with a second model family; the measured variation and paired tests do not support method superiority or broad neural-model generalization.

Figure 12. MLP final-test accuracy under joint label/protected-group Dirichlet partitioning. Error bars are deterministic bootstrap 95% confidence intervals over five paired seeds.

6.4.2. Logical-Client Scaling

The algorithmic scaling suite varied the number of logical clients from 3 to 50 under heterogeneous Adult allocation, using five seeds and three communication rounds. Table 14 reports accuracy, equal-opportunity gap, and local sequential runtime. These measurements exclude the complete Kubo, proof, and ledger path.

Table 14. Algorithmic scaling under heterogeneous Adult allocation. Runtime is measured for logical clients executed on one host.

	B0: FedAvg			B5: FairFed			B6: Coordinate Median
Clients	Accuracy	EO Gap	Runtime (ms)	Accuracy	EO Gap	Runtime (ms)	Accuracy	EO Gap	Runtime (ms)
3	0.7706	0.0291	38.5	0.7884	0.1165	51.3	0.7761	0.0480	38.8
5	0.7707	0.0298	45.6	0.7820	0.0735	58.2	0.7765	0.0591	43.3
10	0.7713	0.0286	54.7	0.7558	0.0029	79.3	0.7928	0.1179	56.8
20	0.7701	0.0248	77.5	0.7580	0.0064	118.4	0.7747	0.0321	89.0
50	0.7722	0.0292	130.6	0.7542	0.0000	220.1	0.7749	0.0499	132.1

FedAvg accuracy remained between 0.7701 and 0.7722. FairFed runtime increased from 51.3 ms at three clients to 220.1 ms at 50 clients. At 50 clients, its measured equal-opportunity gap was zero, but the corresponding macro-F1 was 0.4299, and the subgroup-accuracy gap was 0.1962; the zero gap therefore does not establish a preferable classifier. Coordinate-wise median preserved accuracy in several conditions but produced non-monotonic fairness outcomes. Figure 13 reports the measured runtime growth. The results characterize single-host algorithmic scaling rather than communication or deployment scaling across physical hosts.

Figure 13. Sequential runtime across 3, 5, 10, 20, and 50 logical clients. Error bars show sample standard deviation over five seeds.

6.5. Complete-Path FairAI Execution

The complete-path evaluation exercised the interactions among native publisher and consumer Kubo peers, byte-verified artifact retrieval, Groth16 and signed-decision processing, isolated Hardhat contract state, on-chain approval, approved-CID retrieval, and aggregation. Table 15 identifies the measured complete-path suites and their evidential roles.

Table 15. Measured complete-path suites. These executions provide functional and descriptive systems evidence rather than inferential method comparisons.

Suite	Methods/ Conditions	Clients	Seeds	Rounds	Executions	Measured Role
Complete-path infrastructure	B2, B4, B7	5 and 10	3	3	18	Storage, proof and decision processing, contract approval, approved-CID retrieval, and aggregation
Complete-path attack matrix	B4/B7 under clean, label-flip, sign-flip, and random-weight conditions	5	3	3	24	Full governed path under four model-update conditions
Fabricated submitted metrics	Complete B4 path	3	1	1	1	Metric-derivation trust boundary
Approved-artifact unavailability	Complete B4 retrieval path	3	1	1	1	Fail-closed cancellation before aggregation

The infrastructure matrix comprised two client counts, three methods, and three seeds, yielding 18 isolated executions and 54 scheduled rounds. The attack matrix comprised two methods, four model-update conditions, and three seeds, yielding 24 executions and 72 scheduled rounds. Their role is to establish integrated execution and expose measured protocol, overhead, trust, and failure behavior; the three-seed design is not used to rank B2, B4, and B7 statistically.

6.6. Groth16 Verification, Verifier Security, Gas, and Stage Overhead

The V2 Groth16 benchmark executed 30 witness-generation, proof-generation, and off-chain verification repetitions. All 30 valid proofs were verified, and all six malformed or context-inconsistent negative cases were rejected. Table 16 and Figure 14 report the measured timing distribution.

Table 16. V2 Groth16 benchmark over 30 local repetitions.

Stage	Mean (ms)	SD (ms)	Median (ms)	P95 (ms)
Witness generation	30.681	0.949	30.674	32.151
Proof generation	257.512	8.023	256.177	264.589
Off-chain verification	213.591	4.146	213.395	219.568

Figure 14. Measured V2 Groth16 witness-generation, proof-generation, and off-chain verification time. Error bars show sample standard deviation over 30 repetitions.

