Manipulation‑Resistant Oracles via Continuous Peer Prediction

The paper in three and a half minutes

The problem, the mechanism, why sensor diversity matters, and the evidence, in one narrated film.

Watch the film 3:32

Abstract

Blockchain oracle networks, including decentralised physical infrastructure networks (DePINs), report physical measurements from a source that can manipulate the underlying process. A carbon project operator, for example, can dry a site before measurement and be paid for soil organic carbon (SOC) that was never stored. Peer prediction covers discrete signals under a strategic source, or continuous reports under an honest source, but not both at once. We close that gap for Gaussian reports. Strict propriety of the continuous ranked probability score (CRPS) settles the reporting stage alone. Our result concerns the source stage. A report-only settlement rule whose honest-source payoff is non-decreasing in the true value identifies and deters source manipulation if and only if the sensors respond to that manipulation by different amounts. When they respond identically, manipulation is observationally equivalent to a genuine rise in SOC, and CRPS translation equivariance leaves every peer score unchanged, so no such rule deters the source. Necessity follows from invariance rather than from the signal enumeration available in the discrete case. The source-stage estimator is ordinary weighted least squares, and the contribution is the characterisation around it. With eight calibrated SOC models on 37,280 real European soil spectra, shift-naive aggregators over-credit by up to 57% under a calibrated moisture perturbation while the joint estimate stays near-unbiased. The guarantee holds on the equilibrium path for non-colluding reporters and inherits the models' own calibration error.

The diversity condition, in one drag

Three sensors report Gaussian beliefs about one parcel, each with its own precision. Drag the manipulation and watch what the reports reveal. With identical sensitivities, every mean shifts by the same amount, so the shift is indistinguishable from a genuine rise in SOC. With diverse sensitivities, the design matrix [1 | α] separates the two, and the manipulation is recovered exactly.

Findings

Robustness sweeps

Each sweep relaxes one assumption of the idealised model and runs with the released code. Correlated residuals, which the eight models share because they read one spectrum, sharpen detection rather than weaken it: at fifty percent manipulation, detection power rises from 14% at ρ = 0 to 47% at ρ = 0.9.

How it works

1. Report. Each sensor i submits a Gaussian belief N(m_i, v_i) about the parcel's SOC. Its mean responds to a manipulation s through a measured sensitivity α_i.
2. Score. Each sensor is paid the negative closed-form Gaussian CRPS of its forecast against its peers' reports. CRPS is strictly proper, so the truthful mean and variance are the unique best response; no ground truth is ever needed.
3. Read out. Weighted least squares on the design [1 | α] separates the estimate θ̂ from the manipulation ŝ. Credits are issued on θ̂; the source's stake is slashed when ŝ clears a 5% false-alarm threshold. Both are deterministic in the reports, so the whole round runs as a smart contract.

Measured model ensemble

The drag example teaches the condition. This panel applies the same algebra to the eight measured models, using the parameters reported in the paper. Switch a model off, stage the site, or compress the response spread, and every reading recomputes in closed form.

Deterrent stake

Readings in g/kg of soil organic carbon. The payout row prices one round on the median mineral parcel at 19.9 g/kg. What deters is the detector's power above its false-alarm rate, not its raw power; crediting on the joint estimate removes the gain outright and needs no stake, at the cost of a higher honest-case error.

Beyond soil carbon

The theorem is not about soil. It is about payment settled on a continuous measurement that the paid party can stage before it is taken. Any domain with that shape admits the same test, and the test asks five things of it.

Continuous settlement

A payment, penalty or contractual trigger settles on a continuously measured quantity, not a yes-or-no attestation.

No cheap truth

There is no affordable trusted ground truth. Where a certified meter settles the question, use that meter.

Independent readers

At least three independently operated estimators read the same physical event. Two is the algebraic minimum; three is the practical floor.

A spread of responses

The readers respond to the staging move by different amounts. Different modalities give this almost for free; a fleet of identical instruments never does.

Staging, not tampering

The manipulation acts on the physical process before measurement. Falsifying a report afterwards is a different, better-studied problem.

Reproduce

Every simulation figure regenerates from the committed experiment outputs, with no dataset and no GPU. Re-running the experiments needs the LUCAS 2018 topsoil CSV, which its licence does not allow us to redistribute.

git clone https://github.com/Rqcker/crps-wls
cd crps-wls
pip install -r requirements.txt
python -m src.plots        # figures from the committed CSVs
python -m src.experiments  # all 16 experiments; needs the LUCAS CSV

BibTeX

@inproceedings{song2026manipulation,
  author        = {Song, Junhao and Rolandi, Tanis and Novocky, Adam and
                   Biffis, Enrico and Knottenbelt, William},
  title         = {Manipulation-Resistant Oracles via Continuous Peer
                   Prediction},
  booktitle     = {Mathematical Research for Blockchain Economy (MARBLE 2026)},
  publisher     = {Springer},
  year          = {2026},
  eprint        = {2610.35888},
  archivePrefix = {arXiv},
  primaryClass  = {stat.AP}
}