Repeated-Game Security for Restaking-Based Verifiable Inference

Kani Chen; Yingzhe Yu; Zhenhang Shang

REVIEW 4 major objections 5 minor 23 references

Repeated-Game Security for Restaking-Based Verifiable Inference

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper proves that the standard single-round slashing test overstates the security of restaking-based verifiable inference when the same stake serves many queries.

desk verdict A solid impossibility result for repeated-game slashing, paired with a mechanism theorem that the paper's own simulation contradicts. read the letter →

arxiv 2608.09055 v1 pith:QKUKFYQX submitted 2026-08-10 cs.GT cs.CR

Zhenhang Shang , Yingzhe Yu , Kani Chen This is my paper · ORCID

classification cs.GTcs.CR MSC 91A2091A80

keywords repeatedgamesverifiableinferencerestakingslashingincentivecompatibilitymechanismdesignLLMsubgame-perfectequilibrium

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Restaking-based protocols promise verifiable LLM inference without the proving cost of zero-knowledge machinery or the hardware trust of trusted execution environments, and their security is normally certified by a one-round condition: the expected slashing penalty $c\alpha S$ must exceed the per-query cost saving $\Delta$. The paper argues that this condition can certify protocols that are still cheatable in the long run. Because slashing is proportional, a detected cheat shrinks the stake exposed to future penalties, while the cost saving from cheating is earned again on every future query, so the two diverge over an infinite horizon. The paper derives a closed-form threshold for this repeated-game gap, shows the gap applies to the whole class of memoryless bounded-slashing protocols used by deployed designs, and proposes a mechanism of history-dependent challenges, reputation-weighted slashing, and stake vesting that restores infinite-horizon incentives above an explicit discount factor. If the paper is right, deployed verifiable-inference protocols should be re-examined under repeated interaction, and the standard slashing test alone is not enough.

What carries the argument

The engine of the negative result is the stake-evolution identity $S_{t+1}=S_t(1-\alpha\,\mathbf{1}[\text{cheat and audited}])$: under stationary cheating at rate $p$, the expected stake decays geometrically while the per-query saving $\Delta$ is collected every round, so a condition binding at the initial stake fails along the continuation path, and the always-cheat deviation $p=1$ yields the closed-form profit gap in Lemma 1. The positive construction uses three instruments acting on the continuation payoff: an exponentially weighted suspicion score that raises audit probability through $c(S_t)=c_0+\beta S_t$, a robust Bayesian posterior that ties slashing to reputation via $\text{slash}_t=(\alpha_0+\alpha_1\bar{\rho}_t)S_t$, and a vesting window that keeps stake slashable for $\tau$ rounds after an unbonding request. The threshold $\delta^*$ is the unique solution to $\Delta=\bar{c}(p_{\mathrm{br}})\,\bar{\alpha}(p_{\mathrm{br}})\,S\,(1+\delta^*(1-\delta^{*\tau})/(1-\delta^*)\,\bar{c}(p_{\mathrm{br}})\bar{\alpha}(p_{\mathrm{br}}))$, and the one-shot deviation principle reduces equilibrium verification to ruling out one-period deviations.

What would settle it

Run a live or simulated deployment with the calibrated range $\delta\in[0.92,0.98]$, the one-round condition $c\alpha S_0=\Delta$ binding, partial slashing $\alpha<1$, and no ejection: if the always-cheat stationary strategy yields positive discounted profit, Theorem 1 is confirmed, whereas if no stationary cheat is profitable the stake-evolution model or the calibration is wrong. Separately, measure $\mu(p)$ on naturalistic adversarial workloads; if $\mu'(0)=0$ for some substitute that preserves $\Delta$, the proposed mechanism's restoration fails even where the gap theorem holds.

