What Cannot Be Gamed
Most of the mechanism's defences are not detectors. They are properties of the seams — things that cannot happen because there is no parameter they could pass through — and where a detector would be needed, the economics do the work instead. This page lists each avenue and what closes it.
Smuggling an answer
Closed by the invariant, not by a filter. The only things that reach a worker model are the benchmark's own task text and a validated model ID. The scaffold builds every worker request from the task statement; the conductor cannot rewrite it, prepend to it or append to it, and REASON text never leaves the conductor. The worker call has no parameter such content could travel through, and the audit republishes every request as a function of the task and the observations so anyone can recompute byte-equality. A model ID is a short catalog slug with no room to carry a solution; an unrecognised one is refused rather than forwarded.
This is what makes public benchmarks safe to score on. Memorising the answers has no value when no channel exists to emit them.
Executing code on the validator
Closed at admission. safetensors only — a pure tensor container with no code path. .bin, .pt and .pth are pickle archives, and loading one runs arbitrary code on the single machine that holds the subnet's scoring authority. The gate also refuses the custom-code path a clean safetensors tree can still carry: any bundled *.py, auto_map in config.json, and trust_remote_code anywhere. Refused, never stripped — silently deleting a modeling_*.py and loading the rest would serve an architecture the miner did not upload.
Uploading a different model
Closed by the pin. config.json is compared field by field to the reference, the tokenizer by digest, every tensor's name, shape and dtype against the inventory. A distilled 3B, a 70B, a different family, a different precision — refused, not coerced. The architecture pin fixes the parameter count exactly, which is stronger than a cap.
Serving one tree, having committed to another
Closed by the manifest. The ready signal on chain carries the digest of a signed manifest that names every file's size and SHA-256. The validator checks the manifest against the commitment before pulling a byte, hashes every file as it lands, refuses an unlisted extra, and asks the serving stack for the tree under v3-<hotkey>@<manifest digest> — a stale server on the port is refused by name.
Copying the king
Closed by ε, not by a detector. The king's weights are public and derivatives are allowed (D14). A near-copy ties the king on the same slice, and a tie fails a strict beat of ε = 0.05. To be crowned, a derivative must add five to eight real points — which is improvement, not free-riding — and the ex-king pension pays the predecessor for being built on. Behavioural copy detection was measured under the previous mechanism and found inseparable from honest convergence; it is not attempted here.
Winning one benchmark
Closed by breadth. A win must survive dropping the challenger's single best benchmark and the median benchmark must move its way. Both were added because each alone was measured not to bind: leave-one-out passes a two-benchmark specialist; the median passes a win carried by one benchmark when the rest split six-to-five. At two benchmarks — today's launch corpus — the median condition is arithmetically the aggregate, which is recorded as a known limit rather than hidden.
Draining the king
Closed by batching. The king's arm runs once per window and is shared by every duel in it. An attacker who commits to make the king spend pays a registration burn and a full arm of their own; the king pays once no matter how many challenge. With per-duel re-runs the ratio would be one-to-one; batched it is N-to-one against the attacker.
Stalling the validator
Closed by clocks. A model that emits 512 tokens of REASON at every step and never reaches an action hits the per-call token cap (a parse failure), the per-episode wall clock (the task scores zero for that arm), and the per-arm wall clock (remaining tasks score zero and say why). A model that cannot load, or loads out of memory, is refused before the king's arm is touched: the shot is spent and the king is not charged.
Choosing the slice
Closed by commitment order. The schedule's root goes on chain before any challenger enters; each window's nonce is a chain beacon nobody controls; the validator re-derives the slice from the committed entry and the beacon and refuses a window whose published nonce disagrees. Whoever picks the nonce picks the slice, so nobody does.
Being judged never
Closed by refusing at the door. A challenger who registers, registers a key and uploads 70 GB can be deregistered before ever being evaluated if the queue outlasts the immunity period. So commits beyond the queue's depth are refused rather than accepted — taking a registration burn for a slot that will expire is the outcome the "kind" property forbids — and the validator refuses to start on a subnet whose immunity period does not cover the drain time. Unfunded entries do not hold a slot; a miner waiting on their own wallet is not in the queue.
What is not closed, stated plainly
- Worker-side nondeterminism. Third-party endpoints do not decode deterministically at temperature 0 (measured: six identical calls, six distinct answers). ε and the once-per-slice king arm absorb it; nothing eliminates it.
- Capital. Caps are miner-set and unequal, so the leaderboard measures routing skill and capital together. That is a recorded owner decision (D5), and where an arm ran out of money is published so a verdict decided by funding is visible as such.
- Convergence. Shared training traces push miners toward similar policies, ties break on seniority, and that is the ossification pressure the breadth rule and corpus rotation exist to counter. It is the price of a field anyone can afford to enter.