Repeated-Game Security for Restaking-Based Verifiable Inference

Imagine a world where giant, super-smart computer brains (called Large Language Models) can answer your questions, write your stories, or solve your math problems. But here's the catch: running these brains is expensive and slow. So, companies want to hire independent workers to do the thinking for them. The problem is, how do you know the worker didn't just guess the answer or use a cheaper, dumber brain to save money? This is the world of verifiable inference.

To solve this, we use a system called restaking. Think of it like a security deposit. The worker puts up a pile of digital cash (stake) as a promise to do the job honestly. If they deviate, a referee checks their work, and if they're caught, the referee takes a chunk of their deposit. This is called slashing. For a long time, experts thought this was a perfect safety net. They believed that if the fine for deviating was bigger than the money saved by deviating, no one would ever try to deviate. It was a simple "one-shot" deal: Don't steal the cookie, or you lose the jar.

But what if the worker isn't just doing one job? What if they are hired to do millions of jobs over and over again? This is where the story gets tricky. The paper you're about to read asks a brilliant question: Does the "one-shot" safety net actually work when the game is played over and over? The authors, Zhenhang Shang, Yingzhe Yu, and Kani Chen from the Hong Kong University of Science and Technology, discovered that the old safety net has a hidden hole. They found that if a worker deviates just a little bit, they can actually get away with it, even if the fine looks scary at first. Why? Because every time they get caught, the fine only takes a fraction of their deposit. So, their deposit gets smaller and smaller, making the future fines weaker and weaker, while they keep pocketing the savings from deviating on every single new job. It's like a thief who keeps stealing a little bit of gold, and every time the guard catches them, the guard only takes a tiny piece of their remaining gold, making the thief's "risk" drop until they are practically untouchable.

The Big Discovery: The "Repeat Offender" Loophole

The authors realized that the old rule—"Don't deviate because the fine is bigger than the gain"—only works for a single, one-time decision. But in the real world, these AI providers are in it for the long haul, answering thousands or even millions of questions. The paper models this as a repeated game, where the provider and the protocol play round after round.

They found a "repeated-game gap." Here is the magic trick the deviator uses:

1. The Setup: The provider puts up a big stake.
2. The Deviation: They use a cheaper, faster model to answer questions, saving money on every single query.
3. The Slip-up: Sometimes, the referee (the protocol) catches them.
4. The Loophole: The protocol only slashes (takes away) a percentage of the stake, say 20%. The provider loses some money, but they still have 80% left.
5. The Cycle: Because their stake is now smaller, the next time they get caught, the fine is even smaller (20% of a smaller number). But the money they save by deviating on the next question is exactly the same as before!

The paper proves mathematically that this creates a dangerous imbalance. The savings stay constant, but the penalty shrinks every time they get caught. The authors show that for many existing systems (like EigenAI, VeriLLM, and Sertn AVS), this gap is real. Even though these systems pass the "one-time" safety test, they fail the "long-term" test. In simulations, a rational deviator could make an extra 1.5% to 8% profit just by exploiting this repeated-game loophole, even when the system thinks it's secure.

The Solution: A Smarter, History-Aware System

So, how do we fix a system that gets weaker every time a deviator gets caught? The authors propose a new mechanism that acts like a smart, memory-keeping referee. Instead of just looking at how much money the worker has left, the new system looks at their history.

They introduce three clever tools to plug the hole:

1. Suspicion Scores (The "Watchful Eye"): The system keeps a score for every worker. If they act weirdly (like answering too fast or giving slightly different answers), their suspicion score goes up. The higher the score, the more likely the referee is to check their work. This means if you deviate, you don't just get fined; you get watched more closely next time.
2. Reputation-Weighted Fines (The "Scarlet Letter"): Instead of just taking a percentage of the remaining money, the fine also depends on the worker's reputation. If you have a bad history, the fine becomes much harsher, even if your deposit is small. This stops the "shrinking penalty" trick.
3. Vesting (The "Leash"): When a worker tries to leave the game (withdraw their money), the system doesn't let them run away immediately. Their money is "locked up" for a while. If they try to deviate and then run, the system can still catch them and take their money during this lock-up period. This stops the "deviate and run" strategy.

Does It Actually Work?

The authors didn't just dream this up; they built a simulator to test it. They pitted their new system against the old ones using different types of "deviators," including some who deviate constantly, some who deviate only when they think no one is looking, and some who try to deviate and then run away.

The results were promising. In the simulations, the old systems let deviators keep their extra profit. But the new system, with its history-aware rules, cut the deviators' profits by 31% to 54%. In some cases, it even made deviating a losing strategy, turning a profit into a loss for the deviator.

They also tested how "detectable" deviating really is. They used real AI models (ranging from small 0.5 billion parameter models to huge 14 billion parameter ones) to see if the system could spot the difference between a real answer and a cheap, fake one. They found that the system's "suspicion meter" works very well, especially when the difference in cost between the good model and the cheap model is big. The more the deviator tries to save money, the easier it is to catch them.

Why This Matters

This paper is a wake-up call for the world of blockchain and AI security. It shows that just because a security rule works for a single moment doesn't mean it works for a lifetime. The authors didn't just point out a problem; they built a blueprint for a system that can handle the reality of repeated interactions.

They proved that by making the penalty depend on the worker's past behavior and keeping them on a "leash" when they try to leave, we can create a system that stays secure even when the game goes on forever. It's a shift from thinking about security as a single "bail" to thinking of it as a long-term relationship where trust is earned and lost over time. For anyone building the future of AI on the blockchain, this is a crucial step toward making sure the workers are actually doing the work they promise to do.