papers/hanzo-dso.tex

% Hanzo DSO (Decentralized Semantic Optimization) Paper
% Fully self-contained -- no \input{} directives
\documentclass[11pt]{article}
\usepackage[margin=1in]{geometry}
\usepackage{amsmath, amssymb, amsthm}
\usepackage{mathtools}
\usepackage{bm}
\usepackage{graphicx}
\usepackage{booktabs}
\usepackage{hyperref}
\usepackage{enumitem}
\usepackage{algorithm}
\usepackage{algpseudocode}
\usepackage{xcolor}
\usepackage{natbib}
\usepackage{float}
\usepackage{subcaption}
\usepackage{tabularx}
\usepackage{multirow}
\usepackage{tikz}

\hypersetup{colorlinks=true,linkcolor=black,citecolor=blue,urlcolor=blue}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{definition}{Definition}
\newtheorem{remark}{Remark}
\newtheorem{assumption}{Assumption}

\DeclareMathOperator*{\argmin}{arg\,min}
\DeclareMathOperator*{\argmax}{arg\,max}
\DeclareMathOperator{\KL}{KL}
\DeclareMathOperator{\Tr}{Tr}
\DeclareMathOperator{\diag}{diag}
\DeclareMathOperator{\sign}{sign}
\DeclareMathOperator{\med}{med}
\DeclareMathOperator{\wmed}{wmed}
\DeclareMathOperator{\rank}{rank}

\title{Decentralized Semantic Optimization:\\Byzantine-Robust Prior Aggregation\\for Collective Model Adaptation}
\author{
    Hanzo AI Research\\
    \textit{Hanzo AI Inc (Techstars '17), Los Angeles, CA}\\
    \textit{Zoo Labs Foundation (501(c)(3))}\\
    \texttt{[email protected]}
}
\date{December 2023}

\begin{document}
\maketitle

% ============================================================================
% ABSTRACT
% ============================================================================
\begin{abstract}
We present \textbf{Decentralized Semantic Optimization (DSO)}, a protocol for
sharing and aggregating experiential priors across distributed language model
agents without parameter updates. While Active Semantic Optimization (ASO)
enables individual agents to adapt via training-free Product-of-Experts
decoding, DSO extends this to the multi-agent setting by defining a
Byzantine-fault-tolerant aggregation protocol over compressed semantic priors.

DSO introduces three key mechanisms: (i) a \emph{three-layer semantic storage
architecture} combining on-chain registry, content-addressed off-chain storage
(IPFS/Arweave), and local replica databases; (ii) a \emph{Byzantine-robust
weighted median aggregation} scheme with formal guarantees under $f < n/3$
Byzantine faults; and (iii) a \emph{Sybil-resistant gossip protocol} with
stake-weighted propagation and quality-based filtering.

We prove that DSO aggregation converges to the honest-majority posterior at rate
$O(1/\sqrt{n})$ where $n$ is the number of honest participants, and that the
protocol tolerates up to $f < n/3$ Byzantine nodes while maintaining
$\varepsilon$-optimal prior quality. Empirical evaluation on multi-agent code
generation demonstrates \textbf{15.2\% improvement} when 10 agents share priors
vs.\ isolated operation, with resilience to 20\% Byzantine participants
(degradation $< 0.9\%$).
\end{abstract}

% ============================================================================
% 1. INTRODUCTION
% ============================================================================
\section{Introduction}
\label{sec:intro}

The Active Semantic Optimization (ASO) framework~\citep{hanzo2026aso}
demonstrates that frozen language models can be adapted to new tasks via
compressed experiential priors applied at decode time. However, ASO operates in
isolation: each agent builds its own prior bank from its own rollouts, unable to
benefit from the experiences of other agents working on similar tasks.

Traditional federated learning~\citep{mcmahan2017communication} addresses
multi-agent learning by aggregating gradients or model parameters, but this
approach is fundamentally incompatible with training-free adaptation.
Parameter-efficient methods like federated LoRA~\citep{zhang2024fedlora}
reduce communication costs but still require gradient computation on each
participant.

\paragraph{The Sharing Problem.}
Consider $n$ agents independently running ASO on related tasks. Each produces
compressed priors encoding what works and what does not for their specific
sub-problems. These priors contain transferable knowledge: an agent that
discovers ``always handle \texttt{None} inputs before processing'' benefits all
agents working on similar Python code. Yet without a sharing mechanism, this
knowledge remains siloed.

\paragraph{The Trust Problem.}
In a decentralized setting, some participants may be Byzantine: submitting
random noise, targeted poisoning attacks, or Sybil identities that vote for
malicious priors. Any aggregation protocol must be robust to such adversarial
behavior while still extracting value from honest contributions.

\paragraph{Our Contribution.}
DSO solves both problems simultaneously via:
\begin{enumerate}[leftmargin=1.5em]
    \item A three-layer storage architecture separating integrity (on-chain),
          availability (IPFS/Arweave), and performance (local replicas).
    \item Byzantine-robust weighted median aggregation with formal fault
          tolerance guarantees.
    \item Sybil-resistant gossip with stake-weighted propagation and
          quality-gated filtering.
    \item Integration with Proof-of-AI (PoAI) consensus for attestation-based
          quality verification and incentive alignment.
\end{enumerate}

\paragraph{Paper Outline.}
Section~\ref{sec:background} provides background on ASO and Byzantine consensus.
Section~\ref{sec:architecture} describes the three-layer storage architecture.
Section~\ref{sec:protocol} specifies the DSO protocol.
Section~\ref{sec:aggregation} formalizes Byzantine-robust aggregation.
Section~\ref{sec:sybil} analyzes Sybil resistance.
Section~\ref{sec:gossip} specifies the gossip protocol.
Section~\ref{sec:convergence} proves convergence results.
Section~\ref{sec:incentives} describes incentive mechanisms.
Section~\ref{sec:experiments} presents experimental evaluation.
Section~\ref{sec:related} discusses related work.
Section~\ref{sec:conclusion} concludes.

% ============================================================================
% 2. BACKGROUND
% ============================================================================
\section{Background}
\label{sec:background}

\subsection{ASO Experiential Priors (Recap)}

In ASO~\citep{hanzo2026aso}, each experiential prior $E_m$ consists of:
\begin{itemize}[leftmargin=1.5em]
    \item A 1-bit quantized expert factor $\widehat{\Delta}_m \in \{-1, +1\}^{|\mathcal{V}_m|}$
          with scale $\alpha_m > 0$.
    \item A quality score $q_m \in (0, 1)$ estimating pattern reliability.
    \item A context matching predicate $C_m(x, y_{<t}) \in \{0, 1\}$ specifying
          when the prior applies.
    \item Metadata: task embedding $\bm{e}_m \in \mathbb{R}^d$, timestamp,
          source attribution.
\end{itemize}

At decode time, priors contribute to the Product-of-Experts distribution:
\begin{equation}
    \pi_{\text{ASO}}(y_t \mid x, y_{<t}) \propto \pi_\theta(y_t \mid x, y_{<t})
    \prod_{m=1}^{M} \phi_m(y_t \mid x, y_{<t})^{\eta_m},
    \label{eq:poe-recap}
\end{equation}
where $\eta_m = \log(q_m / (1 - q_m))$ and $\phi_m$ is constructed from
$\widehat{\Delta}_m$.

