Repeated-Game Security for Restaking-Based Verifiable Inference

Core Problem: The paper addresses a security gap in restaking-based verifiable LLM inference protocols. These protocols (e.g., EigenAI, VeriLLM, Sertn AVS) rely on a one-round slashing condition: a rational provider should not cheat when the expected penalty exceeds the per-query cost saving. The authors show this condition can overstate security once inference is supplied repeatedly under the same stake.

Key Contribution: The paper models restaking-based verifiable inference as a discounted repeated game and identifies a repeated-game gap caused by proportional slashing: detected deviations reduce the stake exposed to future penalties, while the saving from cheaper inference is earned again on every query.

The standard one-round incentive compatibility (1-Round IC) condition is defined as: Parameters (S, c, α, ∆) satisfy 1-Round Incentive Compatibility if honest execution weakly dominates cheating in the stage game, equivalently cαS ≥ ∆.

The paper proves that this condition is insufficient for repeated interaction. Lemma 1 shows that even when 1-Round IC binds at the initial stake (cαS0 = ∆), the always-cheat strategy yields strictly higher discounted payoff:

"∆U = UP(p=1) − UP(H) = δcα∆ / ((1−δ)(1−δ+δcα)) > 0"

Theorem 1 generalizes this with slack: if the slack η = cαS0 − ∆ satisfies η cαS0 ≥ ∆(1 + δcα/(1−δ))

The multiplier 1 + δcα/(1−δ) is approximately 1.038 at δ = 0.95, c = 0.01, α = 0.2, and diverges as δ → 1.

Theorem 2 extends the gap to memoryless bounded-slashing protocols (Definition 4), which covers deployed systems: protocols where audit indicators are independent of history, slashing is at most α max·S t, and decisions depend on history only through current stake. The theorem shows such protocols fail ∞-SPIC under the same conditions.

Calibrating to deployed parameters, the paper finds that for δ ∈ [0.92, 0.98], every surveyed protocol passes the one-round IC test but fails repeated-game IC, with deviation-profit fractions of 1.5%–8%:

• EigenAI: 5.4%–8.2%

• VeriLLM: 2.6%–3.9%

• Sertn AVS: 1.5%–2.5%

The paper constructs a deployable mechanism combining three instruments:

1. History-dependent challenges: A public suspicion score S t updated via exponentially weighted moving average, with audit probability c(S t) = min 1, c0 + βS t.

2. Reputation-weighted slashing: Using a two-type Bayesian reputation model, slashing is set as slasht = (α0 + α1ρ̄ t)S t where ρ̄ t is a robust posterior.

3. Time-locked stake with vesting: Stake remains slashable for τ rounds after unbonding, with linear vesting.

Theorem 3 (Main Theorem): The protocol satisfies ∞-SPIC against stationary mixed-strategy deviations whenever δ ≥ δ*, where δ* is the unique solution to:

∆ = c̄(p br)ᾱ(p br)S(1 + δ*(1−δ* τ)/(1−δ*)c̄(p br)ᾱ(p br))

with p br characterized by the first-order condition in equation (16).

Corollary 1 shows the required stake stays bounded as δ → 1: "lim S*(δ) = ∆/(h̄(1+τh̄)) < ∞", whereas the memoryless requirement diverges.

The paper provides the first direct measurement of the audit signal's detectability response on open-weight models from 0.5B to 14B parameters. Key results:

• The audit signal is concave as the mechanism requires in all nine (contracted, substitute) pairs

• Amplitude grows with cost ratio as min(1, 0.45x 0.41)

• Measured responses lower δ* to 0.79–0.92, below our conservative calibration

The paper shows signal responsiveness substitutes for baseline auditing, cutting the required baseline audit rate by 2.6× at target discount factor 0.95.

In the stress regime, the mechanism cuts deviation profit by 31%–54% while preserving low-latency economic verification:

• Cheat-then-exit (A6): held to 9.34% vs. 13.53% on P2 (31% reduction)

• MC-corrected best response (A4′): held to 6.20% vs. 13.60% (54% reduction)

The paper concludes: AVS parameters should be justified by the repeated-game equilibrium they support, not only by a stage-game slashing inequality. The logic applies to any restaking-secured service with private actions, public audit signals, and proportional slashing.

