A deployable mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting is proposed, which restores infinite-horizon subgame-perfect incentive compatibility against stationary mixed-strategy deviations above an explicit discount-factor threshold without per-query cryptographic verification.
Abstract
Restaking-based protocols enable verifiable LLM inference without the high proving cost of zkML or the hardware trust assumptions of TEEs. Their security is commonly justified by a one-round slashing condition: a rational provider should not cheat when the expected penalty exceeds the cost saving from dishonest inference. This paper shows that this condition can overstate security when inference is supplied repeatedly under the same stake. We model verifiable inference as a discounted repeated game and identify a repeated-game gap caused by proportional slashing: detected deviations reduce future penalty exposure, while cost savings are earned again across queries. We derive the gap in closed form, show that it persists under minimum-stake ejection, and extend it to memoryless bounded-slashing protocols covering deployed designs. We propose a deployable mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting. The mechanism restores infinite-horizon subgame-perfect incentive compatibility against stationary mixed-strategy deviations above an explicit discount-factor threshold without per-query cryptographic verification. Evaluation across nine open-weight model pairs from 0.5B to 14B parameters shows that the audit signal has the required concave detectability response. A Stackelberg audit-budget analysis shows that improved signal responsiveness reduces the baseline audit rate by 2.6x at discount factor 0.95. Calibrated to deployed parameters, surveyed protocols pass one-round incentive compatibility but admit repeated-game deviations for discount factors between 0.92 and 0.98, with deviation-profit fractions of 1.5%--8%. Our mechanism reduces deviation profits by 31%--54% while maintaining low-latency economic verification.
A rational Dolev--Yao attacker is introduced, a DY intruder whose actions carry costs and whose security-violating goals carry rewards, and a protocol is called rationally secure when no intruder strategy achieves a violation with strictly positive utility, expressed in a weighted fragment of ATL (WATL).
Decentralized Federated Learning removes the need for a trusted central server but introduces a critical verification gap: participants cannot prove to each other that they have honestly executed the costly local training. This gap undermines both security and incentive alignment, as rational clients are tempted to cheat without fear of automated penalty. Existing defenses are insufficient. Statistical methods cannot cryptographically verify computation, while cryptographic systems incur prohibitive overhead by exhaustively verifying every client. Crucially, both lack a mechanism to automatically convert detection into punishment. To solve the problem, we propose PoL-BFL, a framework that bridges this gap through a novel "verify-then-slash" paradigm. Its core insight is to make verification economically decisive rather than exhaustive. PoL-BFL integrates (1) probabilistic cryptographic verification, where clients efficiently prove training authenticity via zero-knowledge proofs, with only a random subset audited each round; and (2) automated economic enforcement, where smart contracts slash the stake of clients whose proofs fail. This is instantiated in a synergistic three-layer defense that ensures computational authenticity, filters malicious updates that pass cryptographic verification, and enforces incentive compatibility. We prove that honest participation is strictly more profitable than cheating for rational clients whenever the detection probability, stake, and reward parameters satisfy a derived condition. Extensive experiments across eight attack types show that PoL-BFL consistently outperforms single-point defenses. Against free-riding, our detection rate reaches 96.5% compared to 72.5% for ShapleyFL [24]. Against Byzantine attacks, model accuracy under ALIE attack reaches 82.8% versus 68.2% with Krum [5] alone. System overhead remains practical in our controlled testbed: 23.6× faster than Veriblock-FL [9], with per-round gas costs under $1 at 1.5 gwei and $2500/ETH. Code is available at https://github.com/weixiubo/PoL-BFL.
Xiubo Wei, Yahong Chen, Jiahui Hu et al.· Proceedings of the 32nd ACM...· 0 citations
Stackelberg Security Games (SSG) assume that an attacker observes the defender's strategy and chooses the target that maximizes their expected utility perfectly. In most realistic applications this is not plausible, and in the case of cyber deception (e.g., using decoys) the purpose of the game is to induce uncertainty and mistakes. Quantal response is a common way to represent noise and mistakes in decision-making; here it replaces perfect best-response with a logit choice with rationality parameter $\lambda$ and results in a generalized Quantal Stackelberg Equilibrium (QSE), which recovers the classical solution exactly as $\lambda \rightarrow \infty$. We conduct a deeper analysis of how QSE can function as a generalized form of insurance against a variety of forms of model specification error/uncertainty; our analysis shows that QSE provides a practical way to address the important role of tie-breaking rules and model uncertainty in SSG from both a theoretical and practical perspective. We conduct an empirical evaluation in a cybersecurity case study with two networks and real vulnerabilities drawn from CVE and scored using the Common Vulnerability Scoring System (CVSS). QSE beats Stackelberg in realized defender utility spanning 144 scenarios with specification errors and 25 parameter configurations, with gains of 46\% to 175\% showing a substantial advantage in a wide variety of realistic cases.
