Detection & tolerances

Measured float32 drift across reduction orders (relative drift is Cauchy-tailed, state-level drift is a few ulps), a Merkle-committed training trace with a teacher-forced referee, and the finding that a per-step tolerance is a cumulative hidden-deviation budget while bitwise-reproducible operators remove it.

A conformal tolerance (the k-th order statistic of n honest drift scores) has an exact, distribution-free false-slash rate (n+1−k)/(n+1) — but only 51–56% of calibration sets deliver a rate ≤ α. A PAC-safe tolerance exists iff n ≥ ln δ/ln(1−α) (459 runs at 1%/1%), and its margin is hiding room for a cheater: the threshold sits 1.26× above the true quantile at n=2000 on Pareto-3 drift. Gaussian plug-in tolerances over-slash skewed drift up to 17×; pooling calibration across mixed hardware slashes the noisy class 4.8× too often and lets the quiet class hide 2.9× more.

Giving each of L layers its own tolerance lets a prover hide the sum of them: L·c(L,α)σ versus z_α√Lσ for one test on the total, 6.6× more at L=16 and 23× at L=128. The sum test’s power depends only on the total shift; the exact (Šidák) max test’s depends on how it is spread, the prover’s best split is even (log Φ is concave), and the max test catches a 2.7σ one-layer shift half the time but lets 16σ through spread over all 16 layers. A union of both at α/2 caps the hidden budget at the sum test’s (7.8σ) while keeping one-layer sensitivity. Gaussian, independent layers, known σ.

Checking a claimed matrix product by A(Br) ≈ Cr needs a tolerance t, so the error bound becomes size-dependent: a rank-one corruption of Frobenius norm F is missed by a Gaussian probe with probability exactly erf(t/(√2F)), rank one is the worst case for fixed F, and m probes give erf^m (4 probes for 1% at 3t). Rademacher probes miss a two-entry corruption with probability ½ at every size. Emulated float32 noise grows ≈n^0.9; a hashed probe with free retries lets a cheater grind in 1/erf tries (125 at 100t). Stylised, additive corruption.

If a worker paid for T steps runs only (1−f)T, the verifier’s log-loss test (null sd σ′, level α) hides exactly the compute at which the loss curve, inverted, crosses the noise band: L((1−f*)T) = L(T)e^{σ′(z_α+z_P). For a power law with a loss floor this is closed form and grows as the reducible share r falls (6% at r=1 but 64% at r=0.05 for σ′=0.02). Run-to-run seed noise is a floor that no evaluation size removes: with 2% seed noise a 5% cap is unreachable for r ≥ 0.05, while without it 104 to 4×106 eval samples suffice. On exactly solvable quadratic GD the predicted detection probability matches simulation within 1.5 points, and the loss test is worth only about 4.4 random step audits at best (0.16 once training is floor-dominated). Stylised: one statistic, normal approximation, known curve family.}

A decentralised inference provider substitutes a cheaper model on a random fraction p of queries; a verifier re-scores a fraction f under an anytime-valid mixture e-process. Detection delay scales as 1/(f p² χ²), so the profitable attack is a slow leak: undetected savings grow as √N rather than N (measured ×7.75 for ×64 queries). Closed-form audit rate to cap theft, cost-optimal check rate (hK/2Nc)^2/3, and a substitute close enough to the claimed model that even checking every response cannot cap the theft. Seeded Monte Carlo. Stylised.

Anytime-valid slashing of miscalibrated verifiers with e-processes: repeatedly re-running a z-test falsely slashes 37% of honest verifiers at nominal 5%, the likelihood-ratio e-process stays under α by Ville’s inequality, detection delay tracks ln(1/α)/KL within 12% (logarithmic in 1/α), and not knowing the cheating rate costs a factor 1.36. Stylised.

For fixed reports r_A, r_B and binary outcomes with frequency q, the Brier difference is a two-point gamble and A is better exactly when q is on A’s side of the midpoint π=(r_A+r_B)/2. Betting a fraction λ of wealth on it gives an anytime-valid e-process whose best bet grows at exactly KL(q‖π), so the expected decision time is ln(1/α)/KL. A z-test checked after every task falsely declares a winner in 19–38% of null runs at nominal 5%; a uniform mixture over bets stays at or below 3.8% and costs 15–41% extra tasks; a bet twice too large has negative growth. Fixed reports, i.i.d. outcomes. Stylised.

