# Blockchain for Large Language Model Security and Safety: A Holistic Survey

Caleb Geren

Amanda Board∗

Gaby G. Dagher

These authors contributed equally to this work. Lehigh University
<EMAIL_ADDRESS>University of Idaho  boar9227@ vandals.uidaho.edu Boise
State University<EMAIL_ADDRESS>Tim Andersen

Boise State University<EMAIL_ADDRESS>Jun Zhuang

Boise State University<EMAIL_ADDRESS>
###### Abstract

With the advent of accessible interfaces for interacting with large language
models, there has been an associated explosion in both their commercial and
academic interest. Consequently, there has also been an sudden burst of novel
attacks associated with large language models, jeopardizing user data on a
massive scale. Situated at a comparable crossroads in its development, and
equally prolific to LLMs in its rampant growth, blockchain has emerged in
recent years as a disruptive technology with the potential to redefine how we
approach data handling. In particular, and due to its strong guarantees about
data immutability and irrefutability as well as inherent data provenance
assurances, blockchain has attracted significant attention as a means to
better defend against the array of attacks affecting LLMs and further improve
the quality of their responses. In this survey, we holistically evaluate
current research on how blockchains are being used to help protect against LLM
vulnerabilities, as well as analyze how they may further be used in novel
applications. To better serve these ends, we introduce a taxonomy of
blockchain for large language models (BC4LLM) and also develop various
definitions to precisely capture the nature of different bodies of research in
these areas. Moreover, throughout the paper, we present frameworks to
contextualize broader research efforts, and in order to motivate the field
further, we identify future research goals as well as challenges present in
the blockchain for large language model (BC4LLM) space.

##  1 Introduction

From disparate areas such as software development, the solicitation of
political advice, and assistance in creative writing tasks, the introduction
of large language models into everyday life has occurred at unprecedented pace
and scale [106]. Consequently, many of the vulnerabilities that large language
models contend with are well known and understood in the current literature,
such as prompt injection [74][98], hallucinations [52][130][83][12], and data
poisoning [37][54]. Despite this, relatively little in terms of mitigation has
been introduced to combat such weak points [124][2]. The ramifications of this
fact are far-reaching in regards to user experience and mounting data
integrity concerns surrounding AI systems at large [118][40][68].

For example, and representative of the variety of threats that LLMs face, is
the concerning fact that LLMs are easily coaxed into revealing personally
identifiable information (PII), as in the case when an LLM was persuaded into
divulging undisclosed names, physical addresses, emails, phone numbers, and
twitter handles associated with specific individuals to an unauthorized user
[20]. Similarly, attacks such as prompt injection can be compounded with a
model’s tendency to divulge information, resulting in massive data leakage
[118]. Typically, defensive responses to these threats manifest themselves in
the application of established machine learning techniques, such as
differential privacy strategies applied to entire corpus’ to improve privacy
guarantees [1][122]. While this is an important application, it is often the
case that DP guarantees are not enough to fully ensure data privacy in a large
language model [68] due to DP’s ability to protect primarily ”by whom” data is
contributed, rather than ”about whom” the data is focused on. Additionally,
another common attempt to tackle the data privacy problem in LLMs is the use
of federated learning (FL) in the training process. This technique distributes
training across multiple nodes to create a decentralized environment for model
data to exist within [75]. Naturally, this lends itself to further obscuring
sensitive information in a model’s corpus. However, it has been shown that by
taking model weights or gradients, original data from the model can still be
reconstructed [63]. Additionally, federated learning solutions are susceptible
to many of the same types of attacks as large language models, such as single-
point-of-failure attacks or man-in-the-middle attacks [86]. This trend of
typical machine learning solutions failing to exhaustively defend against the
range of attacks now affecting LLMs continues across multiple traditional
threat/defense models [96, 132, 122].

It is clear that to counter new threats arising from large language models
there is a simultaneous need for new technologies to be introduced into the
space. Situated in a similar position to LLMs in their rapid emergence and
adoption are blockchain systems. They have the ability to ensure data
integrity via various tamper-evident mechanisms, introduce a high degree of
confidentiality into otherwise centralized systems, and allow for data
provenance guarantees through traceable and auditable data [27][19][77][4].
These qualities of blockchain systems place themselves at an ideal juncture to
be used for bolstering the robustness of large language models. This
integration creates the necessary conditions to allow for stronger privacy
preservation, enhanced inference checks, anti-adversarial attack technologies,
and similar defenses to be incorporated into the design of large language
models.

This unification of technologies has become a hot topic of research within
both blockchain and large language model oriented communities over the last
several years. As a field in its infancy, blockchain for large language models
(BC4LLM) demands rigorous analysis so that it may progress unhindered from any
limitations that may arise from the combination of two newly introduced
fields, especially given their relative complexity and various nuances.
Towards this end of progress in the fields of large language models and
blockchain systems, we present this survey paper as a vehicle for researchers
to better grasp the state of the two fields and especially understand the
combination of the two technologies in the vein of how blockchain can better
serve large language model systems. To clarify our goals with this paper, we
introduce four research questions that motivate the entirety of the paper and
generalize our aim in writing this survey. They are as follows:

  1. RQ1.

What are the pressing LLM-related security concerns that may be addressed with
blockchain technology?

  2. RQ2.

How can we meaningfully differentiate between security and safety in the
context of BC4LLMs?

  3. RQ3.

In what ways can blockchain technology be used to enhance the safety of LLMs?

  4. RQ4.

What are prominent gaps within the BC4LLMs area, how can these gaps influence
research directions, and what resources can we provide to enable potential new
directions?

Of note is our focus specifically on how blockchain systems may impact large
language model security and safety. We limit the scope of this survey to these
terms in order to provide finer-grained analysis and categorization of
seemingly disparate works - and to more clearly spur research advances in
specific directions. Indeed, we typically see attacks on LLMs occur via
malicious third parties which exploit system vulnerabilities (security)
[5][121][132][44][66] or as passive issues embedded in the structure of a LLM
which places users at risk with no malicious outside influence (safety)
[34][109][92][125]. It is because of this encompassing distinction that we
offer our analysis of the blockchain for LLM (BC4LLM) space in the context of
security and safety. Moreover, we further bolster the significance of this
distinction with definitions of security and safety in the context of large
language models. To the best of our knowledge, we are the first paper to
rigorously introduce such definitions as we aim to lay a foundation upon which
future BC4LLM works can build. It is also worth pointing out our contributions
towards further defining privacy measures in the form of active privacy and
passive privacy efforts, modeled after Yan et al’s survey on bolstering data
privacy [122].

Table 1: Overview of Existing Related Surveys. Reviews concerning blockchain
and large language models take many different forms and facilitate different
functions within the broader context of BC4LLMs literature. However, a
holistic review of BC4LLMs is absent from the current state of the field. For
example, while many survey papers have focused to some degree on general
threats affecting LLMs, fewer have considered LLM-specific threats or
approached these problems from the direction of using blockchain technology.
In this table, we document to what degree several important components of our
survey are present in different reviews. In particular, we examine if the
background is given on relevant subjects, if a model of threat categorization
is introduced, if definitions of security and safety are proposed, whether
security and/or safety in regards to BC4LLMs is explored, if future BC4LLMs
work is probed, and whether or not the survey instead focuses on LLM for
Blockchain (LLM4BC) instead of BC4LLM.
denotes a full discussion of the related topic,  a partial discussion, and
indicates the topic was absent from the review.

Source |  LLM and BC Background | Threat Model | Definitions | Security in BC4LLMs |  Safety in BC4LLMs |  Future Work |  LLM for Blockchain
---|---|---|---|---|---|---|---
|  |  |  | LLM | AI | Non-AI |  |  |
Luo, et al. 2023 [69] |  |  |  |  |  |  |  |  |
Mboma, et al. 2023 [73] |  |  |  |  |  |  |  |  |
He, et al. 2024 [42] |  |  |  |  |  |  |  |  |
Heston 2024 [30] |  |  |  |  |  |  |  |  |
Salah, et al. 2019 [91] |  |  |  |  |  |  |  |  |
Bhumichai, et al. 2024 [13] |  |  |  |  |  |  |  |  |
Dinh and Thai 2018 [28] |  |  |  |  |  |  |  |  |

To separate ourselves, and our analysis of BC4LLM through the lens of safety
and security, from other similar works, we look at several other closely
related reviews. He et al. [42] examine the relationship between large
language models and blockchain in analyzing how large language models can
further enhance blockchain systems in the LLM4BC space. Mboma et al. [74]
provide an exploratory review of general integrations between blockchain and
large language models, which is similar to Heston’s analysis of integrating
the two technologies in the sphere of telemedicine [30]. In the case of Salah,
et al. [91], Bhumichai et al. [13], and Dinh et al. [28], we see the
exposition of potential and existing technologies between blockchain and
artificial intelligence in general. In summary, existing reviews that contend
specifically with the blockchain and large language model space are not
focused on the direction in which they apply the technologies. On the other
hand, reviews that concern blockchain and AI as a whole lose the benefits of
tighter granularity and focus. We present an overview of related works in
table 1, which juxtaposes the above papers’ contents with our specific
focuses, stressing the differentiating factors that we introduce into the
space.

###  1.1 Contribution

We outline the exact contributions of this survey paper, and highlight their
impact in answering our research questions. They are as follows:

  1. 1.

We present several key contributions in the form of various frameworks,
definitions, and compiled resources. Most prominently, we introduce a taxonomy
of blockchain for large language Models in Figure 3. This taxonomy aims to
succinctly explain the relevant interactions between various blockchain
components and corresponding large language model vulnerabilities [RQ1][RQ3].
To further motivate and contextualize this taxonomy as well as our general
discussion of existing literature, we introduce two definitions of safety and
security as they apply to large language models [RQ2]. Moreover, we also
provide multiple datasets relevant to BC4LLM in order to provide future
researchers in the area with the tools to expand upon connections highlighted
by the taxonomy and motivated by our definitions [RQ4].

  2. 2.

We also highlight several other important components of our paper, intended to
support our main contributions but still relevant in their own regard as
pertinent artifacts of the BC4LLMs space. One such artifact is our definitions
of specific areas that are found within our definition of safety, further
expanded upon in Table 3 [RQ2][R3]. These definitions add further weight to
our definition of safety for large language models. We go on to bolster our
definitions of both safety and security by purposefully focusing on the issue
of privacy in the context of security, consequently reaffirming two terms as
introduced by Yan et al. [122]: passive and active privacy [RQ1][RQ3]. Also
relevant in their own right but primarily proposed as supporting contributions
are our contextualization of LLMs as a sub-field of various AI areas [RQ1],
and our succinct taxonomic overview of blockchain components [RQ1][RQ3].

  3. 3.

Finally, we make note of the overarching goal of our paper, which also stands
as the most critical contribution we offer. That is, we present this paper in
part as a holistic literature review in Section 4. In it, we categorize
relevant fields to present novel insights into the space, classify research
efforts in several interrelated respects, relate all BC4LLM research projects
to LLM safety and security, and as a result capture an accurate and
informative picture of how blockchain can benefit large language models
[RQ1][RQ2][RQ3][RQ4].

The remainder of the survey is organized as follows: Section 2 introduces the
background of blockchain technology and large language models. Section 3
consists of our methodology; we analyze how we filtered works for this review,
and introduce the relevant definitions which motivate our analysis of the
current literature. We also share our model of threat categorization, similar
to Yao et al.’s categorization [124]. In Section 4, we present the
comprehensive literature review of the BC4LLM space in the context of safety
and security. We then scrutinize works within these areas in relation to our
BC4LLM taxonomy. Within Section 5, we present relevant datasets to the BC4LLM
space in order to supply future researchers with both well-known and more
obscure datasets. Afterwards, in Section 6, we discuss important challenges
that exist between blockchain technology and large language models which
fundamentally hinder progress in the field at large. Section 7 proposes future
research directions in the BC4LLM space, and section 8 concludes the paper,
which both summarizes our efforts in surveying the BC4LLM area and provides
further insight into the state of BC4LLM as a whole.

##  2 Background

In this section, we present an overview of blockchain as a distributed ledger
technology and relate the abilities of large language models to their
capacities as agents with respect to their nature as both AI models and their
tendency to interact with vast quantities of data.

###  2.1 Blockchain

Since the introduction of Bitcoin as a decentralized currency by Satoshi
Nakamoto in 2008 [79] there has been a subsequent explosion of academic and
commercial interest in its underlying blockchain technology. Additionally, and
as highlighted by the introduction of Vitalik Buterin’s Ethereum blockchain in
2014 [17], there has been a particular focus on blockchain’s potential
applications in fields entirely disparate from digital currencies. The
interest in blockchain, or distributed ledger technologies, stems from its
guarantees about data sovereignty, transparency, and relative permanence.
Concisely, these properties are often referred to as immutability and
irrefutability. Ranging from many diverse fields such as health care record
management, digital identity management, or tax auditing, these properties are
widely applicable and highly desirable, even though the mechanisms through
which we achieve them can be somewhat complex and opaque. In light of the
oftentimes convoluted nature of blockchain systems, we introduce blockchain to
the reader in a piecemeal fashion in order to emphasize the modular, yet
interconnected nature of such systems. Figure 1 represents an overview of our
characterization of blockchain systems in general. We purposefully exclude
certain components such as the incentive mechanism, or wallets, as they are
beyond the scope of our analysis of blockchain as a means to serve large
language models.

