What is the cheapest payment-and-audit protocol that makes honest ML training an equilibrium?

2026-10-31 · Milestone 53: does a progress check (loss on a verifier-held batch every N steps) close the liveness hole that norm checks leave? (H4/H3 link, planned before running)

• Why: milestone 52's "Next". Magnitude checks on submitted updates have no lower bound on progress: a stalling worker (zero step) passes every norm check, and a reversed-step cheater inside C = 1.5 harms every job at T = 200. Design (experiments/progress_check/run.py, protocol of 52: d = 32, 4 seeds, 600 steps, leave-one-seed-out calibration): every N = 10 steps the verifier evaluates the submitted weights on its own fixed batch of 256 training-distribution windows (cost: a forward pass over 256 windows every 10 steps, against a forward and backward pass over 32 windows each step, so roughly 256/(10323) = 27% of training compute by a crude count; stated, not measured). It flags if loss exceeds R x the largest loss any other seed shows at that eval point (R = 1.05, plus a window of +-1 eval point). Adversaries, each T consecutive steps from a random t0: stall (submit no step) and ascent (largest scale passing the per-step C = 1.5 norm check, as 50 to 52). Neither knows the progress check (non-adaptive; an adaptive cheater is the next step). n = 20 shared draws per cell, T = 10, 50, 200. Reported: honest false-flag rate per eval point, share of jobs flagged at least once during or after the window (up to the end of training), mean evals until first flag, and harm among unflagged jobs (|dL| > 0.01 on the separate held-out set).
• Predictions, before running: (1) honest false flags under 2% of eval points at R = 1.05. (2) ascent is flagged in at least 90% of jobs at T = 50 and 100% at T = 200 (a reversed step raises the loss at once). (3) stall at T = 200 is flagged in at least 80% of jobs, but at T = 10 in under 30% (a 10-step stall costs less than seed-to-seed spread, so the check cannot see it, and it should not matter). (4) Harm among unflagged jobs is under 0.15 for every cell (what escapes is what does not hurt). Refuted (2) if ascent at T = 50 is flagged in under 60% of jobs: then loss on a verifier batch is too noisy at this scale and only replication closes the gap.
• Limits known in advance: verifier batch drawn from the training distribution (a verifier with held-out data of the right distribution; if the buyer has none, this fails); threshold calibrated on same-recipe seeds; non-adaptive adversaries; one tiny model; n = 20 gives about +-0.2; the flag time is measured at eval points only.

### Outcome of 53 (experiments/progress_check/: run.py, results.txt, results.json, run.out, smoke_n4.out (n = 4 smoke run, not a result); n = 20 per cell)

• Honest eval points flagged: 0 of 240 (R = 1.05, N = 10).
• ascent, harmful / flagged by window end / unflagged-but-harmful, T = 10, 50, 200: 7 / 11 / 0, 13 / 18 / 1, 20 / 20 / 0 (all of 20). Median evals to first flag 0 in every cell (flagged at the first eval after the window starts).
• stall, same order: 0 / 0 / 0, 8 / 1 / 7, 20 / 6 / 14. Median |dL| 0.0014, 0.0071, 0.0375.
• (1) held (0%). (2) held: ascent flagged in 18 of 20 (0.90, exactly at my line) at T = 50 and 20 of 20 at T = 200. (3) half refuted: stall at T = 10 is flagged in 0 of 20 (held), but at T = 200 only 6 of 20 (0.30), not 0.80: refuted. (4) refuted: 7 of 19 unflagged stall jobs at T = 50 and 14 of 14 at T = 200 are harmful.
• Reading: a loss check on a verifier batch is a good detector of the reversed step (flagged at the first eval, so the cheater is caught in 10 steps and could be stopped before it accumulates harm) and a poor detector of stalling. A stall of 200 of 600 steps costs 0.04 of held-out loss (every job harmed) while the verifier loss stays within 5% of the largest honest value in 14 of 20 jobs: the tolerance needed to keep honest false flags at zero over four seeds is wider than the cost of lost progress. So the liveness hole is only half closed: a progress check bounds active sabotage, and the remaining defect is a lazy worker, which is a pricing problem (the audit/contract of milestones 4 to 6) rather than a detection one.
• Limits: as stated before the run, plus: R = 1.05 was one point and chosen before looking, a tighter R would catch more stalls and has no measured false-flag price here (0 of 240 at 1.05 means the honest spread is smaller than that, so R below 1.05 is untested rather than ruled out); the stall was judged against the largest of three other seeds, which sets the scale; the ascent adversary at C = 1.5 shrinks its scale late (milestone 52), so the later-T rows do not show a large permitted ascent; adversaries are non-adaptive to the progress check; compute cost of the check (about 27% by crude count) not measured.
• Next: sweep R (1.00 to 1.05) to price false flags against stall detection; an adaptive cheater that ascends only until the verifier loss reaches the threshold; paper H4 paragraph gains milestones 43 to 53.

2026-10-30 · Milestone 51: what does the check factor C buy against a reversed-SGD-step cheater who stays inside it for T steps? (H4/H3 link, planned before running)

• Why: milestone 50's "Next". At C = 1.5 the ascent cheater harmed 40% / 75% / 100% of jobs at T = 10 / 50 / 200. Design (experiments/c_sweep/run.py): the milestone 50 protocol, ascent attack only, C = 1.1, 1.25, 1.5, 2.0 with per-step thresholds, T = 10, 50, 200, n = 20 shared draws per cell (a different draw seed, 51, from 50); the ascent scale is now 0.999 of the largest passing one so no step is flagged by rounding (milestone 50's boundary artefact). A 5-draw smoke run at scale 0.25 ran first (kept as smoke.out, not a result).
• Predictions, before the full run: (1) honest false positives rise as C falls: under 1% at C >= 1.5, and at least 1% (0.0100) at C = 1.1. (2) Harm at T = 200 stays at least 0.80 at C = 1.1 (the cheater's step norm still equals an honest step's norm; the harm comes from the sign, not the size). (3) Harm at T = 50 changes by no more than 0.25 between C = 1.1 and C = 2.0 (the norm bound is not the lever). (4) No attack step is flagged. Refuted (2) if harm at T = 200 and C = 1.1 is under 0.50: then a tight norm check does bound a persistent cheater.
• Limits known in advance: same tiny model, K irrelevant to ascent; thresholds calibrated on same-recipe seeds; n = 20 gives about +-0.2; the harm threshold 0.01 is near the median |dL| at T = 10 and 50.

2026-10-30 · Milestone 52 (run alongside a sibling's 51, experiments/c_sweep/; its C sweep overlaps mine, the cumulative check is new): what does tightening C buy against the reversed-step cheater, and does a cumulative (windowed-sum) check close the accumulation? (H4/H3 link, planned before running)

• Why: milestone 50's "Next". A per-step aggregate check stops a one-shot plant but a cheater inside it every step accumulates harm (ascent: 0.40, 0.75, 1.00 harmful at T = 10, 50, 200 for C = 1.5). Design (experiments/c_sweep_cum/run.py): same protocol as 50 (d = 32, 4 seeds, leave-one-seed-out per-step thresholds, harm |dL| > 0.01). Only the ascent adversary. Check 1: per-step C = 1.1, 1.25, 1.5, 2.0 (honest false-flag rate and harm vs T = 10, 50, 200, n = 20 shared draws). Check 2: C = 1.5 plus a cumulative check, the L2 norm of the sum of the last 50 submitted steps at most 1.5 x the honest maximum of that sum (+-5 step window, other seeds); the adversary bisects its scale until both pass.
• Predictions, before running: (1) honest false-flag rate rises as C falls: at C = 1.1 above 2% of steps, at C = 2.0 under 0.5%. (2) Harm at T = 200 falls monotonically with C but is still at least 0.50 at C = 1.1 (the check cannot be tightened to honest level without false positives, and a reversed step at 1.1x is still a reversal). (3) The cumulative check cuts harm at T = 50 to at most 0.30 and at T = 200 to at most 0.50 (honest sums over 50 steps are large and noisy, so the check is loose, but the adversary's sum is aligned). Refuted (3) if cum harm at T = 200 is at least 0.80: then windowed sums are not enough and only a replicated checkpoint closes the gap.
• Limits known in advance: thresholds calibrated on same-recipe seeds; one model; one window W = 50; the adversary is the first-order reversed-step attack only; n = 20 gives about +-0.2; the harm threshold 0.01 is near the median |dL| at T = 50.

### Outcome of 52 (experiments/c_sweep_cum/: run.py, results.txt, results.json, run.out; n = 20 per cell, ascent adversary)

• Replication: the per-step C sweep here reproduces the sibling experiments/c_sweep/ (same milestone, run concurrently, different code path) to within 0.01 in |dL| and identically in harmful counts for C = 1.1 to 1.5; the cumulative-check rows are new.
• Honest steps flagged (2400): C = 1.10, 1.25, 1.50, 2.00 give 3.33%, 1.54%, 0.46%, 0.17% per-step; the added cumulative check (W = 50, C = 1.5) flagged no further honest step (same figures).
• Share harmful, T = 10 / 50 / 200: C = 1.10: 0.25 / 0.70 / 1.00; C = 1.25: 0.35 / 0.70 / 1.00; C = 1.50: 0.35 / 0.70 / 1.00; C = 2.00: 0.35 / 0.80 / 1.00. Per-step + cumulative (C = 1.5): 0.30 / 0.70 / 1.00. Median |dL| at T = 200: 0.149, 0.192, 0.283, 0.402 for C = 1.1 to 2.0 (so harm size does fall as C tightens, the harmful share does not); 0.121 with the cumulative check.
• (1) held (3.3% at C = 1.1, 0.17% at C = 2.0). (2) half refuted: harm share at T = 200 is 1.00 at every C, flat rather than falling; only the size of |dL| falls (0.40 to 0.15), and the "at least 0.50 at C = 1.1" part held. (3) refuted: the cumulative check left harm at 0.70 (T = 50) and 1.00 (T = 200); the stated refutation condition (at least 0.80 at T = 200) is met.
• Reading, with a correction: the cumulative adversary's median scale is 0.0000, i.e. under the windowed-sum check the cheater's only feasible step is about zero, so it stops contributing for T steps. Its harm is withheld training, not a reversed step. In that regime tightening C or adding a sum check cannot help, because a null step passes every magnitude check. The same applies in part to the per-step ascent runs (median scale 0.006 at T = 200 against 1.86 at T = 1: the permitted ascent shrinks to almost nothing as its drifted model's gradients grow). The defect is therefore that magnitude checks on submitted updates have no lower bound on progress; the hole is liveness, not size. A check that closes it must test progress (loss or gradient alignment on a verifier-held batch), not norm.
• Limits: as stated before the run, plus: the harm threshold 0.01 counts stalling as harm (a lazy worker is a harm for a buyer of training, but is not a poisoning attack); the cumulative scale pinning to zero may also mean the bisection's feasible set was empty (past sum already above threshold), which I did not separate from "passes at zero"; one recipe, n = 20 gives about +-0.2.
• Next: a progress check (held-out loss or gradient inner product on a verifier batch every N steps) against the same stall and ascent adversaries; separate stalling from ascent by logging the step norm actually submitted.

2026-10-30 · Milestone 50: can a cheater who spreads the plant over T steps, each passing the per-step aggregate check, accumulate harm? (H4/H3 link, planned before running)

• Why: milestone 49's "Next". The aggregate check sees one step's delta, not the sum. Design (experiments/spread_steps/run.py): same protocol as 49 (d = 32, 4 seeds, K = 4, C = 1.5, leave-one-seed-out per-step thresholds). In T consecutive steps from a random t0 the adversary submits, each step, a step that passes both norm checks: spread16 / spread256 (fresh gradient-chosen plant of 16 / 256 weights, scaled by bisection to just pass), and ascent (a reversed SGD step, +c lr g with c the largest scale passing both norms, the budgeted first-order attack milestone 49 named). T = 1, 10, 50, 200; n = 20 shared draws per cell.
• Predictions, before running: (1) T = 1: harm at most 0.10 for all three (milestone 49 found 0 for the scaled plant; one reversed step of about 1.5x honest size is a small perturbation). (2) ascent harm rises with T and is at least 0.80 at T = 50 (50 steps of 1.5x-honest ascent undoes and reverses training). (3) spread16 harm at T = 200 is at most 0.25 (per-step scales of about 0.005 add to little, and later honest steps repair). (4) No attack step is flagged by the check (by construction, up to bisection tolerance). Refuted (2) if ascent harm at T = 50 is under 0.30: then the aggregate check plus training's self-repair holds against this attack.
• Limits known in advance: honest steps in the other steps keep running, so the cheater is not at full budget outside the window; thresholds calibrated on same-recipe seeds; one model, K = 4, C = 1.5; n = 20 gives about +-0.2; ascent assumes the cheater sees the batch gradient (a worker computes it anyway).

2026-10-30 · Milestone 49: does an aggregate-update check (L2 norm and largest coordinate of the submitted step) close the room under the per-tensor bound? (H4/H3 link, planned before running)

• Why: milestone 48's "Next". At K = 4 a gradient-chosen plant of 16 weights harms 95% of jobs and random plants of 64 harm 85%, so the per-tensor bound is a filter, not a deterrent. Design (experiments/aggregate_check/run.py): clean runs give, per step, a_t = ||step||_2 / lr and b_t = ||step||_inf / lr. A verifier calibrated on the other three seeds flags a submitted step above C x the honest maximum, C = 1.5, with a global threshold (max over all steps) or a per-step one (max over a +-5 step window). The adversary of milestone 48 (topk, K = 4) is scored two ways: how often the unconstrained plant is flagged, and fit_glob / fit_step, an adaptive cheater who shrinks the plant by a scalar until the submitted step passes the check (bisection), then harm is measured. k = 1, 4, 16, 64, 256; n = 20 shared draws.
• Predictions, before running: (1) honest steps flagged by either threshold: under 1% (leave-one-seed-out, C = 1.5). (2) The unconstrained plant is flagged by the global check in under half the draws at k <= 16 (a late step's honest norm is far below the early-training maximum, so the global threshold is loose) and by the per-step check in at least 90% of draws at k >= 16. (3) fit_step harm at k = 256 is at most 0.25 (a plant that must fit within 1.5 x honest norm cannot be large), against 1.00 unconstrained. (4) fit_glob harm at k = 256 exceeds fit_step harm by at least 0.25 (the global threshold leaves room late in training). Refuted (3) if fit_step harm at k = 256 is above 0.25: then an adaptive cheater defeats even a step-aware aggregate check.
• Limits known in advance: threshold calibrated on seeds of the same recipe and data (a verifier needs honest reference runs or the replicated step norm); one model, K = 4, C = 1.5 only; the check is on one step's delta, a cheater could spread the plant over steps (untested); first-order selection; n = 20 gives about +-0.2.

### Outcome of 51 (experiments/c_sweep/: run.py, results.txt, results.json, run.out; n = 20 per cell, ascent attack, per-step thresholds)

• Honest steps flagged, C = 1.1 / 1.25 / 1.5 / 2.0: 0.0333, 0.0154, 0.0046, 0.0017 (of 2400). Share harmful, T = 10 / 50 / 200: C = 1.1: 5, 14, 20 of 20 (0.25, 0.70, 1.00); C = 1.25: 7, 14, 20; C = 1.5: 7, 14, 20; C = 2.0: 7, 16, 20 (0.35, 0.80, 1.00). Median |dL| at T = 200: 0.149, 0.192, 0.282, 0.400. No attack step flagged (the 0.999 margin removed milestone 50's rounding artefact).
• (1) held (0.46% at C = 1.5, 3.3% at C = 1.1). (2) held (1.00 at C = 1.1, refutation line 0.50 far off). (3) held (T = 50: 0.70 at C = 1.1 vs 0.80 at C = 2.0, a gap of 0.10). (4) held by construction.
• Reading: the norm factor is not the lever. Tightening C from 2.0 to 1.1 costs 20 times the honest false positives (0.17% to 3.3%) and removes no harm at T >= 50: a persistent cheater harms every job at T = 200 whatever C, only the size of the harm falls (median |dL| 0.40 to 0.15, a factor 2.7). The cheater stays inside because its step has the honest norm; what is wrong is the direction, which a norm or max-coordinate check cannot see. So H4 needs a direction- or position-aware check (the cumulative distance from a verifier's replicated checkpoint, or recomputation of sampled steps), not a tighter magnitude.
• Limits: as stated before the run, plus: C was swept at one recipe; at T = 10 the harm count (5 to 7) sits near the 0.01 harm threshold; the "harmful" share is monotone in T and C only within +-0.2 noise, so only the T = 200 and false-positive columns are conclusions.
• Next: the cumulative check (distance of submitted weights from a replicated checkpoint at sampled steps) against the ascent and spread attacks, priced in verifier compute; paper H4 paragraph gains milestones 43 to 51.

### Outcome of 50 (experiments/spread_steps/: run.py, results.txt, results.json, run.out; n = 20 per cell, K = 4, C = 1.5, per-step thresholds)

• Honest steps flagged by the per-step thresholds: 11 of 2400 (0.0046), as in 49.
• Share harmful at T = 1, 10, 50, 200: spread16 0, 1, 8, 16 of 20 (0.00, 0.05, 0.40, 0.80); spread256 0, 1, 13, 20 (0.00, 0.05, 0.65, 1.00); ascent 0, 8, 15, 20 (0.00, 0.40, 0.75, 1.00). Median |dL| at T = 200: 0.051, 0.173, 0.264. Per-step plant scale that passes: about 0.002 (k = 16) and 0.0006 (k = 256) of the full plant.
• (1) held (all 0 of 20 at T = 1). (2) narrowly refuted: ascent harm at T = 50 is 0.75, under the 0.80 I set; the refutation condition (under 0.30) is far from met. (3) refuted: spread16 harm at T = 200 is 0.80, not at most 0.25. (4) held for the plants, with an artefact for ascent: 1 to 14 of 4000 plant steps at T = 200 were flagged (bisection tolerance); for ascent the scale is set exactly at the threshold, so float rounding flags about half of the steps (1998 of 4000 at T = 200), a boundary artefact of <= on a computed norm, not a real detection.
• Reading: milestone 49's conclusion needs a qualifier. A per-step aggregate check stops a one-shot plant, but a cheater who stays inside it every step accumulates harm: 20 of 20 jobs harmed once the window is 200 of 600 steps (a third of training), and 40 to 65% at 50 steps, for both a tiny gradient-chosen plant and a reversed SGD step. Training repairs part of it, so harm grows with the window, not instantly. Note the ascent scale shrinks as the cheater's model drifts (median c 1.86 at T = 1, 0.006 at T = 200) because its own honest gradient grows and the threshold, calibrated on clean runs, then allows less: the check does bite, but not enough.
• Limits: as stated before the run, plus: the harm threshold is |dL| > 0.01 on a model that trains to a held-out loss of order 1, and the median |dL| at T = 50 is only 0.008 to 0.02, so the "harmful" share at T = 10 and 50 sits near that threshold and is sensitive to it; one recipe, K = 4, C = 1.5; a 1.5 factor is one point, a tighter C was not swept; n = 20 gives about +-0.2.
• Next: sweep C (1.1, 1.25, 1.5, 2) against T for the ascent attack to price the check (false positives vs window); a cumulative check (distance of the submitted weights from a verifier's replicated checkpoint, which catches drift that per-step checks cannot); paper H4 paragraph gains milestones 43 to 50.