Watch

Extended reading notes

Core claim

The central claim is Theorem 1: with proportional slashing $\alpha<1$, a protocol can satisfy the one-round incentive constraint $c\alpha S_0\ge\Delta$ with strict slack and still fail infinite-horizon subgame-perfect incentive compatibility. The failure occurs whenever the slack $\eta=c\alpha S_0-\Delta$ is smaller than $\delta c\alpha\Delta/(1-\delta)$; equivalently, infinite-horizon security requires $c\alpha S_0\ge\Delta(1+\delta c\alpha/(1-\delta))$, a stake requirement that diverges as the provider's patience $\delta$ approaches 1. The paper extends the result to memoryless bounded-slashing protocols, where any detected cheat can slash at most a fraction of current stake, so the negative result covers the deployed designs surveyed rather than a single implementation. It then proves that a mechanism combining history-dependent audit rates, reputation-weighted slashing, and time-locked vesting restores subgame-perfect incentive compatibility against stationary mixed-strategy deviations once the discount factor passes a threshold $\delta^*$ defined by a closed-form equation, and that the required stake stays finite as $\delta\to 1$.

Load-bearing premise

The proposed fix depends on the monitored risk signal having a positive marginal response at zero cheating, $\mu'(0)>0$; if a substitute model could match the contracted model on all signal channels while preserving the cost saving, the mechanism would degrade to the memoryless baseline and the restoration would fail even though the gap theorem itself stands.

Editorial extensions

If this is right

Any memoryless bounded-slashing verifiable-inference protocol that only checks the one-round condition $c\alpha S_0\ge\Delta$ can admit a profitable always-cheat deviation for $\delta$ in the calibrated 0.92--0.98 range; the paper quantifies deviation-profit fractions of 1.5%--8% for the surveyed designs.
Closing the gap by strengthening the one-round stake requirement alone is hopeless as $\delta\to 1$, since the required stake diverges, whereas the proposed mechanism keeps required stake bounded (Corollary 1).
The mechanism restores infinite-horizon subgame-perfect incentive compatibility against stationary cheating rates above a deployment floor $p$ once $\delta\ge\delta^*$, with no per-query cryptographic verification, and honest operators' robust posterior decays to zero so baseline audit overhead is preserved.
Signal responsiveness substitutes for baseline auditing: in the Stackelberg audit-budget analysis, raising the suspicion-gain parameter $\beta$ cuts the required baseline audit rate by 2.6$\times$ at target $\delta=0.95$.
Minimum-stake ejection does not remove the gap: cheating until ejection loses only a negligible factor relative to the unbounded-horizon gain for deployed parameter ranges.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An extension the paper leaves implicit: the same stake-decay channel should afflict any restaked service with private actions and proportional slashing, such as oracle reporting or data-availability attestations, not only LLM inference; the class result already points in that direction.
A testable consequence: deployed protocols should publish per-signal detectability curves on naturalistic, adversarially distributed workloads; if a substitute can erase $\mu'(0)$ while keeping the cost saving $\Delta$, the proposed mechanism silently degrades to the memoryless baseline the paper itself flags.
The discount-factor calibration is built from operator deregistration and yield data over a fixed window; monitoring these series over time is a cheap way to track whether a deployment is drifting toward the gap region.
Because the mechanism's threshold rises as the saving $\Delta$ grows, an operator can hedge by pricing substitutes closer to the contracted model, reducing the incentive to cheat rather than relying solely on larger slashing.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First thing you should know: the paper's negative result is real; the positive mechanism result is not. Lemma 1 and Theorem 1 give a clean closed form for why one-round IC with proportional slashing fails under repetition: detected slashes shrink future exposure while the cost saving recurs every round. The extension to memoryless bounded-slashing protocols is the right abstraction, and the simulation artifact matches the theory for the baselines. The calibration to EigenAI, VeriLLM, and Sertn, with 1.5-8% deviation profits, is plausible, and the concave signal-response measurements on nine Qwen model pairs are a genuine empirical contribution, even with the templated-prompt caveat the authors state.

The soft spot is Theorem 3. The paper claims infinite-horizon SPIC above a threshold delta* = 0.9322, yet its own Table 5 reports the stationary best response A4' earning +6.20% at delta = 0.95, above that threshold. The authors note that A4' corrects the analytical under-picked best response, but they never reconcile that with the theorem. The stress-test note is right about the mechanism: the asserted steady-state posterior rho_bar(p) = min{1,p} does not follow from the Lemma 2 recursion; for moderate p the true fixed point is much higher, and that feeds directly into h(p), the threshold, and the indifference condition (15). The proof of (15) also introduces an h(p)^2 S vesting term without derivation. The deeper problem is structural: when hS < Delta, always-cheat yields a positive per-round surplus regardless of delta, so no vesting term of that form can make cheating unprofitable. The theorem's condition is not the right infinite-horizon condition.