The verifier-security matrix recorded 14 expected rejections covering unauthorized signing, mutation of signed fields or bound lifecycle context, and replay or nonce reuse. A separate authorized-key-compromise scenario produced one accepted false decision. The results show that typed-data binding, signer authorization, expiration, revocation, and replay controls protect decision origin and payload integrity but do not establish the truthfulness of a signer that remains authorized.

The local Hardhat benchmark reported 348,811 gas per direct Groth16 verification over 30 valid transactions. Direct-verifier deployment used 1,001,364 gas, signed-verifier deployment used 828,703 gas, and ledger deployment used 2,595,352 gas. Table 17 reports model-submission and global-publication gas as participant batch size increased.

Table 17. Mean gas consumption under the local Hardhat benchmark. Submission values are per model; publication values include the participant set and global artifact references.

Batch Size	Submit-Model Gas	Publish-Global-Model Gas
1	483,635.6	242,606.2
5	469,953.3	347,492.8
10	468,327.3	478,761.8
20	467,514.4	741,218.8

Round creation, submission closing, aggregation start, and archival used 47,576, 30,636, 30,779, and 30,941 gas, respectively. Direct Solidity-verification wall-clock latency was not independently instrumented and is therefore not inferred from gas consumption.

Independent stage instrumentation measured mean local-training, local-evaluation, and fairness-computation times of 0.995, 0.573, and 0.154 ms, respectively. Mean artifact serialization, Kubo add, consumer retrieval, and consumer pin times were 0.025, 7.444, 5.478, and 3.142 ms. Mean EIP-712 decision signing, contract submission, and aggregation times were 1.843, 5.569, and 0.121 ms. These values arise from independently bounded stages with different observation counts and are not summed to construct a synthetic critical path.

6.7. Kubo/IPFS Performance and Recovery

Two independent native Kubo 0.29.0 repositories were connected over loopback. Each payload condition used 30 fresh objects and measured add, cold retrieval, warm retrieval, and consumer pinning. Retrieved content was checked against the corresponding serialized payload, and all byte comparisons succeeded. Table 18 and Figure 15 report the sequential-operation results.

Table 18. Two-peer Kubo/IPFS latency over 30 repetitions per payload size. All values are in milliseconds.

Payload	Add Mean	Cold Mean	Cold P95	Warm Mean	Pin Mean
1 KiB	55.43	22.20	25.36	0.98	19.77
10 KiB	56.83	22.06	26.46	1.52	20.72
100 KiB	56.41	24.33	34.80	1.58	20.54
1 MiB	81.53	62.77	74.98	5.74	20.65
10 MiB	67.44	77.22	85.93	20.99	17.04

Figure 15. Mean Kubo add, cold retrieval, warm retrieval, and pin latency across payload sizes. Both peers operated on one physical host and communicated over loopback.

Concurrent retrieval of fresh 1 MiB objects is summarized in Table 19. Mean aggregate throughput increased through concurrency 10 and then decreased slightly at concurrency 20, while mean batch latency continued to increase.

Table 19. Concurrent retrieval of fresh 1 MiB artifacts over 30 repetitions per concurrency level.

Concurrency	Mean Batch Latency (ms)	Mean Aggregate Throughput (MiB/s)
1	55.04	18.44
5	141.13	35.67
10	232.15	43.38
20	482.51	41.73

Thirty isolated recovery trials stopped the publisher after the consumer pinned a 1 MiB object. During the interruption, the consumer retrieved the pinned object in 5.92 ms on average. The publisher API became ready after 108.78 ms, and a complete restart followed by publication and byte-verified retrieval of a new object required 240.10 ms on average. The publisher identity remained stable in all trials. These measurements characterize the tested same-host two-peer topology.

6.8. Poisoning and Complementary Robust Aggregation

The five-seed algorithmic poisoning suite used 10 logical clients, five rounds, Dirichlet $\alpha =0.3$, and a 20% malicious-client ratio. It compared FedAvg (B0) with coordinate-wise median aggregation (B6) under clean, label-flip, sign-flip, and random-weight conditions. Table 20 reports the measured means.

Table 20. Algorithmic poisoning results over five seeds. The accuracy difference is B6−B0.

