Add linkability, messaging redundancy and churn percolation to pd; report
Extends the pd Blend simulator along two axes the deanonymization model
opened up, adds the reports/blend/pd report of record, and fixes three
correctness defects found while reviewing the result.
Linkability over time (pd.linkability):
- time to link an emitter ~ 30s*ln(1/(1-alpha))/(stake*q): inversely
proportional to stake, so a 5% staker is linked in ~2 days and a 0.001%
staker only after ~27 years;
- time to certify a node's stake >= theta from the count of attributable
observations (relative precision ~1/sqrt(N)): sizing a node costs 100-400x
more than identifying it, and sub-0.1% stake is practically unlearnable.
Both are closed forms over the exact deanonymization rates and a
stake-proportional 30 s emission cadence, checked against a Monte-Carlo of
the emission process in verify.
Messaging redundancy (R independent cascades per emission, R = 1..4):
- `redundancy` knob threaded through config/rng/propagation/engine/metrics/
sweep; a node receives from whichever cascade reaches it first, so arrival
times combine element-wise. Delivery and capture both follow 1-(1-x)^R, so
redundancy trades reliability against anonymity and divides time-to-link
by ~R. Measured: delivery 0.34 -> 0.81 at 30% churn for R = 1 -> 4, while a
1%-staker's time to link falls 10 d -> 2.5 d.
- Redundancy buys NO coverage: a cascade only delivers if the sender could
already route to its relay, so every delivered cascade floods the sender's
own component. Coverage is flat in R to four decimals at every degree.
- Near the percolation threshold the cascades fail together rather than
independently, so redundancy under-delivers against 1-(1-p1)^R there.
Churn percolation (configs/percolation.yaml, verify check 7):
- the flood only crosses responsive nodes, so it lives on the responsive
sub-graph -- site percolation on a d-regular graph. A network survives churn
only up to u_c = 1 - 1/(degree-1); measured collapse lands on the predicted
threshold for every degree (3 -> 0.50, 6 -> 0.80, 16 -> 0.93), which inverts
into the sizing rule degree > 1 + 1/(1-u).
Correctness fixes:
- redundancy delay used the fastest cascade's own full delay, which
over-states it (min-max vs max-min); now the element-wise earliest arrival,
reducing exactly to the single-cascade model at R = 1 (test);
- the "redundancy improves coverage" claim was false in both the report and
the simulator README -- removed and replaced with the measured result;
- per-hop latency is degree-dependent (1.5 s at degree 16 to 2.7 s at degree
3), not a flat 1.6 s; and the worst-case observation figure was averaged
over degrees -- at degree 8 and f_adv = 0.2 it is 0.83 -> 1.000.
Statistics: round counts raised for resolution rather than speed -- 8000
rounds per cell in the main sweep, 9600 in the redundancy study, 6400 in the
percolation study, giving SEM <= 0.009 on every delivery rate and <= 0.04 s
on every delay mean. The previous redundancy grid (144 rounds/cell) produced a
non-monotonic delivery curve; it is now monotonic and within 0.015 of theory.
Adversary and deanonymization metrics remain closed-form and exact.
reports/blend/pd: the report of record -- peering-degree trade-offs across
speed, observation, eclipse, deanonymization and reliability, plus the
time-to-link, stake-inference, redundancy and churn-threshold sections, with
21 figures of record and an explicit sampling-error statement.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 22:37:22 +02:00
|
|
|
"""Time-to-link and stake-inference laws, and a Monte-Carlo check of the emission process."""
|
|
|
|
|
|
|
|
|
|
import math
|
|
|
|
|
|
|
|
|
|
import numpy as np
|
|
|
|
|
|
Rename the simulator and report from pd to blend
The study started as a peering-degree question and grew well past it: propagation,
adversary exposure, deanonymization and time-to-link, reliability under uniform
and correlated churn, messaging redundancy, and cover traffic. The pd name no
longer describes it.
tools/simulators/blend/pd/ -> tools/simulators/blend/, package src/pd -> src/blend,
and reports/blend/pd/ -> reports/blend/. Moved with git mv so history follows.
The text substitutions are deliberately narrow. pd is also the conventional pandas
alias, and pandas genuinely has a pd.plotting submodule, so a blanket pd. -> blend.
rewrite would have corrupted four files. Only package-unambiguous forms were
changed: from pd.X, -m pd.X, pd.<our module>, PD_BYTES_BUDGET, src/pd, and the
pyproject name. All four import pandas as pd lines are untouched and verified.