### Outcome of 49 (experiments/aggregate_check/: run.py, results.txt, results.json, run.out; n = 20 per cell, K = 4, C = 1.5)

• Honest steps flagged (leave-one-seed-out calibration, 2400 steps): global thresholds 0 (0.0000), per-step thresholds 11 (0.0046).
• The unconstrained milestone 48 plant (topk, harm 0.45, 0.80, 0.90, 0.95, 1.00 at k = 1, 4, 16, 64, 256 in this run) was flagged by both checks in 20 of 20 draws in every cell. Its submitted step is 130 (k = 1) to 2664 (k = 256) times the honest step norm at that step.
• Adaptive cheater (shrink the plant by a scalar until the step passes): harm 0 of 20 in every cell for both thresholds, k = 1 to 256. The scale that fits is small: median 0.019 (k = 1) down to 0.002 (k = 256) of the full plant under the global check, 0.006 to 0.001 under the per-step check; the passing step is 1.2 to 5 times the honest norm.
• (1) held (0 and 0.5%). (2) half refuted: the global check flagged 100% of unconstrained plants at k <= 16, not under half (my premise that the global maximum is loose late in training was wrong here: the plant is two to three orders of magnitude above any honest step, so even the early-training maximum catches it); the per-step part held (100%). (3) held (0.00 vs the 0.25 ceiling). (4) refuted (fit_glob 0.00, fit_step 0.00: no gap).
• Reading: against this adversary an aggregate check on the submitted step (L2 norm or largest coordinate, 1.5x the honest maximum) separates the milestone 48 plants from honest steps with zero false positives on the global version, and a cheater who stays under it does no measurable harm (|dL| below 0.001 median). So the room milestone 47 and 48 found under the per-tensor bound is closed by an aggregate check at no cost to honest steps here. This is the sharper message for H4: magnitude checks per tensor are not a deterrent, per-step aggregate checks are.
• Limits: shrinking the plant by a scalar is one adaptive strategy, not the optimal budgeted attack (the first-order optimum under an L2 budget is a gradient-ascent step of norm about 1.5 x honest, which the check admits; its harm is that of a reversed SGD step, not measured here); a cheater who spreads small plants over many steps, so each passes, is untested and is the natural next attack (the plant accumulates, the check does not see the sum); thresholds are calibrated on other seeds of the same recipe and data, so a verifier needs honest reference runs or a replicated step norm; one model, K = 4, C = 1.5; n = 20 gives about +-0.2 (0 of 20 has a 95% upper bound of about 0.17).
• Next: the spread-over-steps adversary (plant budget split across T steps, each passing the check; measure cumulative harm vs T); the reversed-SGD-step budgeted attack; paper H4 paragraph gains milestones 43 to 49.

2026-10-29 · Milestone 48: how much harm fits under the per-tensor bound when the adversary plants k weights, not one? (H4/H3 link, planned before running)

• Why: milestone 47's "Next". A single-weight plant under K x m_t (K = 4) harmed 0 of 20 even when chosen by gradient or by a 20-candidate loss search, so any residual room is in plants the bound does not limit: many weights, each inside its own tensor's bound. Design (experiments/bit_flips_multi/run.py): the protocol of milestone 47 at K = 4 only; at a random step the adversary overwrites k = 1, 4, 16, 64, 256 weights (of about 14k; zero-init tensors excluded). Sites: randk (k uniform weights, random signs: control) and topk (the k weights with the largest first-order loss rise g_i (v_i - w_i), v_i = -sign(g_i) K m_t). n = 20 shared (seed, step) draws per cell. Harm = |dL_heldout| > 0.01 or non-finite, as before.
• Predictions, before running: (1) k = 1 reproduces milestone 47: topk harm at most 0.10. (2) topk harm rises with k and is at least 0.50 at k = 256 (first-order rises add, and a 256-weight push of size up to 4 x m_t is a large step in the gradient direction). (3) randk harm at k = 256 stays at most 0.25 (random signs do not add coherently). (4) topk exceeds randk by at least 0.25 at the largest k where randk is still at most 0.10 (the gap is the gain from choosing weights by gradient). Refuted if topk harm at k = 256 is under 0.20: then even a coordinated 256-weight plant fits under the per-tensor bound, and the open room is only in plants of thousands of weights.
• Limits known in advance: one tiny model and recipe; K = 4 only (the smallest honest-safe factor measured in milestone 46); first-order selection, no curvature, no search over values inside the bound; n = 20 gives about +-0.2 intervals; the verifier here checks per-tensor maxima only, not an aggregate such as the norm of the update.

### Outcome of 48 (experiments/bit_flips_multi/: run.py, results.txt, results.json, run.out; n = 20 per cell, K = 4)

• A bug in milestone 47 surfaced while smoke-testing this run: its attack target was -sign(g) K m_t, which lowers the loss, so its grad and eval sites were descent attacks (every first-order score was at most 0 and the picked weights had gradient exactly 0). Both scripts now use +sign(g) K m_t; the 47 erratum below has the corrected numbers.
• Share harmful, topk (gradient-chosen) vs randk (random weights, random signs), k = 1, 4, 16, 64, 256: topk 9, 14, 19, 20, 20 of 20 (0.45, 0.70, 0.95, 1.00, 1.00); randk 0, 2, 4, 17, 20 of 20 (0.00, 0.10, 0.20, 0.85, 1.00). No non-finite outcome. Median |dL|, topk: 0.0096, 0.031, 0.078, 0.151, 0.265. Picked weights have median m_t about 3.8 (embedding) and mean |v| about 10 to 13, far above any honest value of those weights.
• (1) refuted: topk harm at k = 1 is 0.45, not at most 0.10 (the prediction rested on 47's wrong-sign result). (2) held: rises with k, 1.00 at k = 256. (3) refuted: randk harm at k = 256 is 1.00, not at most 0.25; random-sign plants of 64 or more weights up to 4 x m_t already harm 85%. (4) held: at k = 4 (the largest k with randk at most 0.10) topk 0.70 vs randk 0.10, a gap of 0.60. The refutation condition (topk under 0.20 at k = 256) is far from met.
• Reading: the per-tensor bound at K = 4 does not leave a strategic cheater without room. One gradient-chosen weight inside its bound harms 45% of jobs, 16 weights harm 95%, and even uninformed random plants harm most jobs once about 64 weights are touched. The bound filters faults (milestones 44 to 46) but is not a deterrent, and an aggregate check on the update (norm or count of changed weights relative to honest per-step movement) looks necessary. This also moves the H4 line: the cheapest effective attack is small (one to sixteen weights), so detection has to rely on recomputation or the margin, not on magnitude checks.
• Limits: as stated before the run, plus: first-order selection only; one model and recipe; K = 4 only; plants are applied once at one step (training afterwards partly repairs them, so the harm is a lower bound for a persistent cheater); n = 20 gives about +-0.2.
• Next: an aggregate-update check (L2 norm and sparsity of the submitted delta against honest per-step movement) as the defence to test against this adversary; K = 2 and honest per-tensor growth at longer horizons; paper H4 paragraph gains milestones 43 to 48 with the corrected 47.

2026-10-29 · Milestone 47: how much harm fits under the per-tensor bound when the adversary picks the site by gradient? (H4/H3 link, planned before running)

• Why: milestone 46's "Next". Its 3% harm at K = 4 came from a random plant site; a strategic cheater chooses the site. Design (experiments/bit_flips_worst/run.py): at a random step the adversary overwrites one weight with a value inside K x m_t of its own tensor (K = 2, 4; n = 20 shared (seed, step) draws per K). Sites: random (control), grad (argmax of the first-order loss rise g_i (v - w_i), v = -sign(g_i) K m_t, from the step's batch gradient), eval (top 20 by that score, each tried, the largest actual batch loss kept).
• Predictions, before running: (1) random-site harm at K = 4 is at most 0.15 (milestone 46: 0.03). (2) grad-site harm at K = 4 is higher than random by at least 0.10, i.e. a gradient-chosen site recovers a good part of the room. (3) eval-site harm is at least as high as grad-site (up to one draw). (4) At K = 2 grad-site harm stays at or under 0.20: refuted above that, which would mean even the tightest honest-unsafe bound leaves room.
• Limits known in advance: one weight, one tiny model, first-order score and a 20-candidate search only; n = 20 gives about +-0.2 intervals; a multi-weight plant, which the bound does not limit, is untested.

### Outcome of 47 (experiments/bit_flips_worst/: run.py, results.txt, results.json, run.out; first pass without the zero-tensor exclusion kept as results_all.txt, run_all.out)

• Share harmful, n = 20 per cell (same draws for the three sites): K = 2: random 1 (0.05), grad 1 (0.05), eval 1 (0.05). K = 4: random 0, grad 0, eval 0. No non-finite outcome; median |dL| at most 0.0003.
• First pass (zero-init tensors allowed, where K x m_t = 0 so the "plant" is a zeroing): the same, 0 harmful at K = 4 for all sites. There the gradient score picked bias tensors (median m_t 0), a weak attack, so I excluded zero-bound tensors (they need an absolute bound, as milestone 46 said) and reran; the exclusion changes the picked site (now the embedding, median m_t 3.9, so the plant is up to 15.6) and not the harm count.
• (1) held (random 0.00 at K = 4). (2) refuted: grad-site harm at K = 4 is 0.00, not 0.10 above random. (3) held (eval = grad = 0). (4) held (0.05 at K = 2).
• Reading: against the per-tensor bound at K = 4, a first-order gradient search and a 20-candidate loss search found no single-weight plant that harms in 20 draws each, even though the picked weights (embedding entries up to about 15) are far larger than any honest value of that weight. With 0 of 20 the 95% upper bound is about 0.17, so this does not show the room is zero; it shows a single-weight plant is a poor attack here, and milestone 46's 1 of 40 is the same size of effect. The residual room under the per-tensor bound, if any, is in multi-weight or coordinated plants, which the bound does not limit.
• Limits: as stated before the run, plus: the first-order score ignores curvature and the embedding's downstream LayerNorm may mask large values (as milestone 42 found for activations); one model, one recipe, K = 2 and 4 only; the zero-bound tensors are excluded, not bounded.
• Next: a multi-weight plant under the per-tensor bound (k weights chosen by gradient, k = 1 to 64), which is the adversary the bound does not obviously limit; biases under an absolute bound; paper H4 paragraph gains milestones 43 to 47.

### Erratum to 47 (found in milestone 48)

• The attack target was -sign(g) K m_t, a descent direction, so the grad and eval sites did not attack. Corrected rerun (+sign(g) K m_t; the wrong-sign outputs are kept in experiments/bit_flips_worst/wrong_sign/): K = 2: random 1 (0.05), grad 7 (0.35), eval 7 (0.35); K = 4: random 0, grad 8 (0.40), eval 7 (0.35), n = 20 each, no non-finite outcome. So predictions (2) (grad exceeds random by 0.10 at K = 4) and (3) held, (4) (grad at K = 2 at most 0.20) is refuted (0.35). The conclusion "a single-weight plant is a poor attack here" is withdrawn: a gradient-chosen weight inside the per-tensor bound is a real attack, and the 0.03 of milestone 46 was a random-site figure.

2026-10-28 · Milestone 46: does a per-tensor magnitude bound leave an adversary less room than the global bound? (H4/H3 link, planned before running)

• Why: milestone 45's "Next". Its bound K x (global init max|w|) is loose because one tensor (the embedding, max about 4) sets the global maximum while most tensors have maxima near 0.1. A verifier who recomputes the init can hold one maximum per tensor. Design (experiments/bit_flips_tensor/run.py): the plant protocol of milestone 45 with paired draws: the same (seed, step, weight, sign) is set once to a x m0 (global) and once to a x m_t (the init max|w| of the tensor that weight sits in), a = 1, 2, 4, 8, 40 draws each. Both values pass a bound K = a of their own kind, so the harm rate vs a is what an adversary gains under each bound. Only the fp32 weight site, d = 32, 4 seeds. (A smoke run at scale 0.1, 4 draws per cell, ran before this entry and showed 2 of 4 global plants harmful at a = 8 and none per-tensor; it is not used as a result.)
• Predictions, before the full run: (1) most planted weights sit in tensors whose maximum is under half the global one (the smoke run: 69%), so a per-tensor plant is on average far smaller in absolute value. (2) The per-tensor harm rate at a = 8 is under 0.20 (global about 0.5 in milestone 45). (3) Harm is not zero under the per-tensor bound: a plant of a x m_t in a sensitive small-scale tensor (a LayerNorm gain, whose init is 1, is a tensor with m_t = 1) can still harm; per-tensor harm at a = 8 is at least 0.05. (4) Paired: a draw harmful under the per-tensor plant is almost always harmful under the global one (fewer than 3 draws per a harmful only under per-tensor), since the per-tensor value is smaller in absolute terms; refuted otherwise.
• Limits known in advance: one tiny model; the verifier must hold per-tensor maxima of the init (recomputable from the public seed); one planted weight at a random site and step, so a gradient-chosen worst site is not tested; n = 40 per cell gives about +-0.15 intervals; a pre-trained start changes the references.

### Outcome of 46 (experiments/bit_flips_tensor/: run.py, results.txt, results.json, run.out; growth.py, growth.txt for the honest-growth control)

• Planted weights: 88% sit in a tensor whose init maximum is under half the global one (median m_t / m0 = 0.05). Share harmful, global a x m0 vs own-tensor a x m_t (paired, n = 40): a = 1: 2 (0.05) vs 0; a = 2: 0 vs 0; a = 4: 11 (0.28) vs 1 (0.03); a = 8: 13 (0.33) vs 1 (0.03). No draw was harmful only under the per-tensor plant.
• (1) held (0.88). (2) held (0.03 at a = 8, ceiling 0.20). (3) refuted: per-tensor harm at a = 8 is 0.03 (1 of 40), under the 0.05 floor I set; I expected a LayerNorm gain (m_t = 1) to be sensitive, but a plant of 8 there harmed in only one draw. (4) held (0 draws harmful only under per-tensor).
• Control (growth.py, clean runs, 84 nonzero-init tensor x seed pairs): final / init max|w| per tensor has median 1.35, 90th percentile 2.84, maximum 3.89; 38% of tensors exceed 1.5, 20% exceed 2, none exceed 4. So a per-tensor bound needs K >= 4 to accept honest work here (K = 2 would reject one honest tensor in five). The 36 zero-init tensors (biases) have no relative bound at all; they grow to a median 0.06, max 0.47.
• Reading: at the smallest honest-safe factor K = 4, a per-tensor bound admits plants that harm 3% of jobs (1 of 40) where the global K = 4 bound admits 28% (11 of 40). So a verifier who holds one init maximum per tensor removes most of the room that milestone 45's global bound left, at no cost to honest runs here. It is still a filter, not a deterrent: an adversary plants just under K x m_t in the one tensor that is sensitive, and biases need an absolute bound.
• Limits: as stated before the run, plus: 3 planted draws landed in zero-init tensors, where a x m_t = 0 (a no-op plant, counted unharmful); honest growth was measured for one training recipe, and a longer or higher-lr run grows tensors more, so K = 4 is a measured value for this recipe, not a constant; n = 40 gives about +-0.15, so 0.03 vs 0.28 is a clear gap but 1 of 40 vs 0 of 40 is not; the sensitive site was random, not searched.
• Next: a gradient-chosen worst-case site under the per-tensor K = 4 bound; honest per-tensor growth at longer horizons; paper H4 paragraph gains milestones 43 to 46.

2026-10-28 · Milestone 45: does the magnitude-bound check survive a reference a verifier can actually hold, and how much harm fits under the bound? (H4/H3 link, planned before running)

• Why: milestone 44's "Next". Its bound used the true max|w| of the previous checkpoint, which a verifier without a trusted checkpoint lacks. Part A re-scores the same 240 fp32 flips (rng seed 43) against references a verifier can hold: max|w| at initialisation (recomputable from the public seed) and fixed absolute bounds B = 1 and 10, K = 1, 2, 4, 10, 100. Part B is the adversary: plant +-a x m0 (m0 = init max|w|) in one random weight at a random step, a = 1 to 128, 20 draws each, and read off the harm rate vs a, i.e. what a cheater gains by staying under a bound K x m0.
• Predictions, before running: (1) init max|w| is within a factor 2 of the clean final max|w| in every seed (milestone 44 saw max|w| nearly constant), so the init reference catches the same harmful flips as the true previous maximum at K = 4 and 10 (catch rate >= 0.95). (2) A fixed B = 10 catches every harmful flip at K = 1 (the same flips make weights above 1e3); B = 1 may false-alarm only on corrupted submissions, as before. (3) Planted values are harmless at a = 1 and 2 (harm rate <= 0.10) and harmful in most draws (>= 0.5) by a = 128, so there is a threshold a between them: bounds with K < a admit no harmful plant, K >= a admit them. (4) a is above 8: a weight of eight times the largest init weight is absorbed by LayerNorm and the rest of the network; refuted if the harm rate at a = 8 is above 0.25.
• Limits known in advance: one tiny model; the init scale of this model is a property of the init rule (a different init or a pre-trained start moves the reference); one planted weight, random site and step (a worst-case site would harm more); n = 20 per a gives about +-0.2 intervals; weights only; the clean-run false-positive side is trivial here because max|w| barely grows.

### Outcome of 45 (experiments/bit_flips_ref/: run.py, results.txt, results.json, run.out; Part A 120 fp32 flips, 15 harmful, same rng seed 43 as milestones 43/44; Part B 8 values of a x 20 plants)

• Clean runs: init max|w| 4.10 / 3.95 / 3.70 / 3.85 and final max|w| 4.09 / 3.95 / 3.72 / 3.85 for the four seeds, so the largest weight is set by the init and does not move in training.
• Part A: the init-scale reference, B = 1 and B = 10 each catch 15 of 15 harmful flips at every K in {1, 2, 4, 10, 100}, as the true previous maximum does. Flagged share of all flips 0.13 (0.17 for B = 1 at K = 1). The 15 harmful flips match milestone 44's fp32 row.
• Part B (plant +-a x m0, one random weight and step, n = 20): share harmful a = 1: 0.10, 2: 0.05, 4: 0.30, 8: 0.50, 16: 0.60, 32: 0.55, 64: 0.60, 128: 0.55; non-finite final loss in 0 or 1 of 20 per a.
• (1) held (init within 1% of final max; catch 1.00). (2) held. (3) held (0.10 and 0.05 at a = 1, 2; 0.55 at a = 128), with a plateau of about 0.55 to 0.6 from a = 8, not a rise. (4) refuted: harm at a = 8 is 0.50 and already 0.30 at a = 4, above the 0.25 ceiling; the threshold a* is between 2 and 4, not above 8.
• Reading: a bound K x (init max|w|) with K = 2 catches all 15 harmful random flips and leaves an adversary a plant of at most 2 x m0 with harm 0.05 (1 of 20); with K >= 4 a planted weight harms 30% to 60% of jobs. The check is cheap and needs only the public init, but it filters faults rather than deterring a strategic cheater, who plants just under the bound; K must sit close to honest growth (about 1 here).
• Limits: as stated before the run, plus: this model's global max|w| (about 4) is far above typical weights, so a global bound is loose; a per-tensor bound would be tighter and was not tested; the a = 1 harm of 0.10 (2 of 20) is within the +-0.2 noise of n = 20 but says a value equal to the init maximum can matter in a sensitive weight.
• Next: per-tensor bounds; a worst-case plant site chosen by gradient; the paper's H4 paragraph gains milestones 43 to 45.

2026-10-28 · Milestone 44: how many harmful silent bit flips does a magnitude-bound check on the weights catch? (H4, planned before running)

• Why: milestone 43's "Next". A finiteness check catches none of fp16's harmful flips, so test the check milestone 43 proposed: reject a submission if the flipped weight is non-finite or |w| > K x max|w| of the previous checkpoint (K = 1.5, 2, 4, 10, 100). Same flips as milestone 43 (same rng seed 43, same protocol, 3 formats, d = 32, 4 seeds). Also measure the false-positive side: in the 4 clean runs, the growth ratio of max|w| between checkpoints 25 steps apart (a bound K below this ratio would reject honest work).
• Predictions, before running: (1) at K = 10 the check catches at least 90% of harmful exp_hi flips in every format (a harmful flip makes a weight >= 1e3 or non-finite, against a clean max of order 1). (2) Clean growth of max|w| over 25 steps stays under 1.5 in every run, so K >= 1.5 has no false positives on honest training here. (3) The check flags (K = 10) no sign, exp_lo or man_hi flip in fp32/bf16 (they change a value by at most a factor 2 or a tiny amount). (4) Harmful flips the check misses at K = 10 are under 10% of all harmful flips; refuted above that.
• Limits known in advance: the reference is the true max of the previous checkpoint, which a verifier with only the submitted weights does not have (it would need a trusted reference scale, e.g. a replica or the init); one flip per job; weights only; tiny model; counts at n = 60 are small.