Condition	B0 Accuracy	B6 Accuracy	$\Delta$ Accuracy	B0 EOdds Gap	B6 EOdds Gap
No attack	0.7752	0.7688	$-0.0064$	0.0325	0.0252
Label flip	0.7731	0.7671	$-0.0060$	0.1205	0.0357
Sign flip	0.7714	0.7676	$-0.0038$	0.1162	0.0228
Random weights	0.6439	0.7725	$+0.1285$	0.0918	0.0283

Coordinate-wise median reduced the mean random-weight accuracy loss and increased mean accuracy by 0.1285 relative to FedAvg. The paired effect was sizeable ($d_z=0.878$), but no five-seed poisoning comparison remained significant after Holm correction. Median aggregation did not improve mean accuracy under label- or sign-flip conditions, although it produced smaller equalized-odds gaps in the tested runs. Figure 16 visualizes the accuracy results.

Figure 16. Final test accuracy under clean, label-flip, sign-flip, and random-weight conditions for FedAvg and coordinate-wise median aggregation. Error bars show sample standard deviation over five seeds.

The attack injection point is relevant to interpretation. Label-flip metrics were computed from a model trained on inverted labels. In contrast, sign-flip and random-weight replacement were applied after the client had completed genuine evaluation and preliminary policy computation; the submitted parameters therefore differed from the model from which the submitted metrics had been computed. The complete-path attack matrix processed these attacked submissions through the governed workflow and showed that all tested malicious sign-flip submissions passed the configured fairness gate. These outcomes demonstrate that policy admission, proof validity, and artifact consistency are not equivalent to model–metric consistency or malicious-update detection. Robust aggregation therefore remains a complementary control.

6.9. Trust-Boundary and Fail-Closed Outcomes

Two complete-path tests directly establish the boundary among cryptographic consistency, metric derivation, on-chain approval, and artifact availability. Table 21 reports the observed outcomes.

Table 21. Complete-path trust-boundary and fail-closed outcomes.

Scenario	Observed Result	Round State	Approved	Aggregated	Supported Interpretation
Fabricated submitted metrics	Policy-passing values were proved, approved on-chain, and included in aggregation	Archived	Yes	Yes	The combined proof and artifact-binding path verifies compliance and context for supplied values; it does not establish their correct derivation from private data
Approved artifact unavailable	Approved-model retrieval failed; no aggregation or global publication occurred	Cancelled	Yes	No	Approval is necessary but not sufficient; a required approved artifact must also be retrievable and valid

The fabricated-metric outcome distinguishes proof validity from honest metric derivation. The circuit evaluated the submitted, quantized policy statement, while external binding checks linked the public digest fields to the received artifacts. Because the complete submitted statement was internally consistent, fabricated policy-passing values were approved and aggregated; the path did not establish that those values had been produced by evaluating the submitted model on private data.

The unavailable-artifact outcome separately demonstrates fail-closed behavior. The approval record remained on-chain, but approved-model retrieval failed; the round transitioned to Cancelled, and no global model was published. Figure 17 places these outcomes alongside the measured verifier controls.

Figure 17. Observed verifier-control cases and trust-boundary outcomes. Security-control values are executed test-case counts, whereas the trust-scenario values are binary approval and aggregation outcomes; they are not probabilities.

6.10. Three-Client Workflow-Consistency Check

A fixed-seed three-client synthetic workflow was executed three times as a deterministic consistency check of artifact publication, signed verification, approval, approved-set FedAvg, global publication, and archival. All three executions used seed 1001, approved two clients, rejected one client, and produced global accuracy of 0.938889 and a demographic-parity gap of 0.144269. Runtime ranged from 3.562 to 4.323 s. Table 22 reports the execution-level values.

Table 22. Three-client workflow consistency check using a fixed dataset and seed.

Execution	Seed	Approved	Rejected	Global Accuracy	Global DP Gap
1	1001	2	1	0.938889	0.144269
2	1001	2	1	0.938889	0.144269
3	1001	2	1	0.938889	0.144269

Because the dataset and seed were fixed, this check evaluates repeatability of the workflow outputs and execution path rather than variation across independent experimental units.