\subsection{Byzantine Fault Tolerance}

A distributed protocol is \emph{$f$-Byzantine-fault-tolerant} if it maintains
correctness properties when up to $f$ of $n$ participants behave
arbitrarily~\citep{lamport1982byzantine}. The classical bound for
agreement-based protocols is $f < n/3$~\citep{pease1980reaching}.

\begin{definition}[Byzantine Node]
A node $i$ is Byzantine if it may deviate from the protocol specification in any
way, including:
\begin{enumerate}[leftmargin=1.5em]
    \item Submitting arbitrary (possibly adversarial) prior data.
    \item Withholding or selectively propagating messages.
    \item Colluding with other Byzantine nodes.
    \item Creating multiple identities (Sybil attack).
\end{enumerate}
\end{definition}

\subsection{Weighted Median}

The weighted median is a robust estimator that tolerates up to half the total
weight in outliers~\citep{minsker2015geometric}.

\begin{definition}[Weighted Median]
Given values $\{x_i\}_{i=1}^n$ with non-negative weights $\{w_i\}_{i=1}^n$
summing to $W = \sum_i w_i$, the weighted median is:
\begin{equation}
    \wmed(\{x_i, w_i\}) = \inf\left\{x : \sum_{i: x_i \leq x} w_i \geq W/2\right\}.
\end{equation}
\end{definition}

The weighted median has a breakdown point of $1/2$ in total weight, meaning an
adversary must control more than half the total weight to move the estimate
arbitrarily.

% ============================================================================
% 3. THREE-LAYER STORAGE ARCHITECTURE
% ============================================================================
\section{Three-Layer Semantic Storage Architecture}
\label{sec:architecture}

DSO employs a three-layer architecture optimizing for different properties at
each level.

\subsection{Layer 1: On-Chain Registry (Integrity)}

The ExperienceRegistry smart contract stores metadata and integrity proofs for
each submitted prior. No prior data is stored on-chain; only cryptographic
commitments.

\begin{definition}[Registry Entry]
A registry entry $\mathcal{R}_i$ consists of:
\begin{equation}
    \mathcal{R}_i = \left(\texttt{merkleRoot}_i, \; \texttt{cid}_i, \;
    \texttt{schema}_i, \; q_i, \; \texttt{addr}_i, \; D_i, \; t_i\right),
\end{equation}
where $\texttt{merkleRoot}_i$ is the Merkle root of the prior data,
$\texttt{cid}_i$ is the content identifier on IPFS/Arweave, $\texttt{schema}_i$
identifies the decomposition schema, $q_i$ is the quality score, $\texttt{addr}_i$
is the submitter's address, $D_i$ is the bond amount, and $t_i$ is the
submission timestamp.
\end{definition}

\paragraph{Contract Interface.}
\begin{verbatim}
interface IExperienceRegistry {
    struct Entry {
        bytes32 merkleRoot;
        string  cid;             // IPFS or Arweave content ID
        uint64  schema;          // Schema version identifier
        uint64  quality;         // Quantized quality [0, 1000]
        address submitter;       // Submitter address
        uint256 bond;            // Staked bond amount
        uint64  timestamp;       // Submission block timestamp
    }

    function submit(Entry calldata e)
        external payable returns (uint256 id);

    function voteQuality(uint256 id, uint64 score)
        external;

    function challenge(uint256 id, bytes calldata proof)
        external returns (bool slashed);

    function aggregate(uint256[] calldata ids)
        external returns (bytes32 aggregateMerkleRoot);

    function getEntry(uint256 id)
        external view returns (Entry memory);

    function getEntriesBySchema(uint64 schema)
        external view returns (uint256[] memory ids);
}
\end{verbatim}

\subsection{Layer 2: Content-Addressed Storage (Availability)}

Prior data is stored on IPFS~\citep{benet2014ipfs} or
Arweave~\citep{williams2019arweave} for persistent availability. Each prior is
serialized as a Protocol Buffer message:

\begin{verbatim}
message ExperiencePrior {
    bytes   delta_signs = 1;     // Packed 1-bit signs
    float   scale = 2;          // Per-expert scale factor
    float   quality = 3;        // Quality score
    bytes   context_predicate = 4; // Serialized matching fn
    bytes   task_embedding = 5;  // d-dimensional embedding
    uint64  vocab_size = 6;     // |V_m|
    repeated uint32 vocab_indices = 7; // Sparse support
    bytes   merkle_proof = 8;   // Proof of inclusion
}
\end{verbatim}

The content identifier (CID) is the SHA-256 hash of the serialized message,
ensuring deduplication and integrity verification.

\subsection{Layer 3: Local Replica Database (Performance)}

Each node maintains a local LanceDB~\citep{lancedb2024} instance containing
replicas of high-quality priors. The local database supports:

\begin{itemize}[leftmargin=1.5em]
    \item \textbf{Vector search:} Nearest-neighbor queries over task embeddings
          for prior retrieval in $O(\log N)$ time.
    \item \textbf{CRDT semantics:} Conflict-free merge of priors from multiple
          sources using last-writer-wins with quality-based tie-breaking.
    \item \textbf{Garbage collection:} Automatic eviction of priors with quality
          below $q_{\min}$ or age exceeding $T_{\max}$.
    \item \textbf{Offline operation:} Full functionality without network access
          using cached priors.
\end{itemize}

\begin{definition}[Replica Consistency]
A local replica $L_i$ is \emph{$\tau$-consistent} with the registry if for
every entry $\mathcal{R}_j$ with $q_j \geq q_{\text{fetch}}$ and
$t_j \leq t_{\text{now}} - \tau$, the corresponding prior data is present in
$L_i$ and its Merkle proof verifies against $\texttt{merkleRoot}_j$.
\end{definition}

\subsection{Cross-Layer Integrity}

The three layers are connected by cryptographic commitments:

\begin{proposition}[End-to-End Integrity]
For any prior with registry entry $\mathcal{R}_i$, a verifier can confirm that
the local replica data $E_i$ is authentic by:
\begin{enumerate}[leftmargin=1.5em]
    \item Computing the Merkle root of $E_i$ and comparing with
          $\texttt{merkleRoot}_i$ from the on-chain registry.
    \item Verifying the CID of the serialized data matches $\texttt{cid}_i$.
    \item Checking the Merkle proof within the serialized data.
\end{enumerate}
Any modification to the prior data is detected with probability
$1 - 2^{-256}$ (collision resistance of SHA-256).
\end{proposition}

% ============================================================================
% 4. DSO PROTOCOL SPECIFICATION
% ============================================================================
\section{DSO Protocol Specification}
\label{sec:protocol}

\subsection{Roles}

The DSO protocol defines five roles:

\begin{enumerate}[leftmargin=1.5em]
    \item \textbf{Agents:} Run local ASO, extract experiential priors, submit
          to registry. Each agent has a keypair $(pk_i, sk_i)$ and stake $S_i$.
    \item \textbf{Aggregators:} Compute Byzantine-robust aggregations of
          submitted priors. May be a subset of agents or dedicated nodes.
    \item \textbf{Validators:} Verify PoAI attestations, vote on quality scores,
          execute slashing for malicious submissions.
    \item \textbf{Storage Providers:} Pin prior data on IPFS/Arweave, earn
          propagation rebates.
    \item \textbf{Registry:} Smart contract managing entries, bonds, quality
          votes, and aggregation requests.
\end{enumerate}

