When One Leak Pays Forever: Context Binding and the Price of Deterring Collusion

1 Introduction

• Threshold-encrypted mempools can hide transactions until ordering is fixed, but a quorum that sells a long-lived decryption capability can expose later batches.Context-dependent decryption binds shares to contexts such as epochs.Source: §1 · pp. 1–2
• A coalition is deterred exactly when its one-time exposure covers the discounted value of every set of rounds reached by a leak at any time.Honest execution is coalition-safe exactly when this condition holds for every authorized coalition.Source: §1 · p. 2
• With T undiscounted unit-value rounds, full reuse requires exposure T, while binding a leak to its own round requires exposure 1.The gap can grow with the horizon.Source: §1 · p. 2
• With unit values and no discounting, exposure must cover the largest number of rounds reached by one leak; no horizon-constant exposure deters unbounded reuse.If reuse is bounded by ρ(S) rounds and each round is worth at most v̄(S), exposure ρ(S)v̄(S) suffices and is tight when a leak reaches that many maximum-value rounds.Source: §1 · p. 2
• The cheapest profile of per-party stakes is a covering linear program, with one constraint for each authorized coalition.For threshold coalitions and equal stakes, the minimum per-party amount is max over coalition sizes m of λ_m/m.Source: §1 · pp. 2–3
• The paper also extends the analysis to probabilistic and time-distributed exposure, where liability that grows with use restores deterrence under long reuse.Source: §1 · p. 3
• The analysis reduces dynamic deviations to choosing a first-leak time, because the reachability set captures the rounds a leak exposes.A single leak ends the coalition’s participation, and context binding makes its reachability set the leak round alone.Source: §1 · pp. 2–3

Deterrence and coalition deviations

• Unlike strong or coalition-proof equilibrium analyses, the benchmark treats a coalition as one transferable-utility player deviating from honest execution.The irreversible leak makes the first leak, rather than an ordinary one-shot deviation, determine the relevant continuation value.Source: §2 · p. 3

Stake, slashing, and economic security

• The model treats exposure κ as the counterpart of slashed stake, but the profit it must deter is a stream over every round unlocked by one leak.Source: §2 · p. 3

Incentives in collaborative learning; Rational cryptography

• The same one-leak, multiple-round structure also appears in collaborative learning under shared keys, while rational-cryptography work typically studies parties reconstructing or computing a secret among themselves.Source: §2 · p. 3

Threshold decryption, accountability, and context binding

• For Ferveo, Shutter, BlindPerm, and related systems, accountability mechanisms determine exposure while keying choices determine which rounds a leaked decoder can reach.Context-dependent threshold decryption prevents shares from different contexts being combined below the corruption threshold.Source: §2 · p. 3

3.1 Access Structures and Repeated Contexts

• A monotone access structure lists authorized coalitions: if a coalition is authorized, every superset is authorized as well.A k-out-of-n policy is a special case with a quota of k members.Source: §3.1 · p. 4

3.2 Leakage Values and One-Time Accountability Exposure

• Stage value v_t(S) is the coalition’s transferable gain from a buyer’s early access to hidden data; exposure κ(S) is its one-time present-value loss for leaking.Exposure can represent stake slashing, legal penalties, lost rewards, reputational damage, or an effective expected penalty after probabilistic tracing.Source: §3.2 · p. 4

3.3 Reachability Semantics

• The reachability set R_S(t) records the rounds whose hidden data a leak at t makes accessible; a fully reusable object can reach every later round, while context isolation reaches only t.The discounted leakage value is the present-value benefit of that leak; if its supremum is infinite, no finite one-time exposure deters the coalition.Source: §3.3 · pp. 4–5

3.4 Deviation Benchmark

• A coalition is deterred when no deviation yields positive present-value gain after any no-leak history, and honest execution is coalition-safe when every coalition is deterred.The benchmark assumes a public, terminal leak, so each coalition leaks at most once; exposure is charged at the leak, and post-disclosure games are outside the model.Source: §3.3 · p. 4, §3.4 · p. 5

4 Main Results

• A coalition is deterred exactly when its exposure covers the discounted value reachable from every possible leak time; honest execution is safe when this holds for all authorized coalitions.The leak is terminal, so the deviation reduces to choosing when to leak and comparing the resulting reachable value with the one-time exposure.Source: §4 · pp. 5–6
• For infinite stationary reuse with δ < 1, the exact threshold is κ(S) ≥ v(S)/(1 − δ), and it grows without bound as δ approaches 1.Context isolation instead requires exposure equal to the largest per-round value.Source: §4 · p. 6
• T rounds of unit value require exposure T under fully reusable leakage, versus 1 under context isolation, making the gap as large as the horizon.The reusable-versus-context-isolating separation is sharp.Source: §4 · p. 6
• With unit values and no discounting, the exact threshold is the maximum number of rounds ρ(S) that one leak reaches; unbounded ρ(S) defeats any fixed exposure.No instance separates the reusable and one-shot thresholds by more than a factor of T.Source: §4 · p. 6
• A bound on reuse multiplicity gives a deterrence bound that is tight when one leak reaches consecutive rounds at the maximum per-round value; key rotation can cap that multiplicity.Rotation every ρ(S) rounds suffices when a leak cannot include a later key.Source: §4 · p. 6
• For heterogeneous additive stakes, minimum total exposure is a covering linear program; with uniform stakes, the binding coalition need not be the smallest.The binding size is where reachable value per member peaks.Source: §4 · p. 7
• The exact theorem does not require additive or symmetric exposure or a threshold access family, covering weighted and hierarchical policies as well.Source: §4 · p. 7