6.11. Summary of Measured Findings

The results support six principal findings. First, pre-aggregation fairness policies alter client participation and the fairness–utility operating point, with the strongest statistically supported policy-gate trade-off observed for the heterogeneous COMPAS condition. Second, hard admission and FairFed server weighting produce distinct, dataset- and metric-dependent outcomes; neither intervention is uniformly preferable. Third, tightening policy thresholds reduces participation and can produce small measured group gaps alongside degraded predictive behavior. Fourth, the complete FairAI workflow executes with measurable proof, storage, contract, and retrieval overhead in the evaluated local environment. Fifth, coordinate-wise median aggregation reduced the measured random-weight damage in the five-seed poisoning suite, while its behavior differed under the other attacks. Sixth, the trust-boundary experiments separate proof and approval from metric derivation and artifact availability: self-consistent fabricated metrics were approved because they satisfied the encoded and externally bound statement, whereas an unavailable approved artifact prevented aggregation and global publication.

Viewed against the research questions, the core, FairFed, policy, representation, model-family, and scaling suites address RQ1 and RQ2 by quantifying how eligibility and weighting change participation, utility, and multiple fairness criteria. The complete-path matrices and fail-closed test address RQ3 by linking submitted artifacts to approval, retrieval, aggregation, and publication state. The proof, gas, stage, Kubo, concurrency, recovery, and scaling measurements address RQ4. The poisoning, malformed-evidence, replay, authorized-signer, fabricated-metric, and artifact-unavailability outcomes address RQ5. Each answer retains the experimental unit and repetition boundary defined in the Methodology and is interpreted within that boundary.

7. Discussion

The findings support FairAI as a governed pre-aggregation workflow in which model participation is determined through linked policy, evidence, authorization, storage, and lifecycle states. At the learning level, the configured fairness policy changes which client models may enter the aggregation population. At the systems level, the framework connects the submitted model and supporting artifacts to proof and binding results, an authorized decision, on-chain approval, CID-based retrieval, the selected aggregation operator, and the final-round state. The contribution is therefore not a claim that an approved model is automatically fair, private, truthful, or benign. It is an auditable mechanism for controlling model inclusion and for examining the consequences and failure points of that control before a new global model is created.

7.1. Fairness Intervention, Policy Calibration, and Representation

The policy-gate results in Table 8 and Table 9 show that pre-aggregation admission is most consequential under client heterogeneity. Under IID Adult allocation, B3 and B0 produced identical paired global models, and the IID COMPAS differences were small. In those conditions, the configured policy did not materially alter the admitted population. Under joint label/protected-group Dirichlet allocation, client utility and group composition varied more strongly, the gate excluded part of the submitted population, and the global fairness–utility operating point changed. This behavior is consistent with fair-FL research identifying non-IID data, protected-group imbalance, participation, selection, local optimization, and aggregation as interacting sources of disparity and utility variation [4,5,16].

The Adult and COMPAS outcomes also demonstrate why one fairness measure cannot summarize the intervention. Under heterogeneous Adult allocation, the demographic-parity gap decreased from 0.0273 to 0.0127, and the equalized-odds gap decreased from 0.0252 to 0.0169, while accuracy and macro-F1 also decreased. None of the paired Adult differences remained significant after Holm correction, so the observed directions do not establish a stable advantage. Under heterogeneous COMPAS, the operating-point shift was larger: accuracy decreased by 0.0686, and the equalized-odds gap decreased by 0.1036, and both paired differences remained significant after correction. Macro-F1 also decreased, whereas the subgroup-accuracy gap increased. Thus, the same policy reduced selected distributional gaps while worsening another subgroup criterion. Demographic parity, equal opportunity, equalized odds, and subgroup accuracy encode different properties and must be interpreted jointly with predictive utility.

The FairFed comparison in Table 10 and Figure 9 reinforces the importance of the intervention point. The B3 gate makes a binary admission decision from the configured utility and fairness conditions. The evaluated B5 comparator retains participating clients and changes their server-side weights using signed equal-opportunity differences. Under IID allocation, FairFed remained close to FedAvg. Under heterogeneous data, it produced larger and metric-dependent changes. For COMPAS, several group gaps decreased substantially, but accuracy and macro-F1 also decreased, and the subgroup-accuracy gap increased; several paired differences remained significant after Holm correction. For Adult, the equal-opportunity gap decreased, the demographic-parity gap increased, and between-seed variation prevented the paired changes from remaining significant. Hard admission and fairness-aware weighting therefore define different operating points rather than competing as equivalent algorithms. Their suitability depends on the selected fairness objective, utility requirement, protected attribute, outcome definition, and accepted change in client influence [17,18,19,20].