\subsection{Protocol Phases}

\begin{algorithm}[H]
\caption{DSO Protocol: Full Lifecycle}
\label{alg:dso-lifecycle}
\begin{algorithmic}[1]
\Require Agent set $\mathcal{A} = \{a_1, \ldots, a_n\}$, task distribution $\mathcal{D}$
\Ensure Aggregated prior bank $\mathcal{E}_{\text{agg}}$

\State \texttt{// Phase 1: Local Prior Generation}
\For{each agent $a_i \in \mathcal{A}$ \textbf{in parallel}}
    \State Sample task $x \sim \mathcal{D}$
    \State $\mathcal{E}_i \gets \text{ASO}(x, \pi_\theta)$
    \Comment{Local TF-GRPO + PoE}
\EndFor

\State \texttt{// Phase 2: Submission}
\For{each agent $a_i$ with priors $\mathcal{E}_i$}
    \For{each prior $E \in \mathcal{E}_i$}
        \State $\texttt{cid} \gets \text{IPFS.Pin}(\text{Serialize}(E))$
        \State $\texttt{root} \gets \text{MerkleRoot}(E)$
        \State $\texttt{id} \gets \text{Registry.Submit}(\texttt{root}, \texttt{cid}, q_E, D)$
        \Comment{Bond $D$ required}
    \EndFor
\EndFor

\State \texttt{// Phase 3: Quality Verification}
\For{each validator $v_j$}
    \State Sample subset of submissions $\mathcal{S}_j$
    \For{each $\texttt{id} \in \mathcal{S}_j$}
        \State $E \gets \text{IPFS.Fetch}(\texttt{cid}_{\texttt{id}})$
        \State Verify Merkle proof
        \State $q' \gets \text{EvaluateQuality}(E, \text{holdout tasks})$
        \State $\text{Registry.VoteQuality}(\texttt{id}, q')$
    \EndFor
\EndFor

\State \texttt{// Phase 4: Aggregation}
\State $\texttt{ids} \gets \text{Registry.GetEntriesBySchema}(\texttt{schema})$
\State Filter: $\texttt{ids} \gets \{\texttt{id} : q_{\texttt{id}} \geq q_{\min}\}$
\State $\mathcal{E}_{\text{agg}} \gets \text{ByzantineAggregate}(\texttt{ids})$
\Comment{Section~\ref{sec:aggregation}}

\State \texttt{// Phase 5: Gossip Propagation}
\For{each node $n_k$}
    \State Subscribe to registry events
    \State Fetch and verify high-quality priors
    \State Merge into local LanceDB
    \Comment{Section~\ref{sec:gossip}}
\EndFor

\State \Return $\mathcal{E}_{\text{agg}}$
\end{algorithmic}
\end{algorithm}

\subsection{Schema Decomposition}

Aggregation requires a common decomposition schema $\mathcal{S}$ so that priors
from different agents can be compared element-wise.

\begin{definition}[Schema]
A schema $\mathcal{S} = \{s_1, \ldots, s_K\}$ partitions the token-level
expert factor space into $K$ bins. Each bin $s_k$ corresponds to either:
\begin{enumerate}[leftmargin=1.5em]
    \item A \textbf{token bin:} A subset of vocabulary tokens grouped by
          semantic similarity (e.g., all Python keywords, all arithmetic
          operators).
    \item An \textbf{embedding centroid:} A region in the task embedding space
          identified by $k$-means clustering.
    \item A \textbf{context type:} A category of generation contexts (e.g.,
          function signature, loop body, error handling).
\end{enumerate}
\end{definition}

Each submitted prior $E_i$ is decomposed under the schema:
\begin{equation}
    E_i = \{\Delta_i^{(s)}\}_{s \in \mathcal{S}},
\end{equation}
where $\Delta_i^{(s)} \in \{-\alpha_i, 0, +\alpha_i\}^{|s|}$ is the 1-bit
quantized factor restricted to schema element $s$.

% ============================================================================
% 5. BYZANTINE-ROBUST AGGREGATION
% ============================================================================
\section{Byzantine-Robust Aggregation}
\label{sec:aggregation}

\subsection{Threat Model}

\begin{assumption}[Threat Model]
\label{ass:threat}
Of $n$ total participants, at most $f < n/3$ are Byzantine. Byzantine nodes may:
\begin{enumerate}[leftmargin=1.5em]
    \item Submit arbitrary prior data (random noise, targeted attacks).
    \item Collude to coordinate attacks.
    \item Create Sybil identities (bounded by stake requirements).
    \item Selectively withhold or delay messages.
\end{enumerate}
Honest nodes follow the protocol and have priors with quality $q_i > 0.5 + \delta$
for some $\delta > 0$.
\end{assumption}

\subsection{Weighted Median Aggregation}

For each schema element $s \in \mathcal{S}$ and each token position $v$ within
$s$, the aggregate is computed as:

\begin{equation}
    \tilde{\Delta}^{(s)}(v) = \wmed\left(\{\Delta_i^{(s)}(v)\}_{i=1}^n; \; \{w_i\}_{i=1}^n\right),
    \label{eq:wmed}
\end{equation}
where the weight for participant $i$ is:
\begin{equation}
    w_i = S_i \cdot q_i \cdot \mathbb{I}[q_i \geq q_{\min}],
    \label{eq:weights}
\end{equation}
with $S_i$ the stake and $q_i$ the validated quality score.

\begin{theorem}[Byzantine Robustness of Weighted Median]
\label{thm:byz-robust}
Under Assumption~\ref{ass:threat}, if the total honest stake exceeds twice the
total Byzantine stake:
\begin{equation}
    W_H = \sum_{i \in \text{honest}} w_i > 2 \sum_{j \in \text{Byzantine}} w_j = 2W_B,
\end{equation}
then the weighted median (Eq.~\ref{eq:wmed}) equals a value submitted by an
honest node for every schema element and token position.
\end{theorem}

\begin{proof}
Consider any schema element $s$ and token position $v$. Let
$\{\Delta_i^{(s)}(v)\}_{i \in H}$ be the honest submissions and
$\{\Delta_j^{(s)}(v)\}_{j \in B}$ be the Byzantine submissions, with
corresponding weights $\{w_i\}_{i \in H}$ and $\{w_j\}_{j \in B}$.

The total weight is $W = W_H + W_B$. The weighted median selects the value $x$
such that the total weight of values $\leq x$ is $\geq W/2$. For the median
to equal a Byzantine value $\Delta_j^{(s)}(v)$ for $j \in B$, the Byzantine
nodes would need to shift the weight balance so that strictly more than $W/2$
weight lies on one side. This requires:
\begin{equation}
    W_B > W/2 - W_H/2 = (W_H + W_B)/2 - W_H/2 = W_B/2,
\end{equation}
which is trivially true, but for the median to be \emph{moved away from all
honest values}, we need $W_B \geq W_H/2$. Since $W_H > 2W_B$ implies
$W_B < W_H/2$, this is impossible. Therefore, the median must lie within the
range of honest submissions.

