{"id":"821d9c88-e5d4-4411-ba9b-302b2c16bcc4","arxiv_id":"2509.10291","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":3.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper claims AutoML regressors can serve as blockchain nonce generators but only measures output uniqueness, not randomness.","lead":"This paper proposes using machine learning regression models as random number generators (nonces) for blockchain transactions in disaster energy trading, reporting that some models produce unique outputs 100% of the time. It is a design proposal with an evaluation that does not actually test unpredictability or security.","discovery_kind":"incremental","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Randomness rate measures uniqueness, not cryptographic unpredictability; a deterministic AutoML.predict (Algorithm 1) outputs identical nonces for identical inputs, so the central claim of secure nonce generation is unsupported.","rationale":"The reader's weakest_assumption identifies the same load-bearing concern: the randomness rate, defined as the proportion of unique outputs, is treated as a measure of cryptographic unpredictability. This is indeed the central pillar of the paper's claim. My analysis confirms the concern is not merely a matter of missing tests but a fundamental category error. The paper's own Algorithm 1 uses a deterministic AutoML.predict call to generate the nonce, and Section IV-C celebrates output uniqueness as 'randomness.' For a deterministic model, uniqueness across test samples depends only on input diversity, which is trivial for continuous features, and Shannon entropy computed on raw floating-point outputs without binning is meaningless. An adversary who knows the model and the network features can recompute the nonce, so the proposed mechanism does not provide the security properties required of blockchain nonces. The paper offers no independent support such as code, data, or adversarial analysis. Therefore, the reader's REJECT verdict is well-founded and unchanged by my stress-test.","tokens_in":8164,"tokens_out":3181,"duration_ms":36033,"concrete_test":"Retrain the Extra Trees model on the paper's 9000-sample dataset. For any fixed feature vector v, call predict(v) twice and verify identical outputs; then have an adversary with the model weights and the public network state (delay, jitter, loss) compute the nonce for a pending block and compare it to the block's recorded nonce. Matching outputs demonstrate determinism and predictability, falsifying the randomness/unpredictability claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central argument equates output diversity with cryptographic nonce quality. Eq. (1) defines randomness rate as the fraction of unique predictions in the test set, and Section IV-C explicitly states that a rate near 100% indicates 'rarely generates duplicate values, which is a desirable trait in nonce generation.' But uniqueness in a finite test set is not unpredictability. For continuous regression models, floating-point outputs are almost surely unique when input features are continuous; the 100% figures for Random Forest and Extra Trees simply reflect that no two test rows have identical feature vectors, not that outputs are random. More critically, Algorithm 1 computes nonce = AutoML.predict(NetworkFeatures). A trained regressor is a deterministic function; anyone with the model and the same (possibly public) network telemetry can reproduce the nonce exactly. The paper provides no adversarial model, no entropy source, and no standard randomness tests (NIST SP 800-22, TestU01). The Shannon entropy values are computed on raw floating-point outputs without binning, making them near-maximal by construction (each distinct float assigned empirical probability 1/N). Thus the claim that these models are suitable blockchain nonce generators rests on a category error: uniqueness ≠ unpredictability.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes an SDN-assisted blockchain architecture for secure energy trading in disaster scenarios, in which AutoML-selected regression models (Gradient Boosting, LightGBM, Random Forest, Extra Trees, K-Nearest Neighbors) are used to generate nonce candidates. Using a 9000-sample QoS dataset, the authors evaluate the models on standard regression metrics plus a proposed 'randomness rate' defined as the proportion of unique predictions, and Shannon entropy. They report that Random Forest and Extra Trees achieve 100% randomness and maximum normalized entropy, concluding that these deterministic regression models can serve as lightweight, unpredictable nonce generators for blockchain consensus.","tokens_in":8417,"tokens_out":4094,"duration_ms":43576,"significance":"If the proposed mechanism were sound, replacing proof-of-work with ML-generated nonces on SDN