Figure 1: A blockchain consists of four main components. A decentralized
network of nodes interacts with a ledger via a governing consensus mechanism.
This ledger, adequately protected by the consensus mechanism, creates what we
refer to as the blockchain. Layer 2 solutions can interface with this ledger
to enable greater functionality between users and a blockchain’s data.

####  2.1.1 Blockchain Components

Consensus Protocol. Of particular interest to the BC4LLM space, and arguably
the most fundamental component within a blockchain, the consensus protocol is
the governing system that controls how data is added to a blockchain’s ledger.
At its core is the consensus mechanism, which both ensures the validity of
proposed data and fosters an environment of accountability, so that nodes
submitting invalid information may be penalized accordingly. For example, the
Proof of Work (PoW) consensus mechanism [79] is by far the most widely known.
In it, nodes must solve a complex mathematical equation in order to gain
rights to propose data for the blockchain. When such a node submits new data,
it is scrutinized by every other node in the system. If the data is malicious,
or untruthful, the proposal is rejected and the corresponding processing power
performed by the malicious node has effectively been wasted, as that node will
not receive the incentive, a Bitcoin reward. The underlying ideas of
accountability, certain nodes being selected as ’block proposers’, and the
’proof’ of the ability to submit information to the chain are central ideas in
consensus protocols across blockchains with different consensus protocols
[81].

Verifiable Ledger. At a blockchain’s core sits the verifiable ledger, a
repository of data bolstered by a secure way of maintaining the integrity of
that data. Of note is the particular technique through which data itself is
verified on the ledger: the Merkle tree [76], or a variation thereof.
Typically implemented as a ground-up binary tree, data is stored in leaf
nodes, with hashed pointers of that data cascading up the tree. This structure
results in a comprehensive ’Merkle root’, a hash pointer consisting of all the
other hash pointers in lower levels of the tree, which is ultimately based on
the data stored in the leaf nodes. This technique ensures the integrity of
information in the leaf nodes, as any alteration to the data is instantly
reflected in the Merkle root. Likewise, new additions to the Merkle tree can
be checked against previous states of the tree via a recalculation of the
Merkle root accounting for the new transactions. This technique, complementing
the verifiable ledger, is often the key to LLM data provenance and
traceability solutions that rely on blockchain technology.

Decentralized Network. Critically, blockchain’s are decentralized networks.
That is, no central server or group of servers may assume control of the
network in a way that would compromise the network’s state of trustlessness.
This is achieved through multiple avenues, such as the aforementioned
consensus protocol, the distribution of the verifiable ledger among a large
number of independent nodes, and the accessibility of a given blockchain’s
network. [27] In this way, no users in the network are required to trust any
other user. This fundamental aspect of blockchain is responsible for already
realized and potential advancements with LLMs concerning areas such as RAG,
the training process, and even supply chain issues.

Layer 2 Technologies. Apart from the fundamental components found within all
blockchains themselves, there exist several external architectures that
interface with blockchains and further enhance their applicability. Typically,
these are referred to as layer 2 technologies, as they sit a ‘layer’ above the
‘layer 1’ blockchain. Increasingly relevant as blockchain’s influence grows,
layer 2 solutions are a burgeoning area with numerous novel research
directions. Most prominent among these is the space concerning smart
contracts, scripts that rely on a blockchain’s security guarantees in order to
facilitate off-chain transactions [140]. Also of note in the layer 2 field,
and sometimes combined with the efficacy of smart contracts, are zero-
knowledge rollups. Often used to strengthen scalability, zero-knowledge
rollups batch unproposed transactions together, and instead of submitting the
transactions themselves, submit proof that the transactions are indeed valid
[103]. This allows for transactions to be added on-chain without the need for
every full node to redo the calculations found within those transactions. This
area of layer 2 technologies is pivotal as it relates to BC4LLM - layer 2 has
the necessary dynamism to react quickly to new and emerging LLM
vulnerabilities.

###  2.2 Large Language Models

In recent years, large language models (LLMs) have grown in popularity as a
driving force in artificial intelligence (AI), being used across various
fields, such as trustworthiness [51, 25], scholarly document processing [142],
signal processing [89], quantum computing [58], climate production [60, 59],
software engineering [139], and healthcare [42] among multiple other learning
environments. Zhao et al. [135] and Yang et al. [123] define LLMs and pre-
trained language models (PLMs) from the perspectives of model size and
training approach. Generally speaking, PLMs refer to language models that are
pre-trained on large amounts of general text data and then fine-tuned for
specific tasks. LLMs are a kind of PLM. The key distinction is that LLMs are
generally larger in scale with more parameters. These large language models
have demonstrated the ability to learn universal representations of language,
used in various natural language processing (NLP) tasks [47], bolstering their
applicability.

Figure 2: LLMs are a subset of AI. The focus of our paper is LLMs; however, we
acknowledge AI due to the intertwined relationship between LLMs and AI.

LLMs are a sub-field of AI. Given this connection, discussions of blockchain
for AI (BC4AI) research can also be applicable to LLMs. Figure 2 demonstrates
the connections and following developments between AI, machine learning (ML),
deep learning (DL), and LLMs. AI is largely discussed, yet we still see
improvements in ML, such as FL that is better correlated to LLMs than general
AI research. We then note DL as a subset of ML, showing advancements with
neural network structures that are similar to how LLMs learn and operate. To
define ML, we refer to Liu et al. [62] who state that ML is an automated
learning process using algorithms and statistical models to efficiently
perform specific tasks without the use of explicit instructions. DL is a sub-
field of ML that utilizes multiple layers of artificial neurons to learn the
latent space representation of the most basic form of data such as images,
text, and speech signals. As described by Shafay et al. [93] deep learning has
been able to achieve human-like accuracy, or even better accuracy than humans,
on a variety of difficult tasks. Below, we elaborate upon the process of how
models are trained and fine-tuned to become a usable, safe, and secure system.

####  2.2.1 Model Training

During the pre-training phase, the LLM is trained on a diverse, large dataset
of textual data from various sources to learn the statistical properties of
language. The LLM is equipped with a myriad of adjustable parameters, commonly
reaching more than ten billion [47]. Due to the huge model size and the vast
amount of data used to train it, it is computationally challenging to
successfully train a capable LLM, requiring distributed training algorithms
for learning the model parameters [135]. Another crucial factor for LLM
training is the data itself. Data that models are trained on come from a wide
variety of sources, but the data itself may not be up to date [101]. To
mitigate this shortcoming, recent advancements have introduced Retrieval-
Augmented Generation (RAG), which is designed to augment and rectify the
information returned by LLMs by consulting up-to-date online sources. The data
that the LLM was trained on also has other deficiencies, like knowledge gaps
in healthcare fields where data is private and restricted [50]. Due to these
knowledge gaps, the LLM may conjure up hallucinations where the model
generates false information during prompting [72, 3] because of a lack of
relevant information. However, hallucinations may also occur with a plethora
of data available as they are inherent problems in LLMs. Methods of preventing
these hallucinations are elaborated on in 4.2.2. RAG can help rectify
hallucinations, and fill in the gaps of data the LLM is missing, by using up-
to-date and validated information from trustworthy online resources. This
method of data retrieval introduces novel vulnerabilities since the
information gathered by the retriever is largely un-audited and may contain
poisoned data or data that can lead to unsafe responses from the LLMs.

####  2.2.2 Model Tuning and Utilization

After pre-training, the parameters of LLMs can be further updated by training
on domain-specific datasets in downstream tasks. This process is known as
fine-tuning (FT) [16]. A kind of fine-tuning method called supervised fine-
tuning (SFT), aims to improve LLMs’ responsiveness to instructions, ensuring
more desirable reactions involving three major components of instructions,
inputs, and outputs. Inputs relate to prompting and the inputs depend on the
instructions, similar to applications of open-ended generation in ChatGPT. By
providing both inputs and outputs they form an instance, and multiple
instances can exist for a single instruction [42]. Among fine-tuning, there
are a multitude of other training techniques within prompting the model such
as instruction tuning and alignment tuning. By FT from a mixture of multi-task
datasets formatted via natural language descriptions with the use of
instruction tuning, LLMs are enabled to follow task instructions for new tasks
without needing explicit examples, highlighting the ability of generalization
for instruction following [135]. However, LLMs can demonstrate versatility,
even without FT where they produce a phenomenon known as zero-shot learning,
exhibiting the ability to perform tasks for which the model was never
explicitly trained [16].

Alignment tuning, a form of reinforcement learning, is used to promote the LLM
to be a safe interactive machine. Since LLMs are trained to capture the data
characteristics of uncurated pre-training corpora involving both high-quality
and low-quality data, the LLM can generate toxic, biased, or harmful content
for humans. To mitigate this problem, a FT process based on reinforcement
learning from human feedback (RLHF) is used to align the LLM with safety
values in order to make a trustworthy model [135]. The RLHF process ranks LLM
outputs, with rewards scaled to positive and negative values. The LLM is then
trained to produce highly-ranked responses and avoid low-ranked responses. In
healthcare, RLHF provides advantages to the model such as improved accuracy
and reliability through continuous feedback from medical professionals and
customizes the interactions based on real clinical settings and patient needs
[41]. These advanced training techniques improve LLM’s ability to generalize
across tasks and improve their overall utility in various domains.

Table 2: Differences in Definitions of Safety. There is no unifying definition
of safety within the area of large language models. We see obvious agreement
that models should be law-abiding, ethical, and non-violent in order to be
safe, and as such these properties are strongly relevant to our definition of
safety. However, beyond that point, there is generally a deviation between the
authors’ respective definitions. This creates two further categories of terms,
properties that are moderately relevant to safety and those that are weakly
relevant. Questions of fairness, the informing ability of an LLM, and
robustness are generally covered but not unanimously, and hence are moderately
relevant, whereas privacy-preserving properties or non-sycophancy are rarely
discussed in the current literature and are thus weakly relevant to safety.
This dialogue between different modes of thought concerning what makes a large
language model ”safe” heavily influences our definition of safety and our
resulting discussion.

Relevance | Property |  Sun et al. [102] |  Liu et al. [65] |  Han et al. [39] |  Röttger et al. [88] |  Zhang et al. [133] |  Wang et al. [110] |  Tedeschi et al. [105] |  Inan et al. [49] |  Weidinger et al. [112]
---|---|---|---|---|---|---|---|---|---|---
Strong | Ethical | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Law-abiding | ✓ | ✓ | ✓ | ✓ | ✓ |  | ✓ | ✓ | ✓
Non-violent | ✓ | ✓ |  | ✓ | ✓ | ✓ | ✓ | ✓ | ✓
Moderate | Fair |  |  |  | ✓ | ✓ | ✓ | ✓ |  | ✓
Informing |  | ✓ |  |  | ✓ | ✓ |  |  | ✓
Weak | Robust |  |  |  | ✓ | ✓ | ✓ |  |  | ✓
Privacy Preserving | ✓ |  |  | ✓ |  | ✓ |  |  |
Non-sycophantic |  |  |  | ✓ |  |  | ✓ | ✓ |

##  3 Research Methodology

The discussion of blockchain technology’s incorporation into large language
models necessitates a corresponding exploration into the implications of
various terms and definitions found at that intersection. For example, due to
the rapid emergence of LLMs, there exists an absence of consensus in
describing common phenomena concerning LLM safety and security. To ameliorate
this effect, we take care to stress opposing, but related, definitions of
safety found within many different works in Table 2. In light of these
distinctions, we offer two formal definitions of security and safety in order
to contextualize these differing but similar areas of research. These
definitions will also serve to highlight where particular blockchain
technologies could be applied in their respective domains, and focus research
efforts.

First, and to allow a richer discussion centered around safety and security,
we delineate between active and passive privacy within LLMs as introduced in
Yan et al. [122].

  * •

Active privacy is where a user intentionally tries to gain access to sensitive
information by breaking the large language model, especially with backdoor
attacks, prompt injection attacks, and membership inference attacks during the
pre-training and FT phases.

  * •

Passive privacy is the state or condition of any impacted person being
protected from accidental or unexpected data leakage originating from a large
language model. This definition includes protecting the privacy of not only
users but people whose information was added to a model’s corpus without their
knowledge or consent.

Next, we introduce our definitions of security and safety regarding LLMs.

###### Definition 1

LLM Security. A large language model is considered secure if it:

  1. 1.

