BE-CTDE: Blockchain-Enabled Multi-Agent Reinforcement Learning with Anomaly Detection and Token Economics

1

BE-CTDE: Blockchain-Enabled Multi-Agent Reinforcement Learning with Anomaly Detection and Token Economics

arXiv:2610.34121v1 [cs.MA] 25 Oct 2026

Chih-Wei Huang, Hsin-Chieh Lee, Yun-Chen Yu, Ibrahim Althamary, Rongxing Lu, and Phone Lin

Abstract—Multi-agent reinforcement learning supports cooperative decision-making in Internet of Things systems, but strategic deviations can disrupt coordination and undermine confidence in the training process. This paper proposes Blockchain-Enabled Centralized Training and Decentralized Execution (BE-CTDE), which uses blockchain as an active training-management layer. A behavioral verifier compares executed trajectories with sharedpolicy recommendations; its flags drive a token mechanism combining slashing, burning, rewards, and compensation. Retained balances determine each agent’s contribution to the global policy update, connecting auditable behavior to learning influence. We derive a one-round incentive condition that accounts for actiondependent compensation and the payoff from deviation, and a finite expected exclusion-time bound under explicit conditional detection and accounting assumptions, showing perfect detection is unnecessary. An exact finite-population capacity bound characterizes the limits of the population-relative detector. In multi-agent path finding experiments, BE-CTDE outperforms a state-of-the-art learning-based path planner with substantially higher success rates under attack, even when adversaries form the majority. It also outperforms partially defended baselines in all configurations, with collision rates up to 35% lower than under detection without economic consequences and up to 43% lower than under conventional stake slashing. Together, these results characterize how behavioral verification and token feedback can support accountable cooperative learning. Index Terms—Anomaly detection, blockchain, incentive mechanism, Internet of Things (IoT), multi-agent reinforcement learning (MARL), smart contracts, token economics.

I. I NTRODUCTION The proliferation of the Internet of Things (IoT) drives applications such as smart logistics, urban traffic management, and autonomous drone swarms, in which many intelligent This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible. (Corresponding author: Chih-Wei Huang.) Chih-Wei Huang, Hsin-Chieh Lee, and Yun-Chen Yu are with the Department of Communication Engineering, National Central University, Taoyuan City 320317, Taiwan (e-mail: cwhuang@ce.ncu.edu.tw; 112523042@cc.ncu.edu.tw; 113523038@cc.ncu.edu.tw). Ibrahim Althamary is with the Interdisciplinary Research Center for Intelligent Secure Systems, King Fahd University of Petroleum and Minerals (KFUPM), Dhahran 31261, Saudi Arabia (e-mail: ibrahim.thamary@kfupm.edu.sa). Rongxing Lu is with the School of Computing, Queen’s University, Kingston, ON K7L 2N8, Canada (e-mail: rongxing.lu@queensu.ca). Phone Lin is with the Department of Computer Science and Information Engineering, the Graduate Institute of Networking and Multimedia, the Graduate Institute of Biomedical Electronics and Bioinformatics, the Internet of Things Research Center, and the Graduate Institute of Medical Device and Imaging, National Taiwan University, Taipei City 10617, Taiwan (e-mail: plin@csie.ntu.edu.tw).

agents collaborate in dynamic environments to accomplish complex tasks [1]. These interconnected agents share communication, storage, and computing resources for coordinated operations such as adaptive traffic-signal control, infrastructure monitoring, and synchronized drone missions [2]. Achieving high performance, security, and reliability in such resourceconstrained, interactive settings remains challenging, particularly amid data tampering, privacy breaches, and adversarial disruption [3]. To address decision-making complexity in these settings, Multi-Agent Reinforcement Learning (MARL) has emerged as an essential paradigm in which agents optimize resource scheduling and actions through continuous learning over shared information [4], [5]. A widely adopted framework is Centralized Training and Decentralized Execution (CTDE), which derives global insights from centralized training while preserving the distributed execution that real-world IoT latency and connectivity constraints demand. Learning-based multiagent path finding (MAPF) commonly adopts this framework [6], as does the state-of-the-art SCRIMP planner [7]. The traditional training process of the CTDE global model introduces critical vulnerabilities. These include untraceable data that hinder transparency, inherent weaknesses in the centralized architecture such as lack of accountability and a single point of failure [5], and policy disobedience where agents may execute malicious actions [8]. In open IoT deployments, these weaknesses are exacerbated by the broader threat landscape facing autonomous AI agents, including data poisoning, model evasion, and behavioral manipulation [9]. Purely on-device training, conversely, loses the global context cooperative tasks require. What is needed is a training framework that distributes management of the learning process for transparency and fault tolerance without sacrificing the coordination benefits of centralized training. Blockchain can provide a replicated management layer [10], [11], in which commitments to model updates and interactions support an auditable coordination history [12], [13]. Commitments bind recorded inputs; they do not establish sensor truth or the correctness of off-chain inference. Such deployments commonly span several operators with no single party that all of them trust, which is the setting in which a replicated ledger repays its overhead. Trust is then bounded rather than eliminated, since the shared coordination infrastructure is trusted while the agents that participate in training are not. Blockchain alone, however, does not address policy disobedience, because it preserves submitted interaction records yet cannot determine