### Outcome of 44 (experiments/bit_flips_bound/: run.py, results.txt, results.json, run.out; same 360 flips as milestone 43)

• Harmful exp_hi flips (n = 60 per format): fp32 15, bf16 13, fp16 14. Catch rate of the harmful ones at K = 1.5, 2, 4, 10: 1.00 in every format; at K = 100 fp32 and bf16 1.00, fp16 13 of 14 (0.93): one fp16 flip made a weight of about 10 to 100 times the clean maximum and still harmed. No sign, exp_lo or man_hi flip was harmful (0 of 60 per format) and none was flagged.
• Flagged share of all exp_hi flips at K = 10: fp32 0.267, bf16 0.250, fp16 0.317, against harmful shares of 0.250, 0.217, 0.233: the check also rejects 1 to 5 harmless flips per format (a big but benign value, e.g. in a weight the network barely uses), i.e. false alarms among corrupted submissions, not on honest ones.
• Clean growth of max|w| over 25 steps: max 1.001, 99th percentile 1.000 (n = 92 intervals). So (2) held trivially, but it says the largest weight in this model barely moves during training, so any K >= 1.5 is far from honest behaviour here.
• (1) held (100% at K = 10, all formats). (3) held (nothing flagged outside exp_hi). (4) held (0 missed at K = 10).
• Reading: against single flips, a magnitude bound relative to the previous checkpoint's maximum catches every harmful flip at K <= 10 in all three formats, so the residual silent-finite harm that milestone 40 priced is removable by a cheap check, and the replication placement of milestone 40 is an upper bound on what replication has to cover. This does not cover multi-bit or many-weight corruption, small harmful drifts (a flip that is finite and under K x max is untested because none harmed here), or an adversary: a strategic cheater stays under the bound.
• Limits: as stated before the run, plus: the reference scale is the true previous maximum, which a verifier lacks unless it holds a trusted checkpoint; the clean maximum is nearly constant for this tiny model so the false-positive side is not stressed; n = 60 per format gives intervals of about +-0.11 on each share, and "100%" of 13 to 15 harmful flips has a lower 95% bound of about 0.78.
• Next: a verifier-realistic reference (init scale or a replica) instead of the true previous maximum; a stronger adversary against the bound (H3/H4 link); paper H4 paragraph gains milestones 40 to 44.

2026-10-28 · Milestone 43: does a 16-bit stored format change the harm of one silent weight bit flip? (H4, planned before running)

• Why: milestone 42's "Next". Production weights are often stored in bf16 or fp16; the harm of a flip depends on how large a value one exponent bit can create. fp32 and bf16 share an 8-bit exponent (top flip gives about 1.7e38); fp16 has 5 (top flip of a value near 0.5 gives 32768, finite, and only an all-ones exponent gives inf/NaN).
• Design (experiments/bit_flips_format/run.py): protocol of milestone 42, weight site only; the flipped weight is round-tripped through fp32, bf16 or fp16 (one bit of that format's pattern flipped), training stays fp32. 60 high-exponent, 20 each low-exponent, sign, top-mantissa flips per format, 4 seeds.
• Predictions, before running: (1) fp32 reproduces milestone 42's weight row (exp_hi harm within 0.10 of 0.200). (2) bf16 matches fp32 within sampling error (same exponent width): |difference| in exp_hi harm below 0.15. (3) fp16 has a lower non-finite share than fp32 among exp_hi flips (under 0.07, since inf needs all five exponent bits set) but its total exp_hi harm is not lower than 0.10, because a finite 1e3 to 6e4 weight still wrecks the model. (4) sign, exp_lo and top-mantissa flips cause no harm at any format.
• Limits known in advance: storage-only model of a narrower format (no fp16 training, no loss scaling); one tiny model; n = 60 gives about +-0.11 intervals; q still unmeasured.

### Outcome of 43 (experiments/bit_flips_format/: run.py, results.txt, results.json, run.out; 3 formats, 120 flips each, 4 seeds, d = 32)

• Columns are non-finite / finite harm / any harm among exp_hi flips, n = 60 per format: fp32 0.150 / 0.100 / 0.250; bf16 0.117 / 0.100 / 0.217; fp16 0.000 / 0.233 / 0.233. exp_lo, sign and top-mantissa flips: 0 of 20 harmful in every format and class.
• (1) held: fp32 exp_hi harm 0.250 vs milestone 42's weight row 0.200 (band 0.10; different random draw of flips). (2) held: bf16 vs fp32 differ by 0.033 (band 0.15). (3) held: fp16 has no non-finite outcome (0 of 60, bound 0.07) but its exp_hi harm is 0.233, not lower than 0.10: a flip that creates a finite weight of 1e3 to 3e4 harms as often as one that creates inf. (4) held.
• Reading: a narrower exponent removes the inf/NaN failures but not the harm, so a finiteness check on submitted weights would catch none of fp16's harmful flips; a magnitude bound (e.g. |w| below a few times the clean maximum) is the check that carries over across formats. The check on the real clean-weight maximum was not run here.
• Limits: as stated before the run; at n = 60 the intervals are about +-0.11, so fp32, bf16 and fp16 totals (0.25, 0.22, 0.23) are indistinguishable; storage-only model, training stays fp32.
• Next: measure a magnitude-bound check's catch rate on these flips; fp16 training with loss scaling.

2026-10-28 · Milestone 42: do silent bit flips in gradients and activations harm training more than flips in weights? (H4, planned before running)

• Why: milestones 40 and 41 flipped one bit of one weight (P(harm | flip) 0.03 to 0.045, almost all high-exponent flips). A real silent data corruption can also hit the activations of the forward pass or the gradient before the update. Same protocol (d = 32, 600 steps of SGD, 4 seeds, final held-out loss vs the clean run of the same seed, harm = |dL| > 0.01 or non-finite), three sites: weight (re-run as control), gradient (one element of the flattened gradient at a random step), activation (one element of a random block's output at a random step; the flip then propagates through the loss, the gradient and the update). Bit classes exp_hi (27-30) 60, exp_lo (23-26) 20, sign 20, man_hi (16-22) 20 per site.
• Predictions, before running: (1) the weight control reproduces milestone 41 (overall harm over bits 16-31 within 0.02 to 0.07). (2) A gradient flip is less harmful than a weight flip per exp_hi flip: the weight flip persists in the model, a gradient flip is one bad update that later steps (and the shrinking cosine step size) can correct, unless it is non-finite or so large that it overwrites the weight (a 1e38 gradient times lr is itself a 1e37 weight): non-finite share of exp_hi gradient flips is at least as large as for weights (refuted if more than 10 points lower). (3) Activation flips are harmful in a larger share than weight flips (the corrupted value passes through a LayerNorm and the softmax and is multiplied into every downstream gradient): exp_hi harm at least 0.35; refuted if under 0.25. (4) exp_lo, sign and man_hi flips at any site cause finite harm in under 10% of cases.
• Limits known in advance: one tiny model (d = 32), plain SGD, fp32, a single flip per job, flips only in block outputs (not attention scores or the loss); 20 flips per low-bit class gives wide intervals; q is still not measured.

### Outcome (experiments/bit_flips_site/: run.py, results.txt, results.json, run.out; 3 sites, 120 faulty runs each, 4 seeds, d = 32, 32,801 parameters)

• Columns are non-finite / finite harm / any harm among exp_hi (27-30) flips, n = 60 per site: weight 0.133 / 0.067 / 0.200; gradient 0.150 / 0.100 / 0.250; activation 0.083 / 0.000 / 0.083. exp_lo, sign and man_hi: 0 of 60 harmful at every site. Overall P(harm) over bits 16-31 (mantissa 0-15 counted 0): weight 0.025, gradient 0.031, activation 0.010.
• (1) held: the weight control gives 0.025 (band 0.02 to 0.07), close to milestone 41's 0.027 to 0.040.
• (2) the stated criterion held, the motivating claim did not: gradient non-finite share 0.150 is not below the weight's 0.133. But I expected gradient flips to be less harmful overall, and they are not: 0.25 against 0.20 exp_hi harm, with an interval of about +-0.11 each, so no difference is detected. A bad gradient is not self-correcting on this run length; a 1e38 gradient times lr overwrites the weight, as predicted.
• (3) refuted: activation exp_hi harm is 0.083 (5 of 60, all non-finite), under the 0.25 floor; activation flips are the least harmful site, not the most. Reason, checked rather than assumed: about 80% of block-output values have |x| < 2, where flipping exponent bit 30 gives inf/NaN (checked directly: 1.49 -> NaN, loss NaN), while a large finite activation (bits 27-29) is absorbed by the next LayerNorm, so it leaves the loss unchanged. The residual stream's LayerNorm is a natural fault mask.
• (4) held: 0 of 60 finite harm in exp_lo, sign and man_hi at every site.
• Reading: P(harm | flip) is 1% to 3% over bits 16-31 whichever of the three sites is hit, and the part that matters is a high-exponent flip that makes a value inf/NaN; a finiteness check on the submitted weights (and on loss/gradient norms during training) would catch most of what harms. This does not change the f = q x P(harm) placement of milestone 40 (P(harm) 0.045 -> between 0.010 and 0.031 here). Not tested: bf16/fp16 training (smaller exponent range, so more flips overflow), optimiser state, attention scores, larger models.
• Limits: as stated before the run; intervals at n = 60 are about +-0.11, so the ordering gradient > weight > activation is suggestive only.
• Next: fp16/bf16 (does a narrower exponent change the non-finite share?); the paper's H4 paragraph gains milestones 40 to 42.

2026-10-28 · Milestone 41: does the harm of one silent bit flip fall as the model grows? (H4, planned before running)

• Why: milestone 40 measured P(harm | flip) = 0.045 on a 32,801-parameter transformer and flagged that a real flip lands on one of billions of weights, so the per-flip share may not carry over. Repeat the protocol at embedding width d = 16, 32, 64, 128 (about 9k to 400k parameters; 2 layers, 2 heads, same data, 600 steps of SGD, 4 seeds), flipping one bit of one random weight at a random step, bit classes exp_hi (27-30), exp_lo (23-26), sign, man_hi (16-22); mantissa 0-15 is omitted (0 of 100 harmful at d = 32). Harm = |final held-out loss change| > 0.01 or non-finite.
• Predictions, before running: (1) the non-finite share of exp_hi flips does not fall with width (a flip to about 1e38 in any weight that is used blows up the forward pass); its slope in log2(d) is within +-0.1 of zero. (2) The finite-harm share of exp_lo and sign flips (2% and 1% at d = 32) stays at or under 10% at every width, and is non-increasing from d = 32 to d = 128 up to sampling noise. (3) Overall harm over bits 16-31 stays between 0.02 and 0.08 at every width, so the 0.045 figure of milestone 40 is not an artefact of the small model; refuted outside that range at any width. (4) No width has a clean-run loss spread above 0.03 across seeds large enough to mask harm at the 0.01 tolerance (check, not a result).
• Limits known in advance: widths stop at 128 (about 400k parameters), far below production scale, so this is a trend over 8x in parameters, not a claim about billions; 60 exp_hi flips per width gives a binomial interval of about +-0.12 at 0.35; 4 seeds; weights only; one flip per job.

### Outcome (experiments/bit_flips_size/: run.py, results.txt, results.json, run.out; 4 widths, 120 faulty runs each, 4 seeds, 10,305 to 425,825 parameters)

• (1) held: the non-finite share of exp_hi flips is 0.200 / 0.117 / 0.183 / 0.167 at d = 16 / 32 / 64 / 128; slope per doubling of d is -0.003 (the planned band was +-0.1). With 60 flips per width the interval at each point is about +-0.1, so this shows no strong trend, not a flat line.
• (2) held, trivially: exp_lo and sign flips (20 each per width) caused no harm at any width (0 of 40 per width), consistent with the 2% and 1% of milestone 40 given n = 20.
• (3) held: overall harm over bits 16 to 31 is 0.031 / 0.029 / 0.040 / 0.027 (mantissa 0 to 15 counted as 0, which milestone 40 measured as 0 of 100). exp_hi harm in total is 0.25 / 0.23 / 0.32 / 0.22 (pooled 0.254), against 0.35 at d = 32 in milestone 40: within sampling error of it, not clearly lower. Finite harm among exp_hi flips is 0.05 / 0.12 / 0.13 / 0.05, too noisy to call a trend.
• (4) held (check): clean-run loss std across 4 seeds is 0.023 / 0.008 / 0.005 / 0.015, under 0.03 at every width.
• Reading: over a 41-fold range in parameters, harm per flip is about 3% to 4% of flips and does not fall measurably with width; the dominant part is a high-exponent flip that turns a weight into about 1e38 or non-finite. So milestone 40's f = q x 0.045 is not an artefact of the smallest model, to within this noise, and no argument for a lower P(harm) at scale comes from this data. It does not show the same holds at billions of parameters, where a flip in a rarely used weight (embedding row of an unseen token, a dead unit) may matter less.
• Limits: as stated before the run; the lower overall figure than milestone 40 (about 0.03 vs 0.045) is because exp_hi harm is 0.22 to 0.32 here against 0.35 there; the two are consistent given the intervals (exp_hi alone has ±0.12). Not tested: activations, gradients, optimiser state, other optimisers.
• Next: flips in activations and gradients; a larger model on a GPU if one is available; the paper's H4 paragraph gains milestones 40 and 41.

2026-10-28 · Milestone 40: what share of silent bit flips in real training produce a faulty output, and where does that put f? (H4, planned before running)

• Why: milestone 39 treats f (probability a worker returns a faulty output) as a parameter over 0.01 to 0.2 and says where replication flips. A faulty output is only a fault if it differs from the honest one by more than the referee's tolerance. Measure that conditional on the tiny transformer of milestones 11 and 12: inject one single-bit flip into one fp32 weight at a random step of a 600-step honest run, compare the final held-out loss and weights with the clean run of the same seed, and tabulate P(harm | flip) by bit class (sign, exponent high/low, mantissa high/low). Also re-run the clean job with 1 and 4 threads to see whether ordinary nondeterminism alone produces any output difference. Then f = q x P(harm), with q the probability a job suffers at least one flip, swept 1e-6 to 1e-1 (q is a parameter: published silent-data-corruption rates are per machine, not per job).
• Predictions, before running: (1) a flip in an exponent bit 23 to 30 is harmful at a loss tolerance of 0.01 (|delta loss| > 0.01, or non-finite) in a large minority of cases (10% to 60% of all exponent flips); refuted outside that range. (2) Flips in mantissa bits 0 to 15 are harmful in under 2% of cases (relative perturbation below 2^-7 of one weight is absorbed by SGD). (3) Overall P(harm at 0.01) across a uniform bit is between 0.05 and 0.30. (4) Thread count alone gives bitwise-equal final weights on this CPU (difference exactly 0) or below 1e-5 in relative L2: nondeterminism is not the fault source at this scale. (5) Hence at any q <= 0.1, f <= 0.03, which is the low end of the milestone 39 grid, where m = 1 is optimal unless the audit is dear and L is large.
• Limits known in advance: one model (tiny transformer, 600 steps, plain SGD, ~25k parameters); single flips in weights only (no flips in activations, gradients or optimiser state, which can matter differently); fp32 only; q and the loss tolerance are parameters; a flip in a real run lands on one of billions of weights, so the per-flip harm share of a tiny model overstates a large one if harm falls with size, and understates it if not (not tested).

### Outcome (experiments/bit_flips/: run.py, place.py, results.txt, results.json, place.txt, run.out; 500 faulty runs, 100 per bit class, 8 seeds, 32,801 parameters)

• (1) held: across exponent bits 23 to 30 the harm share at eps = 0.01 is 18% (bits 27 to 30: 35%, 24% non-finite; bits 23 to 26: 1%). (2) held: mantissa bits 0 to 15: 0 of 100 harmful, 80% leave the held-out loss exactly unchanged.
• (3) refuted, narrowly: overall P(harm) at eps = 0.01 with a uniform bit is 0.045 (0.047 at 1e-3, 0.041 at 0.1), under the predicted 0.05 floor. The share is almost all the four high exponent bits (4/32 x 0.35); the sign bit (1 of 100) and every lower class are near zero. The 95% binomial interval for the 35% in those bits is about 0.26 to 0.45, so the overall share is about 0.033 to 0.057.
• (4) held, with a correction to the wording: 4 threads vs 1 thread is not bitwise equal (relative weight difference 7e-8, loss difference at most 2.4e-7 against a seed std of 0.0091), but it is far below any referee tolerance: ordinary CPU nondeterminism produces no fault here.
• (5) held, and the placement is sharper than predicted: place.py puts f = q x 0.045 on the milestone 39 optimiser: at q = 0.001 (f = 4e-5) 0 of 48 cells (g, kappa, L, c, lambda; c 5 or 20, L up to 10,000) choose m > 1; at q = 0.01 13 of 48; at q = 0.1 (f = 0.0045) 28 of 48; at q = 1 (every job takes a flip, f = 0.045) 43 of 48. Replication is therefore a rare-fault tool: it pays only where a flip is common and a bad accepted result costs 100 to 10,000 jobs while the audit costs 5 to 20.
• Reading: the faulty-worker rate that matters is q x P(harm), and P(harm) is 4.5%, not 100%. A cheap range or finiteness check on the submitted weights would catch the non-finite part (24 of the 35 points in the high-exponent class), leaving about 1.4% of flips (11% x 4/32) as silent finite harm; this tests a detector the run did not implement, so it is an upper-bound arithmetic reading only.
• Limits: as stated before the run; one tiny model, weights only, fp32, a single flip per job; q is not measured (published silent-data-corruption rates are per machine: they have not been converted to a per-job q here); place.py uses a coarser grid than milestone 39.
• Next: flips in activations and gradients; a model large enough that one weight is a small share (does harm per flip fall with size?); the paper H4 paragraph gains milestone 40.

2026-10-27 · Paper: H4 paragraph gains milestones 37 to 39

• Added the replication-pricing (37, 38) and faulty-worker (39) results to paper/main.tex (section "Redundancy and collusion"); numbers copied from the milestone outcomes below. LaTeX not compiled here (no pdflatex). Next: measure f on real training runs.

2026-10-27 · Milestone 39: do faulty (non-strategic) workers make replication worth buying once the audit has a cost? (H4, planned before running)

• Why: milestones 37 and 38 priced replication only as a deterrent against strategic cheaters and found it dominated. Their reading was that its value is robustness to a faulty worker. Model it: each worker independently returns a faulty output with probability f, and faulty outputs are unique (no two agree). With m = 1, a faulty output is caught by the audit with probability p and re-run (cost one more attempt), otherwise accepted at loss L (a corrupted model update, in units of one job's compute). With odd m > 1, a fault never forms a majority, so the job is accepted when a strict majority is correct (probability q_m = P(Bin(m, 1-f) > m/2)) and otherwise re-run. Expected cost per accepted-or-bad job = [m + c p + lambda m S(m, p) + L P_bad] / (1 - P_retry), with S from stake_closed_partial (the strategic deterrent is still required), m = 1: P_retry = f p, P_bad = f (1-p); m > 1: P_retry = 1 - q_m, P_bad = 0. Grid: g in {0.5, 0.9}, kappa in {0.2, 0.5, 1}, f in {0.01, 0.05, 0.2}, L in {10, 100, 1000}, c in {0.5, 2, 5, 20}, lambda in {0.01, 0.1, 1}; p 0.01 to 1, odd m 1 to 51.
• Predictions, before running: (1) m = 1 in every cell with c <= 0.5 (a full audit at p = 1 costs 0.5 and removes both the fault loss and the stake). (2) Replication is chosen in some cell with L = 1000, f = 0.2 at c = 20 (an audit dearer than three compute units); refuted if no cell picks m > 1 anywhere. (3) At fixed (g, kappa, c = 20, L, lambda) the optimal m is non-decreasing in f; refuted by any decrease. (4) The smallest c at which any cell picks m > 1 lies between 2 and 20; refuted if it is 0.5 or below, or if none does.
• Limits known in advance: faults are independent, unique and not slashed; no correlated faults (a shared bug) which would defeat majority voting and would favour diverse implementations, not more replicas; L, f, c, lambda are parameters, not measured.