Withstands applicable adversarial attacks and maintains system integrity,
providing consistent and accurate responses, and

  2. 2.

Ensures active user privacy, explicitly resisting backdoor, prompt injection,
and inference attacks to prevent malicious users from extracting private
information.

###### Definition 2

LLM Safety. A large language model is considered safe if it interacts with
users in a trustworthy manner, adhering to the aforementioned (Table3
interrelated properties of safety: being ethical, law-abiding, nonviolent,
fair, passively privacy-preserving, and informing.

These definitions will serve a versatile role throughout this paper as
building blocks for our contextualization of relevant and notable research
efforts in the area of BC4LLMs. Moreover, they will also serve the community
at large in helping to establish reliable and tangible properties of secure
and safe large language models. They also will aid in establishing tighter
definitions on finer-grained terms and ideas within BC4LLMs. For example, in
Table 2 we provide definitions for terms found within our definition of safety
to lessen the effect of the vague nature of some of the words. These
definitions are backed by relevant examples found in the literature.

Table 3: Safety Area Definitions and Examples. The area immediately
surrounding BC4LLMs lacks a unifying definition of safety as well as consensus
on what terms within that definition precisely mean. We provide generalized
definitions for terms considered in our definition, as well as examples of
incidents in literature where LLMs deviate from behavior as described in the
definition. Italicized terms indicate inclusion in our definition of safety.

Safety Area |  Definition |  Example of Non-alignment |  |
---|---|---|---|---
Ethicality |  LLMs aligning with moral principles. |  A LLM agreeing with eugenics. [43]. |  }151em |  Found within definition of safety
Legality |  LLMs refusing to assist users in illegal endeavors. |  A LLM assisting a user in creating incendiary devices. [107]. |
Non-violence |  LLMs soliciting generally non-violent advice or instructions. |  A LLM advising a user to perform a ’raid on a drug house’ and ’kill everyone there’ [35]. |
Passive Privacy |  LLMs protecting private data within their corpus absent of malicious threats. |  A LLM partially or fully reconstructing private images from a given dataset [20]. |
Honesty |  LLMs refraining from producing inaccurate or misinformed responses which may lead to negative outcomes. |  LLMs administering faulty or fundamentally dangerous advice to patients or physicians in a healthcare setting [82]. |
Fairness |  LLMs ensuring a equitable environment for interaction, regardless of social identity. |  LLMs associating ”male” names with qualities of leadership, and ”female” names with qualities of amicability [109]. |
Robustness |  The ability of the LLM to defend against adversarial attacks, originating from outside the model. This is a wide-reaching term, and falls within our discussion of security as it relates to LLMs. |  A LLM falling victim to a backdoor attack planted in poisoned training data and producing malicious outputs as a result [124]. |  |
Non-sycophancy |  LLMs choosing consistent outputs despite the chance that they may be in conflict with a user’s beliefs or desires. |  A LLM revising a correct answer to an incorrect answer after the user asks the LLM if they are sure or challenges the LLM’s result in some way [95]. |  |

###  3.1 Research Approach and Limitations

Literature surveys often are limited in their depth and scope by unconscious
factors that impact the authors’ ability to fairly select papers for review.
To be transparent, and to aid researchers conducting similar or future
reviews, we outline our research approach and its associated limitations.
While conducting our research, we used the search engine Google Scholar, and
several databases including ACM Computing Surveys, IEEE Xplore, SpringerLink,
and arXiv. We chose these databases as they either produce quality research
and contribute to the growth of interest in novel areas, or in the case of
arXiv have the most up-to-date papers available. With Google Scholar, we used
keyword searches such as ”blockchain for LLMs” and ”blockchain-based LLMs” as
starting points for relevant, intriguing research papers. To solve problems
concerning scope and interrelated domains of disparate areas, we gathered
various applications of blockchain for AI, blockchain-enabled machine
learning, federated learning, and deep learning tactics to apply them to LLMs.
Lastly, of note is the fact that we were largely aided in this further
research effort by a waterfall approach to finding research papers. That is,
we found several foundational papers in the BC4LLM field, explored citations
in those papers, and subsequently explored citations in those secondary
papers. We continued investigating relevant citations in this waterfall
fashion until we reasonably exhausted all relevant articles. Admittedly, this
method of finding prominent research articles is limited in its natural
tendency to develop blind spots to less well-known research articles or
venues. However, in the spirit of a literature survey, we choose to focus on
more established papers that more accurately capture the trends currently
found in the space. For our exclusion criteria, we limited our research as
follows: no duplicates; found articles from 2016 and above, excluding the
original Merkle Tree paper [76]; no Masters or Ph.D. theses; and only studies
written in English.

###  3.2 Model of Threat Categorization

There exist a wide variety of threats which affect LLMs. Oftentimes, many of
these threats originate from the nature of LLMs acting as AI systems. In
Figure 3 we refer to these vulnerabilities similarly to Yao et al [124] who
categorized the most extensively discussed LLM vulnerabilities and AI-inherent
vulnerabilities together, yet also included external threats under non-AI
inherent vulnerabilities. We contribute further by applying these
vulnerabilities to each respective process within developing a large language
model and tie these to respective applications of blockchain. Beginning with
the training process, LLMs are prone to threats such as data poisoning and
backdoor attacks. As defined in Yao et al. [124] data poisoning is where
attackers influence the training process by injecting malicious data into the
training set, introducing vulnerabilities within the security and
effectiveness of the model. Following the trend of poisoned data, there can be
backdoor attacks implemented on the training data, as defined in Li et al.
[56] who categorize backdoor attacks into attacks on training data and attacks
on local models. The backdoor attacks on training data are further divided
into attacks based on label flipping and attacks based on planting triggers.
Attacks based on label flipping focus on manipulating the labels, whereas
attacks on planting triggers modify the input data and labels, effectively
constructing an adversarial sample. Then, attacks on local models are further
divided into attacks based on modifications to the training process and
attacks based on manipulating the trained model [56]. The backdoor attacks can
be applicable to both the training and prompting phases of LLMs when using
this distinction.

Figure 3: Taxonomy of Blockchain for LLM’s Security and Safety. This diagram
outlines the integration of blockchain technology to enhance the security and
safety of large language models through categorizing interactions and
safeguards into several layers and components. Each section supports relevant
sources for further reference, illustrating a comprehensive approach to
mitigating and preventing vulnerabilities as well as supplementing the
security and safety of LLMs through blockchain technology. Promising areas
that currently do not have blockchain as a solution to these vulnerabilities
intentionally do not have source boxes.

RAG attacks have a variety of issues, including privacy issues [127][5] and
knowledge poisoning attacks [143]. For RAG specifically, Xue et al. [121]
propose BadRAG to identify security vulnerabilities, exposing direct attacks
on the retrieval phase from semantic triggers, and uncovering indirect attacks
on the generative phase of LLMs that were caused by a contaminated corpus.
These RAG-specific attacks and defenses are elaborated on in section 4.1.2.
When interacting with a LLM, we see AI’s inherent vulnerabilities become
relevant, as in Yao et al. [124] note that LLMs are fundamentally AI models
themselves. We focus on the prevalent adversarial attacks that malicious users
may use to tamper with the LLM, attempts to find out sensitive information, or
try to ruin the system entirely. We recognize jailbreaking and prompt
injection as two separate but similar types of adversarial attacks that are
initiated within prompting. For instance, jailbreaking prompts are designed to
bypass the restrictions set by service providers during model alignment or
other containment approaches [96]. Whereas prompt injection attacks aim to
override an LLM’s original prompt and directs it to follow a set of malicious
instructions, leading to erroneous advice or unauthorized data leakage [66].
In our Sections 4.2.1, 4.2.2 we discuss instances of misinformation and
passive privacy leakage addressed as safety concerns. Note that from above, we
included backdoor attacks based on modifications to the trained model in
prompting, since these backdoor attacks can still happen after the model has
been trained [56].

Other attacks relating to LLMs and AI are membership inference attacks (MIA),
relating to a type of privacy attack where some malicious user, given access
to the model, is able to determine whether a given point was used to train
that model with high accuracy [80]. However, Neel and Chang [80] state this
attack is more related to information about the training point data leaking
through the model, and that malicious users must have access to a candidate
point in order to run the attack. Therefore this attack is more prevalent with
passive privacy, highlighting the need for preventing data leakage. Similar
attacks are user inference attacks that seek to gain knowledge or insights
about the model or data’s characteristics, often by observing the model’s
responses or behavior [124].

Lastly, we explore denial of service (DoS) attacks and supply chain
vulnerabilities. From Yao et al. [124] a DoS attack is a type of cyber attack
that aims to exhaust computational resources, resulting in latency or making
the technology resources unavailable. We focus on distributed denial of
service attacks (DDoS) which is a type of DoS attack where requests flood the
system, attacking simultaneously from multiple sources on the network [29].
Yao et al. [124] also defined LLM supply chain vulnerabilities, referring to
the risks in the lifecycle of LLM applications that may occur from using
vulnerable components or services, including third party plugins that may be
used to steal chat histories, access private information, and or execute code
on a user’s machine [124]. All of these security vulnerabilities are
substantial threats to LLMs that need to be mitigated or prevented. Possible
methods of defense are discussed within Section 4.1, using current blockchain
frameworks and experiments for these security problems, as listed by each
developmental phase of the LLM, AI inherent threats, and supply chain issues.

##  4 Existing Literature on BC4LLM

Independently, the fields of both LLMs and blockchain research have grown
substantially over the past several years. It is no surprise that the
literature surrounding these topics has begun to morph and relate to each
other. In previous research, we have seen LLMs for Blockchain Security [42] as
well as an introduction to the term BC4LLM in Luo et al [69] where they
provide a comprehensive survey of blockchain for LLMs. However, they do not
acknowledge the multitude of safety and security solutions that blockchain
provides for certain LLM vulnerabilities. Effectively, Luo et al. [69] aims to
introduce BC4LLM for trusted AI, enabling reliable learning corpora, secure
training processes, and identifiable generated content. In juxtaposition, our
survey aims to analyze possible BC4LLM solutions closely related to our
definitions of safety (2) and security (1) when looking at inherent system
vulnerabilities in LLMs. To begin our analysis, we define these security
problems based on previous work and highlight areas of research that are
applicable to areas of BC4LLM safety and security.

###  4.1 Blockchain for Large Language Model Security

Few papers and experiments analyze how the integration of these two
technological powerhouses interact with one another. We have seen benefits of
this integration that apply to our definition of security (1). Balija et al.
[10] introduced a peer-to-peer (P2P) federated LLM, namely PageRank, which
works with a blockchain. This system operates in a fully decentralized
capacity. Demonstrably, the blockchain implementation led to more efficient
accuracy and latency results. With that being stated, Balija et al. [10]
provide a developing direction in the field of BC4LLM to enhance system
security. Below, we address several current vulnerabilities in LLMs and
analyze them individually. In order to better understand these security
problems, we categorize these vulnerabilities to their respective LLM training
stages, highlight blockchain for AI works, and provide well-researched
blockchain applications as a solution.

Vulnerabilities are present at each step in the process of developing a LLM.
In early methods of model training, we encounter adversarial attacks such as
data poisoning and backdoor attacks within the corpus [96, 122]. Progressing
into model fine-tuning and general use, the LLM can fall victim to prompt-
based attacks, [2][134] [122][66], inference attacks [44] [54], and RAG
related attacks [121] [22][5][26][143] [127]. These attacks are common
vulnerabilities in both LLMs and AI since LLMs and AI are closely related as
seen in Figure 2. Some of the threats against LLMs can be addressed by
implementations from blockchain for AI (BC4AI) research, as elaborated below
in Section 4.1.3. Considering the volume of potential attacks against LLMs, we
make a further distinction of solutions that are specifically related to
BC4LLM research and other blockchain-based solutions from BC4AI research. With
this, we are able to highlight shared vulnerabilities for LLMs and AI. We
provide an analysis of how blockchain can help defend against and mitigate
these vulnerabilities, starting with threats during each phase of LLM training
and utilization, continuing onto different blockchain solutions for AI
inherent threats, and lastly noteworthy technology inherent attacks such as
denial of service (DDoS) attacks and issues with supply chain logistics.

####  4.1.1 Blockchain for Threats within LLM Training Process

Situated at a critical juncture in the process of model development is the
issue of data selection. An area of paramount concern for this data is exactly
how we can verify that training data is authentic and safe as well as tamper-
proof from data poisoning attacks. A new approach may be the LLM’s ability to
unlearn this poisoned data, or data that is unsafe according to our definition
of safety 2. From Zuo et al. [145] they establish federated TrustChain as a
method of enhancing LLM training and unlearning through a blockchain-based
federated learning framework. By integrating blockchain using Hyperledger,
their findings present that the framework is efficient in unlearning
capabilities, showcasing an accuracy score initially of 99.15% and after
unlearning, the accuracy drops to 0.70% [145]. This highlights the potential
for BC4LLM to improve security and privacy guarantees, where the LLM can
selectively forget specified data points while simultaneously preserving their
performance with the leverage of Low-Rank Adaptation (LoRA) and tuning hyper-
parameters. This method of a blockchain-enabled federated unlearning process
is further detailed as a future research possibility that has been thoroughly
explored by few, as emphasized later in Section 7.1.