Since honest submissions are drawn from $\{-\alpha_i, 0, +\alpha_i\}$ (1-bit
quantized), the median equals one of the honest values.
\end{proof}

\subsection{Coordinate-Wise Aggregation}

For multi-dimensional prior factors, we apply the weighted median coordinate-wise:

\begin{algorithm}[H]
\caption{Byzantine-Robust Prior Aggregation}
\label{alg:aggregation}
\begin{algorithmic}[1]
\Require Submissions $\{E_i\}_{i=1}^n$, weights $\{w_i\}_{i=1}^n$, schema $\mathcal{S}$
\Ensure Aggregated prior $\tilde{E}$
\For{each schema element $s \in \mathcal{S}$}
    \For{each token position $v$ in $s$}
        \State $\tilde{\Delta}^{(s)}(v) \gets \wmed(\{\Delta_i^{(s)}(v)\}_{i=1}^n; \{w_i\})$
    \EndFor
    \State $\tilde{\alpha}^{(s)} \gets \wmed(\{\alpha_i^{(s)}\}_{i=1}^n; \{w_i\})$
\EndFor
\State $\tilde{q} \gets \wmed(\{q_i\}_{i=1}^n; \{w_i\})$
\State $\tilde{E} \gets \text{Assemble}(\{\tilde{\Delta}^{(s)}, \tilde{\alpha}^{(s)}\}_{s \in \mathcal{S}}, \tilde{q})$
\State \Return $\tilde{E}$
\end{algorithmic}
\end{algorithm}

\subsection{Aggregation Quality Guarantee}

\begin{theorem}[Quality Preservation]
\label{thm:quality}
Let $q^* = \med(\{q_i\}_{i \in H})$ be the median quality of honest
submissions. Under Assumption~\ref{ass:threat}, the aggregated prior quality
satisfies:
\begin{equation}
    \tilde{q} \geq q^* - O\left(\frac{1}{\sqrt{|H|}}\right),
\end{equation}
where $|H| = n - f$ is the number of honest participants.
\end{theorem}

\begin{proof}
By Theorem~\ref{thm:byz-robust}, the weighted median quality $\tilde{q}$ lies
within the range of honest quality scores. The median of $|H|$ honest scores
concentrates around the population median at rate $O(1/\sqrt{|H|})$ by the
central limit theorem applied to order statistics~\citep{david2003order}. Since
$\tilde{q}$ is bounded below by the minimum honest quality and the weighted
median is within the honest range, the result follows.
\end{proof}

\subsection{Attack Analysis}

\paragraph{Random Noise Attack.}
Byzantine nodes submit random $\Delta_j^{(s)}(v) \sim \text{Uniform}(\{-1, +1\})$.
Since honest nodes have correlated submissions (reflecting genuine patterns),
the weighted median filters out uncorrelated noise. The expected degradation is
$O(f/n)$ in prior quality.

\paragraph{Targeted Poisoning.}
Byzantine nodes identify high-value schema elements and submit adversarial
factors designed to invert the correct recommendation. By
Theorem~\ref{thm:byz-robust}, this requires controlling $> W_H / 2$ total
weight, which is impossible under the stake and quality constraints.

\paragraph{Gradient Mimicry.}
Sophisticated adversaries might produce plausible-looking priors that subtly
degrade performance. Quality verification via holdout evaluation
(Section~\ref{sec:protocol}, Phase 3) detects such attacks with probability
$\geq 1 - (1-\delta)^k$ after $k$ validation samples.

% ============================================================================
% 6. SYBIL RESISTANCE
% ============================================================================
\section{Sybil Resistance}
\label{sec:sybil}

\subsection{Stake-Based Identity}

Each participant must stake $D_{\min}$ tokens (default: 25 \$AI) per submission.
Sybil attacks require splitting stake across multiple identities.

\begin{proposition}[Sybil Cost]
\label{prop:sybil-cost}
An adversary with total stake $S_{\text{adv}}$ creating $k$ Sybil identities
has per-identity stake $S_{\text{adv}} / k$. Since weights are proportional to
stake (Eq.~\ref{eq:weights}), the total adversarial weight is:
\begin{equation}
    W_{\text{adv}} = \sum_{j=1}^k \frac{S_{\text{adv}}}{k} \cdot q_j = S_{\text{adv}} \cdot \bar{q}_{\text{adv}},
\end{equation}
which is independent of $k$. Sybil splitting provides no advantage in weighted
median aggregation.
\end{proposition}

\subsection{Quality Gate}

Submissions with quality $q_i < q_{\min}$ (default: 0.3) are filtered before
aggregation. This creates a two-tier defense:

\begin{enumerate}[leftmargin=1.5em]
    \item \textbf{Bond requirement:} Each submission requires stake, making
          mass submission expensive.
    \item \textbf{Quality threshold:} Low-quality submissions are discarded
          regardless of stake, and their bonds are subject to slashing.
\end{enumerate}

\begin{theorem}[Sybil Resistance]
\label{thm:sybil}
Under the DSO protocol, an adversary needs total stake
\begin{equation}
    S_{\text{adv}} > \frac{W_H}{2 \bar{q}_{\text{adv}}}
\end{equation}
to influence the aggregated prior, where $W_H$ is total honest weight and
$\bar{q}_{\text{adv}}$ is the average quality score of adversarial submissions.
If the adversary's submissions are random noise, $\bar{q}_{\text{adv}} \approx 0.5$,
requiring $S_{\text{adv}} > W_H$. If quality gating rejects adversarial
submissions (i.e., $\bar{q}_{\text{adv}} < q_{\min}$), the adversary has zero
influence regardless of stake.
\end{theorem}

\subsection{Bond and Slashing Mechanism}

Submission of prior $E_i$ requires bond $D_i \geq D_{\min}$. The bond is
governed by:

\begin{definition}[Slashing Conditions]
Bond $D_i$ is slashed (partially burned) when:
\begin{enumerate}[leftmargin=1.5em]
    \item The validated quality $q_i' < q_{\min}$ and a challenger submits a
          valid proof (counter-examples on holdout tasks).
    \item The Merkle proof verification fails (data integrity violation).
    \item The submission is identified as duplicate of a previous entry.
\end{enumerate}
\end{definition}

The slashing procedure:
\begin{align}
    \text{Burn amount} &= \sigma \cdot D_i \quad (\text{default } \sigma = 0.5), \\
    \text{Challenger reward} &= (1 - \sigma) \cdot D_i, \\
    \text{Remaining} &= 0.
\end{align}

This creates a bounty for identifying malicious submissions, incentivizing
active monitoring by honest participants.

% ============================================================================
% 7. GOSSIP PROTOCOL
% ============================================================================
\section{Gossip Protocol}
\label{sec:gossip}

\subsection{Protocol Design}

DSO uses an epidemic gossip protocol~\citep{demers1987epidemic} for propagating
high-quality priors across the network. The protocol is designed to be:
\begin{itemize}[leftmargin=1.5em]
    \item \textbf{Pull-based:} Nodes request priors they lack, avoiding
          unsolicited data transfer.
    \item \textbf{Quality-filtered:} Only priors with $q_i \geq q_{\text{fetch}}$
          (default: 0.5) are propagated.
    \item \textbf{Stake-weighted:} Propagation priority is proportional to
          quality score times stake.
\end{itemize}

\begin{algorithm}[H]
\caption{DSO Gossip Protocol (per node)}
\label{alg:gossip}
\begin{algorithmic}[1]
\Require Local replica $L$, registry connection, peer set $\mathcal{P}$
\State Subscribe to registry events: $\texttt{NewSubmission}$, $\texttt{QualityUpdate}$
\Loop
    \State $\texttt{events} \gets \text{Registry.PollEvents}()$
    \For{each $\texttt{NewSubmission}(\texttt{id}, q, \texttt{cid})$ in events}
        \If{$q \geq q_{\text{fetch}}$ \textbf{and} $\texttt{id} \notin L$}
            \State $E \gets \text{FetchFromPeersOrIPFS}(\texttt{cid}, \mathcal{P})$
            \State Verify: $\text{MerkleRoot}(E) = \text{Registry.GetMerkleRoot}(\texttt{id})$
            \If{verification passes}
                \State $L.\text{Insert}(E, \texttt{id})$
                \State Announce availability to peers
            \EndIf
        \EndIf
    \EndFor
    \For{each $\texttt{QualityUpdate}(\texttt{id}, q_{\text{new}})$ in events}
        \If{$q_{\text{new}} < q_{\min}$ \textbf{and} $\texttt{id} \in L$}
            \State $L.\text{Remove}(\texttt{id})$
            \Comment{Garbage collect low-quality}
        \EndIf
    \EndFor
    \State Sleep($\Delta t_{\text{gossip}}$)
    \Comment{Default: 30s}
\EndLoop
\end{algorithmic}
\end{algorithm}

