Defense axis

#What this axis answers

In an agent population that contains participants who deliberately deliver wrong work, how far can signed records, reputation routing, peer checks, sampled audits, and penalties reduce the chance that a wrong delivery is accepted?

#The most effective one: being seen, not being caught

This is the defense axis's strongest positive result, and it is not "catching them."

In other words: bad actors who were never caught received only 0.57% – 1.84% of an honest participant's workload.

The conclusion in one sentence: what stops attackers is "being seen," not "being caught." Reputation routing alone is enough to starve them, without catching them even once.

(Source: runs/s5_v1_FINDINGS.md)

#Entry cost: neither path should be taken

2026-07-26, 14 mechanism simulations (20 seeds per cell, 40 for E9 and 30 for E15; 400 rounds; 5 honest + 1 attacker; audit rate 0.2, 0.05 from E2/E3 on; reviewer accuracy 0.7, chosen by the author, not measured).

#The real constraint is reviewer accuracy

acc = 0 is the only cell in the whole table where "doing harm starts to pay." None of the other parameters — entry fee, endorser liability, probation length — comes close to the constraint that reviewer accuracy imposes.

#Setting the entry fee too low actually helped the attacker

Free entry = complete blocking. Adding a stake actually made attacking profitable. This is one of our most surprising results.

#Probation length: all the value is in the first step

In one sentence: all of the defensive value is in the m = 0 → 1 step. Making it longer adds no gain at all.

#Verdict

Neither path — an exogenous entry fee or endorser liability — should be taken. The premise is wrong.

Endorser liability is worse: at λ = 1.0 honest participants lose 0.000 but there is no gain at all; at λ = 0.9 honest participants lose 0.691 and the gain is still 0.

#Pulse attack: six conclusions, three refuted

2026-08-03, E17–E24. 30 seeds × 600 rounds, 1,740 per-round files, 1,041,246 lines.

After writing the report, we sent independent agents whose only job was to refute it. Re-verification results for the six headline conclusions:

#Two positive conclusions that were kept

1. Detection probability is a single product (1 − blind spot) × sampling rate × accuracy, with the three factors on the same axis. The blind spot changes the defense's ceiling (residual β/(1−β)), not whether the sampling rate is useful.
2. The blind spot × temporal structure interaction is η² = 0.264, 4 times the main effect of temporal structure. So the sentence pattern "the real variable is X" does not itself hold here.

#Three that are not yet re-verified

#Corrections from prior work

Even our headline had been anticipated: Srivatsa et al. (2005, TrustGuard) measured attacker cost ratios across four oscillation models of 1 : 2.28 : 2.08 : 1.36, and proved that the optimal strategy for an attacker who knows the memory window maxH is to oscillate with period = maxH. Our "1.81×" is both older news and weaker, and we have already judged it ourselves to be noise. Hoffman et al. (2009, ACM Computing Surveys §5.4) list it as a named category, oscillation attack.

#New attack surface: the only load-bearing layer

A1–A3, B1–B5 (A series 12 seeds, B series 10 seeds; means only, no CIs, no paired tests).

#Layer-by-layer ablation (B2)

#Internal collusion (B3) is the cheapest, and hurts the most

A 1.5 – 2.9× gap. The report's conclusion says it plainly: the only load-bearing layer cannot stop the cheapest attacker.

#B5: harm measured as zero

A collusion group that only slanders and never breaks a rule took 95.4% of the routing share, and its "score" is 0. (baseline collusion share 0.331)

This is not harm being underestimated — this is harm being measured as zero. Any score-based routing will do this.

#B4: the optimal slander intensity is 0.75

Score 9.0, routing share 0.094, honest participants' reputation drops 0.30. At 1.0 it falls back to 4.2 (caught by behavior inference).

#Permanent exclusion: 0 / 368

Why "permanent" is the product of two reasonable patches

The closed form (total ≥ exp(n'·((target−mean')/c)²) − 1, m=0.9, target=0.95, c=0.3) at n=10: f=0.5/λ=1 needs 10¹² observations, f=0.9/λ=0 needs 10^0.95 ≈ 9 observations.

That 10¹² is not "a long wait"; it is unreachable.

#Channel separation and multi-directional environments

#Channel separation (passed both criteria)

• Expertise profile: expert hit rate 0.1653 → 0.6200 (random 1/6 = 0.1667; 3.72 times random), quality +24.7 pp. The null control group went 0.4330 → 0.4330, identical to four decimal places, with the same standard deviation.
• Sealed review: herd_overrides went from 7,889 cumulative flips to constantly 0, and the spread across herds is exactly 0.0. False positives 0 / 340.
• The scaled-up version refuted its own overly strong claim: masking disappears monotonically as the group grows (2/10: 0/6→6/6; 4/10: 10/12→12/12; 6/10: 18/18→18/18). It applies only to "small collusion groups."
• Regression: 428 passed / 1 skipped; the three pinned digests reproduced 15/15 bit-for-bit identical; all 180 review envelopes from E10 still verify.

#Multi-directional environments (M1–M5, 300 rounds × 24 seeds)

M1 asks: how much of the shared blind spot does the architecture create by itself?

How to read it: with a one-directional architecture at zero blind spot, 86% of the shared errors are manufactured by the architecture itself. After switching to multi-directional, it falls below the theoretical floor. M1b swept cascade_p / authority_w and got an excess ranging from −0.010 to +0.316 — the magnitude is unreliable; the direction is robust.

M2's add-one ladder (blind spot 0.3): one-directional 0.6935 → multi-directional 0.8252, +13.2 pp, and the bad items that slipped through were halved. Breakdown: hidden reputation +8.0 pp, refusal primitive +6.1 pp, asking for help +0.5 pp, sealed review alone slightly worse.

M3 splits the intervention into two factors: "where to look" contributes 70%, "when to look" contributes 30%.

#Defense experiments with real models

#E10 trust switch (paired, N = 60)

qwen3.6-35b-a3b; 60 paired tasks from EvalPlus MBPP+; 2 saboteurs planted by hand in the roster.

Paired: n=60, b_on_only = 11, c_off_only = 6, 17 discordant, Δ = +0.0833, 95% CI [−0.05, 0.2167], McNemar p = 0.3323. Statistical power is only 0.163; an MDE at 80% would need n = 337.

The second outcome variable is more interesting: work assigned to saboteurs went from off 20/60 (33.3%) → on 11/60 (18.3%), McNemar p = 0.0931 (did not reach .05). Removing 10–30 warm-up tasks puts p at 0.021 – 0.041; removing 35 or 40 gives 0.0703 / 0.2188.}}

#E11 three memory arms (pilot)

Same model, 12 tasks: M0 8/12, M1 8/12, M2 8/12 (time 846.2 / 1,012.9 / 2,144.6 seconds). The original text says: "Not enough to support any effect claim." (original: 「不足以支撐任何效果宣稱。」)

#Independent review: six attack PoCs

2026-07-26, target commit f9a381a. The verdict in one sentence: this architecture currently raises accountability, not trust.

See Attribution. Only the conclusion is listed here: of the three necessary conditions, two fail outright (the signal can be cheaply forged; the penalty bites, but for low scorers it is a reward), and one partly holds.

#What this axis still owes

#Next

• Gain axis
• Records & multi-party execution
• Verdict by verdict: Evidence ledger