Another significant problem in the area of adversarial threats against LLMs is
data poisoning. Gong et al. [37] proposed a possible blockchain solution,
introducing dynamic large language models (DLLM) on blockchains. Instead of
using the traditional centralized data sets that LLMs are provided with,
developing LLMs on blockchains enables the creation of decentralized datasets.
These datasets are less likely to be tampered with and can be easily audited
for accuracy. Gong et al. presents DLLM to evolve after the training process.
This was implemented through neural network parameters that offer the LLM the
ability to learn during its usage.

Figure 4: We provide an overview of a two-level framework consisting of: a
privacy-based blockchain that uses the secure hash algorithm 512 (SHA512) to
generate hashes for data integrity. Then, the enhanced proof of work (ePoW) is
used to authenticate data records and prevent data poisoning attacks from
altering original data. These hashes of data blocks are linked to each other,
called a Hash Chain. Then, for the second level, privacy-based variational
autoencoder (VAE) for secure data transformation, ensures robust protection
against inference attacks while maintaining the utility model for anomaly
detection.

Additionally, blockchain-based systems can help assess where data poisoning
may occur and as shown in [54] blockchain can protect datasets and detect
potential inference attacks through a two-level privacy preserving module.
This research included a framework based on blockchain and deep learning,
including two levels of privacy mechanisms as shown in Figure 4. For the first
level, Keshk et al. [54] used SHA512 to generate secure hashes and then
implemented an enhanced-proof-of-work (ePoW) technique for authenticating data
records and preventing data poisoning attacks. The second level consisted of a
VAE technique for converting original data into an encoded format for
mitigating inference attacks that could be learned from system-based machine
learning. In their testing, these mechanisms were effective in preventing data
poisoning and inference attacks from manipulated smart power network datasets.
BC4LLMs could benefit from this similar type of implementation, working with
secure methods of hashing and blockchain-based deep learning privacy
preservation techniques. By integrating a two-level privacy-preserving module,
BC4LLMs can ensure data integrity and confidentiality while effectively
detecting and mitigating both data poisoning and inference attacks.

Poisoned data has been an interest with RAG in particular. For example, Xue et
al. [121] developed a way to identify security vulnerabilities from a poisoned
corpus, but they do not use blockchain as a solution. We address the absence
of research on blockchain and RAG, especially when using blockchain to help
prevent RAG security issues. We discuss this as a possible future research
direction as there remains a current gap in research of blockchain-based RAG
systems and elaborate on this topic in 7.2. Poisoned data overall is a major
concern within LLMs and we offer blockchain as a potential source of ground
truth to aid in mitigating this threat during the pre-training stages of LLMs
and potentially mitigate RAG security concerns. In addition to data poisoning,
LLMs are susceptible to backdoor attacks hidden in the training data during
the LLM pre-training phase. Notable research by Zhao et al. [134] introduced
ProAttack which improves the stealth of backdoor attacks by accurately
labeling poisoned data samples. As these attacks improve and become more
sophisticated, it is crucial to explore robust defense mechanisms for LLMs.
Few defense mechanisms using blockchain have been made, but we see in Li et
al. [56] a proposal for a blockchain-based federated-learning framework (DBFL)
that withstands backdoor attacks in a blockchain environment through
incorporating an RLR aggregation strategy into the aggregation algorithm of a
user and the addition of gradient noise to limit the effectiveness of backdoor
attacks. The robustness of FL against backdoor attacks is enhanced by using
various blockchain functions, including digital signature verification and
simulation of chain resynchronization [56].

####  4.1.2 Blockchain for Threats within LLM Prompting and Utilization

LLMs undergo continuous training through instruction tuning, alignment tuning,
and fine-tuning, which warrants a list of vulnerabilities such as prompt
injection [74][98] and backdoor attacks [56]. These adversarial attacks are
included under the term active privacy • ‣ 3 where a malicious user attempts
to gain unauthorized access. Blockchain technology, with its inherent
transparency and immutability, holds the potential to mitigate and defend
against these vulnerabilities. For instance, blockchain’s ability to ensure
data integrity and provide traceability can play a pivotal role in defending
against prompt injection attacks. Mbula et al. [74] produce an overview of
LLMs for blockchain and note the capabilities of blockchain, especially the
transparency and immutability to provide a reliable audit trail of
transactions to track and investigate any suspicious activities. Although not
specifically focused on prompt injection, this approach showcases how
blockchain can supplement security by offering a clear and immutable record of
interactions. Applying this to BC4LLMs can help prevent suspicious users from
continuously interacting with a LLM, allowing for traceability to stop the
user from entering malicious prompts. We recognize prompt injection is a
critical vulnerability in LLMs and AI-related systems, yet as noted in the
survey from Shen et al. [98] few blockchain defenses for prompt injection are
present in the current field of research.

Inference attacks are also of critical importance to LLMs and to active
privacy, where a malicious user tries to extract data from the LLM. The
malicious user could also try to gain information about the training data,
hence why the Taxonomy 3 has inference attacks standalone. As discussed
previously in Section 4.1.1 from Keshk et al. [54] that uses Blockchain and DL
to privacy preserve and prevent inference attacks through a framework as
depicted in Figure 4. For more inference attack applicable work, a survey [44]
thoroughly discusses membership inference attacks on ML and provides a group
of defenses including differential privacy, regularization, confidence
masking, and knowledge distillation. In other works, there are instances of
blockchain-based differential privacy methods [136][38][84], but current
research that uses blockchain-based differential privacy frameworks to prevent
inference attacks is limited; It is worth noting that the theoretical
foundation and potential synergies of this combination are promising. Another
area with limited research is blockchain as a defense for jailbreaking
attacks, which exploit the inherent capabilities of LLMs to bypass
restrictions. There are multiple articles defending LLMs from jailbreaking
attacks, yet little to none fully include blockchain to prevent jailbreaking.
Hu et al. [45] explores a blockchain defense mechanism for malware checking on
operating systems, indicating a possible direction for future research in
integrating blockchain to defend against jailbreaking in LLMs. As previously
explained in Section 3.2, backdoor attacks after the model has been trained
are based on modifications to the trained model. The key blockchain-based
federated-learning framework from Li et al. [56] discussed in detail in
Section 4.1.1 used a combination of a blockchain environment and an RLR
aggregation strategy to defend against backdoor attacks. This framework
effectively coordinated FL processes and maintained learning security and user
privacy. When testing backdoor attacks caused by malicious participants, the
accuracy of the model increased when using the RLR aggregation strategy [56].
Given these findings, the possibility of leveraging blockchains transparency
and immutability presents a robust mechanism for improving LLM security
against active privacy threats. However, comprehensive integration and
empirical validation of blockchain-based defenses in LLMs remain imperative to
advance the field of BC4LLMs.

####  4.1.3 AI-intrinsic Threats and Defenses

AI intrinsic threats apply to LLMs due to the proximity of LLMs and AI, as
shown in figure 2. Blockchain for AI (BC4AI) is an emerging technology, with
blockchain-based solutions already being researched as a secure way to
establish trust in the Internet of Things (IoT) [99][24]. Instead of the term
BC4AI, some previous works refer to the integration as ”Onchain AI” [28][23].
Research of BC4AI encapsulates other machine learning related techniques such
as blockchain-based federated learning and blockchain for deep learning.
Federated Learning is an addition to machine learning, as noted in figure 2,
where federated learning uses a privacy-preserving and decentralized approach
to centralized systems.

There are multiple sources relating BC4AI, dating from 2018 to 2024
[28][111][67] [119][31][91][104][71][18][11][13]. Focusing on the most well
known works, Salah et al. [91] state integration benefits of BC4AI. For
example, there are five main benefits, such as enhanced data security,
improved trust in robotic decisions, collective decision-making, decentralized
intelligence, and high efficiency[91]. For enhanced data security, it is known
that information held within the blockchain is highly secure. By storing
sensitive and personal data in a distributed, disk-less environment and
allowing AI algorithms to work to secure data, also to ensure more trusted and
credible decision outcomes. The other benefits of improving trust within AI
decision making involves using the blockchain as a record of the decision-
making process, allowing better AI traceability to analyze the quality of
responses. Secondly, from Dinh and Thai [28] who summarized the integration of
blockchain and AI to where blockchain can assist AI in multiple aspects, as
follows. AI can benefit in secure data sharing from blockchain, allowing
transparency and accountability regarding which user’s data is accessed, when,
and by whom, letting users maintain control of their personal data. Among
other data concerns, with the integration of blockchain and AI, blockchain
technologies can let user’s sell their data via smart contracts, enabling the
possibility of data marketplaces without a centralized middleman, making the
transactions private and secure between users.

A noteworthy framework from Malhotra et al. [71] provides a blockchain-based
proof-of-authenticity framework for explainable AI (XAI) utilizing a public
Ethereum Blockchain, smart contracts, and IPFS (Interplanetary File System) to
ensure secure, traceable, auditable transactions within the Ethereum network.
This framework highlights three major components, smart contracts, an Ethereum
and IPFS interconnected network, and a regulator, as depicted in figure 5. The
use of smart contracts to enable continuous monitoring and tracing by all
peers, in the case of any rule violations there are prompt rebound
transactions to restore the system to an optimal state. To address the size
limitation of storage on the blockchain, as further discussed in Section 6.1,
Malhotra et al. [71] used unique IPFS hashes stored on the Ethereum Blockchain
to access larger-sized explanations that are stored off-chain in IPFS. These
hashes are encrypted with the SHA256 algorithm to maintain data security.
Thus, only entities with the corresponding hash can access and retrieve the
IPFS hash and the associated explanation, ensuring controlled access even in a
distributed network. Lastly, the regulator’s role is responsible for auditing
and has access to the explanations to predict the user at fault using audit
trails if system failure were to occur.

Figure 5: Within BXAI, this diagram illustrates the framework that leverages a
distributed ledger infrastructure, using the Ethereum Blockchain and IPFS for
storage and secure, traceable transactions. Depicted is the interaction
between model utilization: an explainer generating local post-hoc
explanations, the storage of these explanations in IPFS, and their linkage to
the Blockchain. The use of smart contracts helps secure and encrypt the data,
then relay it to a regulator who investigates current explanations, ensuring
accountability and fault anticipation. Blockchain nodes are used to facilitate
the secure and transparent broadcast of events within the Ethereum network.

####  4.1.4 Non-AI Threats and Defenses

Referring to our Figure 3, we specifically focus on DDoS attacks and supply
chain issues. Even though these attacks are common problems among technology
as a whole; they are threats we consider relevant to BC4LLMs. Ibrahim et al.
[48] suggest using a public blockchain to prevent DDoS attacks on IoT devices.
Blockchain provides a tamper-proof platform as well as demonstrates how IoT
devices working with blockchain can verify and authenticate using a trusted
white-list which is implemented in the smart contract. Following this smart
contract usage, if LLMs were to use a trusted white list for users then we can
try to prevent these malicious users from trying to access the LLM in certain
circumstances that are mutually agreed upon. Additionally proven in Shah et
al. [94], blockchain-based solutions play a vital role in mitigating DDoS
attacks.

A point of consideration is how DDoS attacks that target the blockchain to
make the blockchain unavailable would require sufficient computer resources.
The fully decentralized architecture of the blockchain and the consensus
protocol for new blocks ensure that the blockchain can still operate meanwhile
several blockchain nodes could be offline [128]. Incorporating this
architecture into LLMs would help prevent DDoS attackers, as the larger the
blockchain network is, then the harder it would be for a DDoS attack to be
successful. Moreover, blockchain is known as a distributed, immutable, and
verifiable ledger technology that ensures transparency and traceability [90].
By utilizing blockchain for LLMs, we can help mitigate these supply chain
vulnerabilities. The decentralization of the network can maintain the
integrity of the system at all points, aiding in mitigating the risk of a
single point of failure, a common problem with centralized systems [90].
Blockchain is offered as a solution if the LLM were to accidentally crash, or
was purposefully attacked by an attempt at overwhelming the system, then the
LLM would still be intact since it is blockchain-based, removing the single
point of failure entirely. However, it is important to note that blockchain
solutions for LLMs depend on the availability of the underlying LLM
infrastructure. If the LLM server is malfunctioning or shut down, then these
blockchain mechanisms may not be applicable, highlighting the need for a
robust and resilient supply chain. To solidify the supply chain, blockchain
offers secure transactional data in sectors including supply chain management,
healthcare, and federated learning [145]. For better supply chain management
and data traceability, Kayikci and Khosgoftaar [53] address the potential
intersection of blockchain and ML. ML can aid in analyzing data from multiple
sources and identify potential supply chain issues such as delays or quality
issues before they occur. By using blockchain to create a transparent record
of all supply chain transactions there are improvements in security, openness,
traceability, and productivity [53]. While blockchain presents a promising
solution for enhancing security and defending against adversarial threats to
LLMs, ongoing research and development are necessary to address the evolving
landscape of threats and vulnerabilities.