2

whether recorded behavior reflects genuine cooperation or adversarial interference. Closing this loop requires behavioral verification and incentive alignment inside the training process itself, complementing recent advances in adversarial detection for cooperative multi-agent systems [14], [15]. Several architectures have been proposed at the convergence of blockchain and AI. Early frameworks pioneered decentralized machine learning on simulated blockchains, using token incentives to validate data quality [16]–[18]. Subsequent work added incentives for data and compute sharing on real chains but largely overlooked behavior verification and adversarial mitigation during training [19], [20]. In blockchain-integrated MARL specifically, recent efforts explore on-chain coordination for multi-object tracking, path planning in cognitive vehicular networks, and resource management for blockchainbased federated learning in IoT [21]–[23]. The most directly comparable framework, LearnChain [24], makes MARL model updates traceable, but its record is compiled after the fact, and an agent logged as deviant still contributes to the shared model exactly as a compliant one does. Across this literature the ledger observes training rather than participating in it, so the step from detecting misbehavior to withholding its influence over the learned policy remains open. The gap is therefore not auditability but consequence, because evidence of how an agent actually behaved is not carried back into the update that trains the shared policy. We close that loop with Blockchain-Enabled Centralized Training and Decentralized Execution (BE-CTDE), in which blockchain is an active training-management layer. The contributions are: • Closed-loop BE-CTDE. On-chain coordination and offchain learning form an auditable training cycle: behavioral verification updates economic state, economic state determines aggregation weight, and insufficient balance ends an agent’s training contribution. • Detection and aggregation. A framework-agnostic verifier compares executed trajectories with shared-policy recommendations using a task-specific residual. The coupled token mechanism applies slashing, burning, rewards, and compensation, while retained balances weight the per-agent learning contributions. This makes detected deviations economically consequential without requiring gradient-space similarity between heterogeneous agents. • Conditional theoretical guarantees. We derive the oneround incentive comparison with action-dependent compensation and deviation utility. Exclusion in finite expected time needs no perfect detector, only historyuniform detection above a threshold, at most 1/3 in our setting even with full compensation, and the excluded adversary then contributes no new gradient. An exact capacity result makes the threshold hold for every retained population. • Implementation and MAPF evaluation. A private Ethereum/Solidity implementation evaluates BE-CTDE across population scales, adversary ratios, and obstacle densities. BE-CTDE achieves higher success rates under attack than the state-of-the-art SCRIMP planner and, in every configuration, lower collision rates than partially defended baselines, by up to 35% relative to detection

without economic consequences and up to 43% relative to conventional stake slashing. The rest of the paper is organized as follows. Section II reviews related work. Section III sets out the system model, threat model, and design problem, and Section IV develops the detection, incentive, and aggregation mechanisms with their guarantees. Section V describes the blockchain implementation, Section VI reports the MAPF evaluation, and Section VII concludes the paper. II. R ELATED W ORK A. Blockchain Foundations for IoT Blockchain replicates an append-only, cryptographically linked ledger across nodes, replacing trust in a central operator with consensus-backed immutability [11], so transactions and model-update commitments can be audited by every participant when multiple IoT operators share infrastructure without a common trusted server. Proof of Work relies on energy-intensive computational competition, whereas Proof of Stake (PoS) uses stake-based validator selection; their energy requirements differ [25]. Ethereum also supports deterministic smart contracts executed by the Ethereum Virtual Machine (EVM) [26], encoding deposits, verifiable artifacts, rewards, and penalties as an automated trust layer. BE-CTDE uses a permissioned Ethereum management layer to coordinate training while neural-network execution remains off-chain. B. AI and Blockchain Integration Research on decentralized AI increasingly uses blockchain as a coordination substrate. Table I compares representative systems along the dimensions that separate them from BECTDE. Early systems introduced token-incentivized data validation on Ethereum simulators [16], [17] and later extended it to auditable deep learning and resource sharing on real chains [18], [19]. IoT-focused work primarily addresses federated learning, with privacy-preserving data sharing [27], blockchain resource management [23], privacy plus incentives for the Internet of Vehicles [20], and reputation-weighted token incentives for IoT ecosystems [28]. These systems address realistic deployment constraints but not MARL’s cooperative dynamics, behavioral verifiability, or trajectory-level adversarial actions. A smaller literature directly couples blockchain with MARL. Shen et al. [21] coordinate collaborative multi-object tracking, and Chang et al. [22] address path planning and scheduling in cognitive vehicular networks. Both demonstrate feasibility but use offline or simulated chains and emphasize reward traceability. More recent work extends the pairing to computational task offloading in IoT [29] and to decentralized multi-agent path planning with federated updates [30]. LearnChain [24], the closest comparison, records MARL updates on a permissioned chain, yet the chain serves as an audit endpoint, so an agent’s recorded conduct never alters its influence over the aggregated model. Tian [31] more directly records agent behavior and automates penalties and rewards in a smart contract. BE-CTDE differs in both its evidence and its feedback: a trajectory residual