Under Brier loss the best verifier is the one whose report is closest to the outcome frequency q, and each pair has an anytime-valid betting e-process growing at KL(q‖midpoint). Certifying the leader means beating every rival, so the delay is ln(1/α) over the smallest such rate, which belongs to the rival whose midpoint with the leader is nearest q: the best rival on the opposite side of q, not the runner-up (rate 0.0026 against 0.0086 in a six-verifier league). A bet mixture certifies within 1.35–1.60× of the oracle prediction; successive elimination cuts verifier evaluations 4cuts evaluation cost 2–4× at n=8–12ndash;5× at n=8–12; a peeking z-test declares a false strict best in 59% of exact-tie runs against 1.6% for the e-process. Stylised: fixed reports, i.i.d. tasks.

Mean, median and trimmed-mean aggregation of verifier reports under a Byzantine fraction β: mean bias βB is unbounded, median bias σΦ⁻¹(1/(2(1−β))) is independent of B and diverges at β=½, trimmed-mean closed form for τ≥β matches simulation, and trimming below β fails. Stylised.

Extends the forgetting law to a trainer that skips each task with probability s or takes a step fraction a: the final-checkpoint loss on the task at position t is exactly ρ^t−1[(1−2m₁+m₂)(r/d)λ^k + (r/d)ρ(ρ^k−λ^k)], matching exact quadrature and simulation. A skipped task is at least d/(d−r) times worse than a trained one at every lag but clearly so only in a window (ratio ≥2 for lags ≤6.7 at d=16, r=2). Catching a skipping trainer is lag-free: about 17–20 jobs for 20% skipping at any audit lag, scaling as 0.7/s² and falling with job length, while a 10% step shortfall needs about 9,600 jobs. Stylised: linear regression, Haar-random tasks, known initial error.

Mutual radar interference between robots, with heavy-tailed c/d² interferer power hitting each frame intermittently. Per-frame detection probability has a closed form (matches Monte Carlo within 0.003); real Pd plateaus at the probability that no interferer hits the frame (0.656) rather than shrinking in range. A mean-noise-rise twin is 9% optimistic at Pd ≥ 0.9 (63.7 vs 58.4 m) but badly pessimistic for missions that tolerate hit frames (Brier 0.690 vs 0.003 for 3-of-10); for 9-of-10 missions knowing the interferer geometry helps (0.089 vs 0.101). Stylised: simulated interference, illustrative parameters, no radar data.

WNTR simulates EPANET’s Net3 for 72 hours at demand multipliers 1 to 3 under the default demand-driven model and the pressure-driven model (required pressure 15 m, 10 and 25 m swept), with a leak of 2 % of mean demand at 30 seeded junctions read at five sensors. At 1 and 1.25 times base demand the two models agree to the three decimals printed; at 1.5 times the median sensor drop is 0.798 m against 0.792 m and 29 of 30 locations are seen by both. At 2 and 3 times the pumps run past their rated flow, the demand-driven run has 60–91 % of junction-hours below 0 m (down to −458 m) and the leak passes no flow, while the pressure-driven run serves 86 % and 62 % of demand and still sits below the required pressure over half the time, so neither is believable there. Hence the conclusions of the earlier detector study, drawn at base demand, do not depend on the demand model. Limits: one textbook network whose low-pressure nodes are mostly zero-demand, noise-free sensor response only (no detectors or false-alarm budget), assumed required pressure, 30 locations and one leak size.

WNTR simulates one week of hourly pressures on EPANET’s Net3 (92 junctions) with leaks of 0.25–4 % of mean demand (1.7–28 L/s) opened at hour 96 at 60 random junctions, against a nominal model whose demands are wrong (node error sd 5–20 %, system-wide AR(1) error sd 1–5 %) and sensors with noise 0.05–1 m. A moving-average threshold, CUSUM and PELT (changepoint) each get a threshold calibrated on 120 leak-free weeks to at most 5 % of weeks with any alarm, with and without a regression on a noisy inflow meter. With 5 greedily placed sensors and base demand error, the best detector (flow-adjusted CUSUM) finds 100 % of the leaks the sensors can see (28 % of locations) at 4 % of demand but only 8 % at 1 % and 85 % at 2 %, and across all leak locations 3 % at 1 % and 38 % at 4 %. Demand error moves the result far more than sensor noise (covered 2 % leaks: 92 % at low demand error, 85 % at base, 8 % at high), and averaging 15 sensors instead of 5 hurts. PELT did not beat CUSUM on 2 % leaks in any condition at the same false-alarm budget. Limits: the BattLeDIM L-Town network and its leak schedule could not be downloaded here, so there is no comparison with the competition’s methods; Net3 is a textbook network; leaks are simulated, demand error and inflow-meter noise (0.5 %) are assumed and swept, not measured; 60 locations per size, so rates carry binomial error of up to ±0.12.