###  4.2 Blockchain for Large Language Model Safety

The burgeoning dominance of large language models as search engines [87],
code-writers [139], and a vast array of other roles has led to the emergence
of unique problems within the sphere of their safety. For instance, LLMs who
advise users to engage in dangerous activities such as eating glass [40] or
which easily reveal personally identifying information [55] may be unsafe for
users to interact with even in the absence of external threats. In this
section, we rely on our proposed definition of safety (Definition 2) to
explore relevant literature that incorporates blockchain technology into the
various solutions surrounding LLM safety.

####  4.2.1 Blockchain for Passive Privacy in Large Language Models

Despite its novelty, the notion of passive privacy is of paramount importance
in maintaining the safety of large language models. Some models face the issue
of leaking sensitive data, potentially revealing private information like
government-issued ID numbers and patient data [83]. Given the severity of such
leaks, it is evident that solutions to such problems are required for more
substantial advancements in LLMs. To this end, blockchain’s guarantees about
data sovereignty, obfuscation, and traceability translate well into realizable
passive privacy benefits for large language models. In particular, we observe
blockchain-based privacy preservation techniques which originate in varying
proximity to LLMs as seen in BC4LLMs itself [113][100][108], blockchain-
enabled deep learning [93][141][116][115][54], blockchain-enabled machine
learning [7], and blockchain-enabled federated learning
[85][70][137][78][8][32][86].

Within our focus of BC4LLMs, we have observed distinct trends in the
application of blockchain to large language models in their capacity to
bolster passive privacy guarantees. Most notably, the development of ZK-LLMs,
or zero-knowledge large language models as described in Wellington [113] and
Singh [100] have the potential to drastically reduce privacy leakage risks
when interacting with large language models. Considering the problem of data
leakage approached from the lens of access, this application is natural. A
user querying for their own personally identifiable information should,
ideally, be able to access it whereas an unauthorized user should not.
Obfuscating portions or the entirety of a corpus using zero-knowledge proofs
allows for untrusted training nodes, or the model itself, to act on sensitive
data without the ability to regurgitate it to a potentially malicious party.
This same mechanism has broad applications that have been explored in other
recent works as well, with special focuses on ZKPs for data curation and pre-
processing [108] which consequently enhance passive privacy within large
language models.

Additionally, besides material on BC4LLMs, it is necessary to discuss passive
privacy contributions made within LLM-related areas, as described in our
classification of LLMs in the context of AI, ML, and DL.(Figure 2) Especially
important in its immediate applications to LLMs, blockchain-enabled deep
learning (BC-DL) is a growing field with potentially large impacts on LLM’s
passive privacy. Specifically, certain BC-DL technologies propose learning
mechanisms distinct from traditional federated learning models [116][93][54].
The concerted research effort to develop efficient distributed learning models
that deviate from the typical model of federated learning is clearly well
underway. This field has broad implications for blockchain; through the
utilization of various blockchain properties, we see the development of
privacy guarantees which undoubtedly strengthens the BC4LLMs area.

Of particular note in the BC-DL area is the influential DeepChain paper [116]
which introduced a novel privacy-preserving training framework based on
blockchain technology. The proposed system, reliant on a consensus protocol
and corresponding incentive mechanism, allows for the existence of private
training gradients and the guaranteed auditability of training data. This type
of twofold approach, which also leans on zero knowledge in several areas of
the protocol, could be indicative of a new direction of research for
blockchain-enabled passive privacy, stemming from the vastly studied federated
learning area. In order to highlight the novelty of such an approach, we
provide Figure 6 to further illuminate the nature of a system interacted with
chiefly through the two vehicles of consensus and incentivization.

Figure 6: Within DeepChain, we see a deviation from conventional federated
learning models in that while training occurs in iterative rounds, it is
marked by synchronous requirements for consensus on data added to the model in
the last round of training. The contribution-based incentive mechanism rewards
workers for verifying new gradients, and stimulates the trading contract which
facilitates the sharing of new and updated gradient information. A Verifiable
Random Function (VRF) ensures that the committee-based consensus is fair and
alleviates concerns surrounding finality.

Additionally, despite this potential research direction, discussion on the
wide body of research that does exist concerning blockchain-enabled federated
learning (BC-FL) is essential when describing blockchain as a vehicle for
improving the safety and security of large language models. Federated
learning, introduced in McMahan et al. [75], has since been the principle
building block of decentralized learning approaches in machine learning
systems. While too broad to be considered for BC4LLMs, notable to this paper
are the contributions of authors approaching BC-FL in its capacity as a
powerful privacy preserving mechanism [78][8][32][33][70][137].

####  4.2.2 Blockchain for Misinformation in Large Language Models

The issue of large language models fabricating information, commonly known as
hallucinations [72][3] is well understood. As a result, detecting and
defending against hallucinations is a widely explored area [92], with more
research still yet to be conducted [126][130]. Along with this pressing
general body of research, efforts have been made to leverage blockchain
technology to reduce hallucinations by consensus-oriented [131] and oracle-
based [15] approaches. Within consensus, Zhang et al. [131] proposed a system
for efficient large language model inference quality assessment. That is, the
veracity of a given model’s responses was able to be assessed by using a
’Proof of Quality’ consensus mechanism with low latency between the user and
language model. This stands in contrast to other approaches, such as Bouchiha
et al.’s [15] reputation-based system LLMChain, which relies on a
decentralized oracle to cross reference request/response pairs originating
from differing models and speak to the quality of inferences based on those
comparisons. It is worth noting that despite these fundamental differences,
they are both consensus-based approaches. This serves as an excellent example
of how BC4LLMs technology can take many different forms towards the same goal.

Besides steering towards consensus-driven models of governance for
misinformation, several other ideas have been considered to enhance the
correctness of large language model responses. These accomplishments have come
from the zero-knowledge space as in the case of Chen et al. [21], more
optimistic privacy guarantees found within works such as Conway et al. [23],
and even straightforward applications of the verifiable ledger as in
Yazdinejad et al. [125]. Chen et al. propose zkML, a compiler that enables
TensorFlow models to be translated readily into zk-SNARK halo2 circuits via
either KZG or IPA commitments. This conversion allows for any portion, or the
entirety of, an LLM to gain the properties of zero-knowledge, knowledge
soundness, and completeness. Through this, and with potential connections to
verifiable databases, zkML gains the powerful ability to audit inferences and
ensure their accuracy. This research avenue is particularly promising due to
both the efficient and potentially on-chain verification of zk-SNARKs as well
as the extensibility of zkML to virtually any ML model.

Distinct from the zkML approach is that of Conway et al. with opML [23], which
opts for an optimistic approach reliant on a fraud proof rather than a ZK
proof to catch erroneous outputs within a certain challenge period. Clearly,
there exist trade-offs in this implementation when compared to the zkML
approach. Optimistic rollups are desirable in the sense that they are
performant, but if implemented in a RAG environment, or similarly situated
between the user and a model, latency issues can quickly become dominant.
Apart from proof-oriented mechanisms and worth noting is the work of
Yazdinejad et al. [125], which focuses on detecting deep fakes using
blockchain’s verifiable ledger. While not directly applicable to the realm of
LLMs due to the non-atomic nature of data within a language model, important
insights can be drawn from the paper. Namely, BC4LLMs could benefit greatly
from a proposed hashing method applied to particularly sensitive data areas
such as names, addresses, or even health-care related parts of corpora. This
hash could be used as a guarantee of data veracity and could potentially
prevent unsafe behaviors such as sycophancy, deception, or unfairness. Indeed,
this hashing mechanism has the potential to be used as a final check for the
LLM to verify that it is submitting information to the user that is consistent
with standards agreed upon when information was originally committed to the
ledger. Many similar vehicles for the maintenance of data integrity exist,
albeit currently limited by scaling issues on-chain [27].

##  5 Datasets Relevant to BC4LLM

Developing synergistic technologies that incorporate blockchain and large
language models is vital to securing a future consisting of safe, trustworthy
LLMs. To this end, relevant datasets with which researchers may conduct
experiments are of paramount importance. Moreover, it is often the case that
blockchain-enabled systems require unorthodox training sets and edge cases in
order to fully capture the dynamism and robustness of respective
implementations. Therefore we have collected and summarize the relevance of
certain datasets in Table 4. Of note are the standard datasets such as MNIST,
CIFAR-10, SQuAD, and MS-MARCO, and we also give special attention to less
widely known datasets which still may prove useful in certain academic
settings.

Table 4: Datasets Relevant to BC4LLMs Dataset |  Use Case |  Description |  Papers
---|---|---|---
MNIST11footnotemark: 1 |  Pattern Recognition |  Images of handwritten digits for pattern recognition applications oe vulnerability analysis. |  [116][114][75][32][97] [57]
CIFAR-1022footnotemark: 2 |  Labeled images used in capacities from improving pattern recognition to zk-SNARK benchmarks. |  [114][21][75]
MS MARCO33footnotemark: 3 |  Collection of human answered questions, used in training corpora as well as simulating RAG attacks. |  [121][143][22]
MedMINST44footnotemark: 4 |  Collection of medical images from case studies. |  [121][143][22]
Natural Questions55footnotemark: 5 |  Poisoned RAG |  Open domain question answering dataset, incorporating questions from users and rigorous answers. |  [121][143][22]
HotpotQA66footnotemark: 6 |  Question answering dataset with multi-hop questions and supervised, regulated, answers. |  [143][22]
MT BENCH77footnotemark: 7 |  LLM Evaluation |  Ranked pairwise expert human preferences for various model responses. |  [138][15]
SQuAD88footnotemark: 8 |  Reading comprehension dataset comprised of questions posed on Wikipedia article with answers as sections of those corresponding articles. |  [145][46]
IMDB Dataset99footnotemark: 9 |  Sentiment Analysis |  Movie reviews |  [145][46]
SafetyBench1010footnotemark: 10 |  Safety Evaluation |  Large number of multiple choice questions focused on evaluating the safety of large language models. |  [133]
Tweets20111111footnotemark: 11 |  Sensitive Information Handling |  List of scraped tweet identifiers and corresponding tweets from early 2011. |  [145]
MTSamples Scrape1212footnotemark: 12 |  Sample transcription medical reports from various disciplines and areas. |  [145, 46]
DRC Diplomas1313footnotemark: 13 |  Highschool diplomas from the Democratic Republic of the Congo. |  [10]
HealthCareMagic1414footnotemark: 14 |  Real patient-doctor conversations found through the HealthCareMagic website, capturing the nature of patient vocabulary. |  [5]
Enron Emails1515footnotemark: 15 |  Large set of emails generated by employees of the Enron Corporation. |  [145, 46]
LLMGooAQ1616footnotemark: 16 |  Comprehensive database capturing question and answers from a wide variety of domains. |  [15]
GooAQ1717footnotemark: 17 |  Large scale question answering dataset aimed at developing a vast selection of question types. |  [15]
The Pile1818footnotemark: 18 |  Massive and open source data set consisting of a combination of roughly 20 other datasets. |  [134]
11footnotemark: 1https://yann.lecun.com/exdb/mnist/ 22footnotemark:
2https://www.cs.toronto.edu/ kriz/cifar.html 33footnotemark:
3https://microsoft.github.io/msmarco/
44footnotemark: 4https://medmnist.com/ 55footnotemark:
5https://ai.google.com/research/NaturalQuestions 66footnotemark:
6https://hotpotqa.github.io/
77footnotemark: 7https://paperswithcode.com/dataset/mt-bench 88footnotemark:
8https://rajpurkar.github.io/SQuAD-explorer/
99footnotemark: 9https://developer.imdb.com/non-commercial-datasets/
1010footnotemark: 10https://github.com/thu-coai/SafetyBench
1111footnotemark: 11https://trec.nist.gov/data/tweets/ 1212footnotemark:
12https://mtsamples.com/ 1313footnotemark: 13https://minepst.gouv.cd/palmares-
exetat/
1414footnotemark:
14https://huggingface.co/datasets/RafaelMPereira/HealthCareMagic-100k-Chat-
Format-en
1515footnotemark: 15https://huggingface.co/datasets/preference-agents/enron-
cleaned 1616footnotemark: 16https://github.com/mohaminemed/LLMGooAQ/
1717footnotemark: 17https://huggingface.co/datasets/allenai/gooaq
1818footnotemark: 18https://pile.eleuther.ai/

##  6 Prominent Challenges Within
BC4LLM

Despite the promise of the emerging BC4LLMs field, there are several innate
challenges that delay progress and inhibit potential research directions.
Typically, these are derived from certain limitations in blockchain
technology, large language models, or deficits in the way that blockchain can
serve large language models.