Probabilistic exposure

• A risk-neutral coalition is deterred by probabilistic exposure exactly when its expected fine, p(S)f(S), covers the largest discounted value reachable by a leak.This result assumes the deployment fixes detection probabilities and fines in advance.Source: §5 · p. 7

Time-distributed exposure

• Time-distributed exposure deters exactly when its expected discounted charge covers the discounted value reachable after every possible first-leak time.The framework includes fixed charges per compromised round, forfeited future rewards, and detection probability that grows with continued reuse.Source: §5 · p. 8

Long reuse and patient coalitions

• With unlimited reuse and per-round value at least v > 0, required exposure is at least v/(1 − δ), diverging as δ approaches 1.A reachability cap of ρ rounds bounds the requirement by ρv̄ for every δ ≤ 1; a per-compromised-round charge c ≥ sup_r v_r(S) also suffices for δ < 1.Source: §5 · p. 8
• A fixed one-time loss does not remove the divergence from unlimited reuse, whereas a reachability cap or liability growing with use keeps the requirement bounded.For a reachability cap, the bound is tight when a leak reaches ρ consecutive rounds, each worth v̄.Source: §5 · p. 8

6.1 From a Deployment to the Model

• Deployment certification requires an upper bound on reachable value and a lower bound on exposure; uncertain discounting or reach calls for conservative bounds.If feasible exposure cannot clear the bound, the remaining levers include reducing reach, increasing use-linked liability, lowering early-access value, or changing access structure.Source: §6.1 · p. 8

6.2 Threshold-Encrypted Mempools

• In encrypted mempools, full reuse requires κ(S) ≥ sup_t≤T ∑_r=t^T δ^(r−t)v_r(S), while context isolation requires κ(S) ≥ sup_t≤T v_t(S).The comparison is between a leak’s reachable early-access value and the coalition’s exposure.Source: §6.2 · p. 8
• Ferveo generates keys per validator epoch, while Shutter derives epoch keys from a long-lived eon key, so an epoch-key leak can expose a larger reach under Shutter.Committee overlap alone does not extend reach when keys are fresh; key continuity does.Source: §6.2 · pp. 8–9, Table 3 · p. 9
• 196,691 Ethereum insertion attacks had median profit $24.07, 75th-percentile profit $62.92, and maximum profit $20,084.01; these profits are stress benchmarks, not certified upper bounds.The calibration considers a key reused over 32 block contexts with δ = 1, where a leak reaching ρ contexts requires exposure κ(S) ≥ ρv.Source: §6.2 · p. 9, Table 4 · p. 9

6.3 Other Applications

• In federated learning under a collective key, a leak can expose later training rounds; refreshing the key per round or window bounds that reach.The same collective-key pattern is used for distributed clinical and genomic queries, where a query is the context.Source: §6.3 · pp. 9–10
• In sealed-bid auctions and voting, reused threshold keys can expose later auctions or elections, while fresh keys confine reach to one context.For unreleased ballots, the model’s threshold is a lower bound on required exposure because a leak can also reveal past elections.Source: §6.3 · p. 10
• For threshold signatures, reachability tracks the contexts where a leaked signing capability remains valid; state-changing forged actions fall outside the model.Long-lived bridge keys can reach later epochs, while independent per-epoch keys or replaceable context-limited modules confine reach to one epoch.Source: §6.3 · p. 10

Exogenous inputs

• The model takes coalition value, reachability, and exposure as exogenous inputs.Section 6.1 describes how to bound them for a deployment.Source: §7 · p. 10

Scope of the deterrence threshold

• Theorem 4.1 is exact under transferable utility; without side transfers, a coalition has no scalar objective and the threshold is only a transferable-utility benchmark.Risk attitudes do not change the threshold for deterministic value and exposure, but matter when either is random.Source: §7 · p. 10

Coalition interactions and terminal leaks

• The benchmark assumes one coalition leaks while all others execute honestly; when authorized coalitions overlap, one leak may preempt another and the full race is open.The model also treats a leak as terminal; if leakers could continue leaking after one charge, the fully reusable threshold would apply even under context binding.Source: §7 · p. 10

Post-decryption fairness

• Deterring early leakage does not prevent sandwiching after honest decryption, so ordering after release requires its own mechanism or consensus constraints.A theory combining deterrence with post-decryption ordering remains open.Source: §7 · p. 10