Both READMEs reframed: peering degree is now presented as the primary axis that
ties the others together rather than as the subject, and the relative links, which
lost a directory level in the move, are corrected.
Verified after the move: ruff clean, 101 tests, 45 verify anchors, make targets,
the script shims, an end-to-end smoke run, and data/report_numbers.py still
reproducing the report tables from the checked-in evidence.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-06 12:20:07 +02:00
|
|
|
from blend.linkability import (
|
Add linkability, messaging redundancy and churn percolation to pd; report
Extends the pd Blend simulator along two axes the deanonymization model
opened up, adds the reports/blend/pd report of record, and fixes three
correctness defects found while reviewing the result.
Linkability over time (pd.linkability):
- time to link an emitter ~ 30s*ln(1/(1-alpha))/(stake*q): inversely
proportional to stake, so a 5% staker is linked in ~2 days and a 0.001%
staker only after ~27 years;
- time to certify a node's stake >= theta from the count of attributable
observations (relative precision ~1/sqrt(N)): sizing a node costs 100-400x
more than identifying it, and sub-0.1% stake is practically unlearnable.
Both are closed forms over the exact deanonymization rates and a
stake-proportional 30 s emission cadence, checked against a Monte-Carlo of
the emission process in verify.
Messaging redundancy (R independent cascades per emission, R = 1..4):
- `redundancy` knob threaded through config/rng/propagation/engine/metrics/
sweep; a node receives from whichever cascade reaches it first, so arrival
times combine element-wise. Delivery and capture both follow 1-(1-x)^R, so
redundancy trades reliability against anonymity and divides time-to-link
by ~R. Measured: delivery 0.34 -> 0.81 at 30% churn for R = 1 -> 4, while a
1%-staker's time to link falls 10 d -> 2.5 d.
- Redundancy buys NO coverage: a cascade only delivers if the sender could
already route to its relay, so every delivered cascade floods the sender's
own component. Coverage is flat in R to four decimals at every degree.
- Near the percolation threshold the cascades fail together rather than
independently, so redundancy under-delivers against 1-(1-p1)^R there.
Churn percolation (configs/percolation.yaml, verify check 7):
- the flood only crosses responsive nodes, so it lives on the responsive
sub-graph -- site percolation on a d-regular graph. A network survives churn
only up to u_c = 1 - 1/(degree-1); measured collapse lands on the predicted
threshold for every degree (3 -> 0.50, 6 -> 0.80, 16 -> 0.93), which inverts
into the sizing rule degree > 1 + 1/(1-u).
Correctness fixes:
- redundancy delay used the fastest cascade's own full delay, which
over-states it (min-max vs max-min); now the element-wise earliest arrival,
reducing exactly to the single-cascade model at R = 1 (test);
- the "redundancy improves coverage" claim was false in both the report and
the simulator README -- removed and replaced with the measured result;
- per-hop latency is degree-dependent (1.5 s at degree 16 to 2.7 s at degree
3), not a flat 1.6 s; and the worst-case observation figure was averaged
over degrees -- at degree 8 and f_adv = 0.2 it is 0.83 -> 1.000.
Statistics: round counts raised for resolution rather than speed -- 8000
rounds per cell in the main sweep, 9600 in the redundancy study, 6400 in the
percolation study, giving SEM <= 0.009 on every delivery rate and <= 0.04 s
on every delay mean. The previous redundancy grid (144 rounds/cell) produced a
non-monotonic delivery curve; it is now monotonic and within 0.015 of theory.
Adversary and deanonymization metrics remain closed-form and exact.
