{"id":"92813424-e10d-43ba-896a-2fa497c3a801","arxiv_id":"2608.09055","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A one-round slashing condition is insufficient for repeated restaked inference; the paper derives the repeated-game gap and a mechanism that restores long-run incentives above a discount-factor threshold.","lead":"The paper shows that the standard slashing test used to secure restaked AI inference is too weak when the same provider answers many queries, because a detected cheat shrinks the stake at risk while the cost saving is earned again each round. It derives the gap in closed form and proposes a mechanism of history-dependent audits, reputation-weighted slashing, and stake vesting to restore long-run incentives.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Theorem 3's SPIC restoration is contradicted by the paper's own Table 5: stationary best-response A4' earns +6.20% at delta=0.95 > delta*=0.9322.","rationale":"The reader's conditional verdict focuses on the signal-robustness assumption (mu'(0)>0) as the weakest link. My read finds a more direct, internal problem: Section 6.1's Theorem 3, the paper's central positive claim, is contradicted by the paper's own evaluation in Table 5. At the stress calibration, delta*=0.9322; the simulator runs A4', the MC-corrected stationary best response, at delta=0.95 and reports +6.20% profit. Since delta > delta*, Theorem 3 promises SPIC against exactly this class of stationary deviations in [p,1] with p=0.10. The contradiction is not a boundary effect: the profit is roughly six standard errors above zero. The stated culprit is the steady-state robust posterior fixed point rho_bar(p)=min{1,p} (Remark 5). The analytical A4 uses it to compute p_br ~ 0.18, while the MC correction finds p* ~ 0.90, so the fixed point used in (15) and (16) is quantitatively wrong. The paper's own sentence that A4 'under-picks' p* concedes this, yet Theorem 3 is stated as a theorem assuming this fixed point is concave-increasing. Since h(p)=c_bar(p)*alpha_bar(p) multiplies both the contemporaneous and vesting penalty terms in (15), a wrong fixed point invalidates the threshold delta* and the bounded-stake asymptotics of Corollary 1. A second defect compounds this: the vesting exposure term in the proof of (15) is asserted without derivation from the Section 3 model, where audits settle before the next round; a rational cheat-then-exit adversary would stop cheating while its balance vests, so the claimed 'same continuation discipline' does not follow. Both issues bear on the same equation, and the simulation makes the failure concrete. I credit the paper's impossibility direction: Theorem 1 and Lemma 1 are cleanly derived, the ejection-robustness argument (Theorem 5) is plausible, and the simulator passes analytical checks against Lemma 1 and Theorem 5, which lends credibility to the A4' numbers. The empirical detectability measurements are also a useful contribution, despite the templated-prompt limitation. But the headline 'mechanism restores infinite-horizon SPIC' is not supported: the very table that evaluates the mechanism refutes the theorem's prediction. This is an internal inconsistency, not a disagreement with external consensus. Recommended adjustment: REJECT for the current version because the central positive theorem fails the paper's own test; a revised version that weakens Theorem 3 to an empirical claim, corrects the posterior fixed point, and re-derives (15) without the unsupported vesting term could be reconsidered. The reader's conditional verdict under-weights this internal contradiction and over-weights the legitimate but secondary signal-robustness concern.","tokens_in":22652,"tokens_out":14180,"duration_ms":122502,"concrete_test":"Recompute the steady-state robust posterior fixed point rho_bar(p) numerically from the Lemma 2 recursion for the stress calibration of Table 5 (c0=0.20, beta=0.50, alpha0=0.10, alpha1=0.40, tau=200, p=0.10) and use it to re-solve (15) for delta*. Then run the artifact's simulator to find the empirical break-even delta at which the A4' profit crosses zero. If the re-solved delta* exceeds the empirical break-even, or if A4' profit remains positive at delta=0.95, then Theorem 3's guarantee is invalid and the paper's central positive claim fails.","verdict_should_be":"REJECT","load_bearing_attack":"Section 6.1 (Theorem 3, eq. 15) claims infinite-horizon SPIC against stationary deviations in [p,1] whenever delta >= delta*, with delta* = 0.9322 at the stress calibration. Section 7.1's simulator implements P3 with these exact parameters and runs the MC-corrected stationary best response A4' (p* ~ 0.90). Table 5 reports A4' profit +6.20% +/- 0.98% at delta=0.95, i.e., at a discount factor strictly above the asserted threshold. This is a direct internal falsification of the theorem's guarantee, not a matter of external assumptions. The root cause is the asserted steady-state posterior fixed point. Remark 5 states that rho_bar(p)=min{1,p} 'holds by inspection in the calibration,' and the analytical A4 row uses this to compute p_br ~ 0.18. The MC-corrected A4' finds the true best response at p* ~ 0.90, showing the fixed point is far from correct. A wrong steady-state posterior invalidates the indifference condition (15) and the threshold delta*, because it enters h(p)=c_bar(p)*alpha_bar(p) multiplicatively. The paper's own text concedes the analytical A4 'under-picks' p*, yet Theorem 3 is still stated as a theorem with that fixed point as its key non-primitive assumption. The vesting exposure term h(p_br)^2 S delta (1-delta^tau)/(1-delta) in the proof of (15) is also asserted without derivation from the Section 3 model, where detection is contemporaneous; a cheat-then-exit adversary can simply stop cheating during the vesting window, so the claimed 'same continuation discipline' does not follow. Both defects bear on the same equation, and the simulation result makes the conflict concrete.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies restaking-based verifiable LLM inference as a discounted repeated game. It shows that the standard one-round slashing condition (cαS ≥ Δ) is insufficient once the same stake supports many future queries, because proportional slashing reduces future penalty exposure while cheating gains are re-earned each round. The authors derive a closed-form repeated-game gap (Lemma 1, Theorem 1), extend it to a class of memoryless bounded-slashing protocols (Theorem 2), and propose a mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting that is claimed to restore infinite-horizon subgame-perfect incentive compatibility above an explicit discount-factor threshold (Theorem 3). The paper also reports measurements of an audit signal's detectability response on Qwen2.5 models, a Stackelberg audit-budget analysis, and simulations with several adversaries.","tokens_in":23049,"tokens_out":7944,"duration_ms":74737,"significance":"The negative result — that one-round IC overstates security under proportional slashing — is a clean, novel, and practically relevant contribution. Lemma 1 and Theorem 1 are parameter-free derivations under stated assumptions, and the paper ships a reproducible artifact with unit tests and provenance notes. The extension to memoryless bounded-slashing protocols (Theorem 2) is an elegant class result that captures deployed designs. The empirical measurement of the detectability response is a useful first step, and the Stackelberg audit-budget analysis is a sensible application of the framework. However, the paper's central constructive claim, Theorem 3, is contradicted by the paper's own simulation results, and the proof relies on an asserted steady-state posterior and an underived vesting exposure term. As a result, the mechanism's claimed security guarantee is not currently established, which substantially reduces the significance of the paper as a whole.","major_comments":[{"comment":"Theorem 3 asserts ∞-SPIC against stationary deviations for all δ ≥ δ*, with δ* = 0.9322 at the stress calibration. Table 5 reports that at δ = 0.95, which is strictly above δ*, the Monte Carlo corrected stationary best response A4' earns +6.20% ± 0.98% on P3. This is a direct internal contradiction: the theorem's guarantee fails in the paper's own simulation at a parameter point inside the claimed safe region. The paper's explanation that the analytical A4 under-picks p* does not rescue the theorem, because A4' is the appropriate stationary best response and still profits at δ > δ*.","section":"Section 6.1, Theorem 3, and Table 5"},{"comment":"The steady-state robust posterior used in Theorem 3 is not correctly derived. Remark 5 states that ρ̄(p) = min{1, p} holds by inspection in the calibration, but the recursion in Lemma 2 under stationary cheating with audit rate c̄(p) has fixed point ρ̄ = 1 for any p > 0 whenever c̄(p) > 0, not min{1, p}. The claimed concavity of ρ̄(·) is therefore