This is not a minor gap. The mechanism may reduce deviation profit by the reported 31-54%, but it does not restore SPIC as stated. The gap result, though, stands on its own and deserves attention.

The paper is worth a serious referee. The core theorem and the measurements are citable; the mechanism section needs major revision or a downgrade to a bounded-profit claim. I would send it to peer review with that flag.

Referee Report

4 major / 5 minor

Summary. The paper studies restaking-based verifiable LLM inference as a discounted repeated game. It shows that the standard one-round slashing condition (cαS ≥ Δ) is insufficient once the same stake supports many future queries, because proportional slashing reduces future penalty exposure while cheating gains are re-earned each round. The authors derive a closed-form repeated-game gap (Lemma 1, Theorem 1), extend it to a class of memoryless bounded-slashing protocols (Theorem 2), and propose a mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting that is claimed to restore infinite-horizon subgame-perfect incentive compatibility above an explicit discount-factor threshold (Theorem 3). The paper also reports measurements of an audit signal's detectability response on Qwen2.5 models, a Stackelberg audit-budget analysis, and simulations with several adversaries.

Significance. The negative result — that one-round IC overstates security under proportional slashing — is a clean, novel, and practically relevant contribution. Lemma 1 and Theorem 1 are parameter-free derivations under stated assumptions, and the paper ships a reproducible artifact with unit tests and provenance notes. The extension to memoryless bounded-slashing protocols (Theorem 2) is an elegant class result that captures deployed designs. The empirical measurement of the detectability response is a useful first step, and the Stackelberg audit-budget analysis is a sensible application of the framework. However, the paper's central constructive claim, Theorem 3, is contradicted by the paper's own simulation results, and the proof relies on an asserted steady-state posterior and an underived vesting exposure term. As a result, the mechanism's claimed security guarantee is not currently established, which substantially reduces the significance of the paper as a whole.

major comments (4)

[Section 6.1, Theorem 3, and Table 5] Theorem 3 asserts ∞-SPIC against stationary deviations for all δ ≥ δ*, with δ* = 0.9322 at the stress calibration. Table 5 reports that at δ = 0.95, which is strictly above δ*, the Monte Carlo corrected stationary best response A4' earns +6.20% ± 0.98% on P3. This is a direct internal contradiction: the theorem's guarantee fails in the paper's own simulation at a parameter point inside the claimed safe region. The paper's explanation that the analytical A4 under-picks p* does not rescue the theorem, because A4' is the appropriate stationary best response and still profits at δ > δ*.
[Remark 5 and Lemma 2] The steady-state robust posterior used in Theorem 3 is not correctly derived. Remark 5 states that ρ̄(p) = min{1, p} holds by inspection in the calibration, but the recursion in Lemma 2 under stationary cheating with audit rate c̄(p) has fixed point ρ̄ = 1 for any p > 0 whenever c̄(p) > 0, not min{1, p}. The claimed concavity of ρ̄(·) is therefore unsupported, and the best-response characterization (16), which feeds directly into the threshold δ*, is based on an incorrect fixed point. This is a load-bearing error because ρ̄ enters h(p) = c̄(p)ᾱ(p) multiplicatively in (15).
[Section 6.1, proof of Theorem 3] The vesting exposure term h(p_br)^2 S δ(1−δ^τ)/(1−δ) is asserted without derivation. The stage game in Section 3.2 has contemporaneous detection: slashing occurs for detected cheating in the current round. A cheat-then-exit adversary can simply stop cheating after submitting an unbonding request, so it is not evident that the vested balance remains exposed to the same per-round detection probability h(p_br); the term also appears to omit the factor p_br present in the contemporaneous slashing expression p_br h(p_br) S. The proof needs a formal derivation of this continuation exposure before (15) can support the theorem.
[Section 5.2 and Section E] The mechanism's key assumption is μ'(0) > 0, with βμ'(0) as the deployment quantity. The empirical support is limited to 200 templated prompts on Qwen2.5 models; Section C concedes that a substitute matching the contracted model across all signal channels would drive μ'(0) to zero and degrade the mechanism to the memoryless baseline. The paper's claim that the audit signal has the required concave detectability response is therefore not established for naturalistic or adversarially matched workloads, which the paper itself acknowledges as future work. This limitation should be stated more prominently in the abstract and conclusions, since it directly conditions the practical relevance of the mechanism.