### Outcome (experiments/faulty_workers/: run.py, results.txt, results.json, run.out; 648 cells, 26 odd m x 100 audit probabilities each)

• (1) held: 0 of 162 cells at c = 0.5 pick m > 1. (2) held: replication is chosen at f = 0.2, L = 1000, c = 20 (all g, kappa, lambda). (3) held: 0 violations in 54 chains (optimal m never falls as f rises). (4) held: the smallest c with any m > 1 is 2.0 (53 of 162 cells at c = 2, 85 at c = 5, 88 at c = 20; at c = 2 only when L >= 100).
• Not predicted: the optimum is m = 1 or m = 3 and nothing else (422 and 226 cells). Three replicas already push the retry rate (1 - q_3 = 3f^2 - 2f^3, 0.104 at f = 0.2) low enough that a fifth costs more compute than it saves. The m = 3 designs also run a small audit (p* about 0.03 to 0.37), kept only to hold the strategic stake down.
• Reading: replication earns its place against faulty workers, but only when the audit is dear (c of at least two compute units) and a bad accepted result is costly (L of at least 100). With a cheap audit the principal audits every job instead (m = 1, p = 1, which also removes the stake). This closes the milestone 37 and 38 reading: replication is a reliability tool, not a deterrent, and it is bought as a triple, not a larger set.
• Limits: as stated before the run; faults are independent and unique, and a shared bug or a common faulty library would defeat majority voting and call for diverse implementations; f, L, c, lambda are parameters, not measured, so the grid shows where the conclusion flips, not where a real deployment sits.
• Next: measure f on real training runs (bit-flip and nondeterminism rates) to place a deployment on the grid; the paper H4 paragraph still needs milestones 37 to 39.

2026-10-27 · Milestone 38: priced jointly, does the principal ever choose replication once the audit has a cost? (H4, planned before running)

• Why: milestone 37 priced replication against stake only, with the audit free at p = 0.1. Here the principal picks audit probability p, worker count m (odd) and the deterrent stake S = S(m, p) (milestone 35 closed form, kappa as before) to minimise cost per job = m (compute, r = 1) + c p (an audit costs c, in units of one job's compute) + lambda m S(m, p). p on a grid 0.01 to 1 (step 0.01), odd m 1 to 51, g in {0.5, 0.9}, kappa in {0.2, 0.5, 0.8, 1.0}, c in {0.1, 0.5, 2}, lambda in {0.01, 0.1, 1}. Deterrence is exact (stake at the least value), so the comparison is of designs, each deterrent.
• Predictions, before running: (1) at kappa = 1 the optimum is m = 1 in every cell (S* is flat in m, so replication only adds compute). (2) At lambda <= 0.1 the optimum is m = 1 in every cell with kappa >= 0.5. (3) Some cell with kappa < 0.5 and lambda = 1 picks m > 1 at an interior or high p (replication substitutes for stake when capital is dear); refuted if no cell does. (4) The optimal p is non-decreasing in lambda at fixed (g, kappa, c, m = 1) (dearer capital buys more audit); refuted by any decrease.
• Limits known in advance: audit cost c, lambda and the compute price are parameters, not measured; a single audit per job whatever m; one shared cheat mode; stake and audit are the only deterrents priced.

### Outcome (experiments/joint_audit_price/: run.py, results.txt, results.json, run.out; 72 cells, 25,000+ designs searched per cell)

• (1) held: m = 1 at every kappa = 1 cell. (2) held, and more strongly than predicted: m = 1 in all 72 cells, including every kappa < 0.5 cell.
• (3) refuted: no cell, even at lambda = 1 with kappa = 0.2, picks replication. The planned lever (dear capital makes replication substitute for stake) never beats raising the audit probability p: the principal buys deterrence with audit, not with replicas, because an extra replica costs a full unit of compute against audit costs of 0.1 to 2 per unit p.
• (4) held: the m = 1 optimal p never falls as lambda rises (0 violations in 24 chains). Example, g = 0.9, kappa = 1, c = 0.5: p* = 0.13, 0.42, 0.9 for lambda = 0.01, 0.1, 1.
• Reading: with the audit priced, replication is dominated as a deterrent in this model over the whole grid, tightening milestone 37 (which held p fixed). The stake-saving result of milestones 35 and 36 is real but not worth buying. Paper H4 gains one sentence.
• Limits: as stated before the run; the grid stops at m = 51 and p resolution 0.01; c, lambda and compute price are parameters.
• Next: faulty (non-strategic) workers, where replication has value the stake model omits; price it as a reliability benefit.

2026-10-27 · Milestone 37: is replication ever worth its compute? The break-even capital charge on stake (H4, planned before running)

• Why: milestones 6, 35 and 36 show replication (m workers, strict-majority acceptance) can cut the deterrent stake, to zero when cheaters copy a shared cheap mode with probability kappa < 1/2. It was never priced. Cost per job to the principal: m x (compute 1 = the job reward r) + lambda x m x S(m), where lambda is the capital cost of locking one unit of stake for the job's duration (stake is held by each of the m workers). Replication beats one worker (m = 1, stake S(1)) at m when lambda (S(1) - m S(m)) > m - 1; the break-even is lambda(g, kappa) = min over odd m > 1 of (m - 1) / (S(1) - m S*(m)) where the denominator is positive. Stake from stake_closed_partial (milestone 35 model, which applies kappa to a lone cheater too), p = 0.1, g in {0.5, 0.9}, kappa in {0.2, 0.35, 0.5, 0.65, 0.8, 1.0}, m = 1..201.
• Predictions, before running: (1) at kappa = 1 replication never pays (S(m) is flat, so m S(m) > S(1) for m > 1): break-even infinite. (2) Everywhere else the break-even is at least 0.25 (replicating to m = 3 saves at most S(1) <= g/p - r = 8 against 2 extra jobs of compute); refuted by any cell under 0.25. (3) So any realistic capital charge (lambda well under 0.01 per job: stake locked for minutes to days at annual rates) never justifies replication as a deterrent. Refuted if some cell has break-even under 0.05. This is a statement about the model; lambda is a parameter, not measured.
• Limits known in advance: compute cost equals the reward (r = 1) and is per replica; stake is the only deterrent priced; the principal's audit cost is ignored; lambda is a parameter.

### Outcome (experiments/replication_cost/: run.py, results.txt, results.json, run.out; 12 cells, odd m 3 to 201)

• (1) held: at kappa = 1 the break-even is infinite at both g.
• (2) held and far exceeded: the smallest finite break-even is 16.3 (g = 0.5, kappa = 0.65, m = 3), the others 20.5 (g = 0.9, kappa = 0.2, m = 3) and 25.5 (g = 0.9, kappa = 0.35, m = 9); the bar was 0.25. In the 9 other cells there is no m with a positive saving: replication cuts the stake per worker but m x S(m) never falls below S(1), or S*(1) is already 0.
• (3) held: no cell is under 0.05. A capital charge of 16 to 25 times the stake per job is the price at which replication pays, so at any realistic lock cost one worker with a stake and an audit is cheaper than replication as a deterrent in this model.
• Reading: replication's value is not cheap deterrence; it is robustness to a single faulty or bribed worker, which this stake-only pricing does not capture. Paper H4 paragraph gains this.
• Limits: as stated before the run; also the m = 1 stake uses the milestone-35 convention (kappa applies to a lone cheater), which lowers S*(1) at small kappa and so favours m = 1.
• Next: price the audit (cost per audit probability p) alongside the stake, so the principal chooses (p, S, m) jointly.

2026-10-27 · Milestone 36: with a single shared cheat mode copied with probability kappa, does replication come back? (H4; milestone 35, landed in parallel by another run, models coordination differently)

• Why: milestones 6, 33 and 34 give cheaters one shared trajectory (kappa = 1), which is why replication adds nothing against a coordinating majority. Milestone 31 measured the agreement of two independent cheap gradients at 0.03 to 0.35 on a transformer. Model (src/vtm/coalition.py, utilities_partial): each cheater lands on the shared cheap trajectory with probability kappa, otherwise its output agrees with nobody; the accepted output is a strict majority of m identical submissions. Exact expectation by enumerating which cheaters copy; strong equilibrium over all subsets (every member gains strictly), bisection on the stake.
• Order of work, stated honestly: I derived the closed form first, S = max(0, g / (1 - a(1 - p)) - r) with a = kappa P(1 + Bin(m-1, kappa) > m/2), the chance a cheater's copy is accepted when all cheat (the worst coalition), and spot-checked it for m <= 5 before the full run; prediction 1 is therefore a confirmation run. Predictions 2 to 4 were not checked beforehand.
• Predictions: (1) brute force equals the closed form to 1e-6 (g in {0.5, 0.9}, kappa in {0.2 ... 1.0}, m = 1 to 7, p = 0.1). (2) For kappa < 1/2 the stake falls to max(0, g - r) = 0 as m grows (refuted if the closed form at m = 51 exceeds half its m = 1 value where that is positive). (3) kappa = 1 is flat in m and equals g/p - r. (4) kappa = 1/2 is still positive at m = 201.

### Outcome (experiments/partial_copy_mode/: run.py, results.txt, results.json, run.out; 84 brute-force cells)

• (1) held: max |brute force - closed form| = 8.8e-10 over 84 cells; no infinite cell.
• (2) held: at g = 0.9 the stake is 0.098 / 0.314 at m = 1 for kappa = 0.2 / 0.35 and exactly 0 from m = 3 / m = 21 on. For kappa > 1/2 it does not vanish: g = 0.9, kappa = 0.65 settles at 1.169 and kappa = 0.8 at 2.214 (limit g / (1 - kappa(1 - p)) - r), against 8.0 at kappa = 1.
• (3) held: 4.000 (g = 0.5) and 8.000 (g = 0.9) at every m. (4) held: g = 0.9, kappa = 1/2: 0.636 (m = 1), 0.277 (m = 7), 0.181 (m = 201).
• Not predicted: for kappa > 1/2 the stake is not monotone in m; it zigzags with parity (g = 0.9, kappa = 0.65: 1.169, 0.452, 0.849, 0.552, 0.841, 0.629, 0.861 for m = 1 to 7), because an even m needs m/2 + 1 copies, one more than the odd number below it.
• Reading: replication works against a coordinating majority once copying is imperfect and rarer than one half: the least stake drops from the audit value to zero as m grows (a threshold at kappa = 1/2 from the law of large numbers). Above 1/2 it settles at a positive floor. The measured transformer value (milestone 31) is a pairwise agreement of independent cheap gradients; this model is "shared mode with probability kappa, else unique", so do not read 0.35 into the threshold without that assumption.
• Limits: symmetric savings; independent copying with a single shared mode (no second mode a subgroup could coordinate on); pure strategies; all-cheat as the worst coalition is from the closed form's monotonicity and confirmed by brute force only to m = 7.
• Next: a cheater that chooses whether to attempt the copy (coordination cost); the paper's H4 section gains this result (done in this milestone).

2026-10-27 · Milestone 35: does imperfect coordination among cheaters (kappa < 1) lower the deterrent stake in the m-worker game? (H4, planned before running)

• Why: milestones 6, 33 and 34 gave cheaters one shared trajectory (kappa = 1). Milestone 31 measured kappa on real gradients: independent cheap gradients agree only 0.03 to 0.35 of the time, shared ones always. Add kappa to the m-worker game (src/vtm/coalition.py, kappa argument of utilities, strong_equilibrium, min_stake, stake_closed; default 1 keeps every earlier result): two or more cheaters' outputs coincide with probability kappa; otherwise all differ, no output has a strict majority, and every submitter gets -S (no audit, no payment). A lone cheater coincides with itself.
• Closed form derived before running (m >= 2, r = 1): a cheater's deviation gain is g - (r + S)(1 - kappa (1 - p)), so S* = max(0, g / (1 - kappa(1 - p)) - r): the effective detection probability is 1 - kappa(1-p) instead of p. m = 1 is unchanged.
• Predictions: (1) brute force equals the closed form to 1e-6 in every instance (m = 2 to 6, kappa in {1, 0.75, 0.5, 0.25, 0}, g_i = g in {0.2, 0.5, 0.8}, p in {0.05, 0.1, 0.3}); refuted by any larger gap. (2) S* is non-increasing in kappa in every cell, and zero at kappa = 0 for g < 1 (a cheat that never coincides never pays); at kappa = 1 it equals the old g/p - r. (3) m = 1 is unaffected by kappa. (4) Reading for deployment: with measured kappa, the stake saved is only real if the cheaters cannot coordinate; the shared-quarter row of milestone 31 shows they can at no cost, so the conservative design uses kappa = 1. No test: a statement.
• Limits known in advance: all-or-nothing coincidence (one shared coin for the whole coalition, not pairwise agreement); equal savings; pure strategies; kappa is a parameter here, measured only in milestone 31.

### Outcome (experiments/partial_copy_mode/: run.py, results.txt, results.json, run.out; 270 brute-force cells)

• (1) held (after a fix): brute force equals the closed form to 8.4e-10 in all 270 cells. My first run was off by up to 15 in the m = 1 cells because the code applied kappa to a lone cheater; a lone output is its own majority, so kappa now applies only from two cheaters (stake_closed ignores it for m = 1).
• (2) held: the stake never rises as kappa falls (0 of 54 violations) and is zero at kappa = 0 for m >= 2 in 45 of 45 cells. At g = 0.5, p = 0.1: S* = 4.00 (kappa 1), 0.54 (0.75), 0 (0.5 and below), for every m from 2 to 6; m = 1 stays 4.00. (3) held.
• Reading: the stake needed falls steeply as soon as cheaters cannot make their outputs coincide, but the drop needs m >= 2 and uncoordinated cheaters. Milestone 31 measured kappa = 0.03 to 0.35 for independent cheap gradients and 1 for a shared-quarter cheat, so a deployment that must hold against coordinating cheaters keeps kappa = 1 and the stake of milestone 6.
• Limits: all-or-nothing coincidence; equal savings; pure strategies; kappa a parameter.
• Next: pairwise agreement (some cheaters coincide, others not) instead of one coin; paper H4 paragraph gains this result.

2026-10-27 · Milestone 34: what does it cost to keep the auditor out of the coalition? (H4, planned before running)

• Why: milestone 33's next steps named collusion with the auditor. Every earlier result treats the audit as incorruptible. Add the auditor as a player (src/vtm/coalition.py, utilities_aud, strong_equilibrium_aud, min_bond, bond_closed). Workers cheat on one shared trajectory as before; the audit (probability p) catches an accepted cheat if the auditor reports honestly. A colluding auditor reports clean; a meta-audit (probability q < p, the cost of checking the checker) exposes it, and then the auditor forfeits a bond B and the cheaters forfeit the stake S. Strong equilibrium with transfers over all subsets of workers plus the auditor; bisection on B.
• A finding before any experiment: an auditor paid only for catches earns 0 in the all-honest profile whether it colludes or not, so no reward for catching can deter it: the first version of the code (reward w, no bond) returned an infinite requirement in every instance. Deterrence needs something the auditor loses when collusion is found, hence the bond.
• Mistake caught on the way: my first closed form summed the k = floor(m/2)+1 largest savings. Brute force on one instance gave 38 where it gave 32 (g = 0.5, 0.3, 0.2; p = 0.1; S = 3; q = 0.02). A worker beyond the k needed joins the coalition when its saving exceeds the meta-audit's expected take q(r+S), so the corrected form is B* = max(0, sum of (g_i - q(r+S)) over the k largest, plus every further positive term) / q. The corrected form agreed on a 150-instance spot check (max difference 5e-10) before the experiment below was written, so prediction 1 is a confirmation run, not a blind test.
• Predictions, before the full run: (1) brute force equals bond_closed to 1e-6 in every instance with S at least the transferable-utility stake of milestone 33 (below it, workers alone deviate and no bond helps: B = inf, which the run also checks). (2) Replication raises the bond: with S set to the TU stake of each m, g_i ~ U(0,1), p = 0.1, q = 0.02, the mean B at m = 7 is at least 3x the mean at m = 1; refuted if under 1.5x. (3) With q = p the bond is zero at that stake in every instance (the meta-audit is as strong as the audit). (4) Raising S above the TU stake lowers B: B at 3x the stake is below B at the stake in every instance where B > 0.
• Limits known in advance: pure strategies and one shared cheat; the meta-audit probability q and bond are parameters, not measured; savings are drawn, not measured; transfers are costless; the auditor and the cheaters are the same coalition, so this is the favourable case for collusion.

### Outcome (experiments/auditor/: run.py, results.txt, results.json, run.out; 440 brute-force instances, g_i ~ U(0,1), p = 0.1, q = 0.02, m = 1 to 6)

• (1) held (as a confirmation): brute force equals the corrected closed form to 5.2e-10 in all 440 instances at S = the TU stake. Below the stake (0.9x) the bond is infinite in 432 of 432 instances with a positive stake: workers alone deviate and no auditor bond helps.
• (2) held, by a wide margin: mean B from the closed form, 100 draws per m: 17.4 (m = 1), 53.6 (3), 133.3 (7), 201.3 (11), 380.8 (21), 922.5 (51). Ratio m = 7 over m = 1 is 7.67 (bar 3, refutation under 1.5). Brute force m = 1 to 6: 20.6, 39.3, 57.8, 80.2, 91.0, 99.4. B grows about linearly in m, because the coalition that must be deterred pools the savings of a growing majority and every further worker joins once its saving exceeds q(r+S).
• (3) held: with q = p the bond is zero at that stake in 440 of 440 instances.
• (4) held after fixing my test: the first run flagged 3 of 435 instances as violations; all three had a worker-only stake of 0, where "3x the stake" is the same point, so the comparison was vacuous. Restricted to positive stakes: 0 of 432 violations (more stake always lowers the bond).
• Reading: replication, which adds nothing against a coordinating majority (milestone 6), also makes the auditor harder to keep honest: the bond that deters the joint worker-plus-auditor coalition grows with m, where for a single worker it is the cost of a single saving. Per worker, the bond needed per unit q is close to the saving, so a cheap meta-audit (small q) needs a large bond; a meta-audit as strong as the audit (q = p) at the stake needs none. The design implication for the paper: spend on checking the checker (q) rather than on worker stake or replication.
• Limits: pure strategies; q and B are parameters, not measured; savings drawn from a uniform law; costless enforceable transfers; the auditor and cheaters form one coalition (the case most favourable to collusion); an auditor paid only for catches cannot be deterred by its reward at all (model finding above).
• Next: partial copying kappa < 1 in the m-worker game; the paper's H4 paragraph gains this result (done in this milestone).