unsupported, and the best-response characterization (16), which feeds directly into the threshold δ*, is based on an incorrect fixed point. This is a load-bearing error because ρ̄ enters h(p) = c̄(p)ᾱ(p) multiplicatively in (15).","section":"Remark 5 and Lemma 2"},{"comment":"The vesting exposure term h(p_br)^2 S δ(1−δ^τ)/(1−δ) is asserted without derivation. The stage game in Section 3.2 has contemporaneous detection: slashing occurs for detected cheating in the current round. A cheat-then-exit adversary can simply stop cheating after submitting an unbonding request, so it is not evident that the vested balance remains exposed to the same per-round detection probability h(p_br); the term also appears to omit the factor p_br present in the contemporaneous slashing expression p_br h(p_br) S. The proof needs a formal derivation of this continuation exposure before (15) can support the theorem.","section":"Section 6.1, proof of Theorem 3"},{"comment":"The mechanism's key assumption is μ'(0) > 0, with βμ'(0) as the deployment quantity. The empirical support is limited to 200 templated prompts on Qwen2.5 models; Section C concedes that a substitute matching the contracted model across all signal channels would drive μ'(0) to zero and degrade the mechanism to the memoryless baseline. The paper's claim that the audit signal has the required concave detectability response is therefore not established for naturalistic or adversarially matched workloads, which the paper itself acknowledges as future work. This limitation should be stated more prominently in the abstract and conclusions, since it directly conditions the practical relevance of the mechanism.","section":"Section 5.2 and Section E"}],"minor_comments":[{"comment":"The notation S_t is used both for the provider's stake in Section 3 and for the suspicion score in Section 5.2, which is confusing when reading equations (10) and (14) together.","section":"Sections 3 and 5.2"},{"comment":"The validation of Theorem 3 is said to be checked to 'machine precision'; please specify exactly which equation or invariant is verified and how the fixed-point solver is tested.","section":"Section 7.1"},{"comment":"The table caption reports T = 10^5 rounds with 100 seeds, while the text describing the stress regime mentions the same calibration; please confirm the seed count and horizon are consistent across the artifact and the paper.","section":"Table 5 and Section 7.1"},{"comment":"In the displayed equation, the notation δ*τ is ambiguous without parentheses; writing δ^{*τ} or δ^{*τ} would improve readability.","section":"Section 6.1, Equation (15)"},{"comment":"The per-protocol parameters are rounded to two significant digits from whitepapers; it would be helpful to include the exact source values or a pointer to the provenance file in the main text for reproducibility.","section":"Table 4"}],"recommendation":"major_revision","confidential_remarks":"The negative result (Theorems 1 and 2) is strong and publishable, but the constructive theorem currently fails internally. If the authors can correct the steady-state posterior derivation, provide a proper derivation of the vesting exposure, and align Theorem 3 with the simulation results — or honestly reframe the mechanism as a heuristic supported by simulation — the paper could become a valuable contribution. The current version should not be accepted as is."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing you should know: the paper's negative result is real; the positive mechanism result is not. Lemma 1 and Theorem 1 give a clean closed form for why one-round IC with proportional slashing fails under repetition: detected slashes shrink future exposure while the cost saving recurs every round. The extension to memoryless bounded-slashing protocols is the right abstraction, and the simulation artifact matches the theory for the baselines. The calibration to EigenAI, VeriLLM, and Sertn, with 1.5-8% deviation profits, is plausible, and the concave signal-response measurements on nine Qwen model pairs are a genuine empirical contribution, even with the templated-prompt caveat the authors state.