{"slug": "i-built-a-vision-ai-that-blocks-blockchain-attacks-invisible-to-text-based-from", "title": "I Built a Vision AI That Blocks Blockchain Attacks Invisible to Text-Based Systems — From Ouagadougou, Burkina Faso", "summary": "A developer in Ouagadougou, Burkina Faso, built a vision-language model that detects blockchain attacks invisible to text-based security systems. The fine-tuned model, named Imina-Na, identified a Drain Star attack that scored 0.42 on all existing systems and blocked it in 48 milliseconds. The system was trained on Sigui-DePIN-1M, a dataset of one million annotated transaction graph images derived from 1.87 million real on-chain transactions.", "body_md": "I Built a Vision AI That Blocks Blockchain Attacks Invisible to Every Text-Based Security System — From Ouagadougou, Burkina Faso\n\nHow a fine-tuned Vision-Language Model on AMD MI300X detected a Drain Star attack that scored 0.42 on every existing system — and blocked it in 48ms.\n\nThe Attack That Slipped Through Everything\n\nIt was 14:32:01 UTC. Nine wallets simultaneously initiated transfers toward a single hub address. Each transfer: $0.48 USDC. Each one, individually, looked completely normal.\n\nThe receiving hub had no prior negative reputation. The sending wallets had clean histories. The transaction amounts were below average for each sender. Frequency was moderate. No single transaction triggered any rule.\n\nEvery existing text-based security system would have scored this as R = 0.42 — ambiguous, borderline. In the best case: escalated to human review. In the worst case: allowed through.\n\n$4.32 USDC drained. Nine victims. Zero alerts.\n\nThis is a Drain Star attack — and it's completely invisible to text-based analysis.\n\nUntil now.\n\nThe Problem Nobody Is Solving\n\nI've been building blockchain security infrastructure for the past 6 months. What I kept running into was a fundamental gap that nobody in the ecosystem had properly addressed.\n\nTraditional security systems — both rule-based and ML-based — analyze transactions one at a time. They look at:\n\nAmount (normal? abnormal?)\n\nFrequency (too fast?)\n\nDestination (known bad actor?)\n\nSmart contract (audited?)\n\nThis works fine for simple attacks. But coordinated attacks don't look dangerous at the individual transaction level. The attack signature is topological — it exists in the relationship between transactions, not in any single one.\n\nA Drain Star attack with 9 wallets sending $0.48 each is:\n\n9 normal-looking amounts ✓\n\n9 normal frequencies ✓\n\n9 transactions to the same destination (suspicious? maybe)\n\n1 hub address with no prior bad history ✓\n\nText-based score: R = 0.42. ESCALATE. Maybe a human catches it. Maybe not.\n\nThe Insight That Changed Everything\n\nHere's what I realized: these attacks are visually obvious.\n\nWhen you render the transaction subgraph as an image — wallets as nodes, transfers as directed edges — a Drain Star looks exactly like a star. Nine spokes pointing to one hub. Red hub node (high degree centrality). Purple edges (USDC transfers).\n\nA human security analyst looking at this graph for 3 seconds would immediately say: \"That's a drain star. Block it.\"\n\nSo the question became: can a Vision-Language Model do the same thing in 48 milliseconds?\n\nThe answer is yes. But you have to train it first.\n\nBuilding the Dataset: 1 Million Transaction Graphs\n\nI couldn't fine-tune a VLM on generic data. The model needed to see real blockchain attack topologies, thousands of times, until it learned to recognize them instantly.\n\nSo I built Sigui-DePIN-1M: 1,000,000 annotated blockchain transaction graph images derived from 1.87 million real on-chain transactions from Ethereum, Arbitrum, and Polygon.