8 Open Problems

• Derive stage values from strategic buyers, buyer competition, limited commitment, and competing coalitions.This would model how the value of a leak emerges from the market for it.Source: §8 · p. 10
• Extend reachability to time-indexed access structures and coalitions, including partially overlapping committees.Source: §8 · p. 10
• Find exact deterrence thresholds when leaked objects work on structured subsets of future contexts, beyond reuse multiplicity alone.Source: §8 · p. 10
• Determine which thresholds hold with imperfect side transfers, endogenous tracing investment, or risk aversion under random exposure.Source: §8 · p. 10

A.1 Normal Form for Coalition Deviations

• Any coalition deviation is equivalent in payoff to either never leaking, for zero gain, or making one successful leak at its first leak time.A successful leak earns the value of the reachable rounds and incurs the exposure once.Source: §A.1 · p. 14

A.2 Exact Characterization

• A coalition is deterred exactly when its exposure covers the supremum of its leak value over all rounds.The proof establishes sufficiency by bounding every possible leak and necessity by leaking at a round whose value exceeds the exposure.Source: §A.2 · p. 14
• With one round, the exact exposure threshold is that round’s stage value; under context isolation, it is the current round’s value.Source: §A.2 · p. 14
• For a long-lived key, a leak at round t has value equal to the discounted sum of stage values from t through the horizon.With an infinite horizon, constant per-round value, and discount factor below one, the sum is geometric.Source: §A.2 · p. 14

A.3 Separation and Converse Lower Bound

• T rounds of unit-value full reuse require exposure T, while context isolation requires exposure 1.The result uses no discounting; the reuse threshold can grow beyond every constant as the horizon grows.Source: §A.3 · p. 15
• With no discounting and unit stage values, the exact threshold is the maximum number of rounds one leak can reach.If that reuse multiplicity is unbounded across deployments, no horizon-constant exposure deters the coalition.Source: §A.3 · p. 15
• Under discounting, bounded reuse and bounded per-round values yield a sufficient exposure bound, tight when the reachable rounds occur first at the maximum value.Source: §A.3 · p. 15

A.4 Access-Structure Corollaries

• The smallest equal per-party stake is the maximum coalition threshold divided by coalition size; minimizing total individual stakes is a covering linear program.When the threshold depends only on coalition size, the maximum can be taken over sizes.Source: §A.4 · p. 15

B.1 Proofs of the Exposure Extensions

• With a fixed detection probability and fine, expected exposure replaces deterministic exposure in the first-leak deterrence condition.For time-varying expected charges, deterrence requires the charge at each round to cover that round’s leak value.Source: §B.1 · p. 16

B.2 Geometric Evidence Accumulation

• Under a constant tracing hazard, a coalition is deterred exactly when the resulting expected fine dominates its leak value at every round.The proof sums the fine multiplied by the probability that the first tracing evidence arrives at each reachable offset.Source: §B.2 · p. 16

B.3 Stochastic Reuse and Partial Leakage

• With risk-neutral coalitions and history-independent random reachability, deterrence compares expected leak value with expected exposure.This covers reuse ending at a random time; publicly revealed refresh schedules instead fit the deterministic model.Source: §B.3 · pp. 16–17
• A degraded decoder can be modeled as a leakage mode with lower stage values, a smaller reachable set, or both, without monotonicity or subadditivity assumptions.Source: §B.3 · p. 17

B.4 An Explicit k-out-of-n Example

• In the stationary k-out-of-n example, context isolation removes the continuation-value multiplier required under full reuse.Source: §B.4 · p. 17

• Under context isolation, Λt(S) = vt(S).The section applies Theorem 4.1 in each case.Source: §B.5 · p. 17
• Theorem 4.1 is applied to each case.Source: §B.5 · p. 17
• The stated context-isolation relationship equates Λt(S) with vt(S).Source: §B.5 · p. 17

B.6 What the Model Does Not Solve

• Even under the exact deterrence threshold, a builder can profit by ordering its trades around a user’s after honest decryption.The constructed deployment satisfies the paper’s context-isolating condition, yet the builder’s trades leave the user’s order valid and yield positive profit.Source: §B.6 · p. 18
• With exogenous survival probabilities, the first-leak comparison extends to a risk-neutral coalition valuing only rounds where its buyer retains exclusive early access.The extension assumes the random set of rounds with surviving exclusivity has a law independent of public history; endogenizing survival when coalitions overlap and preempt one another remains outside the paper.Source: §B.6 · p. 18

NeurIPS Paper Checklist

• The paper characterizes its contribution as a stylized theoretical analysis, not an empirical or deployed-system evaluation.The checklist states that the paper reports no experiments and that its main results are mathematical statements supported by the formal model and proofs.Source: NeurIPS Paper Checklist · pp. 19–20
• The checklist answers yes to LLM use, noting AI tools helped check derivations and proofs and suggest revisions.Source: NeurIPS Paper Checklist · p. 25