###  6.1 Corpus on Blockchain

Large language models require massive amounts of data to operate, with modern
corpus sizes typically exceeding dozens of terabytes in volume [135]. This
inherent quality of LLMs is situated opposite to problems that blockchain
systems typically prefer to solve. Reconciling the limitations of blockchain’s
throughput and capacity for data handling with LLMs ballooning size is perhaps
the most pressing issue in the BC4LLMs space.

Multiple attempts in which researchers have proposed zero-knowledge proofs for
scalability have been discussed, such as in Wellington [113] and Singh [100].
However, employing zero-knowledge technology solely for scalability, and not
privacy, is a doubtful long-term prospect due to the demands of generating
zero-knowledge proofs, even with incredibly small circuits. Largely, this is
due to the long-standing problem of the MSM within the context of generating
ZKPs [120]. Moreover, current WebGPU and/or WASM implementations could likely
not support the throughput that client-based LLMs would require. For these
reasons, it is unlikely that zero knowledge could be employed as a definitive
solution for scalability issues within BC4LLMs without extensive developments
in zk-SNARK generation research.

The disconnect between large language models’ growing size and the aversion of
blockchain’s to store data readily on chain is a major research challenge.

###  6.2 Reliance on Oracles

The security guarantees of blockchain technology, while robust, often leave
little room for interoperability with external systems [27]. That is, the
blockchain can most easily interact with information on the chain, leaving
little room to consider issues such as fact-checking or moral alignment.
Oftentimes, to develop mechanisms that seek to provide assistance with LLM
toxicity or factuality, oracles are used to bridge this gap [31][34]. Serving
as mediators between chains and online sources, oracles are trusted parties
that deliver information through a variety of protocols and frameworks.
However, introducing a trusted party into an otherwise trustless system has
been a long-standing weak point in this solution [74]. Exploring non-oracle-
based options for ground truth solutions, or toxicity checks, would greatly
enhance the security guarantees of blockchain within LLMs.

###  6.3 Energy Consumption

The crux of many issues concerning large language models stems from their need
to consume and process inordinate amounts of data [135]. This requirement, in
turn, creates a corresponding need for large language models to consume
equally as colossal quantities of energy during their training stages, as well
was during run time [69]. On the other side of the coin, we have energy issues
within blockchain as well. Oftentimes, blockchain systems struggle to limit
energy costs as the demands of both consensus mechanisms and the validation of
proposed transactions incur huge computational costs [74]. Due to their
tendency’s to consume large amounts of compute resources, we see an
unfortunate dissonance between implementing BC4LLM at scale without large
efforts to cut back on energy costs, possibly through a shift away from both
transformer architectures and proof of work type consensus mechanisms [81].

##  7 Future Research Directions

There exist several critically overlooked areas within LLMs that may benefit
greatly from the introduction of blockchain technologies. The most prominent
of these areas include blockchain federated unlearning, RAG, differential
privacy, data provenance, and toxicity mitigation.

###  7.1 Blockchain Federated Unlearning

Privacy regulations are paramount in the online realm, especially concerning
the ”right to be forgotten” and user data privacy which are critical
considerations when working with LLMs and blockchain. Federated blockchain
unlearning offers LLMs the ability to erase learned data. Within our research,
we identified four recent papers that have implemented blockchain federated
unlearning frameworks. As noted previously in Section 4.1.1, Zuo et al. [145]
developed a federated TrustChain framework for blockchain-enhanced LLM
training and unlearning, focusing on the impact of Low-Rank Adaptation (LoRA)
hyperparameters on unlearning performances and integrating Hyperledger Fabric
to ensure the security, transparency, and verifiability of the unlearning
process. In another study, Zuo et al. [144] presented a trustworthy approach
towards federated learning with blockchain-enhanced machine unlearning. This
implementation differs from Trustchain, where Zuo et al. [144] used a machine
unlearning mechanism that utilized two types of clients for training and
unlearning, smart contracts for process automation, and a blockchain network
for secure, immutable record-keeping. Beyond the above works [144], Liu et al.
[64] introduced Blockchain Federated Unlearning (BlockFUL) as a versatile
framework that redesigns the blockchain structure using a Chameleon Hash (CH)
technology to simplify model updates and reduce the computational and
consensus costs associated with unlearning tasks. Additionally, BlockFUL
ensures the integrity and traceability of model updates, including privacy-
preserving results from these blockchain-based unlearning operations [64]. Lin
et al. [61] propose a framework with a proof of federated unlearning protocol
that also utilizes the Chameleon hash function to verify data removal and
eliminate the data contributions stored in other clients’ models. Both, Liu et
al. and Lin et al. use CH functions in their blockchain-enabled federated
unlearning processes. The applications of key blockchain components, such as
on-chain smart contracts and hash mappings for verifying data removal, may
enable LLMs to forget personal data effectively. Blockchain for unlearning is
an emerging area of research with significant potential for further
innovation.

###  7.2 Blockchain Enhanced Retrieval Augmented Generation

Considering the novelty of RAG, there exists a plethora of research that
focuses on how RAG may be attacked, consequently weakening the integrity of
large language models. [121][5][26][143][46][127][22] However, there exists a
vacuum yet to be filled with potential work concerning how these attacks may
be mitigated, especially where defenses can make use of blockchain technology.
In particular, calls for the inspection of blockchain’s potential role in RAG
deployment [9] have been made, and preliminary work done in exploring this
intersection where it concerns blockchain’s potential usefulness in user
experience [129] and performance assessment [84] has been conducted. However,
efforts concentrated on the enhancement of security and safety within RAG
systems are absent from the current literature. A concerted effort towards
bettering BC4LLMs where it concerns RAG would be both mutually and
independently beneficial for blockchain technology and large language models.

###  7.3 Blockchain for Privacy Guarantees in Large Language Models

The clear connection between federated learning, blockchain, and large
language models allows for the field of differential privacy to enter BC4LLMs’
sphere of relevance. Major contributions concerning the impact of differential
privacy on related areas such as deep learning have already been made [1], but
issues such as privacy budget exhaustion still loom large in the space [14].
Moreover, despite conclusions that blockchain can help with privacy budget
exhaustion [38, 136], few efforts have been conducted in exploring these
solutions. Indeed, there is a need for more relevant research in order to
realize the full measure of blockchain’s impact on this area.

###  7.4 Blockchain for Transparency and Data Provenance in Large Language
Models

Several recent papers have urged for increased data accountability measures to
be placed on organizations developing large language models, especially where
it concerns issues of data acquisition [12][41]. Additionally, worth noting
are direct calls for the introduction of blockchain technology to help solve
the issue of data provenance [117] in large language models. Largely, while
this has been answered with responses in the realms of auditability [56],
straightforward data tracking solutions have remained absent from the
literature, despite relatively simple conceptual formulations [28]. Towards
this goal of achieving improved data provenance within large language models
corpus’, RAG databases, and even in-context learning repositories, there is a
need for more explorations into this natural application of distributed ledger
technology to problems of explainable AI concerning large language models.

###  7.5 Blockchain for Non-toxic Large Language Models

Encompassing vital attributes such as ethics, legality, and non-violence,
developing non-toxic large language models has been and will continue to be a
major focus of the field for the foreseeable future [65][39][98]. There is no
doubt that automated filtering of generated toxic content is one of the most
pressing challenges concerning the safety of large language models [36][6].
This is because in essence, filtering inferences negatively impacts the
quality of LLM responses, whereas manual human annotation is a costly and
complex process [6]. Therefore, the applications of blockchain technology in
this regard, while currently limited, are compelling. Considering one of the
most groundbreaking achievements in ML within the past several years,
federated learning has allowed for massive strides to be made within the
spaces of securing training sets, user privacy, and even misinformation
defense. A similar approach, aimed at the problem of toxicity, could be a
hugely beneficial endeavor to the field. Moreover, imagining such a model is
not difficult. Developing consensus around what is considered correct in a
model and using that to propagate gradients and parameters is not dissimilar
to the decisions that must be made about what is or is not toxic given the
state of certain corpora. Given a concentrated research program, automated
non-toxicity could very well have excellent solutions founded within the
blockchain space.

##  8 Conclusion

In this survey, we presented how large language models have been applied to
various facets of everyday life, revealing significant system vulnerabilities
such as data poisoning, hallucinations, jailbreaking, and privacy attacks.
Despite widespread recognition of these issues, effective mitigation
strategies remain limited. Traditional machine learning solutions, such as
differential privacy and federated learning have been applied, but fall short
in providing comprehensive protection against the unique threats faced by
LLMs. The adoption of blockchain technology presents a promising avenue for
enhancing the security and safety of LLMs. Blockchain systems offer robust
mechanisms for ensuring data integrity, provenance and encrypted frameworks
which can be leveraged to bolster LLM defenses. By incorporating blockchain-
based defenses, it is viable to achieve stronger privacy preservation, and
reliable data, and offer LLMs to be more resilient against adversarial
threats.
Furthermore, it is critical to establish clear definitions of security and
safety in the context of LLM technologies. We conclude that security for LLMs
pertains to the ability to tolerate applicable adversarial attacks while
maintaining system integrity to provide consistent and accurate responses.
Whereas safety for LLMs is the model’s capacity to interact with users in a
trustworthy manner, contingent upon adhering to ethical concerns, law-abiding,
non-violent, fair, passively privacy-preserving, and informing. Additionally,
differentiating between active and passive privacy measures will aid in
developing more targeted and effective privacy-preserving strategies. These
distinctions and definitions provide a foundational framework for future
research in the BC4LLM space. From analyzing the integration of blockchain
technology and LLMs, we provided a taxonomy in Figure 3 where previous
research done in the field of BC4LLMs can apply to security and safety
problems that LLMs face. We recognize various gaps in the BC4LLM space that
need to be looked into for further consideration. In refining our
understanding of relevant concepts, we see that the intersection of blockchain
technology and LLMs holds significant potential for addressing the current
shortcomings in LLM security and safety. With our contributions, we can use
BC4LLM to provide more secure, reliable, and safe AI systems.