\n\nThe soft spot is Theorem 3. The paper claims infinite-horizon SPIC above a threshold delta* = 0.9322, yet its own Table 5 reports the stationary best response A4' earning +6.20% at delta = 0.95, above that threshold. The authors note that A4' corrects the analytical under-picked best response, but they never reconcile that with the theorem. The stress-test note is right about the mechanism: the asserted steady-state posterior rho_bar(p) = min{1,p} does not follow from the Lemma 2 recursion; for moderate p the true fixed point is much higher, and that feeds directly into h(p), the threshold, and the indifference condition (15). The proof of (15) also introduces an h(p)^2 S vesting term without derivation. The deeper problem is structural: when hS < Delta, always-cheat yields a positive per-round surplus regardless of delta, so no vesting term of that form can make cheating unprofitable. The theorem's condition is not the right infinite-horizon condition.\n\nThis is not a minor gap. The mechanism may reduce deviation profit by the reported 31-54%, but it does not restore SPIC as stated. The gap result, though, stands on its own and deserves attention.\n\nThe paper is worth a serious referee. The core theorem and the measurements are citable; the mechanism section needs major revision or a downgrade to a bounded-profit claim. I would send it to peer review with that flag.","headline":"A solid impossibility result for repeated-game slashing, paired with a mechanism theorem that the paper's own simulation contradicts.","tokens_in":23585,"tokens_out":9668,"would_cite":true,"duration_ms":94635,"reading_group":"yes","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["91A20","91A80"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper proves that the standard single-round slashing test overstates the security of restaking-based verifiable inference when the same stake serves many queries.","keywords":["repeated games","verifiable inference","restaking","slashing","incentive compatibility","mechanism design","LLM inference","subgame-perfect equilibrium"],"falsifier":"Run a live or simulated deployment with the calibrated range $\\delta\\in[0.92,0.98]$, the one-round condition $c\\alpha S_0=\\Delta$ binding, partial slashing $\\alpha<1$, and no ejection: if the always-cheat stationary strategy yields positive discounted profit, Theorem 1 is confirmed, whereas if no stationary cheat is profitable the stake-evolution model or the calibration is wrong. Separately, measure $\\mu(p)$ on naturalistic adversarial workloads; if $\\mu'(0)=0$ for some substitute that preserves $\\Delta$, the proposed mechanism's restoration fails even where the gap theorem holds.","tokens_in":22450,"feed_emoji":"⚖️","tokens_out":7782,"duration_ms":74019,"temperature":0.7,"pith_summary":"Restaking-based protocols promise verifiable LLM inference without the proving cost of zero-knowledge machinery or the hardware trust of trusted execution environments, and their security is normally certified by a one-round condition: the expected slashing penalty $c\\alpha S$ must exceed the per-query cost saving $\\Delta$. The paper argues that this condition can certify protocols that are still cheatable in the long run. Because slashing is proportional, a detected cheat shrinks the stake exposed to future penalties, while the cost saving from cheating is earned again on every future query, so the two diverge over an infinite horizon. The paper derives a closed-form threshold for this repeated-game gap, shows the gap applies to the whole class of memoryless bounded-slashing protocols used by deployed designs, and proposes a mechanism of history-dependent challenges, reputation-weighted slashing, and stake vesting that restores infinite-horizon incentives above an explicit discount factor. If the paper is right, deployed verifiable-inference protocols should be re-examined under repeated interaction, and the standard slashing test alone is not enough.","feed_headline":"The standard slashing test lets LLM providers cheat long-term","feed_subtitle":"Repeated queries shrink the stake at risk while cheating savings recur; a closed-form threshold shows when one-round security fails.","key_machinery":"The engine of the negative result is the stake-evolution identity $S_{t+1}=S_t(1-\\alpha\\,\\mathbf{1}[\\text{cheat and audited}])$: under stationary cheating at rate $p$, the expected stake decays geometrically while the per-query saving $\\Delta$ is collected every round, so a condition binding at the initial stake fails along the continuation path, and the always-cheat deviation $p=1$ yields the closed-form profit gap in Lemma 1. The positive construction uses three instruments acting on the continuation payoff: an exponentially weighted suspicion score that raises audit probability