Policy sensitivity in Table 11 and Figure 10 shows that threshold selection is an operational control over participation. Mean all-round admission decreased from 0.594 under the lenient profile to 0.072 under the strict profile, while mean final-round admission decreased from 0.55 to 0.07. The strict profile produced very small selected fairness gaps, but these coincided with mean accuracy of 0.5007, macro-F1 of 0.3165, a subgroup-accuracy gap of 0.1956, and substantial variation. Small measured gaps under a highly selective rule therefore do not identify a preferable classifier by themselves. Policy calibration should consider utility, multiple fairness criteria, admitted-client count, represented sample mass, and the handling of empty or unstable aggregation sets.

An operational policy also requires a declared response when admission becomes too low. FairAI records a round without an admissible and retrievable set as unsuccessful rather than silently changing the aggregation population. A deployment must then determine whether to retain the preceding model, obtain further submissions, revise the profile, or escalate the decision.

The representation diagnostics in Table 12 and Figure 11 extend this point from client counts to sample composition. Local minority share was defined using the less frequent of the two protected groups within each client, without assuming that the locally less frequent group was always the globally designated unprivileged group. Under both non-IID conditions, the higher local minority-share group had higher observed admission and lower sample-weighted exclusion than the lower-share group. At $\alpha =0.3$, mean admission was 0.62 versus 0.44, and the corresponding excluded-sample fractions were 0.0966 and 0.1862. These associations are descriptive: they neither establish that entropy caused admission nor demonstrate that the resulting pattern is normatively fair. They show that a client-level rule can alter the composition of data represented in the global model. Entropy and local minority share are therefore monitoring variables, not additional eligibility criteria.

The MLP and logical-client results further constrain generalization. The one-hidden-layer MLP exhibited substantially greater seed variation, and no paired comparison remained significant after Holm correction. At 50 logical clients, FairFed produced a zero equal-opportunity gap, but the same runs had macro-F1 of 0.4299 and a subgroup-accuracy gap of 0.1962.

7.2. Proof Semantics, Decision Authorization, and Artifact Availability

The complete-path suites in Table 15 demonstrate how the governance components compose. The infrastructure matrix exercised B2, B4, and B7 at five and 10 logical clients, yielding 18 isolated executions and 54 scheduled rounds. The attack matrix exercised the complete B4/B7 path under four model-update conditions, yielding 24 executions and 72 scheduled rounds. Because these matrices used three seeds, their evidential role is functional and descriptive rather than inferential ranking. They show that native Kubo publication and retrieval, artifact verification, Groth16 processing, EIP-712 decisions, isolated contract state, on-chain approval, approved-CID retrieval, aggregation, publication, cancellation, and archival can operate as one workflow in the evaluated environment.

Blockchain and content-addressed storage provide complementary functions within this workflow. The ledger records attributable governance states, while Kubo carries the larger model and verification artifacts identified by their CIDs [6,7,8,21,22]. Neither mechanism alone establishes the complete inclusion decision. A CID provides content identity and tamper evidence, not policy compliance or availability; a ledger record provides a decision state, not the model bytes required by aggregation. FairAI’s governance contribution lies in preserving the relationship between the recorded decision and the exact artifact retrieved for use.

The proof benchmark clarifies the assurance provided by Groth16. All 30 valid V2 proofs were verified, and all six malformed or context-inconsistent cases were rejected. The circuit evaluates the submitted, quantized policy relation and carries the client, round, policy, nonce, and digest-field values as public context. SHA-256 values are recomputed from the retrieved artifacts outside the circuit and compared with those public bindings by the artifact-verification service. The assurance therefore arises from the combination of circuit verification and external artifact-binding checks; the circuit does not itself recompute the artifact hashes.

The fabricated-metric outcome in Table 21 defines the semantic boundary of this assurance. Policy-passing values were proved, bound consistently to the submitted artifacts, approved on-chain, and aggregated even though they differed from the locally computed measurements. This did not result from a malformed proof or an altered artifact. The submitted statement was internally consistent, and the proof correctly established the encoded relation over that statement. What remained unverified was the private process that produced the values and their correspondence to the submitted model. Stronger assurance would require a proof or attestation of evaluation, an auditable data commitment, trusted execution, or another mechanism linking private metric computation to the public eligibility claim [9,10,11,14,23,24,25,26].