minor comments (5)

[Sections 3 and 5.2] The notation S_t is used both for the provider's stake in Section 3 and for the suspicion score in Section 5.2, which is confusing when reading equations (10) and (14) together.
[Section 7.1] The validation of Theorem 3 is said to be checked to 'machine precision'; please specify exactly which equation or invariant is verified and how the fixed-point solver is tested.
[Table 5 and Section 7.1] The table caption reports T = 10^5 rounds with 100 seeds, while the text describing the stress regime mentions the same calibration; please confirm the seed count and horizon are consistent across the artifact and the paper.
[Section 6.1, Equation (15)] In the displayed equation, the notation δ*τ is ambiguous without parentheses; writing δ^{*τ} or δ^{*τ} would improve readability.
[Table 4] The per-protocol parameters are rounded to two significant digits from whitepapers; it would be helpful to include the exact source values or a pointer to the provenance file in the main text for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the repeated-game gap and mechanism threshold are derived from stated primitives, the signal response is an external empirical input, and the Table 5 tension is a correctness issue rather than a circular reduction.

full rationale

The core impossibility and mechanism theorems are derived algebraically from the stated stage-game primitives. Lemma 1 and Theorem 1 compute the always-cheat payoff from the stake evolution S_{t+1}=S_t(1-α·1[a_t=C,audited]) and the binding condition cαS0=Δ, yielding ΔU=δcαΔ/((1-δ)(1-δ+δcα)); no fitted parameter or self-citation is needed for this gap. The mechanism's signal response is treated as an explicit empirical input: Section 5.2 labels μ'(0)>0 the 'Key assumption,' and Section E reports a direct measurement on Qwen2.5 model pairs with fitted responses μ(p)=0.57p^0.83 and μ(p)=0.83p^0.71 (R^2>0.98), which is then substituted into the threshold calculation. The measured μ is not calibrated to reproduce the security conclusions; the conservative μ=0.45p^0.5 has lower amplitude, and the measured responses lower δ* further, i.e., in the direction opposite to propping up the mechanism. The paper contains no load-bearing self-citations: deployed-protocol parameters cite third-party whitepapers [2,22,11], and the response anchor cites external literature [12,15]. Certain proof steps are asserted rather than derived—notably the vesting exposure term h(p_br)^2 S δ(1-δ^τ)/(1-δ) in Theorem 3 and the claim that ρ̄(p)=min{1,p} 'holds by inspection'—and Section 7.1 concedes that the analytical A4 under-picks p*≈0.18 relative to the MC-corrected A4′ with p*≈0.90. These are correctness and robustness concerns about an internal assumption, not a reduction of the paper's conclusions to its inputs. Hence no circular step is identifiable.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The gap theorem needs no free parameters beyond protocol inputs. The constructive mechanism depends on multiple calibrated parameters, most importantly the signal response mu and the discount factor delta; the paper measures or estimates these but with limited scope. No new physical entities are introduced.

free parameters (5)

Discount factor delta = 0.92-0.98 deployed; 0.95 headline
Estimated from EigenLayer deregistration hazard and stETH yield; enters the repeated-game payoff and the threshold.
Signal response mu(p)=a*p^q = a=0.45, q=0.5 calibration; measured a in [0.54,1.02], q in [0.70,0.89]
Concave detectability assumed by Theorem 3; calibrated from distillation and quantization literature and measured on Qwen2.5 pairs.
Mechanism parameters = c0=0.01, beta=0.50, lambda=0.02, pi0=0.05, p_floor=0.10, alpha0=0.20, alpha1=0.30, tau=200
Chosen deployment values in Table 2 used for delta-star and simulations; they affect the threshold.
Cost-saving ratio Delta/r = 0.15-0.40
API price differential between contracted and substitute model; deployment-fixed parameter.
Stake-to-reward ratio S0/r = 10^3-10^4
Taken from the EigenLayer operator stake distribution.

