papers/lux-decentralized-cloud/sections/03-provider-reputation-without-surveillance.tex

\section{Provider Reputation Without Surveillance}
\label{sec:reputation}

A decentralized provider market requires a reputation system: users must be
able to distinguish reliable providers from unreliable ones. However, the
standard approach to reputation---collecting and analyzing user feedback,
monitoring traffic patterns, inspecting request/response content---is
incompatible with the privacy guarantees of the capsule model.

We introduce a reputation protocol based exclusively on verifiable on-chain
signals that reveal nothing about user data or behavior.

\subsection{Reputation Inputs}

The reputation score for a provider $\mathcal{P}$ is computed from four
on-chain signals:

\begin{enumerate}
    \item \textbf{Receipt completion rate.} The fraction of committed service
    interactions for which $\mathcal{P}$ produced a valid chain receipt within
    the committed time bound:
    \begin{equation}
        r_{\text{receipt}} = \frac{|\{\sigma : \sigma \text{ valid and on-time}\}|}{|\{\text{committed interactions}\}|}
    \end{equation}

    \item \textbf{Stake duration.} The number of consecutive epochs for which
    $\mathcal{P}$ has maintained stake above the minimum threshold:
    \begin{equation}
        r_{\text{tenure}} = \min\left(1, \frac{T_{\text{staked}}}{T_{\text{max}}}\right)
    \end{equation}

    \item \textbf{Slashing history.} The cumulative fraction of stake that has
    been slashed over the provider's lifetime:
    \begin{equation}
        r_{\text{slash}} = 1 - \frac{\sum_{t} \Delta S_t^{\text{slash}}}{S_{\text{initial}}}
    \end{equation}

    \item \textbf{Proof-of-service attestations.} For storage providers, the
    fraction of proof-of-spacetime challenges passed. For compute providers,
    the fraction of TEE attestations verified. For relay providers, the
    fraction of latency probes within SLA bounds.
\end{enumerate}

\subsection{Reputation Aggregation}

The composite reputation score is:

\begin{equation}\label{eq:reputation}
    \mathsf{Rep}(\mathcal{P}) = \prod_{i \in \{\text{receipt}, \text{tenure}, \text{slash}, \text{service}\}} r_i^{w_i}
\end{equation}

where $w_i$ are governance-set weights satisfying $\sum w_i = 1$. The
multiplicative form ensures that a zero score in any dimension (e.g.,
total slashing) yields a zero composite score, regardless of performance
in other dimensions.

\begin{theorem}[Reputation Sybil Resistance]
Under the stake-weighted reputation model, creating $k$ Sybil identities
with equal stake $S/k$ each yields a strictly lower aggregate reputation
than a single identity with stake $S$, provided $w_{\text{tenure}} > 0$.
\end{theorem}

\begin{proof}
Each Sybil identity starts with $T_{\text{staked}} = 0$, yielding
$r_{\text{tenure}} = 0$ and therefore $\mathsf{Rep} = 0$ for all new
identities. The original identity retains its accumulated tenure. Since
reputation is not transferable (it is bound to the staking identity on-chain),
the attacker cannot redistribute reputation across Sybil identities. The
aggregate service capacity of the $k$ Sybil identities is bounded by $S$
(total stake is conserved), and each must independently accumulate tenure,
creating an unavoidable cold-start penalty.
\end{proof}

\subsection{Privacy-Preserving Feedback}

Users may optionally submit encrypted quality ratings using the CKKS
homomorphic encryption scheme. Ratings are encrypted under the governance
committee's public key and aggregated in ciphertext:

\begin{equation}
    \mathsf{Enc}(\bar{q}) = \frac{1}{N} \sum_{i=1}^{N} \mathsf{Enc}(q_i)
\end{equation}

The governance committee threshold-decrypts the aggregate rating (requiring
$t$-of-$n$ committee members) to obtain the average quality score without
learning any individual rating. This provides a soft signal that complements
the hard on-chain metrics.