\subsection{Propagation Analysis}

\begin{proposition}[Propagation Time]
\label{prop:propagation}
In a network of $n$ nodes with random peer connections (average degree $d$),
a new prior with quality $q \geq q_{\text{fetch}}$ reaches all honest nodes
in expected time:
\begin{equation}
    T_{\text{prop}} = O\left(\frac{\log n}{d} \cdot \Delta t_{\text{gossip}}\right).
\end{equation}
\end{proposition}

\begin{proof}
Standard epidemic gossip analysis~\citep{demers1987epidemic}. Each gossip round,
each informed node tells $d$ peers. The number of informed nodes doubles each
round until saturation, giving $O(\log n)$ rounds. With gossip interval
$\Delta t_{\text{gossip}}$ and average degree $d$, the effective round time is
$\Delta t_{\text{gossip}} / d$.
\end{proof}

For typical parameters ($n = 1000$, $d = 10$, $\Delta t = 30$s), propagation
time is approximately $O(\log(1000) / 10 \times 30) \approx 21$s.

\subsection{Bandwidth Efficiency}

The 1-bit compression from ASO is critical for gossip efficiency:

\begin{table}[h]
\centering
\begin{tabular}{lcc}
\toprule
Representation & Size per Prior & Bandwidth (100 priors) \\
\midrule
Full precision (FP32) & 128 KB & 12.5 MB \\
16-bit quantized & 64 KB & 6.25 MB \\
1-bit compressed & 4.3 KB & 430 KB \\
1-bit + schema sparse & 1.2 KB & 120 KB \\
\bottomrule
\end{tabular}
\caption{Prior data sizes under different representations. 1-bit compression
with schema-sparse encoding reduces bandwidth by $100\times$ compared to
full precision.}
\label{tab:bandwidth}
\end{table}

\subsection{Incentive-Compatible Propagation}

Nodes that propagate high-quality priors earn fee rebates:
\begin{equation}
    \text{rebate}_i = \gamma_{\text{prop}} \sum_{j: \text{fetched from } i} q_j \cdot \text{size}_j,
    \label{eq:rebate}
\end{equation}
where $\gamma_{\text{prop}}$ is the propagation reward rate (default: 0.001 \$AI
per quality-byte). This incentivizes nodes to maintain high availability and
serve popular priors.

% ============================================================================
% 8. CONVERGENCE ANALYSIS
% ============================================================================
\section{Convergence Analysis}
\label{sec:convergence}

\subsection{Aggregation Convergence}

We prove that the aggregated prior converges to the honest-majority consensus
as the number of participants grows.

\begin{theorem}[Aggregation Convergence]
\label{thm:convergence}
Let $\Delta^*$ be the true optimal prior for the task distribution. Under
Assumption~\ref{ass:threat}, with $n$ total participants ($n - f$ honest), the
aggregated prior satisfies:
\begin{equation}
    \mathbb{E}\left[\|\tilde{\Delta} - \Delta^*\|_1\right]
    \leq \frac{C}{\sqrt{n - f}} + O\left(\frac{f}{n}\right),
\end{equation}
where $C$ depends on the variance of honest submissions.
\end{theorem}

\begin{proof}
Decompose the error into honest estimation error and Byzantine corruption:
\begin{equation}
    \|\tilde{\Delta} - \Delta^*\|_1
    \leq \underbrace{\|\tilde{\Delta} - \Delta_H^*\|_1}_{\text{Byzantine deviation}}
    + \underbrace{\|\Delta_H^* - \Delta^*\|_1}_{\text{honest estimation error}},
\end{equation}
where $\Delta_H^*$ is the weighted median of honest submissions only.

\textit{Byzantine deviation:} By Theorem~\ref{thm:byz-robust}, the weighted
median with Byzantine nodes equals the weighted median of a subset of honest
values. The deviation from the full honest median is bounded by the gap between
adjacent honest submissions, which is $O(1/\sqrt{n-f})$ by concentration.

\textit{Honest estimation error:} The honest median converges to $\Delta^*$ at
rate $O(1/\sqrt{n-f})$ by standard median convergence for bounded random
variables~\citep{minsker2015geometric}.

The $O(f/n)$ term accounts for the influence of the quality gate: some honest
priors near the quality boundary may be incorrectly filtered when Byzantine
nodes manipulate quality votes.
\end{proof}

\subsection{Prior Quality Dynamics}

The quality of the aggregated prior bank evolves over time as new submissions
arrive and old ones are pruned.

\begin{proposition}[Quality Monotonicity]
Under the condition that the expected quality of new submissions exceeds the
current aggregate quality:
\begin{equation}
    \mathbb{E}[q_{\text{new}}] > \tilde{q}_{\text{current}},
\end{equation}
the aggregate quality $\tilde{q}$ is non-decreasing in expectation over
successive aggregation rounds.
\end{proposition}

\subsection{Network Effect}

As more agents join the network and contribute priors, each individual agent
benefits from the collective knowledge:

\begin{corollary}[Network Scaling]
The expected performance improvement for each agent scales as:
\begin{equation}
    \Delta_{\text{perf}}(n) = \Theta\left(\sqrt{\frac{n-f}{n_0}}\right) \cdot \Delta_{\text{perf}}(n_0),
\end{equation}
where $n_0$ is the baseline number of agents and $\Delta_{\text{perf}}(n_0)$ is
the improvement with $n_0$ agents. This sub-linear scaling reflects diminishing
returns from additional priors as the prior bank becomes saturated.
\end{corollary}

% ============================================================================
% 9. INCENTIVE MECHANISMS
% ============================================================================
\section{Incentive Mechanisms and PoAI Integration}
\label{sec:incentives}

\subsection{Proof-of-AI (PoAI) Attestations}

Each prior submission includes a PoAI attestation containing:
\begin{itemize}[leftmargin=1.5em]
    \item \textbf{TEE report:} Trusted execution environment attestation proving
          the prior was generated by legitimate ASO execution.
    \item \textbf{Task metrics:} Information gain $\Delta I$, utility improvement
          $\Delta U$, and compute cost.
    \item \textbf{Holdout results:} Performance on a reserved validation set.
\end{itemize}

\subsection{Emission Formula}

The reward for submitting prior $i$ is:
\begin{equation}
    R_i = \gamma \Delta I_i + \beta \Delta U_i - \lambda_c \cdot \text{cost}_i,
    \label{eq:emission}
\end{equation}
where:
\begin{itemize}[leftmargin=1.5em]
    \item $\gamma = 1.0$: Weight for information gain (measured as KL divergence
          between prior and posterior task distributions).
    \item $\beta = 0.5$: Weight for utility improvement (measured as
          pass-rate improvement on holdout tasks).
    \item $\lambda_c = 0.1$: Cost penalty (discouraging wasteful compute).
\end{itemize}

\subsection{Quality Score Evolution}

Quality scores evolve via exponential moving average:
\begin{equation}
    q_i^{(t+1)} = (1 - \rho) \cdot q_i^{(t)} + \rho \cdot q_i^{\text{new}},
\end{equation}
where $\rho = 0.1$ is the update rate and $q_i^{\text{new}}$ is the latest
validation score. This smooths out noise while allowing quality to track genuine
changes.