3

TABLE I F UNCTIONAL COMPARISON OF AI AND BLOCKCHAIN INTEGRATION ACROSS RECENT LITERATURE

References Blockchain MARL [16], [17] [20] [18] [21] [19] [22] [23] [24] BE-CTDE

Simulator Simulator Real Simulator Real Simulator Simulator Real Ethereum

– – – ✓ – ✓ – ✓ ✓

On-chain On-chain Incentive Token-based Data Parameters Learning Mechanism Economy Verification ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ Hash

✓ – – – ✓ – – ✓ Audit

✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓

✓ ✓ ✓ – ✓ – ✓ – Ledger

✓ ✓ ✓ ✓ – ✓ ✓ ✓ Inputs

Malicious Agent Detection – ✓ ✓ – – ✓ – – Flags

On-chain learning denotes anchored artifacts, not neural-network execution; BE-CTDE anchors accounting and input/policy commitments.

compares policy-recommended and executed actions, and the resulting token balance enters the gradient step as an aggregation weight. Thus, detection changes economic state, economic state changes influence, and sustained balance decay triggers exclusion. LearnChain records updates without inferring behavior, while Zhao et al. [20] slash stake without feeding the penalty into the update rule. As Table I summarizes, BECTDE combines executable EVM accounting, residual-based detection (Section IV-B), token accounting (Section IV-C), and token-weighted aggregation (Section IV-D). C. Byzantine-Resilient Multi-Agent Learning and Incentive Design Robust gradient aggregation offers a different defense. Krum [32] replaces averaging with a selection rule based on the n−f −2 nearest gradients and provides convergence under Byzantine workers; coordinate-wise median and trimmedmean rules attain optimal statistical rates [33]. Both families assume an honest majority, so their guarantees do not extend to the majority-adversary setting evaluated in Section VI. These methods identify adversaries through statistical deviation in parameter space, assuming honest gradients concentrate around a common direction. In MARL, however, agents face heterogeneous states, observations, and goals, so honest gradients need not concentrate. BE-CTDE instead evaluates each executed trajectory against the shared policy recommendation, a behavioral reference meaningful across distinct local subproblems. Work specific to cooperative MARL includes Li et al.’s Bayesian Adversarial Robust Dec-POMDP [34], in which Byzantine agents are latent types and honest agents maintain beliefs about peers. This approach is theoretically rigorous but requires extensive belief tracking and supplies no economic mechanism for sustained honest behavior. BE-CTDE takes a complementary path: trajectory-level verification changes accounting state and gradient weights, with removal conditional on crossing an exclusion threshold. BARD-MARL combines policy-graph evidence with Bayesian trust signals to diagnose compromised learned communication [35]. Wu and Klabjan study blockchain-based federated learning with loss-based softmax aggregation and a convergence result in a convex setting [36]. These works distinguish detection and robust update selection from the closed

Fig. 1. BE-CTDE system architecture: IoT agents interact with the environment through observations ot , rewards rt and actions at , while the blockchain layer coordinates training, verifies behavior and manages token incentives. Neural-network computation remains off-chain.

feedback path studied here: movement evidence changes token accounts, accounts change gradient weights, and insufficient balance ends training contribution. Our experiments do not benchmark their algorithms or transfer their guarantees to MARL. BE-CTDE also draws on mechanism design [37] and incentive-compatible federated learning [38], [39]. Section IV-C makes explicit the compensation comparison and external deviation payoff required for a one-round incentive result. A separate conditional drift argument concerns persistent disruption even when token rewards do not deter it. III. S YSTEM M ODEL AND P ROBLEM F ORMULATION A. System Architecture Figure 1 presents BE-CTDE’s two-layer architecture: IoT agents execute the learned policy, while a blockchain trust layer coordinates training and verifies behavior.