## References

  * [1] Martin Abadi et al.  “Deep Learning with Differential Privacy”  In _Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security_ , 2016, pp. 308–318
  * [2] Sara Abdali, Richard Anarfi, CJ Barberan and Jia He  “Securing Large Language Models: Threats, Vulnerabilities and Responsible Practices”  In _arXiv preprint arXiv:2403.12503_ , 2024
  * [3] Josh Achiam et al.  “GPT-4 Technical Report”  In _arXiv preprint arXiv:2303.08774_ , 2024
  * [4] Omar Ali, Ashraf Jaradat, Atik Kulakli and Ahmed Abuhalimeh  “A Comparative Study: Blockchain Technology Utilization Benefits, Challenges and Functionalities”  In _IEEE Access_ 9, 2021, pp. 12730–12749
  * [5] Maya Anderson, Guy Amit and Abigail Goldsteen  “Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation”  In _arXiv preprint arXiv:2405.20446_ , 2024
  * [6] Usman Anwar et al.  “Foundational Challenges in Assuring Alignment and Safety of Large Language Models”  In _arXiv preprint arXiv:2404.09932_ , 2024
  * [7] Pathum Chamikara Mahawaga Arachchige et al.  “A Trustworthy Privacy Preserving Framework for Machine Learning in Industrial IoT Systems”  In _IEEE Transactions on Industrial Informatics_ 16.9 IEEE, 2020, pp. 6092–6102
  * [8] Sana Awan, Fengjun Li, Bo Luo and Mei Liu  “Poster: A Reliable and Accountable Privacy-Preserving Federated Learning Framework using the Blockchain”  In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_ , 2019, pp. 2561–2563
  * [9] Anandaganesh Balakrishnan  “Enhancing Data Engineering Efficiency With AI: Utilizing Retrieval-augmented Generation, Reinforcement Learning From Human Feedback, and Fine-tuning Techniques”  In _International Research Journal of Modernization in Engineering Technology and Science_ 6, 2024
  * [10] Sree Bhargavi Balija, Amitash Nanda and Debashis Sahoo  “Building Communication Efficient Asynchronous Peer-to-Peer Federated LLMs with Blockchain”  In _Proceedings of the AAAI Symposium Series_ 3.1, 2024, pp. 288–292
  * [11] Nishant Baranwal Somy et al.  “Ownership Preserving AI Market Places Using Blockchain”  In _2019 IEEE International Conference on Blockchain (Blockchain)_ , 2019, pp. 156–165
  * [12] Emily M. Bender, Timnit Gebru, Angelina McMillan-Major and Shmargaret Shmitchell  “On the Dangers of Stochastic Parrots: Can Language Models Be Too Big”  In _Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency_ , FAccT ’21, 2021, pp. 610–623  DOI: 10.1145/3442188.3445922
  * [13] Dhanasak Bhumichai et al.  “The Convergence of Artificial Intelligence and Blockchain: The State of Play and the Road Ahead”  In _Information_ 15.5, 2024
  * [14] Anis Bkakria et al.  “Optimal Distribution of Privacy Budget in Differential Privacy”  In _Risks and Security of Internet and Systems: 13th International Conference, CRiSIS 2018, Arcachon, France, October 16–18, 2018, Revised Selected Papers 13_ , 2019, pp. 222–236
  * [15] Mouhamed Amine Bouchiha et al.  “LLMChain: Blockchain-based Reputation System for Sharing and Evaluating Large Language Models”  In _arXiv preprint arXiv:2404.13236_ , 2024
  * [16] Tom B. Brown et al.  “Language Models are Few-Shot Learners”  In _Advances in Neural Information Processing Systems_ Curran Associates, Inc., 2020
  * [17] Vitalik Buterin  “Ethereum: A Next-Generation Smart Contract and Decentralized Application Platform.”  In _white paper_ 3.37, 2014
  * [18] Davide Calvaresi et al.  “Explainable Multi-Agent Systems Through Blockchain Technology”  In _Explainable, Transparent Autonomous Agents and Multi-Agent Systems_ Springer International Publishing, 2019, pp. 41–58
  * [19] Bin Cao et al.  “Blockchain Systems, Technologies, and Applications: A Methodology Perspective”  In _IEEE Communications Surveys & Tutorials_ 25.1, 2023, pp. 353–385
  * [20] Nicholas Carlini et al.  “Extracting Training Data from Diffusion Models”  In _32nd USENIX Security Symposium (USENIX Security 23)_ , 2023, pp. 5253–5270
  * [21] Bing-Jyue Chen, Suppakit Waiwitlikhit, Ion Stoica and Daniel Kang  “ZKML: An Optimizing System for ML Inference in Zero-Knowledge Proofs”  In _Proceedings of the Nineteenth European Conference on Computer Systems_ , 2024, pp. 560–574
  * [22] Pengzhou Cheng et al.  “TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models”  In _arXiv preprint arXiv:2405.13401_ , 2024
  * [23] K.. Conway, Cathie So, Xiaohang Yu and Kartin Wong  “opML: Optimistic Machine Learning on Blockchain”  In _arXiv preprint arXiv:2401.17555_ , 2024
  * [24] Jerry Cuomo  “How blockchain adds trust to AI and IoT”  In _IBM Blog_ , 2020
  * [25] Chengyuan Deng et al.  “Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas”  In _arXiv preprint arXiv:2406.05392_ , 2024
  * [26] Gelei Deng et al.  “Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning”  In _arXiv preprint arXiv:2402.08416_ , 2024
  * [27] Advait Deshpande, Katherine Stewart, Louise Lepetit and Salil Gunashekar  “Distributed Ledger Technologies/Blockchain: Challenges, opportunities and the prospects for standards”  In _Overview report The British Standards Institution (BSI)_ 40.40, 2017, pp. 1–34
  * [28] Thang N. Dinh and My T. Thai  “AI and Blockchain: A Disruptive Integration”  In _Computer_ 51.9 IEEE Computer Society, 2018, pp. 48–53
  * [29] Sidi Boubacar ElMamy et al.  “A Survey on the Usage of Blockchain Technology for Cyber-Threats in the Context of Industry 4.0”  In _Sustainability_ 12.21 MDPI, 2020, pp. 9179
  * [30] Thomas F.  “Perspective Chapter: Integrating Large Language Models and Blockchain in Telemedicine”  In _A Comprehensive Overview of Telemedicine [Working Title]_ IntechOpen, 2024
  * [31] Shaokun Fan et al.  “Blockchain as a trust machine: From disillusionment to enlightenment in the era of generative AI”  In _Decision Support Systems_ 182, 2024
  * [32] Andras Ferenczi and Costin Bădică  “A Fully Decentralized Privacy-Enabled Federated Learning System”  In _Computational Collective Intelligence: 15th International Conference, ICCCI Proceedings_ , 2023, pp. 444–456
  * [33] Reza Fotohi, Fereidoon Shams Aliee and Bahar Farahani  “Decentralized and robust privacy-preserving model using blockchain-enabled Federated Deep Learning in intelligent enterprises”  In _Applied Soft Computing_ 161, 2024, pp. 111764
  * [34] Paula Fraga-Lamas and Tiago M. Fernández-Caramés  “Fake News, Disinformation, and Deepfakes: Leveraging Distributed Ledger Technologies and Blockchain to Combat Digital Deception and Counterfeit Reality”  In _IT Professional_ , 2020
  * [35] Deep Ganguli et al.  “Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned”  In _arXiv preprint arXiv:2209.07858_ , 2022
  * [36] Samuel Gehman et al.  “RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models”  In _Findings of the Association for Computational Linguistics: EMNLP 2020_ , 2020, pp. 3356–3369
  * [37] Yuanhao Gong  “Dynamic Large Language Models on Blockchains”  In _arXiv preprint arXiv:2307.10549_ , 2023
  * [38] Leong Mei Han, Yang Zhao and Jun Zhao  “Blockchain-Based Differential Privacy Cost Management System”  In _arXiv preprint arXiv:2006.04693_ , 2020
  * [39] Tessa Han, Aounon Kumar, Chirag Agarwal and Himabindu Lakkaraju  “Towards Safe Large Language Models for Medicine”  In _ICML 2024 Workshop on Models of Human Feedback for AI Alignment_ , 2024
  * [40] Stefan Harrer  “Attention is not all you need: the complicated case of ethically using large language models in healthcare and medicine”  In _EBioMedicine_ 90, 2023
  * [41] Kai He et al.  “A Survey of Large Language Models for Healthcare: from Data, Technology, and Applications to Accountability and Ethics”  In _arXiv preprint arXiv:2310.05694_ , 2024
  * [42] Zheyuan He et al.  “Large Language Models for Blockchain Security: A Systematic Literature Review”  In _arXiv preprint arXiv:2403.14280_ , 2024
  * [43] Dan Hendrycks et al.  “Aligning AI With Shared Human Values”  In _arXiv preprint arXiv:2008.02275_ , 2020
  * [44] Hongsheng Hu et al.  “Membership Inference Attacks on Machine Learning: A Survey”  In _ACM Computing Surveys (CSUR)_ 54.11s, 2022, pp. 1–37
  * [45] Qinwen Hu, Muhammad Rizwan Asghar and Sherali Zeadally  “Blockchain-based public ecosystem for auditing security of software applications”  In _Computing_ 103.11 Springer, 2021, pp. 2643–2665
  * [46] Zhibo Hu et al.  “Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models”  In _arXiv preprint arXiv:2402.07179_ , 2024
  * [47] Xiaowei Huang et al.  “A survey of safety and trustworthiness of large language models through the lens of verification and validation”  In _Artificial Intelligence Review_ 57.7, 2024
  * [48] Rahmeh Fawaz Ibrahim, Qasem Abu Al-Haija and Ashraf Ahmad  “DDoS Attack Prevention for Internet of Thing Devices Using Ethereum Blockchain Technology”  In _Sensors_ 22.18, 2022
  * [49] Hakan Inan et al.  “Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations”  In _arXiv preprint arXiv:2312.06674_ , 2023
  * [50] Ziwei Ji et al.  “Survey of Hallucination in Natural Language Generation”  In _ACM Computing Surveys_ 55.12, 2023, pp. 1–38
  * [51] Haibo Jin et al.  “JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Models”  In _arXiv preprint arXiv: 2407.01599_ , 2024
  * [52] Enkelejda Kasneci et al.  “ChatGPT for good? On opportunities and challenges of large language models for education”  In _Learning and Individual Differences_ 103, 2023
  * [53] Safak Kayikci and Taghi M. Khoshgoftaar  “Blockchain meets machine learning: a survey”  In _Journal of Big Data_ 11.1, 2024
  * [54] Marwa Keshk et al.  “A Privacy-Preserving-Framework-Based Blockchain and Deep Learning for Protecting Smart Power Networks”  In _IEEE Transactions on Industrial Informatics_ 16.8, 2020, pp. 5110–5118
  * [55] Siwon Kim et al.  “ProPILE: Probing Privacy Leakage in Large Language Models”  In _Thirty-seventh Conference on Neural Information Processing Systems_ , 2023
  * [56] Lu Li, Jiwei Qin and Jintao Luo  “A Blockchain-Based Federated-Learning Framework for Defense against Backdoor Attacks”  In _Electronics_ 12.11, 2023
  * [57] Zonghang Li et al.  “Byzantine Resistant Secure Blockchained Federated Learning at the Edge”  In _IEEE Network_ 35.4, 2021, pp. 295–301
  * [58] Zhiding Liang et al.  “Unleashing the potential of llms for quantum computing: A study in quantum architecture design”  In _arXiv preprint arXiv:2307.08191_ , 2023
  * [59] Fudong Lin et al.  “Comprehensive transformer-based model architecture for real-world storm prediction”  In _Joint European Conference on Machine Learning and Knowledge Discovery in Databases_ , 2023, pp. 54–71  Springer
  * [60] Fudong Lin et al.  “MMST-ViT: Climate Change-aware Crop Yield Prediction via Multi-Modal Spatial-Temporal Vision Transformer”  In _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , 2023, pp. 5774–5784
  * [61] Yijing Lin et al.  “Blockchain-enabled Trustworthy Federated Unlearning”  In _arXiv preprint arXiv:2401.15917_ , 2024
  * [62] Bo Liu et al.  “When Machine Learning Meets Privacy: A Survey and Outlook”  In _ACM Computing Surveys (CSUR)_ 54.2, 2021, pp. 1–36
  * [63] Ming Liu et al.  “Federated Learning Meets Natural Language Processing: A Survey”  In _arXiv preprint arXiv:2107.12603_ , 2021
  * [64] Xiao Liu et al.  “Decentralized Federated Unlearning on Blockchain”  In _arXiv preprint arXiv:2402.16294_ , 2024
  * [65] Yang Liu et al.  “Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models’ Alignment”  In _arXiv preprint arXiv:2308.05374_ , 2024
  * [66] Yi Liu et al.  “Prompt Injection attack against LLM-integrated Applications”  In _arXiv preprint arXiv:2306.05499_ , 2024
  * [67] Vasco Lopes and Luís A. Alexandre  “An Overview of Blockchain Integration with Robotics and Artificial Intelligence”  In _arXiv preprint arXiv:1810.00329_ , 2018
  * [68] Nils Lukas et al.  “Analyzing Leakage of Personally Identifiable Information in Language Models”  In _2023 IEEE Symposium on Security and Privacy (SP)_ , 2023, pp. 346–363
  * [69] Haoxiang Luo, Jian Luo and Athanasios V. Vasilakos  “BC4LLM: Trusted Artificial Intelligence When Blockchain Meets Large Language Models”  In _arXiv preprint arXiv:2310.06278_ , 2023
  * [70] Sameera K. M. et al.  “Privacy-Preserving in Blockchain-based Federated Learning Systems”  In _Computer Communications_ , 2024