assumptions (5)

domain assumption Provider action is private; audits are Bernoulli(c) and independent; audit outcome perfectly reveals cheating; verifier is honest.
Stage game and protocol model in Section 3; Section C discusses but does not resolve collusion and noisy audits.
standard math One-shot deviation principle for discounted repeated games with imperfect public monitoring.
Remark 1 and the proof of Theorem 3 rely on Mailath and Samuelson Theorem 2.1.1.
domain assumption Risk signal mu(p) satisfies mu(0)=0, mu' > 0, and concavity on [0,1].
Key assumption in Section 5.2; directly measured only on templated Qwen2.5 prompts.
domain assumption Steady-state robust posterior rho-bar(p) is concave-increasing on [p_floor,1].
Regularity condition for Theorem 3; the calibration claims rho-bar(p)=min(1,p) by inspection.
domain assumption No profitable Sybil respawning; registration prior pi0 is above the anti-Sybil threshold.
Lemma 4 gives the threshold; the mechanism's reputation-weighted slashing relies on it.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Repeated-Game Security for Restaking-Based Verifiable Inference." pith.science (2026). https://pith.science/paper/QKUKFYQX

@misc{pith2026260809055,
  author       = {Pith},
  title        = {Pith review of: Repeated-Game Security for Restaking-Based Verifiable Inference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QKUKFYQX}},
  note         = {Machine review of arXiv:2608.09055}
}

read the original abstract

Restaking-based protocols enable verifiable LLM inference without the high proving cost of zkML or the hardware trust assumptions of TEEs. Their security is commonly justified by a one-round slashing condition: a rational provider should not cheat when the expected penalty exceeds the cost saving from dishonest inference. This paper shows that this condition can overstate security when inference is supplied repeatedly under the same stake. We model verifiable inference as a discounted repeated game and identify a repeated-game gap caused by proportional slashing: detected deviations reduce future penalty exposure, while cost savings are earned again across queries. We derive the gap in closed form, show that it persists under minimum-stake ejection, and extend it to memoryless bounded-slashing protocols covering deployed designs. We propose a deployable mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting. The mechanism restores infinite-horizon subgame-perfect incentive compatibility against stationary mixed-strategy deviations above an explicit discount-factor threshold without per-query cryptographic verification. Evaluation across nine open-weight model pairs from 0.5B to 14B parameters shows that the audit signal has the required concave detectability response. A Stackelberg audit-budget analysis shows that improved signal responsiveness reduces the baseline audit rate by 2.6x at discount factor 0.95. Calibrated to deployed parameters, surveyed protocols pass one-round incentive compatibility but admit repeated-game deviations for discount factors between 0.92 and 0.98, with deviation-profit fractions of 1.5%--8%. Our mechanism reduces deviation profits by 31%--54% while maintaining low-latency economic verification.

Figures

Figures reproduced from arXiv: 2608.09055 by the authors.

**Figure 1.** Measured risk-signal response µ(p) on Qwen2.5-1.5B-Instruct (8-bit) versus two substitutes: 4-bit quantization (panel a) and 0.5B distilled (panel b). The composite signal (red, with fitted apq curve) is concave on both substitutes; the windowed token-sketch component drives the concavity, while the per-query log-probability and workload components are close to linear. The dashed line is the paper’s conservative ca… view at source ↗

**Figure 2.** Cross-scale detectability. Panel (a): measured composite response µ(p) for the 7B (8-bit) contracted model against four substitutes, with fitted apq curves; the dashed line is the conservative calibration 0.45p 0.5 . Panel (b): fitted amplitude against the contracted-to-substitute cost ratio for all nine (contracted, substitute) pairs (marker shape denotes the contracted scale), with the censored fit min(1, 0.45x 0.… view at source ↗