4

TABLE II P RINCIPAL N OTATION Symbol

Definition

System and learning N, nt , M, Mt Initial, active, initially malicious, and active malicious counts (M < N ) Kt , H, M, fi (t) Retained, honest, malicious sets and detection flag S, A, O State, joint-action, and joint-observation spaces Ω, P, R, γ Observation map, transition/reward functions, and discount factor (o, a, r, m)i,t Observation, action, reward, and prior message of agent i πθ , θ, J(θ) Global policy, parameters, and executed return gi (t), α, T, E Local gradient, learning rate, horizon, and episode count

task-specific extrinsic terms and intrinsic exploration bonuses and γ ∈ [0, 1) is the discount factor. Each agent learns a parameterized policy πθ (a | o) executed in a decentralized manner. Following the CTDE paradigm, the policy parameters θ are updated centrally using globally aggregated information; in BE-CTDE, a trusted off-chain learner consumes the token-accounting outcomes. Recorded hashes identify the policy and inputs used; they do not prove that the learner performed correct optimization. C. Threat Model

The IoT layer supplies observations and executes a shared policy. During training, a trusted coordinator records physical transitions, computes the policy recommendation, and submits sampled records to the verification contract. The contract evaluates consistency and updates token accounts; retained balances determine off-chain gradient weights. This is an auditable training interface, not a proof that independently reported sensor data are truthful. Table II summarizes the notation.

The intended deployment separates participating agents from a permissioned training coordinator and execution ledger. Up to M < N agents can deviate from policy actions [8], [34]; the remaining agents sample or execute the prescribed policy. The model assumes authentic physical observations and an honest training coordinator. The permissioned ledger provides an auditable coordination history under its consensus assumptions [11]. Adversarial capabilities and objective. Attackers can replace their sampled actions with persistent blocking, occupation of another agent’s goal, or repetitive motion [40]. Their objective is disruption rather than token profit. Attacker identities are used to define the adversarial conditions and evaluate outcomes; the behavioral decision rule operates on trajectory evidence. Exclusion removes an agent’s contribution to training; it does not physically remove the agent from the environment. Consequently, learning-layer containment does not guarantee that honest goals remain physically attainable. Trust and scope. The global policy is computed by an honest off-chain learner. A policy hash commits to its bytes, not to correct inference, and a transaction signature authenticates the submitting controller, not independent agent observations. The experiments assess learning under behavioral attacks; network consensus faults and validator incentives are outside this evaluation. Sybil attacks, fabricated sensor records, gradient-inversion attacks, collusion channels, and concealed nonstationary attacks are outside the evaluated threat model; see Section VII.

B. Cooperative Decision-Making under Partial Observability

D. Design Problem

The cooperative decision-making process across N IoT agents is modeled as a Decentralized Partially Observable Markov Decision Process (Dec-POMDP) ⟨S, A, O, Ω, P, R, γ⟩. The state space S captures the global configuration of agents and environmental factors such as obstacles or resource loads; the joint action space A = A1 × · · · × AN comprises the discrete actions ai,t ∈ Ai of each agent, such as movement directions or resource bids. Since agents cannot perceive the global state directly, the observation function Ω : S → O yields a local observation oi,t ∈ Oi correlated with each agent’s sensing range and communication history, with O = O1 × · · · × ON the joint observation space. Dynamics follow the transition function ′ P(s hP| s, a), and i agents jointly maximize the discounted return T t E t=0 γ rt under R : S × A → R, where rt aggregates

The policy samples joint actions, but the environment advances under the executed joint action aexec , which the t adversaries of Section III-C partly control. The objective is therefore the executed return " T # X t exec J(θ) = E γ R(st , at ) . (1)