reports/blend/pd: the report of record -- peering-degree trade-offs across
speed, observation, eclipse, deanonymization and reliability, plus the
time-to-link, stake-inference, redundancy and churn-threshold sections, with
21 figures of record and an explicit sampling-error statement.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-04 22:37:22 +02:00
|
|
|
capture_prob,
|
|
|
|
|
obs_for_precision,
|
|
|
|
|
redundant,
|
|
|
|
|
stake_rel_precision,
|
|
|
|
|
time_to_link_seconds,
|
|
|
|
|
time_to_stake_seconds,
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_redundant_values_and_bounds():
|
|
|
|
|
assert abs(redundant(0.1, 1) - 0.1) < 1e-12
|
|
|
|
|
assert abs(redundant(0.1, 2) - 0.19) < 1e-12
|
|
|
|
|
assert redundant(0.0, 4) == 0.0
|
|
|
|
|
assert redundant(1.0, 3) == 1.0
|
|
|
|
|
# strictly increasing in R for 0 < x < 1
|
|
|
|
|
vals = [redundant(0.2, R) for R in (1, 2, 3, 4)]
|
|
|
|
|
assert all(b > a for a, b in zip(vals, vals[1:], strict=False))
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_capture_prob_linkable_vs_population():
|
|
|
|
|
d1 = 0.2 ** 3
|
|
|
|
|
assert abs(capture_prob(d1, 1.0, 1) - d1) < 1e-12 # linkable, single cascade
|
|
|
|
|
assert abs(capture_prob(d1, 0.5, 1) - 0.5 * d1) < 1e-12
|
|
|
|
|
assert abs(capture_prob(d1, 1.0, 2) - (1 - (1 - d1) ** 2)) < 1e-12
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_time_to_link_matches_geometric_definition():
|
|
|
|
|
p, alpha, slot = 0.02, 0.9, 30.0
|
|
|
|
|
q = p / 0.01 # stake=0.01 -> s*q = p
|
|
|
|
|
t = time_to_link_seconds(0.01, q, alpha, slot)
|
|
|
|
|
n = round(t / slot)
|
|
|
|
|
assert 1 - (1 - p) ** n >= alpha - 1e-12
|
|
|
|
|
assert 1 - (1 - p) ** (n - 1) < alpha
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_time_to_link_scales_inverse_stake():
|
|
|
|
|
q, alpha = 0.01, 0.9
|
|
|
|
|
t1 = time_to_link_seconds(0.01, q, alpha)
|
|
|
|
|
t2 = time_to_link_seconds(0.005, q, alpha)
|
|
|
|
|
assert abs(t2 / t1 - 2.0) < 0.02 # halving stake ~doubles the time
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_time_to_link_unlinkable_is_infinite():
|
|
|
|
|
assert time_to_link_seconds(0.05, 0.0, 0.9) == math.inf
|
|
|
|
|
assert time_to_stake_seconds(0.01, 0.0, 100) == math.inf
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_redundancy_cuts_time_by_about_R():
|
|
|
|
|
d1, s, alpha = 0.2 ** 3, 0.01, 0.9 # small d1 -> q_R ~ R*d1
|
|
|
|
|
t1 = time_to_link_seconds(s, capture_prob(d1, 1.0, 1), alpha)
|
|
|
|
|
t4 = time_to_link_seconds(s, capture_prob(d1, 1.0, 4), alpha)
|
|
|
|
|
assert 3.5 < t1 / t4 < 4.0 # ~4x faster with R=4
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_time_to_stake_scaling():
|
|
|
|
|
q = 0.008
|
|
|
|
|
lin = time_to_stake_seconds(0.01, q, 200) / time_to_stake_seconds(0.01, q, 100)
|
|
|
|
|
assert abs(lin - 2) < 1e-9 # linear in n_obs
|
|
|
|
|
inv = time_to_stake_seconds(0.001, q, 100) / time_to_stake_seconds(0.01, q, 100)
|
|
|
|
|
assert abs(inv - 10) < 1e-9 # inverse in threshold
|
|
|
|
|
assert abs(time_to_stake_seconds(0.05, q, 100) - 100 / (0.05 * q) * 30) < 1e-6
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_obs_for_precision_and_precision():
|
|
|
|
|
assert obs_for_precision(0.1) == 100
|
|
|
|
|
assert obs_for_precision(0.05) == 400
|
|
|
|
|
assert obs_for_precision(0.5) == 4
|
|
|
|
|
assert abs(stake_rel_precision(100) - 0.1) < 1e-12
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def test_time_to_link_matches_simulation():
|
|
|
|
|
"""Empirical alpha-quantile of the first-observation slot matches the closed form."""
|
|
|
|
|
s, q, alpha = 0.02, 0.05, 0.9 # p = s*q = 1e-3
|
|
|
|
|
rng = np.random.default_rng(7)
|
|
|
|
|
first = rng.geometric(s * q, size=300_000) # slots until first success, support {1,2,...}
|
|
|
|
|
emp_slots = float(np.quantile(first, alpha))
|
|
|
|
|
closed_slots = time_to_link_seconds(s, q, alpha) / 30.0
|
|
|
|
|
assert abs(emp_slots - closed_slots) / closed_slots < 0.02
|