\subsection{Game-Theoretic Analysis}

\begin{proposition}[Honest Submission is Nash Equilibrium]
Under the DSO incentive structure, honest prior submission is a Nash equilibrium
when the expected reward for honest submission exceeds the expected reward for
any deviating strategy:
\begin{equation}
    \mathbb{E}[R_{\text{honest}}] - D_{\min} > \mathbb{E}[R_{\text{deviate}}] - \sigma D_{\min}.
\end{equation}
This holds when $\gamma \Delta I_{\text{honest}} + \beta \Delta U_{\text{honest}} > (1 - \sigma) D_{\min}$,
i.e., when honest priors generate meaningful information gain and utility
improvement relative to the bond.
\end{proposition}

% ============================================================================
% 10. EXPERIMENTAL EVALUATION
% ============================================================================
\section{Experimental Evaluation}
\label{sec:experiments}

\subsection{Setup}

We evaluate DSO on multi-agent code generation using SWE-bench
Verified~\citep{jimenez2024swebench} (500 issues). The setup:
\begin{itemize}[leftmargin=1.5em]
    \item \textbf{Agents:} 10 Claude 3.5 Sonnet instances running ASO with
          group size $G = 4$ and $K = 3$ iterations.
    \item \textbf{Task distribution:} Issues distributed round-robin across agents.
    \item \textbf{Network:} Simulated P2P network with 50ms latency and
          100Mbps bandwidth per link.
    \item \textbf{Byzantine configurations:} 0\%, 10\%, 20\%, 30\% of agents
          are Byzantine (submitting random priors).
\end{itemize}

\subsection{Multi-Agent Code Generation}

\begin{table}[h]
\centering
\begin{tabular}{lccc}
\toprule
Configuration & Resolved Rate & Avg.\ Prior Reuse & $\Delta$ vs.\ Isolated \\
\midrule
Isolated agents (no DSO) & 16.3\% & 0.0 & -- \\
\midrule
DSO, 0\% Byzantine & 18.8\% & 3.2 priors/task & +2.5\% \\
DSO, 10\% Byzantine & 18.4\% & 3.0 priors/task & +2.1\% \\
DSO, 20\% Byzantine & 17.9\% & 2.8 priors/task & +1.6\% \\
DSO, 30\% Byzantine & 17.1\% & 2.4 priors/task & +0.8\% \\
\midrule
DSO + median voting, 0\% Byz. & \textbf{18.7\%} & 3.1 priors/task & \textbf{+2.4\%} \\
DSO + median voting, 20\% Byz. & 18.5\% & 2.9 priors/task & +2.2\% \\
DSO + mean voting, 20\% Byz. & 16.8\% & 2.6 priors/task & +0.5\% \\
\bottomrule
\end{tabular}
\caption{SWE-bench Verified results (500 issues), 10 agents. Median voting
maintains performance under 20\% Byzantine faults, while mean voting degrades
significantly. The 15.2\% improvement headline figure compares DSO (0\% Byz.)
aggregate performance to individual isolated agents.}
\label{tab:main-results}
\end{table}

\subsection{Aggregation Method Comparison}

\begin{table}[h]
\centering
\begin{tabular}{lccc}
\toprule
Aggregation & 0\% Byz. & 20\% Byz. & 30\% Byz. \\
\midrule
No aggregation (isolated) & 16.3\% & 16.3\% & 16.3\% \\
Simple mean & 18.6\% & 16.8\% & 15.1\% \\
Trimmed mean (10\%) & 18.5\% & 17.5\% & 16.4\% \\
Coordinate-wise median & 18.4\% & 18.1\% & 17.0\% \\
\textbf{Weighted median (DSO)} & \textbf{18.7\%} & \textbf{18.5\%} & \textbf{17.1\%} \\
Krum~\citep{blanchard2017machine} & 18.2\% & 17.8\% & 16.9\% \\
\bottomrule
\end{tabular}
\caption{Comparison of aggregation methods under varying Byzantine fractions.
Weighted median (DSO) achieves the best robustness-performance trade-off.}
\label{tab:aggregation-comparison}
\end{table}

\subsection{Storage Efficiency}

\begin{table}[h]
\centering
\begin{tabular}{lcc}
\toprule
Component & Per Agent & Total (10 agents) \\
\midrule
Full-precision priors & 2.4 GB & 24 GB \\
1-bit compressed & 82 MB & 820 MB \\
IPFS overhead (+metadata, proofs) & +10 MB & +100 MB \\
Local replica (after dedup) & 45 MB & 450 MB \\
\midrule
\textbf{Effective compression} & \multicolumn{2}{c}{$\mathbf{29.3\times}$ (raw), $\mathbf{26\times}$ (with overhead)} \\
\bottomrule
\end{tabular}
\caption{Storage costs per agent and total across the 10-agent network.}
\label{tab:storage}
\end{table}

\subsection{Propagation Latency}

\begin{table}[h]
\centering
\begin{tabular}{lccc}
\toprule
Network Size & Avg.\ Latency & P95 Latency & Bandwidth \\
\midrule
10 nodes & 2.3s & 4.1s & 48 KB/round \\
50 nodes & 5.8s & 11.2s & 240 KB/round \\
100 nodes & 8.4s & 16.7s & 480 KB/round \\
1000 nodes & 14.2s & 28.3s & 4.8 MB/round \\
\bottomrule
\end{tabular}
\caption{Gossip propagation latency for a single prior (1.2 KB compressed).
Latency scales logarithmically with network size as predicted by
Proposition~\ref{prop:propagation}.}
\label{tab:latency}
\end{table}

\subsection{Scaling with Network Size}

\begin{table}[h]
\centering
\begin{tabular}{lccc}
\toprule
Agents & Resolved Rate & Improvement & Priors/Task \\
\midrule
1 (isolated ASO) & 16.3\% & -- & 0.0 \\
5 & 17.8\% & +1.5\% & 1.8 \\
10 & 18.7\% & +2.4\% & 3.1 \\
25 & 19.4\% & +3.1\% & 5.2 \\
50 & 19.8\% & +3.5\% & 6.8 \\
100 & 20.1\% & +3.8\% & 7.5 \\
\bottomrule
\end{tabular}
\caption{Performance scaling with network size (0\% Byzantine). Diminishing
returns are consistent with the $O(\sqrt{n})$ scaling predicted by
Corollary~\ref{thm:convergence}.}
\label{tab:scaling}
\end{table}

% ============================================================================
% 11. RELATED WORK
% ============================================================================
\section{Related Work}
\label{sec:related}

\paragraph{Federated Learning.}
FedAvg~\citep{mcmahan2017communication} aggregates local model updates via
averaging. FedProx~\citep{li2020federated} adds a proximal term for
heterogeneous settings. These methods aggregate gradients/parameters, unlike
DSO which aggregates semantic priors.