Detection and token economy a∗i,t , aexec Policy-recommended and executed actions i,t ϕi , ρ Outcome map and outcome metric di,t , Di Per-step and cumulative behavioral residual h, L, T Sampling interval, episode length, and sampling instants µt , σt , k, τt Active-population statistics, sensitivity, threshold Fmax , κN , Cmax Flag capacity, worst compensation ratio and bound Ptp , Pfp Detector true- and false-positive rates s, β Deposit and reward factor λ, ct Compensation factor and per-recipient compensation Si (t), Smin , ωi (t) Token balance, exclusion threshold, and aggregation weight pH , p D , b H , b D Conditional flag probabilities and unflagged gains, honest (H) versus deviation (D) Detection floor, gain bound, detection threshold, p, bmax , P ∗ , ε and drift margin Tjex , ∆, udev Exclusion time, incentive margin, and per-round deviation payoff

t=0

Adversarial behavior can depress J(θ) through two channels: it perturbs the executed trajectory, and the resulting training data can distort the centralized update. BE-CTDE directly changes contribution to the second channel. It can improve learned responses to interference, but cannot physically remove an obstacle or guarantee access to an occupied goal. The design couples behavioral consistency, token accounting and policy aggregation. Detection supplies a task-level

5

B. Framework-Agnostic Behavioral Consistency Verification Let Kt be the retained training participants before settlement t, with nt = |Kt | ≤ N . The shared policy supplies a reference action a∗i,u , fixed by πθ and the recorded observation oi,u alone. Verification compares what that recommendation would have produced with what the agent produced, through a taskspecific outcome map ϕi carrying a state-action pair to an observable outcome, and a metric ρ that compares two such outcomes. At each sampled environment step u, this reference and the action aexec i,u the agent executed are both evaluated at the state su it actually occupied, giving the per-step behavioral residual di,u and its episode total Di , X
∗ di,u = ρ ϕi (su , aexec Di = di,u , (2) i,u ), ϕi (su , ai,u ) , u∈T

Fig. 2. BE-CTDE training workflow and shared-policy architecture. Neural inference, communication, advantage estimation and PPO run off-chain (orange), while behavioral verification and token settlement run on-chain (blue); document icons mark results committed to the chain.

reference for identifying deviations; the economic rule changes the cost of those deviations; and retained balances determine learning influence. The analysis asks when a deviation is deterred and when negative balance drift is sufficient for exclusion. The MAPF evaluation measures the resulting task performance across agent populations, adversary ratios and obstacle densities. Task metrics alone do not establish the conditional detection assumptions of the analysis. IV. O N -C HAIN D ETECTION AND T OKEN -BASED I NCENTIVE M ECHANISMS The blockchain layer governs training through sampledinput commitments, behavioral verification, and token incentives while high-frequency execution remains in the IoT layer. A. Training Workflow Overview Figure 2 summarizes the coupled on-chain/off-chain training workflow. Each agent encodes its local observation oti together with the peer messages mt−1 , emits mt , and reads a value estimate i t V and an action distribution πθ,new (a | s) from the shared model. Every h steps, the sampled state st is recorded as the interaction evidence for behavioral verification, so an episode of length L supplies at most ⌊L/h⌋ samples. At every step, by contrast, the off-chain SCRIMP/PPO learner [7] turns the executed actions ati and returned rewards rit into the TD error δ t and the advantage At that form the policy loss. Episode-end detection and incentive settlement then supply the weights applied to that loss in the next update, separating highfrequency inference from economic coordination. The analysis below concerns settlements with residual evidence; without evidence, its balance recursion makes no change.

where T = {h, 2h, . . . , h⌊L/h⌋} collects the sampling instants of an episode of length L. Any ϕi whose outcomes are recorded rather than asserted admits this construction, since a verifier then recomputes di,u by arithmetic on committed values without re-executing the policy, and a bounded ρ common to all agents keeps Di finite and comparable across the population. Residuals measure inconsistency with the reference rather than malicious intent, since an agent that samples its action, or whose outcome the environment alters, differs from the reference while acting honestly. Honest residuals therefore need not concentrate near zero. On retained agents, define the population mean µt and population standard deviation σt of Di . The population-relative detector raises a deviation flag fi (t) when a retained agent’s cumulative residual exceeds the threshold τt , τt = µt + kσt ,

fi (t) = 1{i ∈ Kt , Di > τt },

(3)

with sensitivity k > 0. The comparison is strict, so threshold ties and zero variance produce no flags. If T is empty, the analytical recursion skips that episode. With no retained agents, all weights are zero. Since µt and σt include the adversaries, deviating agents inflate the reference they are judged against, and this selfmasking caps how many can be flagged at one settlement. Proposition 1 (Detector capacity). For k > 0 and n ≥ 1, the maximum simultaneous flag count is   n Fmax (n) = − 1. (4) 1 + k2 Consequently, with Mt > 0 adversaries still active, the realized flagged-adversary fraction is at most min{1, Fmax p(n)/Mt }. Simultaneous coverage of all Mt requires k < n/Mt − 1. Proof. The idea is that flagged agents raise the mean and spread they are judged against, so only a limited number can exceed µ + kσ at once. Fix a settlement, drop the index t, and write xi = Di −Pµ for the centered P residuals of the n retained agents, so that i xi = 0 and i x2i = nσ 2 . Upper bound. Let F ≥ 1 agents be flagged, so each has xi > kσ. Then σ > 0, because σ = 0 makes every xi zero. The flagged residuals add up to some a > F kσ, so the