**Figure 3.** Sensitivity to operator patience, δ ∈ [0.90, 0.99]. Panel (a): simulated deviation profit of the stationary best response at the stress calibration, mean ± 95% CI; P3 overtakes P1 near the predicted threshold δ ∗ ≈ 0.9322 of Theorem 3, and P1’s nonmonotonicity reflects minimum-stake ejection at high δ. Panel (b): analytical minimum stake for ε-∞-SPIC (log scale); P3’s requirement stays bounded while the memoryless … view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: Repeated-game gap on the (cα, δ) plane. Panel (a) reports the stake multiplier in (8), which is the factor by which ∞-SPIC requires more stake than 1-Round IC. Panel (b) reports the deviation-profit fraction in Lemma 1 at S0/r = 5,000. EigenAI, VeriLLM, and Sertn AVS l…

**Figure 5.** Figure 5: Cumulative discounted payoff ratio UP (t)/UH(t) over time. The top panel reports A4′ , the Monte Carlo corrected stationary best response. The bottom panel reports A6, the cheat-then-exit adversary. Shaded bands are 95% confidence intervals across 50 seeds at T = 104 …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 14 canonical work pages

[1]

Abreu, D., Pearce, D., Stacchetti, E.: Toward a theory of discounted repeated games with imperfect monitoring. Econometrica58(5), 1041–1063 (1990),https: //www.jstor.org/stable/2938299 Repeated-Game Security for Restaking-Based Verifiable Inference 27 T able 7.Minimum analytical stakeS/rforε= 10 −2-∞-SPIC at∆/r= 0.25. Memoryless requirements follow Theore...

work page arXiv 1990
[2]

arXiv preprint arXiv:2602.00182 (2026),https://arxiv.org/abs/2602.00182

Alves, D.R., Patankar, V., Pereira, M., Stephens, J., Vaziri, N., Kannan, S.: Eige- nAI: Deterministic inference, verifiable results. arXiv preprint arXiv:2602.00182 (2026),https://arxiv.org/abs/2602.00182

arXiv 2026
[3]

Apple Security Research Blog (2024),https://security.apple.com/blog/ private-cloud-compute/

Apple: Private cloud compute: A new frontier for AI privacy in the cloud. Apple Security Research Blog (2024),https://security.apple.com/blog/ private-cloud-compute/

work page 2024
[4]

Cambridge University Press (1996),https://doi.org/10.1017/ CBO9780511983252

Avenhaus, R., Canty, M.J.: Compliance Quantified: An Introduction to Data Verification. Cambridge University Press (1996),https://doi.org/10.1017/ CBO9780511983252

work page 1996
[5]

Econometrica73(6), 1771– 1813 (2005),https://doi.org/10.1111/j.1468-0262.2005.00638.x

Bergemann, D., Morris, S.: Robust mechanism design. Econometrica73(6), 1771– 1813 (2005),https://doi.org/10.1111/j.1468-0262.2005.00638.x

arXiv 2005
[6]

Blog post (2023),https:// vitalik.eth.limo/general/2023/05/21/dont_overload.html

Buterin, V.: Don’t overload Ethereum’s consensus. Blog post (2023),https:// vitalik.eth.limo/general/2023/05/21/dont_overload.html

work page 2023
[7]

In: IEEE Symposium on Security and Privacy (S&P) (2020),https://doi.org/10.1109/SP40000.2020.00040 28 Z

Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L., Juels, A.: Flash boys 2.0: Frontrunning in decentralized exchanges, miner ex- tractable value, and consensus instability. In: IEEE Symposium on Security and Privacy (S&P) (2020),https://doi.org/10.1109/SP40000.2020.00040 28 Z. Shang et al. T able 8.Cold-start sweep on P3, u...

arXiv 2020
[8]

Edgington, B.: Slashing (2023),https://eth2book.info/latest/part2/ incentives/slashing/

work page 2023

Show all 23 references

[9]