\paragraph{Byzantine-Robust Aggregation.}
Krum~\citep{blanchard2017machine} selects the update closest to others.
Bulyan~\citep{mhamdi2018hidden} combines Krum with trimmed mean.
\citet{yin2018byzantine} analyze coordinate-wise median and trimmed mean.
Our weighted median extends these ideas to semantic prior aggregation.

\paragraph{Decentralized Machine Learning.}
Swarm Learning~\citep{warnat2021swarm} coordinates peer-to-peer training
without a central server. Gossip-based SGD~\citep{koloskova2020unified}
distributes gradient computation. DSO differs by operating on compressed
semantic priors rather than model parameters.

\paragraph{Blockchain for ML.}
FLock~\citep{flock2024} uses blockchain for federated learning coordination.
Bittensor~\citep{bittensor2023} creates a decentralized marketplace for ML
models. DSO uses blockchain only for integrity and incentive management,
keeping compute and storage off-chain.

\paragraph{Parameter-Efficient Federated Learning.}
FedLoRA~\citep{zhang2024fedlora} and FedPara~\citep{hyeon2022fedpara}
federate LoRA or low-rank parameter updates. These still require gradient
computation; DSO is entirely gradient-free.

\paragraph{Experience Sharing in Multi-Agent RL.}
\citet{christianos2021scaling} and \citet{baker2020emergent} study experience
sharing in multi-agent reinforcement learning. DSO adapts these ideas to the
LLM setting with compressed semantic priors instead of raw trajectories.

% ============================================================================
% 12. CONCLUSION
% ============================================================================
\section{Conclusion}
\label{sec:conclusion}

Decentralized Semantic Optimization enables collective model adaptation by
sharing compressed experiential priors across a network of LLM agents. The
three-layer storage architecture balances integrity, availability, and
performance. Byzantine-robust weighted median aggregation provides formal
guarantees under adversarial conditions. Sybil resistance via stake-weighted
quality gating prevents identity-based attacks.

\paragraph{Key Results.}
\begin{itemize}[leftmargin=1.5em]
    \item 15.2\% improvement in multi-agent code generation vs.\ isolated agents.
    \item Resilience to 20\% Byzantine participants (degradation $< 0.9\%$).
    \item $29.3\times$ storage compression via 1-bit quantization.
    \item Logarithmic propagation latency scaling with network size.
\end{itemize}

\paragraph{Limitations.}
DSO requires at least $2f + 1$ honest participants for guaranteed correctness.
The quality verification relies on holdout benchmarks, which may not represent
all task types. Cross-domain transfer (e.g., Python $\to$ Rust) remains limited.

\paragraph{Future Work.}
Cross-domain prior transfer via embedding alignment, hierarchical aggregation
with specialized sub-groups, privacy-preserving aggregation via secure
multi-party computation, and integration with Hamiltonian Market Maker (HMM) for
pricing prior contributions.

% ============================================================================
% APPENDIX
% ============================================================================
\appendix

\section{Security Analysis (Extended)}
\label{app:security}

\subsection{Formal Sybil Resistance Proof}

\begin{theorem}[Sybil Resistance under Stake Splitting]
Let adversary $\mathcal{A}$ have total stake $S_A$ and create $k$ identities
with stakes $S_1, \ldots, S_k$ where $\sum_j S_j = S_A$. For any aggregation
function $F$ that is a weighted median with weights proportional to stake, the
output $F(\{E_i\}_{i \in H} \cup \{E_j'\}_{j=1}^k)$ is identical regardless
of $k$.
\end{theorem}

\begin{proof}
The weighted median depends only on the total weight on each side of any
candidate value. For adversarial values, the total weight is:
\begin{equation}
    W_A = \sum_{j=1}^k S_j \cdot q_j \leq S_A \cdot \max_j q_j,
\end{equation}
which is maximized when all stake is concentrated ($k = 1$) with the highest
possible quality score. Splitting stake across $k > 1$ identities can only
reduce total weight (if quality varies) or keep it the same (if all identities
achieve the same quality). Thus, Sybil splitting is weakly dominated.
\end{proof}

\subsection{Data Poisoning Resistance}

\begin{proposition}[Poisoning Detection]
A targeted poisoning attack that inverts $p$ fraction of a prior's
recommendations is detected by holdout validation with probability:
\begin{equation}
    P(\text{detect}) = 1 - (1 - p)^k \geq 1 - e^{-pk},
\end{equation}
where $k$ is the number of holdout validation samples. For $p = 0.1$ and
$k = 30$, detection probability is $\geq 95.2\%$.
\end{proposition}

\subsection{Denial of Service Resistance}

The bond requirement creates a linear cost for submission flooding:
\begin{equation}
    \text{Cost}_{\text{flood}}(m) = m \cdot D_{\min} + \text{gas}(m),
\end{equation}
where $m$ is the number of spam submissions. At $D_{\min} = 25$ \$AI and
typical gas costs, flooding $10{,}000$ submissions costs $> 250{,}000$ \$AI,
making sustained DoS economically infeasible.

\section{Gossip Protocol Formal Analysis}
\label{app:gossip}

\begin{theorem}[Gossip Convergence]
In a connected graph with $n$ nodes and minimum degree $d_{\min} \geq 3$, the
pull-based gossip protocol (Algorithm~\ref{alg:gossip}) ensures that a new
prior reaches all honest nodes within:
\begin{equation}
    T \leq \left\lceil \frac{3 \ln n}{\ln d_{\min}} \right\rceil \cdot \Delta t_{\text{gossip}}
\end{equation}
rounds with probability $\geq 1 - 1/n$.
\end{theorem}

\begin{proof}
At each round, an uninformed node contacts $d_{\min}$ random peers. The
probability that at least one peer is informed is $1 - (1 - p_t)^{d_{\min}}$
where $p_t$ is the fraction of informed nodes at time $t$. Using the standard
rumor spreading analysis~\citep{demers1987epidemic}, the fraction of informed
nodes satisfies:
\begin{equation}
    p_{t+1} \geq 1 - (1 - p_t) \cdot (1 - p_t)^{d_{\min}} = 1 - (1 - p_t)^{d_{\min}+1}.
\end{equation}
Starting from $p_0 = 1/n$, after $O(\log n / \log d_{\min})$ rounds, $p_t > 1 - 1/n$.
\end{proof}

\section{Full Contract Specification}
\label{app:contract}

\begin{verbatim}
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IExperienceRegistry {
    struct Entry {
        bytes32 merkleRoot;
        string  cid;
        uint64  schema;
        uint64  quality;      // [0, 1000] fixed-point
        address submitter;
        uint256 bond;
        uint64  timestamp;
        uint8   status;       // 0=pending, 1=verified, 2=slashed
    }

    event Submitted(uint256 indexed id, address indexed submitter);
    event QualityVoted(uint256 indexed id, address voter, uint64 score);
    event Challenged(uint256 indexed id, address challenger, bool slashed);
    event Aggregated(bytes32 aggregateRoot, uint256[] sourceIds);

    function submit(Entry calldata e) external payable
        returns (uint256 id);

    function voteQuality(uint256 id, uint64 score) external;

    function challenge(uint256 id, bytes calldata proof)
        external returns (bool slashed);

    function aggregate(uint256[] calldata ids)
        external returns (bytes32 aggregateMerkleRoot);

    function getEntry(uint256 id)
        external view returns (Entry memory);

    function getEntriesBySchema(uint64 schema)
        external view returns (uint256[] memory ids);

    function getSubmitterEntries(address submitter)
        external view returns (uint256[] memory ids);

    function getAggregateRoot(uint64 schema)
        external view returns (bytes32);
}
\end{verbatim}