6

TABLE III I NITIAL DETECTOR CAPACITY AT k = 1.5. T HE LAST COLUMNS BOUND THE REALIZED FRACTION OF ADVERSARIES FLAGGED IN ONE ROUND AT THE STATED INITIAL RATIOS ; THEY ARE NOT CONDITIONAL DETECTION GUARANTEES .

N

Fmax (N )

M/N = 3/8

M/N = 5/8

8 32 64 128

2 9 19 39

0.6667 0.7500 0.7917 0.8125

0.4000 0.4500 0.4750 0.4875

remaining n−F add up to −a, and hence F < n. By Cauchy– Schwarz, m numbers with sum A have squares summing to at least A2 /m. Applying this to both groups,

An agent is permanently excluded precisely when Si < Smin ; equality remains eligible. Excluded balances are frozen, and their aggregation weights are zero. Economic exclusion concerns training influence; it does not itself remove a physical agent. Section VI-A gives the evaluation parameters; the following theorem separately states the conditions sufficient for a continued, self-funded staking process. Lemma 1 (Conditional one-round drift). At an evidencebearing settlement, given pre-settlement history Ft , let pi (t) be the conditional flag probability and bi (t) = βs + E[ct | Ft , fi (t) = 0]. Then E[∆Si | Ft ] = (1 − pi (t))bi (t) − pi (t)s.

(6)

a2 a2 n k2 σ2 F n a2 + = > . nσ 2 ≥ F n−F F (n − F ) n−F

When the unflagged event has probability zero, set bi (t) = βs; its weighted gain term is then zero. The expression is nonnegative exactly when pi (t) ≤ bi (t)/(s + bi (t)).

Dividing by nσ 2 and multiplying by n−F gives n−F > k 2 F , that is, F < n/(1 + k 2 ). The largest integer strictly below n/(1 + k 2 ) is Fmax (n). The bound is reached. For any F < n/(1 + k 2 ), give Fpagents residual δ > 0 and the rest zero. Then σ = δ F (n − F )/n, and the high agents’ centered residual (n − F )δ/n exceeds kσ exactly when n − F > k 2 F , so exactly F agents are flagged. Equal residuals give F = 0. Adversary coverage. Flagged adversaries are among the flagged agents, so at most Fmax (n) of the Mt are flagged. Flagging all of them needs Fmax (n) ≥ M pt , which holds exactly when n/(1 + k 2 ) > Mt , that is, k < n/Mt − 1.

Proof. By (5), a retained balance changes in only two ways: it gains βs+ct when unflagged and loses s when flagged. The loss occurs with conditional probability pi (t) and contributes −pi (t)s. The gain occurs with probability 1 − pi (t), and its average size given that the agent is unflagged is bi (t), so it contributes (1 − pi (t))bi (t). Adding the two gives (6). If pi (t) = 1, the gain never occurs, and the convention bi (t) = βs keeps its term at zero. The compensation ct depends on every agent’s flag, but it enters only through this conditional average, so no independence between agents is needed. Finally, since s+bi (t) > 0, the drift is nonnegative exactly when bi (t) ≥ pi (t)(s + bi (t)), that is, pi (t) ≤ bi (t)/(s + bi (t)).

Table III gives the initial ceilings. At n = 8 at most two agents can be flagged, bounding the true-positive fraction by 2/3 or 2/5 for three or five adversaries, and no flags are possible once n ≤ 3. At the 5/8 ratio the ceiling stays below 1/2 for every evaluated N , so a majority adversary population is never more than half flagged in one round and separation is not guaranteed. The verifier needs only residuals and eligibility, not ground-truth labels, and it reads Di only through its standing in the population, as do the token and aggregation rules, so any admissible (ϕi , ρ) leaves them unchanged.