2026-10-27 · Milestone 33: does a side-payment (transferable-utility) coalition bring back the proposal's 1/m stake law? (H4, planned before running)

• Why: milestone 6 showed the least deterrent stake is flat in m, S* = max(0, g/p - 1), when all workers have the same saving g and a deviation must make every member strictly better off. It named side payments as the model change that might produce 1/m. Here workers have heterogeneous savings g_i (a cheap trajectory is cheaper for some, e.g. those with idle hardware), and a coalition may share its gains.
• Model (src/vtm/coalition.py, new gs and transfers arguments): as milestone 6 but worker i saves g_i. Non-transferable (NTU, the old rule): a joint deviation counts when every member gains. Transferable (TU): when the members' summed gain is positive (they can split it). Brute force over all subsets and joint actions, bisection on the stake, m = 1 to 7.
• Closed forms I derived before running (r = 1, majority = k = floor(m/2)+1): a cheating member's gain is g_i - p(1 + S) whenever cheaters hold a strict majority, so NTU S = max(0, g_(k)/p - 1) with g_(k) the k-th largest saving, and TU S = max(0, mean of the k largest g_i / p - 1) (a larger cheating coalition only adds smaller g_i, so k is the best size).
• Predictions, before running: (1) brute force matches both closed forms to the bisection tolerance in every cell; refuted by any cell off by more than 1e-6. (2) TU stake is at least the NTU stake in every cell, strictly greater whenever the k largest g_i are not all equal and the NTU value is positive. (3) Neither falls as 1/m: with g_i iid uniform on (0,1), p = 0.1, the mean over 200 draws of the NTU stake (the k-th order statistic, near the median 0.5, so near 4) and of the TU stake (near the mean of the upper half, 0.75, so near 6.5) are flat in m for m >= 5 within 25%, and both exceed the 1/m curve S*(1)/m by m = 7. The 1/m law is therefore not recovered by side payments; refuted if either mean at m = 7 is under 60% of its value at m = 3.
• Limits known in advance: pure strategies and one shared cheat; savings are drawn, not measured; TU assumes costless, enforceable transfers (the favourable case for the coalition); no collusion with the auditor.

### Outcome (experiments/side_payments/: run.py, results.txt, results.json, run.out; 1,080 brute-force instances, g_i ~ U(0,1), p = 0.1)

• (1) held: brute force equals both closed forms to 8.9e-10 in all 1,080 instances (m = 1 to 7; 200 draws for m <= 5, 40 for m = 6, 7).
• (2) held: TU stake is never below NTU (0 instances) and is strictly above it in 816 of 816 instances where the k largest savings differ and NTU > 0.
• (3) held: mean brute-force stake NTU / TU at m = 3, 5, 7: 3.71 / 5.11, 4.03 / 5.65, 4.00 / 5.83, against the 1/m curve 1.34, 0.80, 0.57. Ratio m = 7 over m = 3: NTU 1.08, TU 1.14 (refutation bar was under 0.60). Closed forms to m = 51 (200 draws): NTU stays at 3.9 to 4.1 (the median saving 0.5 gives 4.00); TU rises from 5.17 (m = 3) to 6.42 (m = 51), toward the upper-half mean 0.75 giving 6.50. Even m sits lower than odd m in the NTU brute-force means (3.06, 3.35 against 3.7 to 4.0) because the majority k = m/2 + 1 then reaches one step further down the order statistics.
• Reading: side payments do not bring back 1/m. They raise the deterrent stake (up to 1.6x here at large m), because the coalition can pool the savings of its most efficient cheaters, and the stake does not fall with m in either rule. Replication still adds no deterrence against a coordinating majority. H4's 1/m clause stays refuted as worded; the law belongs to per-verifier bribes (verifier-bribery), where the briber pays each verifier separately.
• Limits: savings drawn from a uniform law, not measured; costless enforceable transfers; one shared cheat; pure strategies; p fixed at 0.1 in the sweep (the closed form scales as 1/p).
• Next: the paper's H4 paragraph gains this result (done in this milestone); remaining: partial copying kappa < 1 in the m-worker game, or collusion with the auditor.

2026-10-27 · Milestone 32: the paper's H3 section gains the measured agreement table (no experiment)

• Why: milestone 31 measured delta, alpha and kappa on the transformer but the paper's "Redundancy and collusion" section still carried only the assumed-range result.
• Change: one paragraph in paper/main.tex ("Measured agreement on a transformer") with every figure copied from experiments/agreement/results.txt: delta 0.000; alpha and kappa at four tolerances; peer contract cheaper than audit-only in 2 of 16 cells for the independent quarter-batch cheat (tau 1e-1, p 0.1, saving 0.12 to 0.14) and 0 of 16 for shared-quarter and stale.
• Limits: not compiled (no LaTeX here; only commands already used in the file); the H4 side-payment variant is still open.

2026-10-26 · Milestone 31: what agreement probabilities do real cheap gradients have, and does that make agreement worth paying for? (H3 inputs, planned before running)

• Why: milestone 5 swept H3's inputs (benign disagreement delta, honest-cheat agreement alpha, cheat-cheat agreement kappa) over assumed ranges and found that agreement helps only when kappa < 1. The log's own next step was to measure alpha and kappa on real training. Code: experiments/agreement/run.py: along the honest transformer trajectory of transformer_cheats (same model, corpus, 600 steps, 10 seeds), at every step compute the honest gradient g, a second honest gradient g2 on a permuted batch, two cheats of the "subsample" kind, c1 and c2, each a gradient on an independent random quarter of the batch, a shared-quarter cheat (both workers take the first quarter, so kappa = 1 by construction) and the stale gradient (the previous honest one; two stale workers submit the same vector). Two submissions agree when lr * ||a - b|| <= tau. For tau in {1e-3, 1e-2, 3e-2, 1e-1}: delta = P(honest pair disagrees), alpha = P(cheat agrees with honest), kappa = P(two cheats agree). The measured triples then go into vtm.peer.peer_cost (g = 0.75 for a quarter batch, p in {0.1, 0.3}, S in {0, 1}) to see whether the unique-equilibrium contract with agreement is cheaper than audit-only.
• Predictions, before running: (1) Honest pairs agree: delta is under 1% at every tau (reorder drift is about 1e-8 of the step). (2) For independent quarters, kappa < alpha at every tau where either is strictly between 0.05 and 0.95 (two independent quarters are farther apart than one quarter and the full batch, by a factor of about 1.5 in variance), so cheats disagree with each other more than with an honest worker, and the agreement term then has the wrong sign for separating them: the peer contract is NOT cheaper than audit-only in the unique-equilibrium version in those cells. (3) The shared-quarter and stale cheats have kappa = 1 and the peer contract is no cheaper there. Refuted if (2) fails: kappa >= alpha with the 95% range over seeds above, at some tau in the interior.
• Limits known in advance: distances are measured on the honest trajectory (the cheaters' own trajectories would differ); agreement is a threshold on a gradient distance, one of several possible tests; 10 seeds; one model and corpus; the g, p and S of the contract step are chosen, not measured.

### Outcome (experiments/agreement/: run.py, results.txt, results.json, run.out; 10 seeds)

• Measured agreement, tau 1e-3 / 1e-2 / 3e-2 / 1e-1 (mean over seeds; 2.5/97.5 percentiles over seeds are in results.txt): honest pair delta 0.000 at every tau; alpha (independent quarter-batch cheat agrees with the honest gradient) 0.038 / 0.122 / 0.216 / 0.429; kappa (two independent quarter-batch cheats agree) 0.032 / 0.102 / 0.185 / 0.350; shared-quarter cheat vs honest 0.038 / 0.123 / 0.218 / 0.428; stale vs honest 0.042 / 0.136 / 0.239 / 0.451. These alpha values equal the accept rates of milestone 26 to within 0.003 (the same event, a cheap gradient within tau of the referee's).
• (1) held: delta is zero to three digits at every tau (reorder drift is far below 1e-3). (2), first half, held: kappa < alpha at every tau, and the seed ranges do not overlap (tau 1e-1: kappa [0.345, 0.353] against alpha [0.424, 0.435]). (2), second half, refuted: I predicted the peer contract would be no cheaper than audit-only in those cells. Using the measured triple in vtm.peer.peer_cost with the unique-equilibrium requirement, the peer contract is cheaper in exactly one cell group: quarter-batch cheat, tau 1e-1, p = 0.1: cost 6.596 against 7.500 (S = 0, saving 12.0%) and 5.596 against 6.500 (S = 1, 13.9%). At p = 0.3 and at every tau up to 3e-2 the costs are equal to four digits. (3) held: shared-quarter and stale cheats (kappa = 1) get no saving anywhere.
• Why my reasoning failed: a worker facing a cheating peer also sees disagreement with probability 1 - alpha, so a penalty on disagreement hits the honest worker too; the contract can only use the gap alpha - kappa (0.079 at tau 1e-1, 0.006 to 0.03 below), which is what the saving is paid for. Where delta = 0 and alpha is small the agreement signal is nearly perfect at telling a cheat from an honest peer, yet worth nothing once (cheat, cheat) must not be an equilibrium.
• Reading: on real gradients, agreement between redundant workers is worth paying for only where independent cheats are measurably less alike than a cheat and an honest worker, which here is a 0.08 gap at the loosest tolerance and one audit rate. This narrows the paper's H3 statement: "once copying is excluded, agreement helps only through alpha - kappa, and on a transformer that gap is at most 0.08".
• Limits: distances on the honest trajectory only; agreement defined as a gradient distance threshold (the same tau as acceptance); quarter-batch cheats pick their quarter at random, and a cheat that coordinates which quarter to use is the shared-quarter row; 10 seeds; one model and corpus; g, p, S chosen not measured.
• Next: the paper's H3 paragraph with this table; the H4 side-payment variant (when does a 1/m stake law appear).

2026-10-26 · Milestone 30: the paper's H6 section gains milestones 27 to 29 (no experiment)

• Why: the draft covered predictors A, B, C, kC and the C-on-other-cheats result (milestones 24 to 26) but not the direction, decomposition and curvature runs, which together explain why the norm test cannot bound damage for the subsample and stale cheats.
• Change: one paragraph in paper/main.tex, "Negative results (H6)", with every figure copied from experiments/{direction,subsample_decomp,curvature}/results.txt as logged in milestones 27 to 29, including their caveats (orthogonal-arm intervals contain zero; second-order sum off by 44x to 110x, so no bound is offered).
• Limits: the container has no LaTeX, so the paragraph was not compiled here (it uses only commands already used in the file); the abstract and limitations were not changed.

2026-10-26 · Milestone 29: is the subsample cheat's orthogonal error harmful because it points along high-curvature directions? (H6, planned before running)

• Why: milestones 27 and 28 put the subsample damage in a structured component orthogonal to the honest gradient, not in its size or its parallel part. Test the curvature explanation directly. Code: experiments/curvature/run.py: the real cheat, same seeds, batches and acceptance rule; at each accepted step, Hessian-vector products of the full-batch loss give the Rayleigh quotient u'Hu of the unit orthogonal error, of a random unit direction, and of the honest gradient direction; lambda_max by 8 power iterations every 10th accepted step; second-order sum 0.5 lr^2 e_orth'H e_orth. Taus 3e-2 and 1e-1, 10 seeds.
• Predictions, before running: (1) Rayleigh(orth) is at least 3x Rayleigh(rand) (mean of per-seed ratios, 95% range over seeds above 1), because a random direction in a high-dimensional parameter space has curvature near the mean eigenvalue, while a quarter-batch gradient error is built from the same per-example gradients that dominate the Hessian's top eigenspace. (2) Rayleigh(orth) is still well below lambda_max (under 50%). (3) The second-order sum is within a factor 3 of the measured damage at tau 1e-1 (+0.0024). Refuted: (1) if the ratio is under 1.5 (curvature does not explain the harm); (3) if off by more than 10x.
• Limits known in advance: 10 seeds; one model and corpus; curvature of the batch loss at the current point, not of held-out loss over the remaining path; the second-order sum ignores interaction with later steps and the gradient term.

### Outcome (experiments/curvature/: run.py, results.txt, results.json, run.out; 10 seeds)

• Rayleigh quotient u'Hu of the unit orthogonal error against a random unit direction, tau 3e-2 / 1e-1: 1.006 / 0.964 against 0.0031 / 0.0030, ratio 324 [297, 361] / 320 [300, 349] (mean and 2.5/97.5 percentiles over seeds). The honest-gradient direction has 1.16 / 1.29. lambda_max (8 power iterations, every 10th accepted step) 5.6 / 5.4.
• (1) held, by two orders of magnitude (bar was 3x, refutation under 1.5x). (2) held: the orthogonal error sits at about 18% of the lambda_max estimate (an 8-iteration power estimate is a lower bound, so the true share is smaller still). It is as sharp as the gradient direction itself, not at the top of the spectrum.
• (3) refuted. The second-order sum 0.5 lr^2 e'He over accepted steps is +0.0120 / +0.2644 against measured held-out damage +0.00027 / +0.00240: 44x and 110x too large (my bar was off by more than 10x = refuted).
• Reading: curvature explains why direction matters (the matched-size random error of milestone 27 sees about 1/320 of the curvature), but a one-step quadratic sum is a useless damage predictor, because later honest steps damp most of the injected error in sharp directions and the batch loss at the current point is not the held-out loss at the end. This is a repeat of the milestone 24 to 26 pattern: the mechanism is identifiable, the closed form is not. The paper's H6 section should say so and not offer a second-order bound.
• Limits: 10 seeds; one model and corpus; curvature of the batch loss, not held-out; lambda_max underestimated by 8 iterations; the run uses PyTorch's math attention kernel (the fused CPU kernel has no double backward), so trajectories differ at float level from transformer_cheats and the measured damage is borrowed from there, not rerun; stale not measured.
• Next: model the damping (a linear-recursion predictor: injected error propagated through the following steps with I - lr H), or stop H6 at the mechanism and move to milestone 5 (joint contract).

2026-10-26 · Milestone 28: for the subsample cheat, is the damage in the error component along the honest gradient or orthogonal to it? (H6, planned before running)

• Why: milestone 27 refuted "isotropic random error of the same norm does the same damage" for subsample (random is about 9x smaller at tau 1e-1) and left open which structured part of the error matters. Split e = cheap - g into a parallel part (e.g_hat) g_hat and an orthogonal remainder, and apply each alone with the cheat's own acceptance rule. Code: experiments/subsample_decomp/run.py (from experiments/direction/run.py; same 10 seeds, 600 steps, taus 1e-2, 3e-2, 1e-1; compared with the measured real damage in transformer_cheats/results.json).
• Predictions, before running: (1) The orthogonal-only arm carries at least half of the real damage at tau 1e-1 (+0.0024), because a quarter-batch gradient's error is mostly gradient noise orthogonal to g. (2) The parallel-only arm is near zero damage (|damage| under 20% of real, interval containing zero), because a quarter of the batches give a mean parallel coefficient near 0 (the four quarter gradients average to g, so the average of e.g over quarters is exactly zero). Refuted if the parallel arm carries at least half of the real damage, in which case the cheat acts as a step-size distortion, not as noise.
• Limits known in advance: 10 seeds; one model and corpus; acceptance decisions differ between arms because trajectories differ; the split is relative to the honest gradient only, not to curvature.

### Outcome (experiments/subsample_decomp/: run.py, results.txt, results.json, run.out; 10 seeds)

• Damage (held-out loss over honest, 10 seeds) at tau 1e-2 / 3e-2 / 1e-1: real +0.00019 / +0.00027 / +0.00240; orthogonal-only +0.00020 / +0.00028 / +0.00234 (ratios 1.04, 1.02, 0.97); parallel-only -0.00001 / -0.00002 / +0.00007 (ratios -0.07, -0.06, 0.03). Mean parallel coefficient alpha over accepted steps +0.001 to +0.002.
• (1) held on the point estimates: the orthogonal part reproduces the real damage at every tau (0.97 to 1.04). (2) held: the parallel part is under 8% of real, intervals contain zero.
• Caveat on strength: the orthogonal-arm intervals are wide and contain zero at all three taus (tau 1e-1: [-0.00016, +0.00541]), as the real cheat's did in milestone 26 for tau below 1e-1, so this says the orthogonal component accounts for the mean damage, not that either is separately detectable at 10 seeds.
• Reading: with milestone 27 (isotropic random error of the same norm is about 9x weaker), the subsample harm sits in a structured orthogonal component, not in a step-size distortion along g. What makes that component harmful (alignment with high-curvature directions, or with the batch's own examples) is untested.
• Limits: 10 seeds; one model and corpus; split relative to the honest gradient only; stale cheat not decomposed.
• Next: project the orthogonal error onto the top Hessian eigendirections (power iteration) to test the curvature explanation; delayed-gradient predictor for stale.

2026-10-26 · Milestone 27: is the damage of the subsample and stale cheats set by the size of the accepted error or by its direction? (H6, planned before running)

• Why: milestone 26 showed path-length predictor C misses both cheats (7x over for subsample, 30x to 100x under for stale). Its "Next" proposed a size-of-error predictor. Before building one, test whether size is the right variable: if error of the same norm in a random direction does the same damage as the real cheat, a size predictor is the right family; if not, direction (systematic bias) is what matters and no norm-based predictor can work.
• Method (experiments/direction/run.py): same transformer, corpus, 10 seeds, 600 steps and acceptance rule (lr ||cheap - referee|| <= tau) as transformer_cheats. The "rand" arm, for each cheat and tau in {1e-2, 3e-2, 1e-1}, accepts the same way but applies the honest batch gradient plus an error of norm ||cheap - g|| in a uniformly random direction. Damage = held-out loss minus the honest run's, paired by seed; interval = 2.5/97.5 percentiles of the 10 paired differences. Compared with the measured real-cheat damage from transformer_cheats/results.json. Also reported: error path share = sum of accepted lr||cheap - g|| / sum of lr*||g||.
• Predictions, before running: (1) Subsample: the random-direction damage is within a factor 2 of the real damage at tau 1e-1 (+0.0024), because a quarter-batch error is mostly sampling noise, which is direction-free. (2) Stale: the random-direction damage is below 10% of the real damage (+0.018, +0.31, +1.55) at every tau, because a reused gradient is a systematic lag, not noise. Refuted if random-direction damage is at least 50% of real at any tau >= 3e-2. (3) The error path share is under 12% for both cheats at every tau, so the size of the error cannot account for a stale damage of 1.55 nats.
• Limits known in advance: 10 seeds; one model and corpus; random isotropic error is only one alternative direction; the acceptance decisions in the rand arm are made on the cheat's own error but the trajectories differ, so accept rates differ slightly.

### Outcome (experiments/direction/: run.py, results.txt, results.json, run.out)

• Damage of the random-direction error (same accepted steps' error norm), against the real cheat, held-out loss over honest, 10 seeds: subsample 1e-2 / 3e-2 / 1e-1: +0.00001 / +0.00004 / +0.00027 against real +0.00019 / +0.00027 / +0.00240 (ratios 0.05, 0.14, 0.11). Stale: +0.00002 / +0.00007 / +0.00072 against real +0.01765 / +0.30677 / +1.55000 (ratios 0.00, 0.00, 0.00). Random-direction intervals contain zero in 5 of 6 rows (the stale 1e-1 row, +0.00072 [-0.00025, +0.00141], also does).
• Error path share (accepted lr*||cheap - g|| over path): subsample 0.4%, 2.3%, 16.1%; stale 0.7%, 3.7%, 23.9% at tau 1e-2, 3e-2, 1e-1.
• (1) refuted. I expected subsample's random-direction damage within 2x of the real one; it is about 9x smaller at tau 1e-1. A quarter-batch gradient's error is not direction-free noise: it is correlated with the step (the quarter batch is a subset of the batch it approximates, and a shorter-batch gradient is systematically biased toward the batch's own examples).
• (2) held. Stale random-direction damage is under 0.1% of the real damage at every tau; the refutation clause (50% at tau >= 3e-2) was not near. A reused gradient hurts through direction, not size.
• (3) refuted at tau 1e-1 (16% and 24% share against my 12% bar); held at 1e-2 and 3e-2. At 3e-2 the stale cheat's share is 3.7% yet it costs 0.31 nats, at which matched-size random error costs 0.00007.
• Reading: for both cheap-gradient cheats the harm of accepted steps is set by the direction of the error, not by its size, so a predictor built from accepted error norms (the "next" of milestone 26) is the wrong family and is dropped. A usable predictor needs the systematic part of the error: for stale, the lag (a delayed-gradient model whose damage depends on curvature and step size); for subsample, the correlated component. Whether the referee's threshold on norm can bound damage at all is then in doubt for these cheats; the paper's H6 section should say the norm test certifies a path share, not a loss bound, for non-skip cheats.
• Limits: 10 seeds; one model and corpus; isotropic random error is one alternative direction, not the only one (an error along the true gradient or in the stale direction at random sign would separate lag from bias further); accept rates in the rand arm differ from the real arm by up to 2 points for stale at 1e-2 (0.119 vs 0.136).
• Next: a delayed-gradient predictor for stale (the damage as a function of lag and lr, checked against 1.55 nats), and an error-direction decomposition for subsample (component along the honest gradient versus orthogonal).