controllers could reduce computational overhead in energy-constrained disaster environments. The paper provides a clearly described architecture and benchmarks five models, including training and inference times. It does not, however, provide any security analysis, standard randomness testing, or reproducible experimental details. The central claim rests on a metric that conflates output uniqueness with cryptographic unpredictability, so the contribution, as presented, does not establish a valid nonce-generation method.","major_comments":[{"comment":"The randomness rate R = U / (Σ P_i) × 100, defined as the fraction of unique predictions in the test set, is not a measure of unpredictability. For continuous regression outputs, floating-point predictions are almost surely unique whenever input feature rows are distinct, so the 100% values in Table II likely reflect the absence of duplicate feature vectors rather than any stochastic property. Moreover, Algorithm 1 uses nonce = AutoML.predict(NetworkFeatures), a deterministic function; anyone with the model and network telemetry can reproduce the nonce. The paper offers no adversary model, no secret entropy input, and no standard tests such as NIST SP 800-22 or TestU01. The conclusion that these models are suitable nonce generators is therefore unsupported. The equation itself is also not well-formed: the text defines P as 'the number of unique predictions' while using ΣP_i as the total","section":"IV-C, Eq. (1)"},{"comment":"The Shannon entropy calculation is applied to raw floating-point predictions without specifying any binning or discretization. With continuous outputs, the empirical distribution assigns probability near 1/N to each distinct value, so H(X) ≈ log2 N; after normalization to [0,1] this is near 1.0000 by construction. Thus the entropy values in Table II provide no independent evidence of uniformity or unpredictability. The authors must specify a quantization scheme and compare the entropy against the theoretical maximum for the chosen bins. As written, the entropy result is an artifact of the evaluation procedure.","section":"IV-C, Eq. (2)"},{"comment":"The mining process lacks any security analysis. The block hash includes a 'predicted nonce' from a deterministic AutoML model; if network features are observable or estimable, an adversary can precompute candidate nonces and craft valid-looking blocks. The paper does not analyze collision resistance, nonce reuse, resistance to feature manipulation, or double-spending. Claiming that the method 'eliminates the need for PoW or deterministic nonce generation' is unjustified without a threat model and a formal or simulation-based security argument.","section":"IV-D, Algorithm 1"},{"comment":"The experimental basis is thin. The dataset is described only as '9000 samples' with no source, generation process, feature distributions, train/test split, or number of repeated runs. The randomness rates are point estimates from a single test set, with no confidence intervals or sensitivity analyses (e.g., to floating-point precision, input perturbations, or test-set size). Since these numerical results are the sole support for the central claim, the manuscript needs at least the data-generation procedure and code to be reproducible.","section":"V, Table II"}],"minor_comments":[{"comment":"Typographical and notation issues: the definition of P and U should be clarified; as printed, R = U / (Σ P_i) × 100 is ambiguous and not dimensionally consistent with the prose.","section":"IV-C, Eq. (1)"},{"comment":"The terms 'non-deterministic' and 'randomness' are used to describe outputs of deterministic regression models. Recommend replacing these with 'diverse' or 'pseudo-random' to avoid an internal contradiction.","section":"Abstract and IV-D"},{"comment":"Several references have inconsistent formatting (e.g., [8] is listed with a Sensors DOI, while the in-text citation and surrounding references use IEEE style). Please unify the reference list.","section":"References"},{"comment":"The paper does not state whether the reported randomness rates are based on the same train/test split used for the accuracy metrics, nor how shuffling was applied. This should be specified for reproducibility.","section":"V"}],"recommendation":"reject","confidential_remarks":"The core metric of the paper, randomness rate as the proportion of unique predictions, is a category error when used as evidence of cryptographic nonce quality. A deterministic regressor's output uniqueness in a finite test set has no bearing on unpredictability, and the Shannon entropy computation is similarly an artifact of continuous outputs. These are load-bearing flaws that cannot be repaired by local edits; the paper would need a fundamentally different evaluation methodology and a security model to support its claims. The topic may fit an applied security venue, but the current manuscript is not suitable for publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here—using AutoML regression models to generate blockchain nonce candidates in disaster scenarios—is genuinely new relative to the cited literature. The authors are clear that they care about output diversity, not prediction accuracy, and they provide a concrete SDN architecture, benchmark five models, and report both prediction quality and timing. That part is solid and readable.