Theorem 1 (One-round incentive compatibility). At a fixed history Ft , compare honest execution and a specified deviation. The subscripts H and D evaluate the conditional flag probability pi (t) and conditional unflagged gain bi (t) of Lemma 1 under honest execution and under the deviation, respectively, and udev ≥ 0 is the additional deviation utility in token-equivalent units. For an agent maximizing expected oneround utility, honest execution strictly dominates this deviation if and only if

C. Token-Based Incentive Mechanism A retained agent self-funds stake s, forfeiting it when flagged. Unflagged agents recover their principal and receive reward βs plus equal compensation P from the fraction λ of slashed deposits. With Ft = i∈Kt fi (t) flags, the perrecipient compensation is λsFt . ct = nt − Ft The fraction 1 − λ of slashed stake is burned; rewards are minted. With integer tokens, rounding compensation downward and burning the residue preserves the upper bounds below. For a retained agent i ∈ Kt in an evidence-bearing settlement, ( βs + ct , fi (t) = 0, Si (t + 1) = Si (t) + (5) −s, fi (t) = 1.

(pD − pH )s + (1 − pH )bH − (1 − pD )bD > udev .

(7)

Proof. By Lemma 1, the expected one-round token change is (1 − pH )bH − pH s under honest execution and (1 − pD )bD − pD s under the deviation, which additionally earns udev . Honest execution is strictly better exactly when (1 − pH )bH − pH s > (1 − pD )bD − pD s + udev . Grouping the two deposit terms as (pD − pH )s turns this inequality into (7). Each step can be reversed, so the condition is both necessary and sufficient. Corollary 1 (Common-gain incentive margin). If additionally bH = bD = b, the strict-deterrence boundary is ∆ = (pD − pH )(b + s),

udev < ∆.

(8)

For udev = 0, this reduces to pD > pH . Proof. When both actions earn the same unflagged gain b, the two gain terms of (7) differ only through their probabilities:

7

(1 − pH )b − (1 − pD )b = (pD − pH )b. The left side of (7) then equals (pD − pH )s + (pD − pH )b = ∆, so the condition reads udev < ∆. With udev = 0, it requires (pD − pH )(s + b) > 0, which holds exactly when pD > pH because s + b > 0. The common-gain condition is substantive: changing one trajectory can alter peer flags and compensation. These are one-round comparisons, not a dynamic equilibrium result. If udev ≥ ∆, the specified deviation is not strictly deterred at that operating point. Assumption 1 (Conditions for exclusion). An agent starts retained, re-stakes from its own balance without top-ups, and is permanently excluded below Smin ≥ s. Evidence-bearing settlements continue while it remains retained. For all possible active populations, capacity supplies the pointwise bounds κN = max

Fmax (n)

1≤n≤N n − Fmax (n)

ct ≤ Cmax = λsκN ,

,

(9)

bmax = βs + Cmax .

Indeed, more flags mean more slashed stake shared among fewer recipients, so ct grows with Ft ; Proposition 1 caps Ft at Fmax (nt ), and the population only shrinks from N , so every realized ct is at most Cmax . Because this holds in every outcome, it also holds on average under any conditioning, giving bi (t) ≤ bmax with no independence or decreasingcompensation assumption. Theorem 2 (Finite expected exclusion time). Under Assumption 1, let p be the infimum of the conditional flag probabilities pj (t) of Lemma 1 over all evidence-bearing settlements and all pre-settlement histories before exclusion. If p > P ∗ = bmax /(s + bmax ), the number Tjex of evidencebearing settlements until agent j is excluded satisfies E[Tjex ] ≤

Sj (0) − Smin + s , ε

ε = ps − (1 − p)bmax > 0. (10)

Proof. The idea is that agent j’s balance falls by at least ε per settlement on average and cannot fall far below Smin , so the expected number of settlements before exclusion is at most its distance to that floor divided by ε. Count only evidencebearing settlements, write T = Tjex , and let S̃j (t) = Sj (t ∧ T ) be the balance frozen at exclusion. Step 1 (average loss per settlement). The drift (1 − p)b − ps in (6) rises with the gain b and falls with the flag probability p. While j is retained, bj (t) ≤ bmax by (9) and pj (t) ≥ p, so E[∆Sj | Ft ] ≤ (1 − p)bmax − ps = −ε, and ε > 0 is the same as p(s + bmax ) > bmax , that is, p > P ∗ . Step 2 (adding up r settlements). The frozen balance is the initial balance plusPthe changes made while j was retained, S̃j (r) = Sj (0) + t<r 1{T > t}∆Sj (t). Whether T > t is known before settlement t, soPStep 1 gives E[1{T > t}∆Sj (t)] ≤ −ε Pr[T > t]. Since t<r Pr[T > t] = E[T ∧r], E[S̃j (r)] ≤ Sj (0) − ε E[T ∧ r].