\n\nThe construction pipeline:\n\nStep 1 — Data collection\n\nRaw transaction subgraphs extracted via archive node queries. For each seed transaction: depth-2 ego-network spanning a 10-block window.\n\nStep 2 — Visualization\n\nEach subgraph rendered as a 672×672 PNG using NetworkX and Matplotlib:\n\nBackground: #0d0f2b (deep indigo)\n\nHub nodes (degree > 3): Red\n\nLeaf nodes: Green\n\nUSDC transfer edges: Purple (width proportional to amount)\n\n4 layout algorithms in rotation to prevent overfitting\n\nStep 3 — Labeling\n\nFour classes with graph-theoretic criteria:\n\nCode\n\nInter-rater agreement (Cohen's κ = 0.91) validated by manual review of 10,000 samples.\n\nResult: 11.1GB of the most specialized blockchain security dataset in existence.\n\n📊 Dataset: huggingface.co/datasets/Ibonon/sigui-depin-1m\n\nFine-Tuning Imina-Na on AMD MI300X\n\nI named the model Imina Na — the Grand Mask of the Awa society in Dogon cosmology. The most sacred layer.\n\nBase model: Qwen2-VL-2B-Instruct. Fine-tuning method: LoRA (r=16, α=32) targeting the attention projections. Hardware: AMD Instinct MI300X (192GB HBM3) via AMD Developer Cloud.\n\nCode\n\nThe results:\n\nMetric\n\nBase Qwen2-VL\n\nImina-Na V2 (fine-tuned)\n\nOverall F1\n\n88.1%\n\n92.9%\n\nDrain Star recall\n\n82.3%\n\n95.2%\n\nFalse positives\n\n12.0%\n\n3.1%\n\nInference latency\n\n48ms\n\n48ms (unchanged)\n\nThe fine-tuning added 4.8 F1 points and cut the false positive rate by 75%. Same latency. No tradeoffs.\n\n🤖 Model: huggingface.co/Ibonon/imina_na_v2_lora\n\nThe Full Pipeline: Sigui Protocol\n\nImina Na is Layer 5 of a 5-layer security oracle I call Sigui Protocol — named after the Dogon ceremony of cosmic renewal that happens every 60 years.\n\nCode\n\nThe risk formula:\n\nPython\n\nBack to the Attack: What Actually Happened\n\nLet me finish the story from the beginning.\n\nThe attack:\n\n9 coordinated wallets → 1 hub\n\nEach transfer: $0.48 USDC\n\nAll wallets: clean history\n\nHub: no prior bad reputation\n\nText-only pipeline (Layers 1-4):\n\nCode\n\nThe attack would have been escalated to human review. Maybe blocked. Maybe not. Depends on whether a human was watching at 14:32:01 UTC.\n\nWith Imina Na (Layer 5):\n\nThe transaction subgraph is rendered in 3ms. Nine inbound edges converging on a single red hub node. The topology is immediately recognizable.\n\nImina Na's response:\n\nJson\n\nFinal score:\n\nCode\n\nDecision time: 48ms total.\n\nThe attack was blocked. Nine wallets protected.\n\nThe attack was invisible to text. Imina Na saw it.\n\nERC-8259: Standardizing Agent Trust\n\nBuilding Sigui made me realize there's a deeper problem: there's no standard for AI agent identity and reputation on Ethereum.\n\nWhen an agent makes a transaction, there's no way for a smart contract to:\n\nVerify which AI model is operating the wallet\n\nQuery a behavioral trust score\n\nReceive standardized threat signals from security oracles\n\nI submitted ERC-8259 to Ethereum Magicians to address this. It proposes three interfaces:\n\nSolidity\n\nThe standard received substantive feedback from Pablo at AHM, who operates behavioral reputation for ~20,000 agent wallets on Base mainnet. Their operational insight about confidence-aware reputation (observation density ≠ score) is now incorporated into the spec.\n\n💬 Discussion: ethereum-magicians.org/t/erc-8259\n\nUsing Sigui in Your Agent (3 Lines of Code)\n\nThe whole system is available as an open-source Python SDK:\n\nBash\n\nPython\n\nFor LangChain agents:\n\nPython\n\nFor OpenClaw agents:\n\nBash\n\nThe skill returns deterministic verdicts (ALLOW / BLOCK / ESCALATE) with exit codes for programmatic handling. Starknet, Aptos, and Ethereum are supported natively.