Whitepaper (2023),https://docs.eigencloud.xyz/assets/files/EigenLayer_ WhitePaper-88c47923ca0319870c611decd6e562ad.pdf

EigenLayer: EigenLayer: The restaking collective. Whitepaper (2023),https://docs.eigencloud.xyz/assets/files/EigenLayer_ WhitePaper-88c47923ca0319870c611decd6e562ad.pdf

2023
[10]

Econometrica54(3), 533–554 (1986),https:// www.jstor.org/stable/1911307

Fudenberg, D., Maskin, E.: The folk theorem in repeated games with discounting or with incomplete information. Econometrica54(3), 533–554 (1986),https:// www.jstor.org/stable/1911307

1986
[11]

Gagich, C., Chan, R., Graham, S., Prangley, W.: Inference network- a verified inference network,https://public.inferencelabs.com/ inference-network-whitepaper.pdf
[12]

Inter- national Journal of Computer Vision129, 1789–1819 (2021),https://doi.org/ 10.1007/s11263-021-01453-z Repeated-Game Security for Restaking-Based Verifiable Inference 29

Gou, J., Yu, B., Maybank, S.J., Tao, D.: Knowledge distillation: A survey. Inter- national Journal of Computer Vision129, 1789–1819 (2021),https://doi.org/ 10.1007/s11263-021-01453-z Repeated-Game Security for Restaking-Based Verifiable Inference 29

2021 doi
[13]

In: 27th USENIX Security Sym- posium (USENIX Security)

Kalodner, H., Goldfeder, S., Chen, X., Weinberg, S.M., Felten, E.W.: Ar- bitrum: Scalable, private smart contracts. In: 27th USENIX Security Sym- posium (USENIX Security). pp. 1353–1370 (2018),https://www.usenix.org/ conference/usenixsecurity18/presentation/kalodner

2018
[14]

Journal of Eco- nomic Theory27(2), 253–279 (1982),https://doi.org/10.1016/0022-0531(82) 90030-8

Kreps, D.M., Wilson, R.: Reputation and imperfect information. Journal of Eco- nomic Theory27(2), 253–279 (1982),https://doi.org/10.1016/0022-0531(82) 90030-8

1982 doi
[15]

In: Proceedings of Machine Learning and Systems (MLSys) (2024),https://proceedings.mlsys.org/paper_files/paper/ 2024/hash/42a452cbafa9dd64e9ba4aa95cc1ef21-Abstract-Conference.html

Lin, J., Tang, J., Tang, H., Yang, S., Chen, W.M., Wang, W.C., Xiao, G., Dang, X., Gan, C., Han, S.: A WQ: Activation-aware weight quantization for on-device LLM compression and acceleration. In: Proceedings of Machine Learning and Systems (MLSys) (2024),https://proceedings.ml...

2024
[16]

Oxford University Press (2006),https://doi.org/10.1093/acprof: oso/9780195300796.001.0001

Mailath, G.J., Samuelson, L.: Repeated Games and Reputations: Long-Run Re- lationships. Oxford University Press (2006),https://doi.org/10.1093/acprof: oso/9780195300796.001.0001

2006
[17]

Jour- nal of Economic Theory27(2), 280–312 (1982),https://doi.org/10.1016/ 0022-0531(82)90031-X

Milgrom, P., Roberts, J.: Predation, reputation, and entry deterrence. Jour- nal of Economic Theory27(2), 280–312 (1982),https://doi.org/10.1016/ 0022-0531(82)90031-X

1982
[18]

arXiv preprint arXiv:2601.02313 (2026),https://arxiv.org/abs/2601.02313

Nodehi, H.A., Cadambe, V.R., Maddah-Ali, M.A.: Game of coding: Coding theory in the presence of rational adversaries, motivated by decentralized machine learn- ing. arXiv preprint arXiv:2601.02313 (2026),https://arxiv.org/abs/2601.02313

2026
[19]

Blog post (2024),https: //qwenlm.github.io/blog/qwen2.5/

Qwen Team: Qwen2.5: A party of foundation models. Blog post (2024),https: //qwenlm.github.io/blog/qwen2.5/