\n\nThe problem is that the paper's definition of randomness is a facade. The “randomness rate” R in Eq. (1) is simply the proportion of unique predictions in the test set. For continuous floating-point outputs, that proportion is trivially high whenever input feature vectors differ; Random Forest and Extra Trees hitting 100% is a reflection of float uniqueness, not unpredictability. The Shannon entropy calculation uses the same raw floats without binning, so it approaches 1.0 by construction. These are not subtle issues—they are the entire empirical basis for the claim.\n\nMore importantly, Algorithm 1 computes nonce = AutoML.predict(NetworkFeatures). A trained regressor is a deterministic function. Anyone who has the model and the network telemetry can reproduce the nonce exactly. The paper provides no adversarial model, no entropy source, no standard randomness tests (NIST, TestU01), and no security analysis. Saying that a deterministic function produces “unpredictable” outputs is a category error. The authors even claim the models passed “randomness and unpredictability thresholds” without ever defining any threshold.\n\nThere is also a minor formula issue: Eq. (1) is malformed because P_i is not defined, but it collapses to U/N. The dataset is not described in enough detail to know whether the 9000 samples are independent, and no code is provided, so the results are not reproducible as they stand.\n\nSo the central claim—that these models are suitable for secure nonce generation—does not hold up. This is a load-bearing flaw, not a fixable evaluation gap. That said, the paper is not incoherent or deceptive; it is a straightforward mistake about what uniqueness implies. The writing is honest about what the models do, which makes the paper useful as a cautionary example. If the authors can add a real unpredictability analysis and standard randomness tests, the idea might have legs, but as submitted it would not pass serious review.\n\nI recommend sending it to peer review only because the concept is novel enough to merit expert eyes, but the reviewers should be asked to focus on the security model and the meaning of the randomness metric. For my own work, I would not cite it, and I would only bring it to a reading group as an illustration of why uniqueness is not randomness.","headline":"The paper's randomness metric measures output uniqueness, not cryptographic unpredictability, and its nonce generation is deterministic, so the central claim fails—though the idea of using AutoML regressors for nonces is genuinely new.","tokens_in":742,"tokens_out":848,"would_cite":false,"duration_ms":43506,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that AutoML-trained regression models can generate blockchain nonce values from network telemetry, with Random Forest and Extra Trees reaching 100% on its randomness metric.","keywords":["Blockchain","Nonce generation","AutoML","Regression models","Randomness rate","SDN","Energy trading","Disaster resilience"],"falsifier":"Run the trained Random Forest or Extra Trees regressor twice on the same network-state vector and observe that it yields the identical nonce; or feed a long sequence of model-generated nonces to a standard statistical randomness test suite (e.g., NIST SP 800-22) and find that it fails.","tokens_in":8055,"feed_emoji":"⚡","tokens_out":3256,"duration_ms":32748,"temperature":0.7,"pith_summary":"After a disaster, households with solar power can trade energy with mobile charging units, but such trades need a blockchain that works without centralized coordination. The authors argue that the nonce values blockchain consensus normally obtains from brute-force proof-of-work can instead be produced by machine-learning regression models running in SDN controllers. They train five AutoML-selected regressors on quality-of-service network features and measure each model's 'randomness rate'—the share of unique predictions in a test set. Random Forest and Extra Trees reach 100% uniqueness and maximum Shannon entropy, and the other three models score above 97%, which the paper takes as evidence that lightweight, context-sensitive nonce generation is feasible in degraded networks.","feed_headline":"Tree ensembles hit 100% on blockchain nonce randomness test","feed_subtitle":"Paper proposes