The signed and direct verification paths place trust differently. The signed path uses EIP-712 domain separation, signer authorization, expiration, revocation, and replay controls. The security matrix showed that these mechanisms rejected unauthorized, altered, expired, revoked, and replayed decisions, but the authorized-key-compromise scenario produced an accepted false decision. Authentication can establish the origin and integrity of a decision without establishing the truthfulness of an authorized signer. Direct Solidity verification removes the signed intermediary from proof acceptance but retains dependence on the circuit, generated verifier, proving material, contract implementation, and setup process, while introducing measurable gas cost. The verification backend is therefore a governance and operational choice, not merely an interchangeable cryptographic detail.

Artifact availability remains a separate condition after approval. In the unavailable-artifact scenario, the approval record remained on-chain, but retrieval of a required approved model failed. The round transitioned to Cancelled, aggregation did not start, and no global model was published. This fail-closed behavior preserves the distinction among provenance, eligibility, availability, and actual aggregation inclusion. It also shows that replication, pinning, retrieval verification, and cancellation rules are part of model governance rather than external storage administration.

7.3. Poisoning, Robust Aggregation, and Privacy

The poisoning results in Table 20 and Figure 16 distinguish fairness governance from attack-oriented aggregation. In the five-seed algorithmic suite, coordinate-wise median increased mean accuracy by 0.1285 relative to FedAvg under random-weight replacement and reduced the measured equalized-odds gap. The paired accuracy effect was sizeable but did not remain significant after Holm correction. Under label- and sign-flip conditions, the median reduced the mean equalized-odds gap but did not improve mean accuracy. Its benefit was therefore attack-dependent rather than uniform.

The complete-path attack matrix exposes a related model–metric consistency problem. Label-flip metrics were computed from the model trained on inverted labels. By contrast, sign-flip and random-weight replacement were applied after genuine evaluation and preliminary policy computation, so the submitted parameters differed from the model from which the submitted metrics had been obtained. All tested malicious sign-flip submissions passed the configured fairness gate. A fairness rule, a valid proof over supplied values, and byte-consistent artifacts therefore do not jointly constitute a poisoning detector. Robust aggregation, anomaly detection, model–metric consistency checks, authentication, and attack-specific defenses address different threat surfaces and remain complementary to the governance path [13,27,28,29,32].

The privacy interpretation is similarly bounded. The client training and policy-evaluation rows were not published to Kubo or recorded on-chain, so the implementation maintains raw-record locality. The governed workflow nevertheless exposes model parameters, submitted metrics, public proof inputs, manifests, CIDs, transaction metadata, gas use, and timing information. The submitted-policy values are public proof signals and are not concealed by zero knowledge. Raw-record locality therefore does not establish protection against membership inference, model inversion, reconstruction, parameter leakage, metric leakage, CID correlation, or metadata analysis. Secure aggregation, differential privacy, encrypted computation, and empirical privacy-attack evaluation are complementary to FairAI’s provenance and authorization controls [30,31].

7.4. Systems Overhead, Storage Behavior, and Scaling Implications

The proof, gas, storage, and scaling measurements make the operational cost of governance visible. Mean proof generation and off-chain verification were 257.512 and 213.591 ms, respectively, and were substantially larger than the independently instrumented logistic-regression training, fairness-computation, and aggregation stages. The isolated stage means were collected with different observation counts and are not additive representations of one critical path. Direct Groth16 verification used 348,811 gas per measured transaction. Per-model submission gas remained broadly stable across the tested batch sizes, while global-publication gas increased with the recorded participant set. These values support relative analysis of local Hardhat contract operations; gas alone does not determine elapsed time, monetary fees, confirmation latency, or production-chain throughput.

The Kubo experiments provide direct component evidence for artifact handling. All measured objects were retrieved byte-for-byte. Aggregate throughput increased from 18.44 MiB/s at concurrency 1 to 43.38 MiB/s at concurrency 10, then decreased slightly at concurrency 20 while batch latency continued to rise, indicating saturation in the two-peer loopback topology. In the recovery trials, a consumer-pinned object remained retrievable during publisher interruption, the publisher retained its identity after restart, and a newly published object was subsequently retrieved and verified. These findings support independent retrieval, pinning, and byte verification as availability controls, but they do not characterize geographically distributed or public-IPFS operation.

