reports/blend: section 3.11, timing

Prices two ways of delaying at a matched latency budget: the free-running clock
(batch at the tick) against an independent per-message draw. Measured by the
effective anonymity set of a release, and by MAP success -- how often the
observer single best guess is right -- because perplexity flatters a heavy tail.

The dominant result is that at the specified cover rate timing linkage is
essentially total under BOTH designs: the best guess is right 98-99% of the time.
That follows directly from the mixing~0 result of 3.10 -- a relay holds about one
message, and delay cannot manufacture ambiguity out of one message. Traffic buys
timing protection; delay does not.

Between designs the independent draw wins at equal cost, against the intuition
that batching should be safer: a tick is a hard boundary the observer can exclude
behind, whereas an exponential never excludes anything outright. But the margin is
a third of what the set size suggests (68% larger set, 19% better against the best
guess), so perplexity alone would have overstated the case for Poisson-style
mixing threefold.

A minimum release interval changes nothing, structurally: a zero-length gap is
instantaneous, so it never covers an arrival and is never sampled.

Section 5 updated -- the timing caveat is discharged, and the structural results
are now flagged as an upper bound on the anonymity a deployment actually gets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

reports/blend/README.md

@@ -43,6 +43,8 @@ A node's exposure is not only *whether* it is deanonymized but *how soon*: if ea
 
 8. **Cover traffic buys uniform emission counts, and almost nothing else for free.** Every node emits equally often whether or not it produces blocks, which hides block production in the emission *count*. But per-relay **mixing never happens** — at one message per second a relay holds 0.0014 messages, and even 256× the rate only reaches 0.39 — so the anonymity set is entirely **blending**, the broadcasts a relay saw between releases, which is `rate·(2M+1)/3`. Delay is the cheap lever: an anonymity set of 100 costs 42.9 msg/s at a 3 s release delay but 4.9 msg/s at 30 s. And the guarantee has a hard edge: a node's proposals must fit its emission quota, capping stake at `α_max = ln(1−q)/ln(1−f)` of *inferred* stake — about 0.1 % at the baseline rate, so a 9.5 % holder overruns by ~65× and is distinguishable by emission count alone (§3.10).
 
+9. **Timing linkage is total at the specified rate, whichever way you delay.** A relay that holds and re-emits leaves a timing signature; matching the outgoing message to the incoming one links both ends of a hop. At one message per second the observer's best guess is right **98–99 %** of the time under both designs tested — because a relay holds ~one message, and delay cannot manufacture ambiguity out of one message. Raising the rate is the only thing that helps. Between designs, an independent per-message draw beats batching at a clock tick at equal latency (MAP success 0.55 against 0.68 at 64 msg/s), because a tick is a hard boundary the observer can exclude behind — but the advantage is a third of what the anonymity-set number alone suggests (§3.11).
+
 **The tension, in one line.** Axes 1, 2-eclipse, and 4 all want *more* degree; axis 2-observation and axis 3-full-deanonymization want *less*. Because whole-path deanonymization (axis 3) depends only on the blend-path length, the resolution is to raise the degree to where speed, eclipse, and churn saturate (6–8) and to control anonymity independently through the number of blend hops. Messaging redundancy (finding 6) does not escape the trade — it moves reliability and anonymity together, never apart — and time itself is an axis: exposure is a rate, and a high-stake node accumulates it fastest (finding 5).
 
 *Method note: the peer graph is a deterministic, exactly d-regular matching-union reconstructible from one seed; the adversary observation/eclipse counts and both deanonymization rates are computed in closed form, so they carry no sampling error at any N; propagation delays are Monte-Carlo over random senders (1 000 rounds × 8 topologies = 8 000 rounds per cell; see §5 for the resulting error bars). Delays fold a geographic link base (15–200 ms), an exponential transport jitter, and a per-node processing lag ({10, 50, 100} ms); mixing is the residual wait to a relay's next free-running release on a Uniform{0…3}-second clock.*
@@ -380,6 +382,33 @@ Because `s_max` is expressed against `D̂`, an estimator that runs low tightens
 ![Fig 24 — the emission-quota stake ceiling](report-figures/24_quota_stake_ceiling.png)
 *Fig 24 — The most stake a node can hold and still emit like everyone else, against cover rate: predicted ceiling, the 99 %-safe ceiling, the measured transition band, and the largest staker actually present.*
 