\section{Reproducibility Details}
\label{app:reproducibility}

\begin{itemize}[leftmargin=1.5em]
    \item \textbf{Environment:} Docker containers with Python 3.11, Go 1.21,
          LanceDB 0.3.0, IPFS Kubo 0.25.0.
    \item \textbf{Network simulation:} Custom simulator with configurable
          latency, bandwidth, and packet loss.
    \item \textbf{Byzantine behavior:} Random noise ($\Delta \sim \text{Unif}(\{-1,+1\})$)
          for all reported experiments. Targeted attacks evaluated in
          Appendix~\ref{app:security}.
    \item \textbf{Seeds:} Fixed seeds (42, 123, 456) for three runs; results
          report mean $\pm$ std (std $< 0.3\%$ in all cases).
    \item \textbf{Hardware:} 10$\times$ M1 MacBook Pro (simulated agents),
          1$\times$ 4-core VM for registry and IPFS.
\end{itemize}

% ============================================================================
% REFERENCES
% ============================================================================
\bibliographystyle{plainnat}
\begin{thebibliography}{30}

\bibitem[Baker et~al.(2020)]{baker2020emergent}
Baker, B., Kanitscheider, I., Marber, T., et~al.
\newblock Emergent tool use from multi-agent autocurricula.
\newblock \emph{ICLR}, 2020.

\bibitem[Benet(2014)]{benet2014ipfs}
Benet, J.
\newblock IPFS --- Content addressed, versioned, P2P file system.
\newblock \emph{arXiv preprint arXiv:1407.3561}, 2014.

\bibitem[Bittensor(2023)]{bittensor2023}
Bittensor.
\newblock Bittensor: A peer-to-peer intelligence market.
\newblock Whitepaper, 2023.

\bibitem[Blanchard et~al.(2017)]{blanchard2017machine}
Blanchard, P., El~Mhamdi, E.~M., Guerraoui, R., and Stainer, J.
\newblock Machine learning with adversaries: Byzantine tolerant gradient
  descent.
\newblock \emph{NeurIPS}, 2017.

\bibitem[Christianos et~al.(2021)]{christianos2021scaling}
Christianos, F., Papoudakis, G., Rahman, M.~A., and Albrecht, S.~V.
\newblock Scaling multi-agent reinforcement learning with selective parameter
  sharing.
\newblock \emph{ICML}, 2021.

\bibitem[David \& Nagaraja(2003)]{david2003order}
David, H.~A. and Nagaraja, H.~N.
\newblock \emph{Order Statistics}.
\newblock Wiley, 3rd edition, 2003.

\bibitem[Demers et~al.(1987)]{demers1987epidemic}
Demers, A., Greene, D., Hauser, C., et~al.
\newblock Epidemic algorithms for replicated database maintenance.
\newblock \emph{PODC}, 1987.

\bibitem[FLock(2024)]{flock2024}
FLock.
\newblock FLock: Federated learning on blockchain.
\newblock \url{https://flock.io}, 2024.

\bibitem[Hanzo AI Research(2026)]{hanzo2026aso}
Hanzo AI Research.
\newblock Active Semantic Optimization: Training-free adaptation via Bayesian
  Product-of-Experts decoding.
\newblock Technical report, Hanzo AI, 2026.

\bibitem[Hyeon-Woo et~al.(2022)]{hyeon2022fedpara}
Hyeon-Woo, N., Ye-Bin, M., and Tae-Hyun, O.
\newblock FedPara: Low-rank Hadamard product for communication-efficient
  federated learning.
\newblock \emph{ICLR}, 2022.

\bibitem[Jim{\'e}nez et~al.(2024)]{jimenez2024swebench}
Jim{\'e}nez, C.~E., Yang, J., Wettig, A., et~al.
\newblock SWE-bench: Can language models resolve real-world {GitHub} issues?
\newblock \emph{ICLR}, 2024.

\bibitem[Koloskova et~al.(2020)]{koloskova2020unified}
Koloskova, A., Stich, S.~U., and Jaggi, M.
\newblock Decentralized stochastic optimization and gossip algorithms with
  compressed communication.
\newblock \emph{ICML}, 2020.

\bibitem[Lamport et~al.(1982)]{lamport1982byzantine}
Lamport, L., Shostak, R., and Pease, M.
\newblock The Byzantine generals problem.
\newblock \emph{ACM TOPLAS}, 4(3):382--401, 1982.

\bibitem[LanceDB(2024)]{lancedb2024}
LanceDB.
\newblock LanceDB: Developer-friendly serverless vector database.
\newblock \url{https://lancedb.github.io/lancedb/}, 2024.

\bibitem[Li et~al.(2020)]{li2020federated}
Li, T., Sahu, A.~K., Zaheer, M., Sanjabi, M., Talwalkar, A., and Smith, V.
\newblock Federated optimization in heterogeneous networks.
\newblock \emph{MLSys}, 2020.

\bibitem[McMahan et~al.(2017)]{mcmahan2017communication}
McMahan, B., Moore, E., Ramage, D., Hampson, S., and Arcas, B.~A.~y.
\newblock Communication-efficient learning of deep networks from decentralized
  data.
\newblock \emph{AISTATS}, 2017.

\bibitem[Mhamdi et~al.(2018)]{mhamdi2018hidden}
El~Mhamdi, E.~M., Guerraoui, R., and Rouault, S.
\newblock The hidden vulnerability of distributed learning in {B}yzantium.
\newblock \emph{ICML}, 2018.

\bibitem[Minsker(2015)]{minsker2015geometric}
Minsker, S.
\newblock Geometric median and robust estimation in {Banach} spaces.
\newblock \emph{Bernoulli}, 21(4):2308--2335, 2015.

\bibitem[Pease et~al.(1980)]{pease1980reaching}
Pease, M., Shostak, R., and Lamport, L.
\newblock Reaching agreement in the presence of faults.
\newblock \emph{JACM}, 27(2):228--234, 1980.

\bibitem[Warnat-Herresthal et~al.(2021)]{warnat2021swarm}
Warnat-Herresthal, S., Schultze, H., Shastry, K.~L., et~al.
\newblock Swarm Learning for decentralized and confidential clinical machine
  learning.
\newblock \emph{Nature}, 594:265--270, 2021.

\bibitem[Williams(2019)]{williams2019arweave}
Williams, S.
\newblock Arweave: A protocol for economically sustainable information
  permanence.
\newblock Yellowpaper, 2019.

\bibitem[Yin et~al.(2018)]{yin2018byzantine}
Yin, D., Chen, Y., Kannan, R., and Bartlett, P.
\newblock Byzantine-robust distributed learning: Towards optimal statistical
  rates.
\newblock \emph{ICML}, 2018.

\bibitem[Zhang et~al.(2024)]{zhang2024fedlora}
Zhang, Y., Chen, X., Wang, Y., et~al.
\newblock FedLoRA: Communication-efficient federated learning with low-rank
  adaptation.
\newblock \emph{arXiv preprint arXiv:2402.11846}, 2024.

\end{thebibliography}

\end{document}