Logical-client scaling likewise measures computation on one host rather than distributed deployment. FedAvg accuracy remained comparatively stable from 3 to 50 clients, while sequential runtime increased. FairFed runtime increased from 51.3 ms to 220.1 ms over the same range, consistent with its additional client-level statistics and weighting operations. Network transfer, stragglers, independently administered clients, cross-host scheduling, and distributed failures were not represented. The fixed-seed three-client consistency check similarly supports repeatability of one configured workflow, not independent statistical generalization.

7.5. Ethical Scope and Positioning Within Trustworthy Federated Learning

FairAI occupies a different intervention point from the principal research streams reviewed in Section 3. Relative to fairness-aware training and aggregation, it provides a versioned admission and audit process around a submitted-model artifact. Relative to blockchain-based FL, it links ledger state to proof evidence and to the exact off-chain artifact retrieved for aggregation. Relative to verifiable FL, it places the proof at the policy-eligibility boundary and connects proof acceptance to an authorized governance decision. Relative to robust FL, it preserves a modular stage at which attack-oriented aggregation can operate over the approved and retrieved population.

Group fairness is the ethical property directly encoded and measured in the experiments. Transparency, accountability, responsibility, and integrity are supported as governance properties: submissions and decisions are attributable, artifacts are content-addressed, authorized actions and lifecycle transitions are recorded, and the path from a local contribution to a global output can be reconstructed. These properties make a fairness decision inspectable, but they do not transform one policy threshold into a complete theory of ethical AI.

Honesty illustrates the distinction. FairAI can record which values were submitted, verify the encoded policy relation, authenticate the decision source, and expose later alteration, yet the fabricated-metric and authorized-signer tests show that truthfulness is not fully established. Broader ethical dimensions, including legal legitimacy, social responsibility, respect, and environmental impact, require domain, institutional, and social justification beyond the proof and ledger. The term ethical should therefore be understood here as fairness-centered governance with explicit evidence and trust states. FairAI’s distinctive contribution is to connect policy outcome, artifact identity, verification, authorization, availability, and aggregation consequence within one auditable lifecycle.

7.6. Limitations and Overall Interpretation

The first limitation concerns external validity. Adult and COMPAS are public tabular datasets with binary outcomes, and one evaluated protected attribute per dataset. Logistic regression is the principal model, and the MLP suite covers one small neural architecture. The primary comparisons use 10 paired seeds, whereas the MLP, scaling, and algorithmic-poisoning suites use five and the complete-path matrices use three. The statistical results characterize variation induced by the executed partitions, initializations, and training conditions on these datasets; they do not represent every population, policy, model family, or deployment domain.

The second limitation concerns topology and operational realism. Dataset preparation and partition construction were centralized, and the clients were logical processes rather than independently administered institutions or devices. The Kubo repositories communicated over loopback, the contracts ran on an ephemeral Hardhat network, and the infrastructure suites used one host. Persistent ledgers, geographically separated peers, network contention, client churn, stragglers, and multi-host failures would introduce effects not represented in the measured storage, gas, recovery, and scaling values.

The third limitation concerns assurance coverage. The V2 relation verifies the submitted, quantized policy statement, while external checks verify the corresponding artifact bindings. Neither proves the complete local training and evaluation procedure nor the semantic correspondence between submitted parameters and metrics. The signed path depends on the authorized verifier, and the proving material was generated through the experimental single-contributor setup. Direct verification was evaluated for gas but was not substituted for the signed backend in the complete-path matrices. The contracts were exercised through the reported security scenarios but were not independently audited or formally verified.

The fourth limitation concerns privacy and adversarial coverage. The study did not implement secure aggregation, differential privacy, encrypted updates, or empirical inference and reconstruction attacks. The poisoning experiments evaluated label flip, sign flip, and random weights at the configured malicious-client ratios; the protocol tests covered defined authorization, binding, replay, signer, and availability conditions. Adaptive backdoors, collusion, sybil participation, strategic long-horizon attacks, and broader storage or verifier failures were not evaluated.

Within these limits, the evidence supports a precise interpretation. FairAI implements fairness-policy admission as a traceable model-artifact workflow; separates hard admission from fairness-aware weighting; links supplied policy claims to artifact and round context; records authorized on-chain approval; retrieves the approved model through its CID; applies the configured aggregation operator; and cancels a round when the approved-artifact set cannot be validated. The same experiments identify the design’s limits: fairness interventions can trade utility against different disparity criteria and representation; self-consistent evidence does not establish honest metric derivation; fairness admission does not identify every poisoned model; and content identity does not guarantee availability. FairAI’s value lies in making policy, evidence, authorization, availability, inclusion, and failure states explicit so that stronger fairness, attestation, privacy, and robustness mechanisms can be added at their appropriate intervention points without losing traceability from local submission to global model.