+<a id="s3-11"></a>
+### 3.11 Timing — can an observer tell a blended message from a relayed one?
+
+§3.10 leaves an obvious opening. A blend relay holds a message and re-emits it; a node merely forwarding one passes it straight through. If the delay is visible, so is the relay's role — and matching an outgoing message back to the incoming one links the two ends of a hop. This section prices two ways of delaying, at a **matched latency budget** so they differ only in *how* they delay:
+
+- **clock** — the free-running tick of §2: everything held is released together at the next tick.
+- **jitter** — each message waits its own independent draw, with the same mean as the clock's residual.
+
+The measure is the **effective anonymity set** of a release: the perplexity of the observer's posterior over which arrival produced it. Alongside it sits **MAP success** — how often the observer's single best guess is right — because perplexity flatters a heavy tail. An exponential delay never fully excludes an old arrival, so it can look unlinkable while still being guessed correctly; this is the "Poisson mixing is praised but never really proven" worry, made measurable.
+
+| rate (msg/s) | design | mean hold | effective set | linked | **MAP success** |
+|---|---|---|---|---|---|
+| 1 | clock | 10.4 s | 1.02 | 0.985 | **0.992** |
+| 1 | jitter | 9.8 s | 1.05 | 0.958 | **0.983** |
+| 16 | clock | 10.2 s | 1.23 | 0.811 | 0.900 |
+| 16 | jitter | 10.2 s | 1.57 | 0.554 | 0.830 |
+| 64 | clock | 10.2 s | 1.97 | 0.468 | 0.678 |
+| 64 | jitter | 10.1 s | 3.27 | 0.097 | **0.553** |
+
+**At the specified cover rate, timing linkage is essentially total under either design** — the adversary's best guess is right 98–99 % of the time. That is the direct consequence of §3.10's result that a relay holds 0.0014 messages: with one message per relay there is nothing to confuse it with, and no amount of delay manufactures ambiguity out of a single message. **Traffic buys timing protection; delay does not.**
+
+Between the two designs, **the independent draw wins at equal cost**, contrary to the intuition that batching at a tick should be safer. The clock's tick is a *hard boundary*: the observer can exclude everything before the previous tick, so the candidate set is exactly one inter-tick batch. An exponential has unbounded support and never excludes anything outright. But the margin is much smaller than the set size suggests — at 64 msg/s jitter's effective set is **68 %** larger while its advantage in defeating the best guess is only **19 %**. The heavy tail keeps old arrivals nominally possible while contributing almost nothing, so **perplexity alone would have overstated the case for Poisson-style mixing by roughly a factor of three.**
+
+One objection needs disposing of: the clock figures above hand the observer the *tick schedule*, which is the conservative assumption but also the harsher one, since a real observer sees only ticks that released something. Measured both ways, it makes **no difference at all** — and provably so. A silent tick implies nothing was pending at it, and any arrival older than the previous release has already left, so the window bounded by the true previous tick and the window bounded by the last observed release contain the same arrivals. The clock design is not being handicapped by a generous adversary.
+
+**A minimum release interval changes nothing.** Forbidding zero-length intervals (`min_blend_delay = 1`) leaves the mean hold at 10.1 s against 10.4 s, and the effective set, linkage and MAP success are identical to three decimals. This is structural rather than a null measurement: a zero-length gap is instantaneous, so it can never cover a message arrival and is never drawn by the residual or by the size-biased interval. Excluding it removes probability mass that was never sampled. What it *does* change is `E[S]`, the spacing of release opportunities — so a minimum would matter under per-message jitter, where a zero draw is a genuinely unmixed forward, but under a free-running clock it buys nothing.
+
 ---
 
 <a id="s4"></a>
@@ -401,7 +430,7 @@ Because `s_max` is expressed against `D̂`, an estimator that runs low tightens
 ## 5. Validity and caveats
 