2024
[20]

arXiv preprint arXiv:2507.00631 (2025),https://arxiv.org/abs/2507.00631

Shi, D., Joo, K.: A protocol for trustless verification under uncertainty. arXiv preprint arXiv:2507.00631 (2025),https://arxiv.org/abs/2507.00631

2025
[21]

arXiv preprint arXiv:2402.02675 (2024),https://arxiv.org/abs/2402.02675

South, T., Camuto, A., Jain, S., Nguyen, S., Mahari, R., Paquin, C., Morton, J., Pentland, A.: Verifiable evaluations of machine learning models using zkSNARKs. arXiv preprint arXiv:2402.02675 (2024),https://arxiv.org/abs/2402.02675

2024 arXiv
[22]

arXiv preprint arXiv:2509.24257 (2025),https://arxiv.org/abs/2509

Wang, K., Zhao, Z., Song, X., Li, Z., Xia, L., Tong, C., Shi, B., Qu, W., Yang, E., Ai, L.: VeriLLM: A lightweight framework for publicly verifiable decentralized inference. arXiv preprint arXiv:2509.24257 (2025),https://arxiv.org/abs/2509. 24257

2025
[23]

Open-source software (2023), https://github.com/zkonduit/ezkl

Zkonduit: ezkl: Easy zero-knowledge inference. Open-source software (2023), https://github.com/zkonduit/ezkl

2023

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Abreu, D., Pearce, D., Stacchetti, E.: Toward a theory of discounted repeated games with imperfect monitoring. Econometrica58(5), 1041–1063 (1990),https: //www.jstor.org/stable/2938299 Repeated-Game Security for Restaking-Based Verifiable Inference 27 T able 7.Minimum analytical stakeS/rforε= 10 −2-∞-SPIC at∆/r= 0.25. Memoryless requirements follow Theore...

work page arXiv 1990

[2] [2]

arXiv preprint arXiv:2602.00182 (2026),https://arxiv.org/abs/2602.00182

Alves, D.R., Patankar, V., Pereira, M., Stephens, J., Vaziri, N., Kannan, S.: Eige- nAI: Deterministic inference, verifiable results. arXiv preprint arXiv:2602.00182 (2026),https://arxiv.org/abs/2602.00182

arXiv 2026

[3] [3]

Apple Security Research Blog (2024),https://security.apple.com/blog/ private-cloud-compute/

Apple: Private cloud compute: A new frontier for AI privacy in the cloud. Apple Security Research Blog (2024),https://security.apple.com/blog/ private-cloud-compute/

work page 2024

[4] [4]

Cambridge University Press (1996),https://doi.org/10.1017/ CBO9780511983252

Avenhaus, R., Canty, M.J.: Compliance Quantified: An Introduction to Data Verification. Cambridge University Press (1996),https://doi.org/10.1017/ CBO9780511983252

work page 1996

[5] [5]

Econometrica73(6), 1771– 1813 (2005),https://doi.org/10.1111/j.1468-0262.2005.00638.x

Bergemann, D., Morris, S.: Robust mechanism design. Econometrica73(6), 1771– 1813 (2005),https://doi.org/10.1111/j.1468-0262.2005.00638.x

arXiv 2005

[6] [6]

Blog post (2023),https:// vitalik.eth.limo/general/2023/05/21/dont_overload.html

Buterin, V.: Don’t overload Ethereum’s consensus. Blog post (2023),https:// vitalik.eth.limo/general/2023/05/21/dont_overload.html

work page 2023

[7] [7]

In: IEEE Symposium on Security and Privacy (S&P) (2020),https://doi.org/10.1109/SP40000.2020.00040 28 Z

Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L., Juels, A.: Flash boys 2.0: Frontrunning in decentralized exchanges, miner ex- tractable value, and consensus instability. In: IEEE Symposium on Security and Privacy (S&P) (2020),https://doi.org/10.1109/SP40000.2020.00040 28 Z. Shang et al. T able 8.Cold-start sweep on P3, u...

arXiv 2020

[8] [8]

Edgington, B.: Slashing (2023),https://eth2book.info/latest/part2/ incentives/slashing/

work page 2023