2026-10-26 · Milestone 26: does path-length predictor C carry to the subsample and stale cheats? (H6, planned before running)

• Why: milestone 25 left C untested on cheats whose acceptance depends on the cheat's own error. Fix: record, in the honest run, the distance e_t of each cheap gradient from the referee's (quarter-batch gradient; previous honest gradient) beside the update norm d_t (vtm.margin_tf.train(record=True) now returns dist_subsample, dist_stale; trajectories unchanged). Code: experiments/h6_cheats/run.py, same 10 seeds and 600 steps as transformer_cheats.
• Predictions, before running: (1) the accept rate predicted from honest runs matches the measured one for subsample (the cheat does not change the model much) and undershoots it for stale (a chain of reused gradients drifts, so later steps are accepted more often). (2) C, which treats an accepted step as a skipped one, overshoots subsample (a quarter-batch gradient still descends; I expect C/measured above 2 at tau 1e-1) and undershoots stale (a reused gradient is worse than no step; ratio below 0.5 at tau >= 1e-2). So C is inside [0.5, 2] on at most 2 of the 8 rows. Refutation of "C is specific to skip": C inside the band on at least 5 of 8 rows.
• Limits: 10 seeds; rows with CI containing zero are not scored.

### Outcome (experiments/h6_cheats/: run.py, results.txt, results.json)

• Accept rate predicted from honest runs: subsample matches the measured rate to three digits in all four rows (0.038, 0.123, 0.218, 0.428). Stale matches at 1e-3 and 1e-2 (0.042, 0.136) but overshoots at 3e-2 (0.239 vs 0.226) and 1e-1 (0.451 vs 0.386). I had predicted an undershoot; the sign was wrong, chains of reused gradients are accepted less often than a single reuse from an honest gradient.
• C / measured: subsample 2.83 (1e-2, not detectable), 8.03 (3e-2, not detectable), 7.03 (1e-1, the one detectable row: +0.0024 measured vs +0.0169 predicted); stale 0.03, 0.01, 0.01 at 1e-2, 3e-2, 1e-1 (measured +0.018, +0.31, +1.55 against predicted +0.0005, +0.003, +0.020). Inside [0.5, 2]: 0 of 8 rows.
• Verdict: prediction (2) held, refutation clause met. C is a predictor for the skip cheat only: it overshoots a cheat that still descends (subsample, 7x) and undershoots one that moves the model the wrong way (stale, 30x to 100x), because it prices an accepted step by the distance it forgoes and ignores what the cheat does instead. A predictor for these cheats needs the cheat's own error, for example the accepted steps' e_t summed, not the honest step's d_t.
• Limits: 10 seeds, one corpus, one model; the stale gap grows with tau, so the honest-run distance is a worse proxy as chains lengthen; no attempt yet to predict with e_t.
• Next: test an error-based predictor (sum of accepted e_t as the lost-or-wrong path share) on both cheats; add this row to the paper's H6 section.

2026-10-26 · Milestone 25: does a one-parameter correction k * C, fitted on digits, carry to the transformer? (H6)

• Why: milestone 24 left C (parameter-free path-length predictor) below 1 at every non-trivial row (0.11 to 0.97 on digits, 0.49 to 0.69 on the transformer) and named a fitted correction as the next step. Code: experiments/h6_fitted/run.py, an analysis of milestone 24's results.json only (no new training).
• Plan, written after seeing the 24 table but before running the fit: k = geometric mean of measured/C over the digits rows that are detectable and below tau 0.3 (1e-3, 1e-2, 1e-1; 3e-1 is trivial); apply k C to the transformer, which the fit never sees. Prediction: k near 3.6 does not transfer. It would lift the transformer's 1e-2 row into the band but push the two scored rows (3e-2, 1e-1), where C was already inside [0.5, 2], above 2, so the corrected predictor lands in the band on no more rows than C. Refutation: k C inside the band on at least 3 of the 4 transformer rows.
• Outcome (experiments/h6_fitted/: run.py, results.txt, results.json): measured/C on the fit rows 9.51, 3.02, 1.62; k = 3.60 (leave-one-row-out 2.21, 3.93, 5.36, so the fit is unstable, since the ratio falls with tau). Transformer k C / measured: 1e-3 0.00, 1e-2 1.75, 3e-2 2.21, 1e-1 2.48. Inside [0.5, 2]: C 2 of 4, k C 1 of 4.
• Verdict: prediction held, correction refuted. The undershoot of C is not a constant factor: on digits it shrinks from 9.5x at tau 1e-3 to 1.6x at 1e-1, so a single k fixes one end and breaks the other, and the transformer's scored rows go from inside the band to 2.2x and 2.5x over. Keep C unfitted as the H6 predictor; its remaining error is a function of tau (the unobserved cost of skipping, for example the batch never seen), which a second-order or per-step term, not a scalar, would have to model.
• Limits: three fit rows, one fitted scalar, analysis of existing runs; skip cheat only. C on stale and subsample is not tested (acceptance there depends on the cheat's own error, not on the honest norms, so C needs per-step accept flags that milestone 19 did not store).
• Next: log accept flags in transformer_cheats and test C's path-share form on subsample; try a tau-dependent term; add the negative result to the paper's H6 section.

2026-10-26 · Milestone 24: does a parameter-free path-length predictor fix H6? (planned before running)

• Why: milestone 7a refuted H6 for two simple predictors on the digits MLP: A (first order) overshoots 12x to 123x, B (train fewer steps, skipped share counted in steps) overshoots 3x to 18x, because the skipped steps are the small ones and their loss is recovered. The log named "a better predictor" as the paper's open constructive claim. H6 has never been tested on the transformer.
• Predictor C (no fitted parameter, sees only the honest runs): skipping at tau forgoes a share g(tau) = sum over steps with |d_t| <= tau of |d_t|, divided by sum of all |d_t| (share of the path length, not of the step count). Predict the degradation as the held-out loss of an honest worker trained round((1 - g) T) steps on the same compressed schedule, minus the honest loss. Idea: B counts a skipped step as a whole step of progress; the skipped steps carry a small part of the distance travelled.
• Evaluation (experiments/h6_pathlength/run.py): digits MLP (20 seeds, measured from experiments/margin/results.json) and the transformer (10 seeds, 600 steps, honest norms recorded, measured from experiments/transformer/results.json). Report A, B, C ratios against measured. Scored rows: measured degradation above the honest seed std; also rows whose 95% CI excludes zero ("detectable"), because only 2 rows per setup clear the std bar. H6 as stated: ratio in [0.5, 2] on a majority of settings.
• Prediction: C overshoots less than B at every detectable tau (it must, since g < f), and lands inside [0.5, 2] on at least half of the detectable rows of the digits MLP. On the transformer I expect C within 2x at tau = 1e-1 and an undershoot of more than 2x at small tau, where the true cost of skipping is tiny but C is not zero. Refutation of C: ratio outside [0.5, 2] on a majority of detectable rows in both setups.
• Not tested: other cheats than skip, other models, a fitted (one-parameter) predictor.

### Outcome (experiments/h6_pathlength/: run.py, results.txt, results.json; digits 20 seeds, transformer 10 seeds)

• C/measured, rows scored (degradation above seed std): digits tau 1e-1 0.62, 3e-1 0.97 (trivial: every step skipped); transformer tau 3e-2 0.61, 1e-1 0.69. All four are inside [0.5, 2]; B was 2.4x to 6.7x on the non-trivial ones (A 12x to 123x).
• Detectable rows (95% CI excludes zero, below the std bar): C undershoots: digits 1e-3 0.11, 1e-2 0.33; transformer 1e-3 0.00 (path share 0.02%), 1e-2 0.49. B overshoots these by 4.5x to 93x. So over all detectable-or-scored rows C is inside [0.5, 2] on exactly half (2 of 4 per setup), not a majority.
• Verdict: prediction held (C is closer to the measurement than B at every non-trivial row; inside the band on half the digits rows; transformer within 2x at 1e-1 and undershooting at small tau). Refutation condition (majority outside on both setups) not met, since it is exactly half. H6 as worded (ratio in [0.5, 2] on a majority of settings): holds on the scored rows of both models, does not on the small-tau detectable rows. C is a lower-side predictor: ratio below 1 at every non-trivial row (0.33 to 0.97 except the transformer's 1e-3), consistent with skipping also costing something beyond the forgone distance (a skipped step's batch is never seen).
• Limits: two rows per setup clear the std bar, so "holds" rests on four points; no fitted parameter, but also no held-out tuning, and C was designed after seeing B's overshoot in 7a; skip cheat only; transformer measured degradation comes from milestone 11 (same seeds and honest runs, rerun here only for norms).
• Next: a one-parameter correction (or a second-order term) fitted on digits and tested on the transformer; test C on the stale and subsample cheats; add to the paper's H6 section.

2026-10-26 · Milestone 23: the draft compiles with the federated-learning citations (no experiment)

• Installed TeX Live again (texlive-latex-extra, -publishers, -fonts-recommended, cm-super, -bibtex-extra; the install took several minutes, and a second apt-get started while the first ran failed on the dpkg lock) and ran pdflatex, bibtex, pdflatex twice on paper/main.tex. Result: 4 pages, no undefined references or citations, so kang2019contract and lin2019freeriders from milestone 22 resolve. This closes milestone 22's compile check.
• Still open: bibtex warns of missing publisher, address and page fields on several entries (not filled from memory); EC'26 single-column style files and page limit (owner step); whether a no-chain rule is enforceable.

2026-10-25 · Milestone 22: related work gains federated-learning incentives (no experiment)

• Added a paragraph to paper/main.tex and two entries to paper/refs.bib: Kang et al. 2019, contract-theory incentives for federated learning (arXiv:1905.07479), and Lin, Du & Liu 2019, free-riders in federated learning (arXiv:1911.12560). Both ids returned the cited titles, years and author lists from the arXiv API this session. The Limitations sentence now names what related work still lacks: trusted-hardware attestation and Byzantine-robust aggregation.
• Not compiled: this session had no LaTeX (milestone 16's TeX Live install was not repeated), so the two new \cite keys are unchecked by bibtex. Searched Crossref for Truebit and SafetyNets; no usable hit, so they are not cited.
• Still open: the compile check above, EC'26 style files and page limit (owner step), whether a no-chain rule is enforceable.

2026-10-25 · Milestone 21: cheaper-cheat results move into the paper (no new experiment)

• Added a "Cheaper cheats" paragraph and Table tab:cheats (skip, subsample, stale, stale1 at tau = 1e-2) to the margin section of paper/main.tex; every number is copied from experiments/transformer_cheats/results.txt and experiments/transformer_stale_chain/results.txt (milestones 19 and 20), none rerun. Rewrote the Limitations tail: it still said the draft was uncompiled (it compiled in milestone 16) and now names the real gaps (incomplete related work, sigconf instead of the EC'26 single-column style, page limit unchecked).
• Still open: related-work section, the EC'26 style files and page limit (owner step), whether a no-chain rule is enforceable.

2026-10-25 · Milestone 20: is the stale cheat expensive because reuse chains across steps? (H1), planned before running

• Why: milestone 19 found stale costs +0.0177 (2.1 seed std) at tau = 1e-2 and the mechanism was a guess. One candidate: an accepted stale gradient becomes the next step's "previous gradient", so reuse can chain over consecutive steps and drift further from the true gradient. stale1 (margin_tf.py) allows reuse only of an honestly computed gradient, so a chain has length 1. Code: experiments/transformer_stale_chain/run.py; same setup as milestone 19 (600 steps, 10 seeds, fixed split, reorder referee, same taus).
• Prediction: stale chains are long at 1e-2 (mean chain above 1.5, max above 5) and stale1 is accepted on fewer steps (under 8% at 1e-2, vs 13.6%) and costs under a third of stale: degradation at 1e-2 below +0.006 (stale: +0.0177) with stale1 CI overlapping one seed std (0.0083) or less. Refutation of the chaining explanation: stale1 degradation at 1e-2 above +0.012, or within 30% of stale's.
• Analysis: as milestone 19 plus mean and max accepted-chain length. Not tested: other models, a cap above 1, momentum.

### Outcome (experiments/transformer_stale_chain/: run.py, results.txt, results.json; 10 seeds, fixed split, honest loss 2.7252, seed std 0.0083)

• Stale reuse chains: mean accepted-chain length 25.3 / 43.5 / 13.0 / 5.4 steps at tau 1e-3 / 1e-2 / 3e-2 / 1e-1, longest 26 / 83 / 108 / 137 (the prediction of mean above 1.5 and max above 5 at 1e-2 was far too low). A chain is a run of consecutive accepted reuses, so the cheater skips every backward pass for dozens of steps.
• stale1 (reuse only after an honest step), accepted share 2.2 / 6.9 / 12.1 / 22.9%; degradation (95% CI) +0.00001, +0.00016 (+0.00004 to +0.00026), +0.00014, +0.00125 (+0.00071 to +0.00173). At tau = 1e-2 that is 1% of stale's +0.01765 and 0.02 seed std; at 1e-1 it is 0.15 std against stale's 187 std.
• Verdict: prediction held (accepted 6.9% < 8%; degradation < +0.006; refutation threshold +0.012 not reached). Chaining explains the stale cost: the harm comes from reusing a gradient for many steps in a row, which a referee that checks each step against its own recompute cannot see, because every step in the chain starts within tau of the last accepted one. A rule that forbids reusing a submitted gradient (the prover must show a fresh forward pass, for instance) removes it in this setup.
• Limits: this shows the chain is what costs, not that the no-chain rule is enforceable (stale1 is an idealised cheater that obeys it, no enforcement mechanism is modelled); caps above 1 not tried; same 30k-parameter model, 600 steps, plain SGD.

2026-10-25 · Milestone 19: do cheaper cheats than skipping pass the reorder referee on the transformer? (H1), planned before running

• Why: every transformer result so far uses one cheat (skip). The paper's Limitations say "the skip shortcut only for the dense results". Two cheats that save real compute and submit a non-zero update: subsample (gradient of a quarter of the batch, about 4x cheaper) and stale (resubmit the previous step's gradient, no backward pass). Same referee as milestone 11 (accepts when lr * ||submitted - referee recompute|| <= tau, float32 reorder), same 600 steps, 10 seeds, fixed split. Code: experiments/transformer_cheats/run.py, margin_tf.py strategies subsample and stale.
• Prediction: both are accepted far less often than skip at equal tau, because their error is gradient noise or staleness, not a small step: at tau = 1e-2 subsample is accepted on under 5% of steps and stale on under 10% (skip: 16%); at tau = 1e-3 both on under 1%. Where they are accepted the cost is below one seed std. At tau = 1e-1 both are accepted on a majority of steps (update norms have a median 0.08) and degrade held-out loss by more than 1 seed std. Refutation of the narrow form of H1 for these cheats: acceptance at tau = 1e-2 above skip's 16%, or a degradation CI at tau = 1e-2 that excludes zero and exceeds one seed std (0.0083).
• Analysis: as milestone 11 (paired degradation against the honest run of the same seed, 95% bootstrap CI, accepted share, share of seeds where cheating is better). Not tested: other models, bf16 referee, combinations of cheats.

### Outcome (experiments/transformer_cheats/: run.py, results.txt, results.json; 10 seeds, fixed split, honest loss 2.7252, seed std 0.0083)

• Accepted share (subsample / stale): tau 1e-3 3.8% / 4.2%; 1e-2 12.3% / 13.6%; 3e-2 21.8% / 22.6%; 1e-1 42.8% / 38.6%.
• Degradation (95% CI): subsample +0.00001, +0.00019 (-0.00024 to +0.00057), +0.00027, +0.00240 (0.0013 to 0.0036); stale +0.00001, +0.0177 (0.0132 to 0.0220), +0.307, +1.55.
• Verdict: the prediction was mostly wrong on acceptance. Both cheats are accepted on 4% of steps at tau = 1e-3 (predicted under 1%) and on 12 to 14% at 1e-2 (predicted under 5% and 10%), and on fewer than half of steps at 1e-1 (predicted a majority). Acceptance is close to skip's (16% at 1e-2), which suggests the referee mainly accepts the small-update steps whatever the cheat. On cost: subsample never costs more than 0.3 seed std up to 3e-2 and 0.3 std at 1e-1, so it is a free saving, not a refutation (H1 narrow form not refuted for it). Stale refutes the narrow form of H1 at tau = 1e-2: +0.0177 is 2.1 seed std with a CI excluding zero, ten times skip's +0.0017, and it reaches 1.55 (187 std) at 1e-1. The margin therefore depends on the cheat: a tolerance that is harmless against skipping and subsampling already admits a harmful stale cheat.
• Limits: 30k parameters, 600 steps, plain SGD, one fixed split, stale reuses the last submitted gradient (reuse can chain across consecutive accepted steps; chain length not measured), no compute accounting beyond the nominal 4x for subsample. The mechanism for the stale cost is a guess, not tested.

2026-10-25 · Milestone 18: the transformer margin with the held-out block moved per seed (H1), planned before running

• Why: the paper's Limitations say the transformer uses one fixed split (last 20% held out), so the seed std excludes split variance. experiments/transformer_splits/run.py is the milestone 11 run (600 steps, 10 seeds, float32 reorder referee, taus 1e-3 to 1e-1) where seed s holds out the contiguous 20% block starting at s/9 of the corpus (10 evenly spaced positions, train on the rest; honest and skip share the split, so the paired difference is unaffected by it).
• Prediction: the skip shortcut's cost at tau = 1e-2 stays below one (now larger) seed std, with the 95% CI of the paired degradation still above zero and within about 0.003 of the milestone 11 value (+0.0017); the skipped shares match milestone 11 (5%, 16%, 29%, 59%) within 2 points since they depend on gradient norms, not the split. Refutation of the narrow form of H1 here: degradation at tau = 1e-2 above one seed std with a CI excluding zero, or a CI that includes a benefit larger than the cost at milestone 11.
• Analysis: as milestone 11 (paired degradation, 95% bootstrap CI, share skipped, share of seeds where skipping is better).
• Result (experiments/transformer_splits/, 10 seeds, each with its own held-out block, float32 reorder referee, torch CPU): honest held-out loss 2.7775, seed std 0.0706 (8.5x the fixed-split std of 0.0083, so split choice dominates the variance). Reorder drift p99 9.2e-8, max 1.6e-7; update norms 10/50/90%: 0.0039 / 0.080 / 0.220 (as milestone 11). Skip degradation (paired, 95% CI): tau = 1e-3 skips 5.1%, +0.00006 (0.00002 to 0.00011); 1e-2 skips 16.2%, +0.00155 (0.00123 to 0.00190, 0.02 seed std); 3e-2 skips 28.7%, +0.0081 (0.0071 to 0.0093); 1e-1 skips 59.5%, +0.0646 (0.0577 to 0.0711). Skipping was better on 2 of 10 splits at 1e-3 and on none at larger tau.
• Verdict: prediction held. Degradation at 1e-2 (+0.00155) is within 0.003 of milestone 11 (+0.0017), its CI excludes zero, and the skipped shares match milestone 11 within 0.3 points. The narrow form of H1 is not refuted, and the fixed-split limitation is lifted for the margin: the paired cost is nearly independent of which block is held out. Measured against the larger split-inclusive std, the cost at 1e-2 is negligible (0.02 std).
• Limits: still 30k parameters, 600 steps, plain SGD, float32 reorder referee, skip shortcut only; splits are 10 contiguous blocks of one 87 kB text, not independent corpora.