\n\n🔧 OpenClaw Skill: clawhub.ai/ibonon/sigui-security\n\nThe Numbers So Far\n\nBuilt solo, from Ouagadougou, Burkina Faso:\n\n380+ attacks blocked and permanently recorded on Arc L1 testnet\n\n1,000,000 transaction graphs in the open-source dataset\n\n273 PyPI downloads in the first month (sigui-sdk)\n\n115 OpenClaw skill installs in 4 days\n\n133 dataset downloads on HuggingFace\n\nStarknet Foundation Grant: passed pre-screening, in deep technical screening\n\nERC-8259: under active community review on Ethereum Magicians\n\nWhat's Next: Trustformer\n\nThe 48ms latency of Imina Na comes largely from the graph-rendering pipeline (~28ms of overhead). The model inference itself is only ~20ms.\n\nI'm proposing Trustformer (T-GAT) — a native Spatio-Temporal Graph Attention Transformer that eliminates the rendering step entirely. Instead of converting transactions to images, it processes them as raw token sequences with a novel Dual Flow-Reputation Attention mechanism:\n\nPython\n\nProjected latency: < 5ms. Same F1. No rendering overhead.\n\nPreprint: drive.google.com/file/d/1t9CklAUMLQ9wZgcqLrrvMtTYSGOYYos_\n\n(I'm currently seeking an arXiv endorser for cs.CR or cs.AI — endorsement code P4EHO3 at arxiv.org/auth/endorse. If you hold endorser status and find this work valuable, I'd be honored by your support.)\n\nOpen Source, All of It\n\nEverything is MIT-licensed and available today:\n\nResource\n\nLink\n\n🐙 GitHub\n\ngithub.com/ibonon/Sigui\n\n📦 SDK (PyPI)\n\npypi.org/project/sigui-sdk\n\n🧠 Model V2\n\nhuggingface.co/Ibonon/imina_na_v2_lora\n\n📊 Dataset\n\nhuggingface.co/datasets/Ibonon/sigui-depin-1m\n\n🔧 OpenClaw Skill\n\nclawhub.ai/ibonon/sigui-security\n\n💬 ERC-8259\n\nethereum-magicians.org/t/erc-8259\n\n📄 Preprint\n\nTrustformer Architecture\n\nThe Bigger Picture\n\nAs AI agents become autonomous economic actors — managing wallets, executing DeFi strategies, interacting with smart contracts without human oversight — the security infrastructure protecting them was not designed for this world.\n\nTraditional systems analyze transactions one at a time. Attackers coordinate across transactions. The gap is structural, not incremental.\n\nVisual topology analysis is not the only answer. But it's a layer that was missing, and Sigui is the first system to operationalize it at production latency on real blockchain data.\n\nIf you're building AI agents that interact with blockchain infrastructure, I'd love to hear about your security challenges. Drop a comment or reach me on GitHub.\n\n— Eric Warma · Independent Researcher · Ouagadougou, Burkina Faso\n\nTags: #blockchain #ai #security #machinelearning #python #web3 #opensource #defi", "url": "https://wpnews.pro/news/i-built-a-vision-ai-that-blocks-blockchain-attacks-invisible-to-text-based-from", "canonical_source": "https://dev.to/ibonon/i-built-a-vision-ai-that-blocks-blockchain-attacks-invisible-to-text-based-systems-from-50b3", "published_at": "2026-05-31 02:03:03+00:00", "updated_at": "2026-05-31 02:42:18.220755+00:00", "lang": "en", "topics": ["artificial-intelligence", "computer-vision", "ai-products", "ai-infrastructure"], "entities": ["AMD MI300X", "Ouagadougou", "Burkina Faso", "Drain Star"], "alternates": {"html": "https://wpnews.pro/news/i-built-a-vision-ai-that-blocks-blockchain-attacks-invisible-to-text-based-from", "markdown": "https://wpnews.pro/news/i-built-a-vision-ai-that-blocks-blockchain-attacks-invisible-to-text-based-from.md", "text": "https://wpnews.pro/news/i-built-a-vision-ai-that-blocks-blockchain-attacks-invisible-to-text-based-from.txt", "jsonld": "https://wpnews.pro/news/i-built-a-vision-ai-that-blocks-blockchain-attacks-invisible-to-text-based-from.jsonld"}}