Improvement 1: Repeated-Game-Aware Security Parameterization for Restaking Protocols

The AI system can automatically compute and enforce the corrected stake requirement cαS0 ≥ ∆(1 + δcα/(1−δ)) for any restaking-based verifiable inference deployment. Given user-provided parameters (per-query cost saving ∆, audit probability c, slashing fraction α, discount factor δ), the system outputs whether the protocol satisfies ∞-SPIC or flags the required stake multiplier. This prevents the common mistake of relying on 1-round IC, which overstates security by up to 8% in surveyed protocols. The system can also generate a warning when δ is near 1, where the required stake diverges, and suggest switching to the time-locked vesting mechanism to keep stake bounded.

Improvement 2: History-Dependent Audit and Slashing Controller

The AI system can implement the proposed mechanism’s core logic: maintain a public suspicion score S t via exponentially weighted moving average of audit outcomes, set audit probability as c(S t) = min 1, c0 + βS t , and compute slashing as (α0 + α1ρ̄ t)S t using a robust Bayesian posterior over provider types. The system can tune β, α0, α1, and the vesting period τ to satisfy the Theorem 3 condition for a target δ*. It can also simulate the protocol under stationary mixed-strategy deviations to verify that the always-cheat strategy yields non-positive discounted payoff, and automatically adjust parameters if the condition fails.

Improvement 3: Empirical Audit-Signal Calibration Tool

The AI system can ingest audit signal measurements (e.g., detectability response from open-weight models 0.5B–14B) and fit the concave response curve min(1, 0.45x 0.41) for any contracted-substitute pair. Given a cost ratio x, it predicts the audit signal amplitude and uses this to lower the required baseline audit rate by up to 2.6× at δ=0.95. The system can also recommend optimal baseline audit rates and challenge budgets by solving the Stackelberg audit-budget problem, substituting signal responsiveness for expensive random audits.

Improvement 4: Repeated-Game Stress-Test Simulator

The AI system can simulate adversarial deviation strategies (e.g., cheat-then-exit, MC-corrected best response) under the proposed mechanism. It outputs deviation profit fractions and compares them against memoryless protocols (e.g., EigenAI, VeriLLM, Sertn AVS) under identical parameters. The system can identify which deviation strategy is most profitable for a given stake level and suggest parameter adjustments to reduce profit by 31%–54% as demonstrated. It can also verify that the mechanism preserves low-latency economic verification by tracking audit frequency and stake dynamics over time.

Improvement 5: Protocol Design Advisor for Restaking Services

The AI system can generalize the repeated-game gap analysis to any restaking-secured service with private actions, public audit signals, and proportional slashing (not just LLM inference). Given a service description (action space, signal distribution, cost structure), the system determines whether memoryless bounded-slashing protocols fail ∞-SPIC and recommends the three-instrument mechanism (history-dependent challenges, reputation-weighted slashing, time-locked vesting). It can also compute the minimal stake required as δ→1, showing the boundedness advantage over memoryless designs, and output a deployment-ready parameter set.

Restaking-based protocols enable verifiable LLM inference without the high proving cost of zkML or the hardware trust assumptions of TEEs. Their security is commonly justified by a one-round slashing condition: a rational provider should not cheat when the expected penalty exceeds the cost saving from dishonest inference. This paper shows that this condition can overstate security when inference is supplied repeatedly under the same stake. We model verifiable inference as a discounted repeated game and identify a repeated-game gap caused by proportional slashing: detected deviations reduce future penalty exposure, while cost savings are earned again across queries. We derive the gap in closed form, show that it persists under minimum-stake ejection, and extend it to memoryless bounded-slashing protocols covering deployed designs. We propose a deployable mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting. The mechanism restores infinite-horizon subgame-perfect incentive compatibility against stationary mixed-strategy deviations above an explicit discount-factor threshold without per-query cryptographic verification. Evaluation across nine open-weight model pairs from 0.5B to 14B parameters shows that the audit signal has the required concave detectability response. A Stackelberg audit-budget analysis shows that improved signal responsiveness reduces the baseline audit rate by 2.6x at discount factor 0.95. Calibrated to deployed parameters, surveyed protocols pass one-round incentive compatibility but admit repeated-game deviations for discount factors between 0.92 and 0.98, with deviation-profit fractions of 1.5%--8%. Our mechanism reduces deviation profits by 31%--54% while maintaining low-latency economic verification.