2026-10-25 · Milestone 17: venue-format check and proof layout (no experiment)

• The EC'26 call (found by search; ec26.sigecom.org is not reachable through the proxy, so the page was not read) says submissions must use the EC'26 LaTeX style files, single column at 10 pt, and may be rejected without review for using another style or exceeding the page limit. The draft uses acmart sigconf (two columns), so it is not in the venue's format, and the page limit was not found (past calls: 18 pages, 2014 and 2016 only). Both must be checked against the call before submission: an owner step, with the style files.
• Fixed the 17 pt overfull line in the H5 proof by displaying the definition of r and p; the draft now compiles to 4 pages with one 1.25 pt vbox warning and no undefined references.
• Not done: the bibtex missing-volume, page and publisher fields on six entries (Crossref returned 403 again, so they were not filled from memory).

2026-10-25 · Milestone 16: the draft compiles; figures and full-width tables added (no experiment)

• Installed TeX Live (texlive-latex-extra, -publishers for acmart, -fonts-recommended, cm-super) and built paper/main.tex with pdflatex and bibtex: 4 pages in the sigconf,anonymous format, no undefined references or citations. Two problems the uncompiled draft hid: neither figure was in the paper, and both result tables overflowed the column (one by 258 pt). Fixed: both tables are now table*, the margin figure and the frontier figure are included (\graphicspath to ../experiments/), and make_figures.sh renders frontier.svg to a PNG (LaTeX cannot read the SVG).
• Still open: one 17 pt overfull line in the H5 proof; bibtex warns of missing page numbers or publisher on six entries; the paper is 4 pages of a longer-form EC submission, so it still needs the page-limit check against the current call. Submitting is an owner step.

2026-10-25 · Milestone 15: all 17 references checked against the registries (no experiment)

• Crossref and the arXiv API were reachable this session (they 403ed in milestones 10 and 14). Six DOIs resolve to the cited titles and years (Townsend's by hand, since cite_check.py cuts a DOI at its parenthesis and does not read eprint= fields from a .bib); eleven arXiv ids return the cited titles and years (the arXiv API returned empty bodies for some ids on the first try and succeeded on retry). One discrepancy: kong2019 carries the 2019 venue year while arXiv v1 is 2016; left as is.
• Still open for the paper: the draft is uncompiled (no LaTeX here), and the transformer is 30k parameters on one fixed split.

2026-10-25 · Milestone 14: transformer results move into the paper (no new experiment)

• Added a "A small transformer" paragraph and Table tab:tf to the margin section of paper/main.tex, and shortened the Limitations sentence to point at it. Every number is copied from experiments/transformer*/results.txt (milestones 11 to 13); none was rerun.
• Still open: the draft is uncompiled (no LaTeX here), the 17 references are not machine-checked (registries 403 through the proxy), and the transformer is 30k parameters on one fixed split.

2026-10-24 · Milestone 13: the transformer trained 5x longer (H1), planned before running

• Why: milestones 11 and 12 stop at 600 steps with held-out loss 2.73, far from converged, so the late-training regime (small updates, where skipping should be cheapest) is only partly reached. experiments/transformer_long/run.py is the milestone 11 run with steps=3000 (same model, corpus, 10 seeds, float32 reorder referee), taus 1e-3, 3e-3, 1e-2, 3e-2.
• Prediction: the median update norm falls (late cosine steps shrink with lr), so at fixed tau a larger share is skipped than at 600 steps (above 16% at 1e-2). The loss given up at tau = 1e-2 stays below one seed std. Refutation of the narrow form of H1 here: a tau at or below 10x the worst reorder drift (about 1.5e-6, outside the grid) with degradation above one seed std and a CI excluding zero; the grid's smallest tau is 1e-3, so the drift-sized test is the skipped share and degradation there.
• Analysis: as milestone 11 (10 seeds, paired degradation, 95% bootstrap CI, share skipped).
• Result (experiments/transformer_long/, 10 seeds, 3000 steps, float32 reorder referee, torch 2.14.1 CPU): honest held-out loss 2.2793 (seed std 0.0269; 2.7252 at 600 steps). Update norm quantiles 10/50/90%: 0.0080 / 0.139 / 0.234; reorder drift p99 9.3e-8, max 1.3e-7. Skip degradation (paired, 95% CI): tau = 1e-3 skips 3.5%, +0.00014 (0.00008 to 0.00020); 3e-3 skips 6.2%, +0.00040 (0.00018 to 0.00061); 1e-2 skips 11.3%, +0.0030 (0.0026 to 0.0036, 0.11 std); 3e-2 skips 19.7%, +0.0126 (0.0111 to 0.0142, 0.47 std). Skipping was better on 1 of 10 seeds at 1e-3 and 3e-3 and on none at 1e-2 and 3e-2.
• Verdict: the narrow form of H1 is not refuted: the loss given up stays under one seed std up to tau = 3e-2 (20% of steps saved), and nothing near drift size (1.3e-7) is skipped beyond the grid floor. My prediction on the skipped share was wrong: it is lower than at 600 steps (11% against 16% at 1e-2), not higher, because the median update norm rose (0.139 against 0.081) as the model moved into a region of larger gradients under the same lr schedule; 3000 steps is still not a converged regime (loss 2.28). The seed std tripled (0.027), so the "below one std" reading is easier to meet; the paired CI excludes zero at every tau, so the cost is measurable but small.
• Limits: same 30k-parameter model and corpus, plain SGD, reorder referee, skip shortcut only; 3000 steps does not reach convergence.

2026-10-24 · Milestone 12: bf16 referee on the transformer (H1), planned before running

• Why: milestone 11 ran only the float32 reorder referee; the lower-precision referee is the realistic one (a verifier on different hardware). margin_tf.py already has the bf16 path (autocast forward, float32 loss); experiments/transformer_bf16/run.py uses it with the same 10 seeds, corpus and taus.
• Prediction: bf16 drift is far larger than float32 reorder drift (around 1e-4 to 1e-2 per step, from the fp16 numbers of milestone 8 scaled by bf16's coarser mantissa), so a referee tolerance must sit above it, and the honest false-dispute rate at tau = 1e-3 is high (above 10%). The skip shortcut at tau = 1e-2 (about the p99 drift) still skips 10 to 20% of steps at a cost below one seed std. Refutation of the narrow form of H1 here: a tau at or below 10x the max bf16 drift with degradation above one seed std and a CI excluding zero.
• Analysis: as milestone 11, plus drift quantiles and the share of honest steps whose bf16 drift exceeds 1e-3 and 1e-2.
• Result (experiments/transformer_bf16/, 10 seeds, same corpus and taus, torch 2.14.1 CPU, bf16 autocast referee): honest loss 2.7252 (std 0.0083). bf16 drift per step: median 8.5e-4, p99 2.4e-3, max 4.0e-3, against update norms of 0.0038 / 0.081 / 0.22 (10 / 50 / 90%). So a referee tolerance of 1e-3 falsely disputes 41% of honest steps, and 1e-2 disputes none. Skip shortcut judged by the bf16 referee: tau = 1e-3, 1e-2, 3e-2, 1e-1 skips 5.1%, 16%, 29%, 59% of steps for +0.00009, +0.0017 (CI 0.0011 to 0.0022, 0.2 std), +0.0085, +0.063 (all CIs exclude zero).
• Verdict: prediction held on drift scale (p99 2.4e-3 is inside 1e-4 to 1e-2) and on the false-dispute rate (41% at 1e-3, above 10%). The narrow form of H1 is not refuted: at tau = 1e-2, about 2.5x the max bf16 drift, the cheater skips 16% of steps and gives up 0.2 seed std. The cost numbers equal the float32 run to the third digit because the skip decision depends on the gradient norm, which bf16 barely changes; the referee matters for the false-dispute rate, not for what the cheater saves. Practical consequence: an honest-safe tolerance on bf16 hardware (>= 1e-2) already lets a cheater skip 16% of steps at no measurable quality cost.
• Limits: same as milestone 11 (30k parameters, 600 steps, fixed split, skip shortcut only); bf16 here is CPU autocast on the forward pass, not a different accelerator.

2026-10-24 · Milestone 11: the margin on a small transformer (H1), planned before running

• Why: every margin result so far is an MLP (milestones 3, 8, 9); the paper's main weakness. src/vtm/margin_tf.py trains a 2-layer, d=32, 2-head character-level causal transformer (about 30k parameters) with plain cosine SGD (lr 0.5, 600 steps, batch 32, context 32) on experiments/transformer/corpus.txt, an 87 kB snapshot of this repository's research guidance text (real text, 80/20 split by position, fixed). Referee: same step with the batch rows permuted (float32 reorder). Skip shortcut as before. A one-seed pilot gave held-out loss 2.72, update norms 0.0036 / 0.083 / 0.23 at the 10 / 50 / 90% quantiles, and float32 reorder drift at most 1.1e-7.
• Prediction: the result carries over: drift is 4 to 6 orders below the update norms, so tau at drift size skips almost nothing, and degradation stays below one seed std for tau <= 1e-2 (about the 10 to 40% quantile of norms). It hurts at tau = 0.1 (above the median norm, so over half the steps skipped). Refutation of the narrow form of H1: a tau at or below 10x the worst measured drift (about 1e-6, outside the grid; the grid's smallest tau is 1e-3) with degradation above one seed std and a CI excluding zero. Because the grid starts at 1e-3, the drift-sized test is the skipped share at 1e-3, which I expect to be near 10%, and the degradation there.
• Analysis: 10 seeds (init and batch order; the split is fixed, a stated limit), degradation = skip loss minus honest loss, paired by seed, 95% bootstrap CI, share of steps skipped.
• Result (experiments/transformer/, 10 seeds, OMP_NUM_THREADS=1, torch 2.14.1 CPU; about 5 minutes on 4 cores): honest held-out loss 2.7252 (seed std 0.0083); float32 reorder drift p99 9.1e-8, max 1.5e-7 against update norms of 0.0038 / 0.081 / 0.22 (10 / 50 / 90%), so drift is 4 to 6 orders below the updates, as predicted. Skip degradation (paired, 95% CI): tau = 1e-3 skips 5.1% of steps, +0.00009 (CI 0.00005 to 0.00013); tau = 1e-2 skips 16%, +0.0017 (0.0011 to 0.0022, 0.2 seed std); tau = 3e-2 skips 29%, +0.0085 (0.0077 to 0.0092, 1.0 std); tau = 0.1 skips 59%, +0.062 (0.057 to 0.068, 7.4 std). Skipping was better on 1 of 10 seeds at 1e-2 and on none elsewhere.
• Verdict: the narrow form of H1 is not refuted on a transformer: at any tau up to 10x the worst measured drift (about 1.5e-6) almost nothing is skipped (the smallest grid point, 1e-3, is already 6,700x the drift and skips 5%), and the loss given up stays below one seed std up to tau = 1e-2 (16% of steps saved). It reaches one std at tau = 3e-2 and clearly hurts at 0.1. Unlike breast cancer (milestones 8 and 9) skipping never helps here, so the cheater's saving is paid for in loss, as on digits. Two details of the prediction were off: the share skipped at 1e-3 is 5%, not about 10%, and the degradation at 1e-2 and 3e-2 is small but its CI excludes zero (measurable, not noise).
• Limits: a 30k-parameter character model on 87 kB of text, 600 plain-SGD steps (held-out loss 2.73 is far from converged, so the late-training regime where updates shrink is only partly reached), fixed split, 10 seeds, float32 reorder referee only (a bf16 referee path exists in margin_tf.py but is not run), skip shortcut only. It shows the pattern is not specific to MLPs; it does not show it at realistic scale.
• Next: references checked against the registries (they 403 from here), and a longer-trained or larger model if budget allows.

2026-10-24 · Milestone 10: paper body drafted from the log (no new experiment)

• Wrote the introduction, related work (partial), model, margin (with a table covering the three setups and the 20-split run), contracts and bound, collusion, H6 and limitations sections of paper/main.tex, and updated the abstract to the three-task, 20-split result. Every number is copied from experiments/*/results.txt or this log. The 39 tests pass, and paper/make_figures.sh regenerates both figures with no diff.
• Still open for the paper: the H5 proof is not yet moved out of the peer.py docstring, the eight remaining proposal references are not added or checked, the draft is uncompiled (no LaTeX here), and a transformer step is not done (no torch in this session's interpreter).
• Next: references and proof; a transformer margin step once an installable framework is available.
• Addendum (same day, second run): replaced the partial Related work with all 17 proposal works in three groups, added the H5 proposition with its proof to the Model section, and 8 bib entries (refs.bib now 17). cite_check.py got 403 for all 17 ids, so those entries are not machine-checked; compare with the registries before submission.

2026-10-24 · Milestone 9: the margin with the data split resampled (H1), planned before running

• Why: milestone 8 left open that the breast-cancer gain from skipping (-0.0115 at tau = 1e-2) could be an artefact of one 171-sample test set, since seed pairing varied init and batch order but not the split. Here seed s also draws split s (70/30 permutation seed s), so the seed std includes split variance and the paired difference is honest-vs-skip on the same split.
• Prediction: on breast cancer the mean degradation at tau = 1e-2 and 3e-2 stays at or below zero but its CI is wider, and may include zero; on digits-deep it stays within one (now larger) seed std at tau = 1e-2. Refutation of "skipping helps on breast cancer": the 95% CI at tau = 1e-2 or 3e-2 lies entirely above zero or contains zero with a mean above 0.
• Analysis: 20 splits and seeds, setups as milestone 8, reorder referee, skip shortcut, bootstrap CI of the paired difference, share of steps skipped.
• Result (experiments/splits/, 20 splits and seeds, reorder referee, skip shortcut): breast cancer (honest loss 0.1142, std over splits 0.0417): skipping lowers held-out loss at tau = 1e-3, 1e-2 and 3e-2 (-0.0007, -0.0098 with CI -0.0135 to -0.0063, -0.0166 with CI -0.0271 to -0.0075), better on 95% of splits at 1e-2 and 80% at 3e-2, and hurts only at tau = 0.1 (+0.054, CI 0.035 to 0.071, 99.5% of steps skipped). Digits 64-128-64-10 (honest loss 0.0943, std 0.0229): +0.0001 (CI includes zero), +0.0016 (0.07 std), +0.0047 (0.2 std), +0.028 (1.2 std) at tau = 1e-3, 1e-2, 3e-2, 1e-1, skipping 13%, 39%, 60%, 83% of steps.
• Verdict: the milestone 8 gain on breast cancer is not a one-split artefact: it holds on 19 of 20 splits at tau = 1e-2, so my prediction that its CI might reach zero was wrong. Resampling the split makes the seed std 2 to 5 times larger (0.023 and 0.042 against 0.004 and 0.012), which makes the 'below one seed std' reading easier to meet on digits-deep (even tau = 3e-2 is 0.2 std); the paired CI, not the std, is the right yardstick, and by it digits-deep skipping is measurably (CI above zero) but only slightly harmful at tau = 1e-2. H1's narrow form stands on two tasks and 20 splits each.
• Limits: still two small sklearn tasks, plain SGD, skip shortcut only, reorder referee only. No transformer.
• Next: paper model and margin sections; a transformer step if an installable framework allows.

2026-10-24 · Milestone 8: the margin on a deeper network and a second dataset (H1), planned before running

• Why: the paper's main weakness (milestone 7) is one dataset and one small MLP. src/vtm/margin_gen.py generalises the milestone 3 code to any-depth ReLU MLPs and other real sklearn datasets (tests: it reproduces margin.train weights on the digits MLP, its gradient matches finite differences on a 3-layer net, and a zero-tolerance skipper is honest). Setups: a 64-128-64-10 MLP on digits, and a 30-32-2 MLP on the breast-cancer data (569 samples, standardised). 20 seeds, 1,500 steps, cosine SGD, skip shortcut only, both referees.
• Prediction: the qualitative result carries over (skipping is invisible at drift-sized tolerances and costs below one seed std there), but the tolerance at which it starts to hurt depends on the task, since it is set by the late-training update norms, not by a fixed number: it should sit lower on breast cancer (an easy, nearly separable task whose updates shrink fast) and similar on the deeper digits net. Refutation of "drift-sized tolerances give up less than one seed std": on any setup, a tolerance at or below 10 times the worst fp16 drift with degradation above one seed std and a CI excluding zero.
• Analysis: paired by seed, degradation = loss(skipping) minus loss(honest), 95% bootstrap CI over 20 seeds, plus the share of steps skipped and the honest false-dispute rate at each tolerance.
• Result (experiments/setups/, 20 seeds each; 3 tests pass in tests/test_margin_gen.py): digits, 64-128-64-10 (honest loss 0.0582, seed std 0.0044): skip passes 3.8%, 11.9%, 37%, 57%, 82% of steps at tau = 1e-4, 1e-3, 1e-2, 3e-2, 1e-1 and costs +0.0000, +0.0002, +0.0025 (CI 0.0019 to 0.0031, 0.6 seed std), +0.0074 (1.7 std), +0.034 (7.6 std). Same shape as the one-hidden-layer net of milestone 3 (+0.0034 at 1e-2). Breast cancer, 30-32-2 (honest loss 0.0949, std 0.0119): skipping lowers held-out loss for tau from 1e-4 to 3e-2 (-0.0015 at 1e-3, -0.0115 at 1e-2 with CI -0.0129 to -0.0101, -0.0119 at 3e-2 while skipping 91% of steps), and only at tau = 0.1 does it hurt (+0.068, 5.7 std), with 99.5% of steps skipped. Honest drift is again far below the update norms (float32 reorder max 9e-8; fp16 p99 1.3e-3 to 2.3e-3, max 1.6e-2 to 1.8e-2), so fp16 false disputes are 8% to 24% at tau = 1e-4 and about 1% to 3% at 1e-3.
• Verdict: the proposal's refutation rule (no tau at or above measured drift with degradation above one seed std) is not met on either setup: the skip shortcut passes 37% (digits-deep) and 67% (breast cancer) of steps at tau = 1e-2, about the worst fp16 drift, and the loss it gives up there is 0.6 seed std on digits-deep and negative on breast cancer. It does exceed one std once tau reaches 3e-2 (digits-deep, 1.7 std) or 0.1 (breast cancer, 5.7 std), i.e. 2 to 6 times the worst fp16 drift, so the 'narrow form' of milestone 3 carries over: the margin is real and costs the requester saved work at drift-sized tolerances, and quality only above a task-dependent threshold. My prediction that breast cancer would hurt at a lower tolerance was wrong in the opposite direction: on an easy, nearly separable task, skipping low-norm late steps acts like early stopping and improves held-out loss, so there the margin is pure saved work for the cheater. The threshold follows the late update-norm distribution (median honest norm 0.020 on digits-deep, 0.0047 on breast cancer), which suggests stating tau relative to a norm quantile.
• Limits: still plain SGD with a cosine schedule on small tabular and image tasks, still no transformer; the skip shortcut only; breast-cancer held-out loss gain from skipping may be a train-test split effect of one 171-sample test set (seed pairing varies init and batch order, not the split). Open: repeat with several data splits and a real transformer step.
• Next: fill the paper's model and margin sections using the three setups; a data-split-resampled margin run.