  * [71] Diksha Malhotra, Poonam Saini and Awadhesh Kumar Singh  “Blockchain-based proof-of-authenticity frameworks for Explainable AI”  In _Multimedia Tools and Applications_ 83.13, 2024, pp. 37889–37911
  * [72] Joshua Maynez, Shashi Narayan, Bernd Bohnet and Ryan McDonald  “On Faithfulness and Factuality in Abstractive Summarization”  In _arXiv preprint arXiv:2005.00661_ , 2020
  * [73] Jean Gilbert Mbula Mboma et al.  “Integrating LLM with Blockchain and IPFS to Enhance Academic Diploma Integrity”  In _2024 International Conference on Artificial Intelligence, Computer, Data Sciences and Applications (ACDSA)_ , 2024, pp. 1–6
  * [74] Jean Gilbert Mbula Mboma, Obed Tshimanga Tshipata, Witesyavwirwa Vianney Kambale and Kyandoghere Kyamakya  “Assessing How Large Language Models Can Be Integrated with or Used for Blockchain Technology: Overview and Illustrative Case Study”  In _2023 27th International Conference on Circuits, Systems, Communications and Computers (CSCC)_ , 2023, pp. 59–70
  * [75] H. McMahan et al.  “Communication-Efficient Learning of Deep Networks from Decentralized Data”  In _Artificial intelligence and statistics_ , 2017, pp. 1273–1282
  * [76] Ralph C. Merkle  “A Digital Signature Based on a Conventional Encryption Function”  Springer, 1988, pp. 369–378
  * [77] Du Mingxiao et al.  “A review on consensus algorithm of blockchain”  In _2017 IEEE International Conference on Systems, Man, and Cybernetics (SMC)_ , 2017, pp. 2567–2572
  * [78] Anudit Nagar  “Privacy-Preserving Blockchain Based Federated Learning with Differential Data Sharing”  In _arXiv preprint arXiv:1912.04859_ , 2019
  * [79] Satoshi Nakamoto  “Bitcoin: A Peer-to-Peer Electronic Cash System”, 2008
  * [80] Seth Neel and Peter Chang  “Privacy Issues in Large Language Models: A Survey”  In _arXiv preprint arXiv:2312.06717_ , 2024
  * [81] Cong T. Nguyen et al.  “Proof-of-Stake Consensus Mechanisms for Future Blockchain Networks: Fundamentals, Applications and Opportunities”  In _IEEE Access_ , 2019
  * [82] Ankit Pal, Logesh Kumar Umapathi and Malaikannan Sankarasubbu  “Med-HALT: Medical Domain Hallucination Test for Large Language Models”  In _arXiv preprint arXiv:2307.15343_ , 2023
  * [83] Xudong Pan, Mi Zhang, Shouling Ji and Min Yang  “Privacy Risks of General-Purpose Language Models”  In _2020 IEEE Symposium on Security and Privacy (SP)_ , 2020, pp. 1314–1331
  * [84] Young-Hoon Park, Yejin Kim and Junho Shim  “Blockchain-Based Privacy-Preserving System for Genomic Data Management Using Local Differential Privacy”  In _Electronics_ 10.23, 2021
  * [85] Attia Qammar, Ahmad Karim, Huansheng Ning and Jianguo Ding  “Securing federated learning with blockchain: a systematic literature review”  In _Artificial Intelligence Review_ 56.5, 2023, pp. 3951–3985
  * [86] Youyang Qu et al.  “Blockchain-enabled Federated Learning: A Survey”  In _ACM Computing Surveys_ 55.4, 2023, pp. 1–35
  * [87] Liz Reid  “Generative AI in Search: Let Google do the searching for you”  In _Google_ , 2024
  * [88] Paul Röttger, Fabio Pernisi, Bertie Vidgen and Dirk Hovy  “SafetyPrompts: a Systematic Review of Open Datasets for Evaluating and Improving Large Language Model Safety”  In _arXiv preprint arXiv:2404.05399_ , 2024
  * [89] Kangrui Ruan et al.  “S2e: Towards an end-to-end entity resolution solution from acoustic signal”  In _ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)_ , 2024, pp. 10441–10445
  * [90] Sara Saberi, Mahtab Kouhizadeh, Joseph Sarkis and Lejia Shen  “Blockchain technology and its relationships to sustainable supply chain management”  In _International Journal of Production Research_ 57.7, 2019, pp. 2117–2135
  * [91] Khaled Salah, M. Ur Rehman, Nishara Nizamuddin and Ala Al-Fuqaha  “Blockchain for AI: Review and Open Research Challenges”  In _IEEE Access_ 7, 2019, pp. 10127–10149
  * [92] Oshani Seneviratne  “Blockchain for Social Good: Combating Misinformation on the Web with AI and Blockchain”  In _Proceedings of the 14th ACM Web Science Conference 2022_ , 2022, pp. 435–442
  * [93] Muhammad Shafay et al.  “Blockchain for deep learning: review and open challenges”  In _Cluster Computing_ 26.1, 2023, pp. 197–221
  * [94] Zawar Shah et al.  “Blockchain Based Solutions to Mitigate Distributed Denial of Service (DDoS) Attacks in the Internet of Things (IoT): A Survey”  In _Sensors_ 22, 2022
  * [95] Mrinank Sharma et al.  “Towards Understanding Sycophancy in Language Models”  In _arXiv preprint arXiv:2310.13548_ , 2023
  * [96] Erfan Shayegani et al.  “Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks”  In _arXiv preprint arXiv:2310.10844_ , 2023
  * [97] Meng Shen et al.  “Exploiting Unintended Property Leakage in Blockchain-Assisted Federated Learning for Intelligent Edge Computing”  In _IEEE Internet of Things Journal_ 8.4, 2021, pp. 2265–2275
  * [98] Tianhao Shen et al.  “Large Language Model Alignment: A Survey”  In _arXiv preprint arXiv:2309.15025_ , 2023
  * [99] Saurabh Singh et al.  “Convergence of blockchain and artificial intelligence in IoT network for the sustainable smart city”  In _Sustainable Cities and Society_ 63, 2020
  * [100] Shridhar Singh  “Enhancing Privacy and Security in Large-Language Models: A Zero-Knowledge Proof Approach”  In _International Conference on Cyber Warfare and Security_ 19.1, 2024, pp. 574–582
  * [101] Tobin South, Guy Zuskind, Robert Mahari and Thomas Hardjono  “Secure Community Transformers: Private Pooled Data for LLMs”  MIT, 2023
  * [102] Lichao Sun et al.  “TrustLLM: Trustworthiness in Large Language Models”  In _arXiv preprint arXiv:2401.05561_ , 2024
  * [103] Xiaoqiang Sun et al.  “A Survey on Zero-Knowledge Proof in Blockchain”  In _IEEE Network_ 35.4, 2021
  * [104] Hamed Taherdoost  “Blockchain Technology and Artificial Intelligence Together: A Critical Review on Applications”  In _Applied Sciences_ 12.24, 2022, pp. 12948
  * [105] Simone Tedeschi et al.  “ALERT: A Comprehensive Benchmark for Assessing Large Language Models’ Safety through Red Teaming”  In _arXiv preprint arXiv:2404.08676_ , 2024
  * [106] Timm Teubner et al.  “Welcome to the Era of ChatGPT et al.”  In _Business & Information Systems Engineering_ 65, 2023
  * [107] Casey Tonkin  “‘ChatGPT, help me make a bomb”’, 2023
  * [108] Imdad Ullah et al.  “Privacy Preserving Large Language Models: ChatGPT Case Study Based Vision and Framework”  In _arXiv preprint arXiv:2310.12523_ , 2023
  * [109] Yixin Wan et al.  “”Kelly is a Warm Person, Joseph is a Role Model”: Gender Biases in LLM-Generated Reference Letters”  arXiv, 2023
  * [110] Boxin Wang et al.  “DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Models”  In _NeurIPS_ , 2023
  * [111] Qianlong Wang et al.  “AI at the Edge: Blockchain-Empowered Secure Multiparty Learning With Heterogeneous Models”  In _IEEE Internet of Things Journal_ 7.10 IEEE, 2020, pp. 9600–9610
  * [112] Laura Weidinger et al.  “Sociotechnical Safety Evaluation of Generative AI Systems”  In _arXiv preprint arXiv:2310.11986_ , 2023
  * [113] Sean Wellington  “BasedAI: A decentralized P2P network for Zero Knowledge Large Language Models (ZK-LLMs)”  In _arXiv preprint arXiv:2403.01008_ , 2024
  * [114] Chenkai Weng et al.  “Mystique: Efficient Conversions for Zero-Knowledge Proofs with Applications to Machine Learning”  In _30th USENIX Security Symposium (USENIX Security 21)_ , 2021, pp. 501–518
  * [115] Jian Weng et al.  “Auditable privacy protection deep learning platform construction method based on block chain incentive mechanism” US Patent 11,836,616  Google Patent, 2023
  * [116] Jiasi Weng et al.  “DeepChain: Auditable and Privacy-Preserving Deep Learning with Blockchain-Based Incentive”  In _IEEE Transactions on Dependable and Secure Computing_ 18.5, 2021, pp. 2438–2455
  * [117] Karl Werder, Balasubramaniam Ramesh and Rongen (Sophia) Zhang  “Establishing Data Provenance for Responsible Artificial Intelligence Systems”  In _ACM Transactions on Management Information Systems_ , 2022, pp. 1–23
  * [118] Amy Winograd  “Loose-Lipped Large Language Models Spill Your Secrets: The Privacy Implications of Large Language Models Notes”  In _Harvard Journal of Law & Technology (Harvard JOLT)_, 2022
  * [119] Leon Witt et al.  “Blockchain and Artificial Intelligence: Synergies and Conflicts”  In _ArXiv preprint arXiv:2405.13462_ , 2024
  * [120] Charles F. Xavier  “PipeMSM: Hardware Acceleration for Multi-Scalar Multiplication”, Cryptology ePrint Archive, Paper 2022/999, 2022
  * [121] Jiaqi Xue et al.  “BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models”  In _ArXiv preprint arXiv:2406.00083_ , 2024
  * [122] Biwei Yan et al.  “On Protecting the Data Privacy of Large Language Models (LLMs): A Survey”  In _arXiv preprint arXiv:2403.05156_ , 2024
  * [123] Jingfeng Yang et al.  “Harnessing the Power of LLMs in Practice: A Survey on ChatGPT and Beyond”  In _ACM Transactions on Knowledge Discovery from Data_ 18.6, 2023, pp. 1–32
  * [124] Yifan Yao et al.  “A Survey on Large Language Model (LLM) Security and Privacy: The Good, The Bad, and The Ugly”  In _High-Confidence Computing_ , 2024, pp. 100211
  * [125] Abbas Yazdinejad, Reza M. Parizi, Gautam Srivastava and Ali Dehghantanha  “Making Sense of Blockchain for AI Deepfakes Technology”  In _2020 IEEE Globecom Workshops (GC Wkshps_ , 2020, pp. 1–6
  * [126] Hongbin Ye et al.  “Cognitive Mirage: A Review of Hallucinations in Large Language Models”  In _arXiv preprint arXiv:2309.06794_ , 2023
  * [127] Shenglai Zeng et al.  “The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)”  In _arXiv preprint arXiv:2402.16893_ , 2024
  * [128] Rui Zhang, Rui Xue and Ling Liu  “Security and Privacy on Blockchain”  In _ACM Computing Surveys_ 52.3, 2020
  * [129] Ruichen Zhang et al.  “Interactive AI with Retrieval-Augmented Generation for Next Generation Networking”  In _IEEE Network_ , 2024
  * [130] Yue Zhang et al.  “Siren’s Song in the AI Ocean: A Survey on Hallucination in Large Language Models”  In _arXiv preprint arXiv:2309.01219_ , 2023
  * [131] Zhenjie Zhang et al.  “Proof of Quality: A Costless Paradigm for Trustless Generative AI Model Inference on Blockchains”  In _arXiv preprint arXiv:2405.17934_ , 2024
  * [132] Zhexin Zhang et al.  “Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritization”  In _arXiv preprint arXiv:2311.09096_ , 2024
  * [133] Zhexin Zhang et al.  “SafetyBench: Evaluating the Safety of Large Language Models with Multiple Choice Questions”  In _arXiv preprint arXiv:2309.07045_ , 2023
  * [134] Shuai Zhao et al.  “Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models”  In _arXiv preprint arXiv:2305.01219_ , 2023
  * [135] Wayne Xin Zhao et al.  “A Survey of Large Language Models”  In _arXiv preprint arXiv:2303.18223_ , 2023
  * [136] Yang Zhao et al.  “A Blockchain-Based Approach for Saving and Tracking Differential-Privacy Cost”  In _IEEE Internet of Things Journal_ 8.11, 2021, pp. 8865–8882
  * [137] Yang Zhao et al.  “Privacy-Preserving Blockchain-Based Federated Learning for IoT Devices”  In _IEEE Internet of Things Journal_ 8.3, 2021, pp. 1817–1829
  * [138] Lianmin Zheng et al.  “Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena”  In _Advances in Neural Information Processing Systems_ 36, 2024
  * [139] Zibin Zheng et al.  “A Survey of Large Language Models for Code: Evolution, Benchmarking, and Future Trends”  In _arXiv preprint arXiv:2311.10372_ , 2024
  * [140] Zibin Zheng et al.  “An overview on smart contracts: Challenges, advances and platforms”  In _Future Generation Computer Systems_ 105, 2020, pp. 475–491
  * [141] Xudong Zhu, Hui Li and Yang Yu  “Blockchain-Based Privacy Preserving Deep Learning”  In _Information Security and Cryptology_ , 2019, pp. 370–383
  * [142] Jun Zhuang and Casey Kennington  “Understanding survey paper taxonomy about large language models via graph representation learning”  In _arXiv preprint arXiv:2402.10409_ , 2024
  * [143] Wei Zou, Runpeng Geng, Binghui Wang and Jinyuan Jia  “PoisonedRAG: Knowledge Poisoning Attacks to Retrieval-Augmented Generation of Large Language Models”  In _arXiv preprint arXiv:2402.07867_ , 2024
  * [144] Xuhan Zuo et al.  “Federated Learning with Blockchain-Enhanced Machine Unlearning: A Trustworthy Approach”  In _arXiv preprint arXiv:2405.20776_ , 2024
  * [145] Xuhan Zuo et al.  “Federated TrustChain: Blockchain-Enhanced LLM Training and Unlearning”  In _arXiv preprint arXiv:2406.04076_ , 2024