replacing proof-of-work with AutoML regression outputs for disaster-zone energy trading.","key_machinery":"The load-bearing device is the 'randomness rate' metric of Eq. (1), the proportion of unique model predictions in the test set, paired with Shannon entropy (Eq. 2) as a uniformity measure. These metrics recast a regressor's output diversity as a cryptographic qualification. The AutoML regressors themselves—five models selected via the PyCaret pipeline—are the generators: throughput is the target proxy, and the four QoS features (delay, jitter, packet loss, throughput) provide the context-dependent variation that yields nonce candidates within the SDN controller.","core_discovery":"The central claim is that predictive variability in regression models is a usable source of blockchain nonce values. On a 9000-sample dataset of one-way delay, jitter, packet loss, and throughput, five AutoML-selected regressors were trained to predict throughput. The authors intentionally disregard prediction accuracy and instead evaluate the diversity of outputs, defining randomness rate as the percentage of unique predictions. Random Forest and Extra Trees produced 100% unique outputs with Shannon entropy of 1.0, Gradient Boosting 97.6%, KNN 98.8%, LightGBM 99.9%. The paper interprets these scores as showing that tree-based ensembles can serve as lightweight nonce generators in an SDN-ass","pith_inferences":["Extension: Uniqueness on a fixed test set is not the same as unpredictability to an adversary; a deterministic regressor produces identical output when the same feature vector reoccurs, so the generated nonce is reproducible by anyone with the model and the network state.","Extension: A more direct test of the paper's claim would be to feed identical inputs repeatedly and check for identical outputs, or to run a standard cryptographic randomness battery (e.g., NIST SP 800-22) on a long sequence of generated nonces.","Extension: The observed 'randomness' may largely reflect the diversity of feature vectors in the test set rather than an intrinsic property of the model; reshuffling or resampling the same data would likely change the metric.","Extension: If deployed, the security of this scheme would rest on the secrecy of the model or its input features—an unusual trust assumption for a public blockchain ledger."],"forward_implications":["In a disaster, SDN controllers can generate nonce values from network telemetry, avoiding the computational cost of proof-of-work brute-force search.","Random Forest and Extra Trees regressors produced 100% unique outputs and maximum Shannon entropy on the test set, making them the paper's recommended nonce generators.","The other three models—Gradient Boosting, K-Nearest Neighbors, LightGBM—also exceeded 97% randomness and high entropy, suggesting a spectrum of workable candidates.","The paper's trade-off analysis implies that models optimized for predictive accuracy (e.g., Gradient Boosting) are not necessarily the best for nonce generation, and vice versa.","All five models are claimed to pass the randomness and unpredictability thresholds the authors consider necessary for secure blockchain integration."],"fun_headline_variants":["Tree ensembles hit 100% on nonce randomness test","Proof of AutoML: ML regressors as nonce source","Random Forest, Extra Trees ace blockchain nonce test","AutoML regressors turn out as nonce generators","Disaster blockchain gets nonce boost from tree models"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The central claim collapses if output uniqueness on a fixed test set is taken as cryptographic unpredictability, since a deterministic regressor reproduces the same output when the same feature vector appears again.","fun_headline_variants_meta":{"raw":{"variants":["Tree ensembles hit 100% on nonce randomness test","Proof of AutoML: ML regressors as nonce source","Random Forest, Extra Trees ace blockchain nonce test","AutoML regressors turn out as nonce generators","Disaster blockchain gets nonce boost from tree models"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000245,"raw_usage":{"total_tokens":1392,"prompt_tokens":784,"completion_tokens":608,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":528,"completion_tokens_details":{"reasoning_tokens":529}},"tokens_in":528,"tokens_out":608,"duration_ms":8225,"temperature":1.0,"reasoning_tokens":529,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-04T17:58:23.254098+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the trained Random Forest or Extra Trees regressor twice on the same network-state vector and observe that it yields the identical nonce; or feed a long sequence of model-generated nonces to a standard statistical randomness test suite (e.g., NIST SP 800-22) and find that it fails.","supporting_citations":[],"review_version":1}