8. Conclusions and Future Work

This article introduced FairAI, a governed model-artifact framework for fairness-gated federated learning. FairAI connects local model generation, content-addressed publication, versioned policy evaluation, Groth16 evidence, authorized smart-contract decisions, CID-based retrieval, selective aggregation, and global publication within one auditable lifecycle. A local model influences the global update only when its submission satisfies the configured governance predicates and the approved artifact is subsequently retrieved and validated through its registered CID. The framework therefore makes model eligibility, provenance, authorization, availability, and aggregation inclusion explicit stages of federated learning.

The real-data experiments showed that pre-aggregation admission and fairness-aware server weighting define distinct fairness–utility operating points. Under heterogeneous Adult data, the policy gate reduced the demographic-parity gap from 0.0273 to 0.0127 while accuracy decreased from 0.7740 to 0.7629; the paired differences did not remain significant after Holm correction. Under heterogeneous COMPAS data, the equalized-odds gap decreased from 0.2262 to 0.1226 while accuracy decreased from 0.6495 to 0.5809, and both paired differences remained significant after correction. The policy-sensitivity results further showed that threshold selection governs participation as well as measured disparity, while the FairFed, representation, MLP, and logical-client analyses demonstrated that the resulting operating point depends on the intervention mechanism, dataset, client distribution, fairness criterion, and model family.

The complete-path evaluation linked native Kubo/IPFS publication and retrieval, Groth16 processing, EIP-712 decisions, Solidity contracts, on-chain approval, approved-CID retrieval, and aggregation in a single executable workflow. All 30 valid V2 proofs were accepted, and all six malformed or context-inconsistent cases were rejected. Retrieved artifacts were checked against their published content, and the contract layer recorded approval, rejection, publication, cancellation, and archival states. When an approved-model artifact became unavailable, the round was cancelled before aggregation, and no global model was published. The poisoning experiments also showed that policy admission and robust aggregation address different stages of the workflow: coordinate-wise median produced its clearest mean benefit under random-weight replacement, while its effect remained attack-dependent.

The fabricated-metric experiment identifies an important assurance boundary. The implemented proof relation verifies the submitted, quantized policy statement and its artifact context; it does not verify the private process by which the submitted metrics were derived. Similarly, the signed-verifier path authenticates an authorized decision and its domain context, while the truthfulness of an authorized signer remains a separate governance concern. These findings sharpen the contribution of FairAI as a governance framework that makes the claims, artifacts, decisions, retrieval outcomes, and aggregation consequences of federated participation traceable and enforceable.

A central direction for future work is to extend proof-linked governance from submitted-policy compliance to verifiable metric derivation and model–data consistency. This can be investigated through proofs of evaluation, auditable data commitments, trusted execution and remote attestation, or hybrid mechanisms that bind a private evaluation procedure to the public eligibility claim. The verification architecture can also be strengthened through governed multi-party proving-key generation, decentralized or threshold verifier sets, formal smart-contract verification, independent security assessment, and proof constructions designed to reduce verification and publication cost.

A second direction is to integrate stronger privacy and adversarial safeguards into the governed lifecycle. Secure aggregation, differential privacy, encrypted computation, and empirical membership-inference, inversion, and reconstruction tests would extend the privacy evaluation beyond raw-data locality. Adaptive poisoning, backdoors, collusion, sybil participation, anomaly detection, and additional Byzantine-resilient aggregation methods would broaden the robustness analysis while preserving the distinction between governance admission and attack-oriented model filtering.

Finally, FairAI should be evaluated across independently administered clients, persistent multi-host deployments, wider-area networks, longer-running federations, stragglers, verifier failures, and distributed storage disruptions. Broader datasets, model families, protected attributes, fairness definitions, participation measures, and domain-specific policies are also needed to study how approval-gated aggregation transfers across application settings. Such evaluations will determine how the policy, assurance, and operational mechanisms introduced by FairAI should be calibrated when the governed artifact lifecycle is deployed across real institutional boundaries.