 - **Attribution confidence is bracketed, not settled.** §3.4 gives two readings of the same event: `full_deanon` (any adversarial peer counts as identification) and the confidence-weighted rate (only the sender's own links count as evidence). The first is an upper bound on adversary capability, the second a lower bound, and at `f_adv = 0.2`, degree 8 they differ by five orders of magnitude. The truth lies between, because an adversary also learns from the sender's *neighbourhood* — an honest peer with adversarial peers of its own leaks the message upstream, and with `observed_frac` at 0.83 most honest relays are themselves watched. Resolving that needs a k-hop observability model rather than the 1-hop one used here; until it exists, design against the upper bound and read the lower bound as the floor.
-- **Structural adversary; timing correlation is the next study, and is blocked on cover traffic.** The adversary is modelled as controlling *nodes* and their peerings: it observes messages traversing relays it owns (deanonymization) and honest nodes it peers (observation). It does **not** perform timing or traffic-analysis correlation across honest relays. That is not an oversight but a sequencing constraint — a timing adversary is only meaningful against a network that emits **cover traffic**. With §3.10 that prerequisite is now in place, so the timing study is unblocked and is the next piece of work rather than a deferred one. It has a specific target: distinguishing a *relayed* message from a *blended* one by when it leaves a relay, and deciding between adding random jitter to the release and holding messages to a clock tick so they leave alongside blended traffic. §3.10 already supplies the reason to expect that comparison to be sharp — a relay holds 0.0014 messages on average, so a release almost never coincides with another, and timing carries essentially no cover of its own. An adversary that adaptively targets the transport path of a *specific* known sender is likewise outside the current model.
+- **Structural adversary; timing correlation is the next study, and is blocked on cover traffic.** The adversary is modelled as controlling *nodes* and their peerings: it observes messages traversing relays it owns (deanonymization) and honest nodes it peers (observation). It does **not** perform timing or traffic-analysis correlation across honest relays. That is not an oversight but a sequencing constraint — a timing adversary is only meaningful against a network that emits **cover traffic**. With §3.10 that prerequisite in place, the timing study is now done and reported in §3.11: at the specified cover rate a relay's in-to-out matching is essentially forced under either release design, so the structural results above should be read as an upper bound on the anonymity a deployment actually gets. What remains outside the model is an adversary correlating timing *across* relays rather than at one, and one that combines timing with the structural evidence of §3.4. An adversary that adaptively targets the transport path of a *specific* known sender is likewise outside the current model.
 - **Churn is modelled both ways; adversarial churn is not.** §3.5 removes nodes independently and §3.9 removes whole AS/region failure domains, at matched churn — and the correlated case turns out to be *gentler* on the live network, so the uncorrelated threshold is the conservative one. What remains outside the model is **adversarially placed** churn: an attacker who chooses which nodes to silence (a cut set rather than a random or clustered set) would be worse than either, and the worst-case placement machinery used for the adversary in §3.3 has no counterpart here. Regional churn also assumes equal-sized domains; real AS sizes are heavy-tailed, so a single dominant provider failing would remove a larger, less uniform slice than modelled.
 - **Exactly d-regular topology — by design, not by simplification.** Every node has exactly the same number of peers because the protocol requires it: the peer graph is derived by every node from one global seed, so the degree is a protocol constant rather than an emergent property. This is the topology the deployed network will have, so the results are not an idealisation of some heavier-tailed reality — a degree *distribution* would be a different protocol, not a more realistic model of this one.
 - **Sampled propagation, exact structure — and what each is worth.** Only the propagation quantities are sampled: they are Monte-Carlo over **1 000 rounds × 8 independent topologies = 8 000 rounds per cell**, which puts the standard error at **≤ 0.009 on every delivery rate**, **≤ 0.001 on every coverage figure** (bar the critical cell below), and **≤ 0.04 s on every full-delay mean** (the redundancy study uses 1 200 × 8 = 9 600 rounds per cell, SEM ≤ 0.006, and the churn-threshold study 800 × 8 = 6 400). That is a digit finer than the tables quote, so the reported two-decimal rates and 0.1-second delays are resolved rather than sampling noise; error bars were computed across topologies, which captures graph-to-graph variation as well as round-to-round. Everything else — the graph invariants, the observation and eclipse counts, both deanonymization rates, and therefore all of §3.6–§3.8's derived times — is closed-form and carries **no sampling error at all** at any N. The worst-case adversary placement is a greedy envelope characterized at N ≤ 10⁵.
@@ -423,4 +452,4 @@ The **evidence** is checked in too: [`data/`](data) holds the sweep outputs behi
 
 ## Figures
 
-All twenty-four rendered figures are versioned in [`report-figures/`](report-figures): `01`–`03` propagation delay (vs degree, vs path length, vs N); `04`–`09` adversary observation and eclipse (vs `f_adv`, vs degree, and heatmaps); `10`–`11` reliability under churn (delivery and coverage); `12`–`15` deanonymization (whole-path and full, vs path length, `f_adv`, and degree); `16`–`18` linkability over time (time to link vs stake, with redundancy, and time to learn stake vs threshold); `19` the redundancy reliability-vs-anonymity trade-off in probability and `21` the same trade in delivery-vs-time-to-link; `20` the churn-percolation threshold; `22` correlated versus uniform outages; `23`–`24` cover traffic (the anonymity set against rate and delay, and the emission-quota stake ceiling). Eighteen of the twenty-four are embedded above; the other six (`04`–`06`, `09`, `11`, `13`) are alternative cuts of data already shown — for instance 11 and 20 both plot coverage against churn, and 20 supersedes 11 by walking the churn past every degree's threshold.
+All twenty-four rendered figures are versioned in [`report-figures/`](report-figures): `01`–`03` propagation delay (vs degree, vs path length, vs N); `04`–`09` adversary observation and eclipse (vs `f_adv`, vs degree, and heatmaps); `10`–`11` reliability under churn (delivery and coverage); `12`–`15` deanonymization (whole-path and full, vs path length, `f_adv`, and degree); `16`–`18` linkability over time (time to link vs stake, with redundancy, and time to learn stake vs threshold); `19` the redundancy reliability-vs-anonymity trade-off in probability and `21` the same trade in delivery-vs-time-to-link; `20` the churn-percolation threshold; `22` correlated versus uniform outages; `23`–`24` cover traffic (the anonymity set against rate and delay, and the emission-quota stake ceiling). §3.11's timing results are tabulated rather than plotted. Eighteen of the twenty-four are embedded above; the other six (`04`–`06`, `09`, `11`, `13`) are alternative cuts of data already shown — for instance 11 and 20 both plot coverage against churn, and 20 supersedes 11 by walking the churn past every degree's threshold.