Repeated-Game Security for Restaking-Based Verifiable Inference
2026-08-10 • Computer Science and Game Theory
Computer Science and Game TheoryCryptography and Security
AI summaryⓘ
The authors explain that current systems for verifying large language model (LLM) outputs—called restaking-based protocols—assume providers won’t cheat if the penalties outweigh the gains from dishonesty. However, they show that when providers answer many queries using the same stake, this assumption isn’t always true because penalties decrease with repeated cheating. By modeling the problem as a repeated game, the authors find a gap in security and propose a new method involving history tracking and reputation-based penalties to fix it. Their solution reduces cheating incentives without needing heavy cryptographic checks every time and performs well in tests across multiple models.
restaking-based protocolslarge language models (LLMs)verifiable inferenceone-round slashingdiscounted repeated gameproportional slashingstake vestingsubgame-perfect incentive compatibilityaudit signaleconomic verification
Authors
Zhenhang Shang, Yingzhe Yu, Kani Chen
Abstract
Restaking-based protocols enable verifiable LLM inference without the high proving cost of zkML or the hardware trust assumptions of TEEs. Their security is commonly justified by a one-round slashing condition: a rational provider should not cheat when the expected penalty exceeds the cost saving from dishonest inference. This paper shows that this condition can overstate security when inference is supplied repeatedly under the same stake. We model verifiable inference as a discounted repeated game and identify a repeated-game gap caused by proportional slashing: detected deviations reduce future penalty exposure, while cost savings are earned again across queries. We derive the gap in closed form, show that it persists under minimum-stake ejection, and extend it to memoryless bounded-slashing protocols covering deployed designs. We propose a deployable mechanism combining history-dependent challenges, reputation-weighted slashing, and stake vesting. The mechanism restores infinite-horizon subgame-perfect incentive compatibility against stationary mixed-strategy deviations above an explicit discount-factor threshold without per-query cryptographic verification. Evaluation across nine open-weight model pairs from 0.5B to 14B parameters shows that the audit signal has the required concave detectability response. A Stackelberg audit-budget analysis shows that improved signal responsiveness reduces the baseline audit rate by 2.6x at discount factor 0.95. Calibrated to deployed parameters, surveyed protocols pass one-round incentive compatibility but admit repeated-game deviations for discount factors between 0.92 and 0.98, with deviation-profit fractions of 1.5%--8%. Our mechanism reduces deviation profits by 31%--54% while maintaining low-latency economic verification.