Asif Rahman, Md Abu Sayed, Ahmed Ann Noor Ryen et al.· 0 citations
Existing Capture-the-Flag (CTF) platforms trust a single organizer, offer limited auditability, and are vulnerable to infrastructure-level manipulation. We propose zk–MPSFV, a zk-SNARK-based, multi-phase sub-flag verification scheme that replaces centralized scoring with an on-chain, zero-knowledge, publicly verifiable scoreboard. Challenges are decomposed into sub-challenges arranged as a directed acyclic graph (DAG): a team unlocks the next step only after proving completion of all parent nodes. Sub-flags and decryption keys are jointly generated by n organizers and released via an off-chain ($t, n$) Shamir–BLS threshold signature produced through multi-party computation (MPC), preventing any single organizer from leaking or altering keys. Teams submit zk-PLONK proofs that the contract verifies, timestamps, and records immutably. Under standard assumptions (collision-resistant hashing, SNARK soundness/zero-knowledge, IND-CCA2 ECIES, and at least t honest organizers), we prove that zk–MPSFV achieves the stated security goals, including DAG-gated progress, anti-replay, and threshold-robust organizer security, while out-of-band flag sharing remains out of scope. On a three-organizer testbed with 30 simulated teams, setup costs 0.45 ms per sub-flag, proof generation averages 5.34 s on an 8-core system, and on-chain verification costs $\approx$ 170kL2 gas on zkSync Era with a median fee of 1.33 $\times 10^{-6}$ ETH (about ${\$}$0.0046 at ${\$}$3,435/ETH). Stress replays sustain $\approx$ 7 proof transactions/s up to 5000 proofs; extrapolating to 50,000 proofs (1000 teams $\times$ 50 submissions) yields $\approx$ 0.0665 ETH (about ${\$}$200–${\$}$228) and $\approx$ 2 hours of settlement time. Overall, zk-MPSFV is practical for small- to mid-scale, audit-ready progression CTFs.
S. Khanji, Behzad Abdolmaleki, John A. Clark et al.· IEEE Computer Security Found...· 0 citations
We introduce a repeated dynamic incentive framework for characterizing when"compliance", or full-effort honest service provision, is incentive compatible in Decentralized Physical Infrastructure Networks (DePIN). We model quality control in this setting as a repeated moral-hazard problem between the protocol and each provider, where compliance is enforced by both slashing posted collateral and the discounted threat of demotion to probation tiers on a reputation ladder. Our main contribution is the"deterrence ratio"$\Gamma$, the worst-case ratio of a deviation's private gain to its marginal probability of detection. We find that if any profitable deviation does not increase the fail probability relative to compliance, then binary public-outcome protocols cannot deter it. When all profitable deviations have positive detection gaps and no weakly costlier action is less likely to fail, compliance is sequentially incentive compatible if and only if immediate slashing plus discounted reputation loss is at least $\Gamma$ at every reputation tier. We use this condition to formulate a protocol design problem mapping service primitives to stake requirements, reward schedules, probation rules, and audit frequency.
An agent playing a Nash-equilibrium strategy in a two-player zero-sum imperfect-information game secures the game value but forfeits the additional value offered by a flawed opponent. Diffuse deviations pose a particular challenge: binary release rules may gather too little evidence to act, while a full best response to an incomplete opponent model can be highly exploitable. We introduce \emph{budget-constrained confidence-scheduled restricted responses} (CS-RNR), the first opponent-exploitation method whose safety guarantee is a certificate the agent computes on the strategy it actually deploys, so that every exploit it commits to is one it has audited itself. The method tracks pooled action frequencies with anytime-valid confidence sequences and treats a frequency as exploitable only once its interval separates from an equilibrium reference. The confirmed deviations define a conservative opponent model, which a restricted-response solve turns into candidate counter-strategies over a grid of pin levels. Before deployment, each complete candidate is evaluated by a full-tree best response. The resulting certificate is compared with a user-specified budget and committed atomically with the strategy. Because this check is performed on the played strategy, model quality determines the exploitation achieved while the certificate controls reference-relative expected loss. In Leduc hold'em, CS-RNR obtains $6.2\times$ the steady-state gain of a money-verified binary gate while keeping every deployed strategy within budget. A trajectory mixture using the same estimator reaches $13.6\times$ the budget. Across Leduc, Liar's Dice, and 5-rank Leduc, all $36{,}000$ audited hands satisfy the reported certificate tolerance.
Boning Li, Longbo Huang· arXiv.org· 2 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