2026-10-24 · Milestone 7: paper skeleton

• Wrote paper/ (ACM EC acmart skeleton, refs.bib with nine checked references, make_figures.sh, README). The abstract states only results already in this log; every section is a stub marked with what remains (related work from PROPOSAL.md, the model section, moving the H5 proof out of the peer.py docstring, tables). The frontier figure regenerates byte-identically from experiments/frontier/figure.py; the margin figure needs numpy and matplotlib and was not rerun here. LaTeX is not installed, so the skeleton is uncompiled.
• Where the paper stands against the bar: the novelty claim narrowed (a tolerance has a price, but two of the six hypotheses are refuted as worded: H4's 1/m and H6's predictor); one dataset and one MLP is the main weakness, and a second model or a real transformer step is the most valuable next experiment; a constructive predictor for H6 is the candidate positive claim.
• Next: second model for H1/H4-style margin measurement; fill sections in order model, margin, frontier.

2026-10-24 · Milestone 7a: H6, predicted against measured skip degradation (planned before running)

• Plan: two predictors that see only the 20 honest runs (recorded per-step update norms). A, first order: a skipped step forgoes the descent it would have bought, |d|^2/lr, summed over steps with |d| <= tau. B, fewer steps: the skipper has done (1 - f(tau)) T steps, so predict the loss of an honest worker trained that long on the same compressed cosine schedule. Measured: the milestone 3 skip degradation, reorder referee. H6 is refuted if the ratio predicted/measured leaves [0.5, 2] on a majority of settings. I expect A to overshoot (it ignores that later steps recover the loss) and B to overshoot at small tau (skipped steps are the low-value ones, not a random subset).
• Result (experiments/h6/, 9 taus): both predictors miss. Only rows with measured degradation above one seed std (0.0039) count as scored: tau = 0.1 and 0.3 (2 of 9). A is out of range at both (123x and 12x); B is 3.0x at tau = 0.1 and 1.00 at tau = 0.3, where every step is skipped and the prediction is just the untrained network, which is trivial. At tau = 1e-3 and 1e-2 (degradation 0.0002 and 0.0034, below noise) A overshoots 46x and 105x and B 18x and 4.6x. Verdict: H6 refuted for these two simple models (the ratio is in range in 1 of 9 settings, and that one is trivial). Both overshoot by an order of magnitude or more because skipped steps are exactly the small-update steps, whose loss is recovered by the remaining training.
• Caveats: zero-step case approximated by 1 step; ratios on below-noise rows are not meaningful and are reported only for completeness; one dataset, one MLP. A better predictor (second order, or a model of recovery) is open and would be the paper's constructive claim.
• Next: paper skeleton (milestone 7).

2026-10-24 · Milestone 6: collusion on a shared trajectory (H4), planned before running

• Setting: m workers on one job, each submits honest (cost 1) or the shared cheap trajectory K (cost 1 - g). Outputs are compared; the strict-majority output is accepted and its submitters are paid r = 1 (individual rationality), submitters of any other output (or all, if there is no strict majority) get -S. One independent audit per job catches K with probability p, and then every K submitter gets -S. Brute force: for m = 1 to 7 and a grid of (g, p), find the least S at which all-honest is a strong equilibrium (no subset of workers has a joint deviation, over all 2^|subset| action profiles, that leaves every member strictly better off), by bisection over exact payoffs.
• Closed form to test (my derivation, not the proposal's 1/m): a minority deviation is punished by replication alone, and a majority coalition of size floor(m/2)+1 escapes replication with probability one and is deterred only by the audit: p (r + S) >= g, i.e. S* = max(0, g/p - 1) for every m >= 1, with no dependence on m.
• Predictions: (1) a coalition of floor(m/2)+1 workers escapes replication (trivially true); (2) S*(m) is flat in m, so the proposal's "falls as 1/m" is refuted for a per-job audit and belongs to the verifier-bribery setting, where a briber must pay each of m verifiers; (3) replication multiplies the pay bill by m and lowers the needed stake by nothing, so against a perfectly coordinating coalition it is dominated by m = 1 plus the audit. Refutation of my closed form: any (m, g, p) where brute force differs from it by more than the bisection tolerance.
• Also checked: the threshold is unchanged if the audit is drawn once per job rather than per worker (payoffs are linear in the caught indicator).
• Result (experiments/collusion/, 140 cells: m 1 to 7, g in {0.1, 0.3, 0.5, 0.9}, p in {0.05, 0.1, 0.25, 0.5, 1}; 14 tests pass with tests/test_coalition.py): brute-force strong-equilibrium search matches max(0, g/p - 1) to 7e-10 in every cell. The smallest coalition that escapes replication is floor(m/2)+1 (1, 2, 2, 3, 3, 4, 4 for m = 1 to 7). The stake is flat in m (g = 0.5, p = 0.1: 4.00 for every m), so the proposal's 1/m fall (which would give 0.57 at m = 7) is refuted for a per-job audit; the pay bill grows as m.
• Verdict on H4: the first half (a coalition escapes replication with probability one) holds, with the coalition needing a strict majority. The second half, as worded, is refuted by construction in this model: a coordinating majority faces only the audit, so replication adds no deterrence beyond it; the 1/m law belongs to verifier-bribery, where a briber pays each of m verifiers separately. Caveat on strength: the flat-in-m result follows from the payoff structure (it is a theorem here, proved in the docstring argument, and the search confirms the code implements it), so it is a check of the model rather than a discovery; what would make 1/m appear is a different model (side payments, a split penalty budget, per-verifier bribes), not tested.
• Not done and limits: pure strategies and one shared cheat only (no mixed coalition equilibria, no partial copying kappa < 1, no benign drift delta, no side payments, no coalition that also bribes the auditor); majority rule only (no unanimity or reference-answer pay); the parameters are swept, not measured. H6 and the paper remain.
• Next: milestone 7, the paper skeleton in paper/ (EC format), and H6 (predicted against measured degradation); a model variant with side payments to see when a 1/m law does appear.

2026-10-24 · Milestone 5: peer agreement (H3) and a one-sided lower bound (H5), planned before running

• H3 setting: two workers, each picks honest (cost 1) or a cheat (cost 1 - g, audit catch probability p, one shared deterministic shortcut). Each is paid w(audit outcome, agree or disagree) >= -S, four numbers. Agreement probabilities: honest-honest 1 - delta (benign drift beyond the tolerance), honest-cheat alpha (the cheat's output stays within the agreement test), cheat-cheat kappa (kappa = 1 is the copying equilibrium). The cheapest contract is a linear programme in the four payments. Three versions: audit-only (w does not depend on agreement), peer contract that only requires honest-honest to be an equilibrium, and peer contract that also requires (cheat, cheat) not to be an equilibrium (strictly, margin 1e-6).
• Prediction: the first peer version never costs more (more signals cannot raise the cost: a refinement), and is strictly cheaper when alpha < 1 and kappa < 1, so the proposal's wording of H3 ("raises the minimum cost") holds only for the third version. In the third version at kappa = 1 I expect agreement to be worth nothing (cost equal to audit-only everywhere on a random sweep), because paying for agreement makes (cheat, cheat) more attractive. Refutation of H3 as stated: some instance with kappa = 1 where the third version is strictly cheaper than audit-only.
• H5 plan: prove a one-sided resolution bound (any contract implementing honest against a deviation with gain g, pay floor -S and one-sided resolution p, where p = 1 - min_s P_a(s)/P_h(s), costs at least max(C, g/p - S)), test LP >= L on random instances and on the measured skip actions, and report how loose it is where the score is Gaussian (I expect it to be vacuous there, since a Gaussian likelihood ratio reaches zero in the tail).
• Result H3 (experiments/joint/h3.py, 4,000 random instances, g, p, S, delta, alpha, kappa; alpha capped at 1 - delta, since a cheat should not agree with an honest peer more often than an honest worker does): version 2 (honest-honest only) is cheaper than audit-only in 1,191 instances and never dearer (as a refinement must be), up to 97% cheaper; version 3 (also exclude copying) is cheaper in 451 of 4,000 but in 0 of 1,349 instances with kappa = 1, where the contracts cost the same. Where cheats do not coordinate (kappa 0 or 0.5) agreement keeps helping (301 of 1,334 and 150 of 1,317). Excluding copying costs the peer contract more in 896 instances (403 of the 1,349 with kappa = 1) and the audit-only contract the same as before.
• Verdict on H3: supported in the narrow form that the proposal's own refutation clause names. Agreement lowers cost only when cheats cannot coordinate on a shared trajectory; once copying equilibria are excluded and cheats copy perfectly, an agreement term is worth nothing beyond the audit. The wording "raises the minimum cost" is wrong as stated: adding a signal cannot raise the cost of a fixed equilibrium, it raises the cost only of the unique-equilibrium requirement. A first sweep with alpha uniform on [0, 1] showed a spurious saving at kappa = 1 (403 instances, up to 80%) from instances where a cheat agrees with an honest peer more than honest workers do, so that a penalty on agreement separates them; the cap fixes it, and the margin was lowered from 1e-4 to 1e-6 after savings of 0.2% at small p turned out to be the margin divided by p.
• Result H5 (experiments/joint/h5.py): the bound max(C, g/p - S), with p the one-sided resolution, is proved (docstring) and is never violated by the LP in 2,755 random feasible instances; it equals the LP in 2,410 of them and is exact for two actions with a binary audit (error 1e-13). H5 as written (a function of (g, tau, S) met within a constant factor) is refuted in general: the largest LP/bound ratio is 2,093, with three or four actions. On the measured skip actions with a tau = 0 audit the bound is exact. For the Gaussian score the bound is vacuous (1.0 against an LP cost of 5.76), since a Gaussian likelihood ratio reaches zero in the tail; a bound for noisy scores needs the LP dual, which is open.
• Not done and limits: two workers, one shared cheat, independent audits, binary agreement; no mixed equilibria in the copying exclusion; the random sweep draws parameters from ranges rather than measuring alpha, kappa and delta on real runs (milestone 3 gives delta only for fp16 drift); H4 (collusion), H6 and the paper are untouched; test_margin.py needs scikit-learn, absent from this session's interpreter.
• Next: milestone 6 (H4, brute-force equilibrium search over small coalitions) and measure alpha and kappa on real training trajectories.

2026-10-24 · Milestone 4: single-check frontiers and a first look at H2

• Plan, written before the first run: take the measured skip family of milestone 3 as the worker's action set (action a skips every step whose honest update has norm at most tau'; effort is one minus the skipped share; cost is effort times the honest compute cost C). Solve the hidden-action linear programme (src/vtm/contract.py) for audit-only, score-only and joint contracts, with pay bounded below by minus the stake S. An audit re-executes m random steps and catches a skipped step iff its update norm exceeds the referee's tolerance tau; the score is the held-out loss on n_test examples (Gaussian with measured mean, seed variance and per-example variance). Prediction: audit-only is cheapest at tau = 0 (one audited step deters, because the penalty probability grows with the gain), becomes infeasible at any tau above benign drift because a cheaper action with the same signal exists, score-only is expensive because near actions are indistinguishable, and the joint contract beats both only where the score is precise. Refutation of H2: joint cost equals the lower envelope of the two everywhere.
• Checks of the solver first: the LP equals the closed form max(C, C/p - S) of audit.threshold on a grid of detection probabilities, equals a 2,500x2,500 brute-force grid search on 12 random two-action instances (within 1%), and never costs more when a signal is refined (tests/test_contract.py).
• Result, honest target (all workers must do every step; experiments/frontier/, 20 seeds per action, 400 score bins, S = 1 x C): at tau = 0 audit-only costs 1.001 C (one audited step, since the proportional penalty always deters, and the replication endpoint m = T costs 2.0 C). At every tau >= 1e-4 audit-only is infeasible at any stake and audit size, because skipping the steps below tau passes every audit and the pay cannot tell it from honest work. Score-only then costs 5.76 C at n_test = 540, 12.4 C at 100 and 1.23 C at 5,000; the best contract linear in the score costs 1.2e4 C (a slope large enough to punish 0.0002 of loss, because the 9.5% of work saved at tau' = 1e-3 moves the loss that little).
• H2: the joint contract is strictly cheaper than the better single check in 4 of 45 cells (stake 0.25 or 1, n_test = 5,000, tau 1e-4 or 1e-3: ratios 0.72 and 0.81, one or two audited steps added to the score), and equal in the other 41. In all four the audit-only cost is infinite, so the comparison is joint against score alone, and where both single checks are finite (tau = 0) the joint contract equals audit-only. Verdict: supported only in that narrow form; the audit helps the score where the score alone is almost precise enough, and does nothing at n_test = 540 or 100.
• Unplanned, added after seeing the table above and flagged as post hoc: pricing the full-effort target is the wrong question for a requester who only cares about the model. Section C of results.txt sets the target to the action that skips every step below tau' and sets the referee tolerance to the same tau'; then any skipping beyond it is caught with probability equal to its gain per audited step, one audited step at S = 1 already deters, and the requester's total cost is the target's effort plus 1/T (e.g. 0.698 C at tau' = 1e-2, which gives up 0.0034 of loss, 0.88 seed std; 0.468 C at 3e-2, 3.3 seed std). In this model the tolerance is a menu of quality-for-cost trades, not a leak, as long as the requester accepts the margin it sanctions.
• Not done and limits: the action set is the skip family only (half-batch and float16 shortcuts of milestone 3 cost nothing measurable, so a requester that accepts them is already inside the margin; a mixed action set is open); one dataset, one MLP, plain SGD; the score is Gaussian and independent of the audit given the action; one worker (no replication, so H3 and H4 untouched); detection of a skipped step is deterministic given its norm; the audit cost is the real re-execution cost 1/T per step but no cost for the referee's coordination or dispute resolution. H5 (lower bound) and H6 (predicted vs measured) are untested.
• Next: milestone 5 properly (H3, and a lower bound for H5 on this LP), and a mixed action set including half-batch and float16 so the sanctioned margin is priced across all three shortcuts.

2026-10-24 · Milestone 3: benign drift and the hidden margin on real training (planned before running)

• Setting: a 64-64-10 ReLU MLP trained by minibatch SGD in float32 on the real sklearn digits data (1,797 images, 70/30 split), 20 seeds (init and batch order), T = 1,500 steps. A refereed check re-executes one step from the worker's checkpoint and accepts if the L2 distance between the worker's next checkpoint and the referee's is at most tau.
• Benign drift: the referee recomputes the step with the batch rows in a different order (float32 reduction order changes), and, as a heterogeneous-hardware case, with float16-rounded inputs and weights. I expect float32 reorder drift near 1e-7 of the update norm and the float16 case near 1e-3.
• Shortcut family "cheat when cheap": on each step the worker computes the honest update and a cheaper alternative (skip the step; use half the batch; compute with float16-rounded inputs and weights) and uses the alternative whenever its distance from the referee's honest recomputation is at most tau, so a single-step check passes it by construction.
• H1 prediction: the skip shortcut degrades held-out loss by more than the seed-to-seed standard deviation only once tau reaches the late-training update norms (1e-3 to 1e-2); at tau within a few multiples of float32 reorder drift the margin is real but its cost is below noise, so H1 is probably refuted for float32-only tolerances and supported for tolerances sized for float16 hardware. Refutation rule is the proposal's: no tau at or above measured drift with degradation above one seed std.
• Analysis: paired by seed, degradation = loss(cheating) minus loss(honest); 95% bootstrap interval of the mean over 20 seeds; fraction of steps cheated; false-dispute rate of honest workers as a function of tau. H6 (predicted vs measured degradation) is not tested in this step.
• Result (experiments/margin/, 20 seeds, honest held-out loss 0.0916, seed std 0.0039, accuracy 97.6%): honest drift is far below my guess for float32 reordering (max 5.7e-8 in L2, zero on every step in the median case, because the BLAS reduction was nearly order-independent here), and the float16 referee gives median 3.3e-5, p99 9.2e-4, max 9.1e-3 against honest update norms of median 0.026. The skip shortcut passes 3% of steps at tau = 1e-4, 9.5% at 1e-3, 30% at 1e-2 and 89% at 1e-1, and gives up loss 0.0002, 0.0034 (CI 0.0026 to 0.0042, just under one seed std) and 0.118 (CI 0.113 to 0.124, 30 seed stds) at tau 1e-3, 1e-2, 1e-1. Half-batch and float16-input shortcuts pass 95% (half-batch, tau = 0.1) and 89% (float16 inputs, tau = 1e-4) of steps and cost nothing measurable (|degradation| < 0.001, half-batch even slightly negative at tau >= 0.1).
• Verdict on H1: supported only in a narrow form. Cheating passes at every tau, so the margin exists, but for a tolerance sized to benign drift (tau up to about 10 times the worst fp16 drift, 1e-2) the quality it gives up is below one seed std; the shortcut that hurts (skipping) needs tau about 10 times the worst benign drift. The proposal's refutation rule is not met (tau = 0.1 degrades by 30 stds), but the cost to the requester at drift-sized tolerances is compute saved by the worker (up to 30% of steps), not a worse model. The model should price the margin as skipped work, with a quality cost that switches on at a threshold, not as a smooth loss.
• Disclosure: the float16-input shortcut computes exactly what the fp16 referee computes, so against that referee it passes every step by construction; the tables and the figure use the reorder referee for it (the skip and half-batch rows are the same under both referees to three digits).
• A bug found and fixed before the final run: the referee's row permutation shared a random stream with batch sampling, so cheaters and honest workers saw different batches and the seed pairing broke; test_zero_tolerance_cheater_is_honest caught it.
• Not done: H6 (predicted vs measured degradation) is untested; one dataset, one small MLP, plain SGD with a cosine schedule; tau is in absolute L2 units of one step. Next: milestone 4 (single-check frontiers), and repeat on a second model and a real transformer step where an installable framework allows.

2026-10-24 · Milestone 2: one library reproducing four earlier projects

• Hypothesis written before running: the closed forms of verification-game (x = k/(lam S + h), y = s/(s+S)), audit-allocation (t = g/(g+S)), verifier-bribery (bribe floor and the 1/m collusion-proof stake) and effort-elicitation (Brier value V(n) = Var(p) n/(a+b+n), rent per cost (n-1)/(a+b)) follow from payoffs alone, so a library that derives each numerically (2x2 equilibrium from matrices, bisection on best responses, exact beta-binomial sums) should match each formula to 1e-6 or better and match the earlier projects' code. A mismatch would mean one of the earlier projects is wrong.
• Result: src/vtm/ (stdlib only) and 14 tests pass. The matrix-derived inspection equilibrium equals the closed form on 81 grid points with checking worthwhile (the dominant-cheating region is a separate test); the bisected audit threshold and bribe floor equal their formulas; the Brier rent law holds exactly; every figure agrees with the earlier projects' own functions. No mismatch found: the four closed forms are confirmed, not extended.
• Not done: this is a consolidation. The shared model of effort, a tolerance tau and a held-out score (the method section) is not built, so H1 to H6 are untested. The proposal's open item (whether Verde or proof-of-learning already price the tolerance) is not yet read.
• Next: milestone 3, drift and the shortcut margin on real training (needs numpy or torch: probe the environment first).

2026-10-24 · Programme opened

• Wrote PROPOSAL.md: 17 references looked up on arXiv and Crossref (one wrong arXiv id, 1611.03158, and one near-miss, 1603.07319, were caught and replaced by 1606.07042, the Gao et al. paper), six falsifiable hypotheses H1 to H6, seven milestones, target ACM EC.
• Prior work here: about 60 scoring, effort, audit, game and verifier projects, each stylised. The claim of novelty is narrow: the tolerance as a priced cheating margin, a joint contract with a cost frontier, collusion on a shared shortcut, and measurement on real training.
• Not yet checked: whether Verde or the proof-of-learning papers already price the tolerance (read their full text at milestone 2, before building on gap item 1).
• Next: milestone 2, one library reproducing the closed forms of verification-game, audit-allocation, verifier-bribery and effort-elicitation as tests.