through $c(S_t)=c_0+\\beta S_t$, a robust Bayesian posterior that ties slashing to reputation via $\\text{slash}_t=(\\alpha_0+\\alpha_1\\bar{\\rho}_t)S_t$, and a vesting window that keeps stake slashable for $\\tau$ rounds after an unbonding request. The threshold $\\delta^*$ is the unique solution to $\\Delta=\\bar{c}(p_{\\mathrm{br}})\\,\\bar{\\alpha}(p_{\\mathrm{br}})\\,S\\,(1+\\delta^*(1-\\delta^{*\\tau})/(1-\\delta^*)\\,\\bar{c}(p_{\\mathrm{br}})\\bar{\\alpha}(p_{\\mathrm{br}}))$, and the one-shot deviation principle reduces equilibrium verification to ruling out one-period deviations.","core_discovery":"The central claim is Theorem 1: with proportional slashing $\\alpha<1$, a protocol can satisfy the one-round incentive constraint $c\\alpha S_0\\ge\\Delta$ with strict slack and still fail infinite-horizon subgame-perfect incentive compatibility. The failure occurs whenever the slack $\\eta=c\\alpha S_0-\\Delta$ is smaller than $\\delta c\\alpha\\Delta/(1-\\delta)$; equivalently, infinite-horizon security requires $c\\alpha S_0\\ge\\Delta(1+\\delta c\\alpha/(1-\\delta))$, a stake requirement that diverges as the provider's patience $\\delta$ approaches 1. The paper extends the result to memoryless bounded-slashing protocols, where any detected cheat can slash at most a fraction of current stake, so the negative result covers the deployed designs surveyed rather than a single implementation. It then proves that a mechanism combining history-dependent audit rates, reputation-weighted slashing, and time-locked vesting restores subgame-perfect incentive compatibility against stationary mixed-strategy deviations once the discount factor passes a threshold $\\delta^*$ defined by a closed-form equation, and that the required stake stays finite as $\\delta\\to 1$.","pith_inferences":["An extension the paper leaves implicit: the same stake-decay channel should afflict any restaked service with private actions and proportional slashing, such as oracle reporting or data-availability attestations, not only LLM inference; the class result already points in that direction.","A testable consequence: deployed protocols should publish per-signal detectability curves on naturalistic, adversarially distributed workloads; if a substitute can erase $\\mu'(0)$ while keeping the cost saving $\\Delta$, the proposed mechanism silently degrades to the memoryless baseline the paper itself flags.","The discount-factor calibration is built from operator deregistration and yield data over a fixed window; monitoring these series over time is a cheap way to track whether a deployment is drifting toward the gap region.","Because the mechanism's threshold rises as the saving $\\Delta$ grows, an operator can hedge by pricing substitutes closer to the contracted model, reducing the incentive to cheat rather than relying solely on larger slashing."],"forward_implications":["Any memoryless bounded-slashing verifiable-inference protocol that only checks the one-round condition $c\\alpha S_0\\ge\\Delta$ can admit a profitable always-cheat deviation for $\\delta$ in the calibrated 0.92--0.98 range; the paper quantifies deviation-profit fractions of 1.5%--8% for the surveyed designs.","Closing the gap by strengthening the one-round stake requirement alone is hopeless as $\\delta\\to 1$, since the required stake diverges, whereas the proposed mechanism keeps required stake bounded (Corollary 1).","The mechanism restores infinite-horizon subgame-perfect incentive compatibility against stationary cheating rates above a deployment floor $p$ once $\\delta\\ge\\delta^*$, with no per-query cryptographic verification, and honest operators' robust posterior decays to zero so baseline audit overhead is preserved.","Signal responsiveness substitutes for baseline auditing: in the Stackelberg audit-budget analysis, raising the suspicion-gain parameter $\\beta$ cuts the required baseline audit rate by 2.6$\\times$ at target $\\delta=0.95$.","Minimum-stake ejection does not remove the gap: cheating until ejection loses only a negligible factor relative to the unbounded-horizon gain for deployed parameter ranges."],"supporting_citations":[{"why":"Supplies the discounted repeated-game framework and the one-shot deviation principle used to verify subgame-perfect equilibria.","marker":"[16]"},{"why":"Folk-theorem background for why repeated-game incentives need not follow from one-round stage-game incentives.","marker":"[10]"},{"why":"Provides the restaking