Security under observation.
LeakDetect AI is an open-source framework that detects, measures, and simulates hidden information leakage across Ethereum wallets, AI agents, smart contracts, and multi-chain systems.
Instead of asking "can this system execute safely?" LeakDetect asks: what does this system unintentionally reveal while operating?
The threats no one is watching.
Ethereum security today focuses on visible failures: contract exploits, phishing, wallet compromise. But systems can function correctly while unintentionally leaking sensitive information.
Adversaries with deep learning, statistical inference, and side-channel analysis are turning observation itself into the attack surface.
Mapped to Ethereum's trillion-dollar security themes.
- Signing-time leakage analysis
- Wallet interaction observability
- Approval-pattern fingerprinting
- Autonomous signing behavior
- Behavioral deanonymization
- Multi-chain traceability
- Wallet fingerprinting
- AI-agent operational inference
- Bridge interaction leakage
- RPC metadata exposure
- Cross-chain timing analysis
- Infrastructure observability risk
- AI transaction agents
- Autonomous execution frameworks
- Agent-to-agent coordination
- AI-generated contract flows
Five layers, one observability pipeline.
Measurable security, not vibes.
LeakDetect introduces standardized metrics so that observability risk can be tracked, benchmarked, and reduced across releases: the way performance and coverage already are.
Eight years of leakage research, ported to Ethereum.
Benchmarked leakage detection, measured against baselines.
Results from the LeakDetect AI research pipeline: AutoML based leakage detection on timing and error-code vulnerabilities, side-channel key recovery benchmarks, and validation against an industrial-grade TLS testing tool.
| Technique | 10/90 | 30/70 | Balanced |
|---|---|---|---|
| AutoML Mid-Point | 0.50 | 0.50 | 0.78 |
| AutoML Log-Loss | 0.50 | 0.66 | 0.74 |
| DL-LA Baseline | 0.46 | 0.49 | 0.50 |
| Technique | 10/90 | 30/70 | Balanced |
|---|---|---|---|
| AutoML Mid-Point | 0.34 | 0.36 | 0.88 |
| AutoML Log-Loss | 0.88 | 0.91 | 0.93 |
| AutoML Cal Log-Loss | 0.87 | 0.91 | 0.94 |
| AutoML Fischer's Exact Test | 0.82 | 0.62 | 0.95 |
| AutoML Paired t-Test | 0.61 | 0.59 | 0.96 |
| GMM Baseline | 0.33 | 0.33 | 0.33 |
| MINE Baseline | 0.63 | 0.64 | 0.67 |
| PC-Softmax Baseline | 0.69 | 0.69 | 0.70 |
| DL-LA Baseline | 0.51 | 0.56 | 0.72 |
LeakDetect: protecting Ethereum from hidden leakages.
We are grateful to everyone who supported LeakDetect through the Ethereum Security QF round. The project received direct donations plus ETH from the matching pool, with special thanks to The DAO Fund, Wintermute and all individual contributors.
- →Complete real-world dataset collection and preparation.
- →Run automated leakage detection across Ethereum, Zcash, Tornado Cash, wallets and ETH-FIL workflows.
- →Extend analysis to P2P/libp2p network-level leakage.
- →Publish technical reports, datasets where appropriate, case studies and IETF materials.
- →Document reproducible findings, leakage scores and practical mitigations.
- →Refine milestones with Ethereum security and P2P contributors and continue the 1TS proposal.
- →Explore a Trillion Dollar Security Research Retreat bringing researchers, protocol developers and security engineers together.
Scalable, private, and decentralized by default.
As LeakDetect AI scales across wallets, agents, and chains, we are building the infrastructure to keep security intelligence open, privacy-preserving, and censorship-resistant: from storage to inference.
Audit logs, inference traces, and leakage datasets are stored on IPFS with content-addressing and encryption. No single point of failure. No custodial data silos.
P2P gossipsub and DHT routing enable AI agents to share threat signals, model updates, and observability metadata without centralized relays. Resilient by design.
Privacy-preserving computation for ML training and inference. Secrets are split into shares across a decentralized network: no node ever sees the full model or raw data.
Foundation models, tokenizers, and evaluation pipelines integrated natively. Fine-tune leakage-detection transformers and publish them back to the community.
Open infrastructure for observability-aware security.
- CLI tooling
- SDKs
- Wallet integrations
- AI-agent integrations
- Multi-chain test infra
- Standardized leakage datasets
- Open benchmark suites
- Reproducible pipelines
- AI-agent observability corpora
- Wallet providers
- AI-agent frameworks
- Infrastructure providers
- Security monitoring
- Multi-chain dApps
- Leakage-aware metrics
- Wallet observability standards
- Agent operational assessment
- Cross-chain metadata risk
- IPFS for privacy-preserving log storage
- libp2p for decentralized AI networking
- Nillion zk training & inference pipeline
- Hugging Face model integration & fine-tuning
Collaborations powering observability-aware security in the wild.
- Live testing on Park Pro Token (PPT) using a Ledger hardware wallet
- PPT is listed across 10+ key EVM chains on SushiSwap and Mainnet
- Real-world wallet, signing and cross-chain leakage telemetry feeds the detector
Real-time leakage detection for AI agents.
Sunstone: a solar-powered IoT emergency pendant for elderly individuals living alone: is a key government-affiliated project that has added LeakDetect AI to its roadmap. The same temporal-anomaly principle Sunstone uses to catch a medical emergency from continuous sensor data is being applied to live AI-agent behavioral streams on Ethereum.
LeakDetect AI today profiles a system, trains on its traces, and measures leakage: ideal for controlled hardware devices and TLS servers. AI agents executing autonomous transactions on Ethereum are different: they emit signals continuously, and an adversary won't wait for a profiling phase to finish. The Sunstone roadmap brings a streaming detector that learns normal behavior in place and raises a flag the moment something drifts.
Identify the behavioral signals AI agents emit: transaction timing, gas usage per operation, signing behavior, API call sequences, response-time variance: and structure them as time-series streams. Synthesize a standardized Ethereum-agent dataset of normal sequences plus injected leakage patterns, in the same spirit as ASCAD / AES_HD for hardware. Statistically profile the normal sequences to establish a baseline the live detector can reason against.
Validate the core idea: can a temporal model watching a live stream of agent behavioral signals detect leakage-shaped deviations? A Bidirectional LSTM consumes a sliding window of readings, trains only on normal sequences, and flags anything outside that envelope. BiLSTM reads context in both directions, which helps separate true anomalies from noise. Output: a Python PoC that ingests a simulated stream, learns normal, and raises real-time flags as new data arrives.
Different channels carry different signal depending on the leak: timing for timing leaks, gas for computation-heavy leaks. An attention layer on top of the BiLSTM learns per-channel and per-timestep weights, focusing the model on the most informative slices of the sequence. The weighted summary feeds the anomaly scoring head. Benchmarked against the Phase 2 baseline on detection accuracy and false-positive rate.
The temporal detector sits alongside the existing profiling pipeline as a live monitoring layer: offline benchmarking stays, real-time flagging is added. A lightweight collection interface captures agent signals as time-series windows. Anomaly scores are mapped onto the existing VS / KRP / ILR vulnerability framework so outputs are consistent. Initial benchmarks on simulated Ethereum-agent scenarios give comparable numbers to the hardware and TLS suites already in the repo.
In decentralized systems, anything observable can eventually become exploitable.
We invite Ethereum researchers, wallet providers, AI-agent developers, infrastructure builders, and multi-chain teams to collaborate with LeakDetect AI in advancing the next generation of Ethereum security.