platform context, the operator-management interface the mechanism targets, and the event stream used to calibrate the discount factor.","marker":"[9]"},{"why":"A surveyed deployed verifiable-inference design whose published audit and slashing parameters instantiate the measured repeated-game gap.","marker":"[2]"},{"why":"A second surveyed deployed design in the memoryless bounded-slashing class used for the quantification.","marker":"[22]"},{"why":"A third surveyed deployed design whose parameters define the low end of the gap range.","marker":"[11]"},{"why":"Supplies the knowledge-distillation detectability evidence used to calibrate the risk-signal response $\\mu(p)$.","marker":"[12]"},{"why":"Provides quantization cost ratios and detectability evidence used for the cross-scale amplitude scaling of $\\mu(p)$.","marker":"[15]"},{"why":"The open-weight model family used in the direct empirical measurement of the audit signal's concavity.","marker":"[19]"}],"fun_headline_variants":["One-round slashing fails when providers repeat LLM inference","Repeated queries expose a slashing blind spot in restaking","Restaking verification: the slashing test misses repeat cheats","Proportional slashing lets LLM providers cheat across queries","New mechanism closes the repeated-game gap in restaked inference"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proposed fix depends on the monitored risk signal having a positive marginal response at zero cheating, $\\mu'(0)>0$; if a substitute model could match the contracted model on all signal channels while preserving the cost saving, the mechanism would degrade to the memoryless baseline and the restoration would fail even though the gap theorem itself stands.","fun_headline_variants_meta":{"raw":{"variants":["One-round slashing fails when providers repeat LLM inference","Repeated queries expose a slashing blind spot in restaking","Restaking verification: the slashing test misses repeat cheats","Proportional slashing lets LLM providers cheat across queries","New mechanism closes the repeated-game gap in restaked inference"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000344,"raw_usage":{"total_tokens":1963,"prompt_tokens":1090,"completion_tokens":873,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":706,"completion_tokens_details":{"reasoning_tokens":790}},"tokens_in":706,"tokens_out":873,"duration_ms":8197,"temperature":1.0,"reasoning_tokens":790,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:17:35.492640+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a live or simulated deployment with the calibrated range $\\delta\\in[0.92,0.98]$, the one-round condition $c\\alpha S_0=\\Delta$ binding, partial slashing $\\alpha<1$, and no ejection: if the always-cheat stationary strategy yields positive discounted profit, Theorem 1 is confirmed, whereas if no stationary cheat is profitable the stake-evolution model or the calibration is wrong. Separately, measure $\\mu(p)$ on naturalistic adversarial workloads; if $\\mu'(0)=0$ for some substitute that preserves $\\Delta$, the proposed mechanism's restoration fails even where the gap theorem holds.","supporting_citations":[{"cited_title":"Econometrica54(3), 533–554 (1986),https:// www.jstor.org/stable/1911307","cited_arxiv_id":null,"evidence_quote":"Folk-theorem background for why repeated-game incentives need not follow from one-round stage-game incentives."},{"cited_title":"Whitepaper (2023),https://docs.eigencloud.xyz/assets/files/EigenLayer_ WhitePaper-88c47923ca0319870c611decd6e562ad.pdf","cited_arxiv_id":null,"evidence_quote":"Provides the restaking platform context, the operator-management interface the mechanism targets, and the event stream used to calibrate the discount factor."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"A third surveyed deployed design whose parameters define the low end of the gap range."},{"cited_title":"In: Proceedings of Machine Learning and Systems (MLSys) (2024),https://proceedings.mlsys.org/paper_files/paper/ 2024/hash/42a452cbafa9dd64e9ba4aa95cc1ef21-Abstract-Conference.html","cited_arxiv_id":null,"evidence_quote":"Provides quantization cost ratios and detectability evidence used for the cross-scale amplitude scaling of $\\mu(p)$."},{"cited_title":"Blog post (2024),https: //qwenlm.github.io/blog/qwen2.5/","cited_arxiv_id":null,"evidence_quote":"The open-weight model family used in the direct empirical measurement of the audit signal's concavity."}],"review_version":1}