These expectations are finite because every change lies in [−s, bmax ]. Step 3 (the balance has a floor). A retained balance is at least Smin , and the settlement that excludes j removes at most s, so S̃j (r) ≥ Smin − s. With Step 2, ε E[T ∧ r] ≤ Sj (0) − Smin + s for every r. As r → ∞, E[T ∧ r] increases to E[T ], which gives (10); in particular, T is finite with probability one. Corollary 2 (Exclusion of new gradient contributions). If the theorem’s conditions hold for every adversary in the finite initial population, all are excluded in finite expected time and thereafter supply zero direct gradient contribution. Updates use retained honest contributors if any remain. Proof. Theorem 2 gives each adversary a finite expected exclusion time, and with finitely many adversaries the last exclusion also has finite expectation, since E[maxj Tjex ] ≤ P ex j E[Tj ]. Exclusion is permanent, so an excluded agent never rejoins the retained set: it receives weight ωj = 0 in (11) of Section IV-D, and its gradient term vanishes from Gt+1 in (12). After the last exclusion, only honest agents carry weight, and the update is skipped if none remain. Self-funding and exclusion are accounting requirements, whereas the history-uniform detection floor is a condition on the verifier and environment: a surviving adversary at n ≤ 3, for example, contradicts a positive floor, so pooled detection rates alone cannot certify (10). The clock counts evidence-bearing settlements only. For an honest agent, a falseflag bound pH (t) ≤ β/(1 + β) gives nonnegative drift but does not guarantee retention, since positive-drift processes can still cross the threshold. Section VI-D reads these conditions against the evaluated configuration. For N = 8, κN = 0.4 (at n = 7, F = 2), so bmax = (0.1 + 0.4λ)s for β = 0.1, and the sufficient thresholds P ∗ are 1/11, 3/13, and 1/3 for λ = 0, 0.5, 1. Taken together, Theorem 2 and these values show that exclusion does not require a perfect detector: even with full compensation, P ∗ is at most 1/3 and holds for every retained population, so under Assumption 1 an adversary whose conditional flag probability never drops below some p > 1/3 is excluded in finite expected time, after which Corollary 2 removes its direct gradient contribution. D. Token-Weighted Policy Aggregation After settlement t, normalize balances only over the new retained set Kt+1 : ( P Si (t + 1)/ j∈Kt+1 Sj (t + 1), i ∈ Kt+1 , ωi (t + 1) = 0, otherwise. (11) Weights are held fixed during each learning update. To state a bounded-influence result, suppose each per-agent loss gradient gi = ∇θ ℓi is clipped to a prescribed norm limit Lg > 0:   X Lg ḡi = gi min 1, , Gt+1 = ωi (t + 1)ḡi . (12) ∥gi ∥2 i Take ḡi = 0 when gi = 0. The optimizer consumes Gt+1 ; for adaptive optimizers, its parameter increment need not

8

be a learning rate times this vector. Clipping makes every ∥ḡi ∥2 ≤ Lg , so by the triangle inequality the direct preoptimizer contribution of any contributor set B is at most Lg times its total weight: X i∈B

≤ Lg

ωi (t + 1)ḡi 2

X

ωi (t + 1).

(13)

i∈B

Exclusion makes an agent’s coefficient exactly zero, while prior influence in model parameters or optimizer state can persist. If no contributors remain, the update is skipped. The norm bound is a sufficient design condition; the evaluation does not establish a numerical per-agent gradient bound. V. I MPLEMENTATION AND B LOCKCHAIN I NTEGRATION A. Smart Contract Execution Pipeline The architecture separates the blockchain coordination layer from the SCRIMP learner. The contracts correspond to the stages in Fig. 2 and provide persistent records at their interfaces. BatchDataStorage receives sampled interaction records (oi,t , ai,t , ri,t , mi,t−1 ), associated with the agent, episode and policy version. The OutputHead, TDError, TrainingGAE and PolicyLoss interfaces anchor policy/value outputs, temporal-difference residuals, advantages and policy-update information, respectively. Their names identify the computations being recorded; neural inference and optimization remain off-chain. At episode end, MaliciousDetection uses recommended and executed behavior to form the cumulative residuals and population-relative flags of Section IV-B. IncentiveMechanism consumes those flags, applies deposit forfeiture, rewards, compensation and burning, and updates balances and eligibility. This state determines the weights for the subsequent policy update. Keeping the detection result and its economic consequence in the same episode sequence prevents an update from combining flags from one round with balances from another. Module boundaries organize access to shared state; they do not, by themselves, establish a gas advantage over a single-contract implementation. B. On-Chain and Off-Chain Function Allocation Observation encoding, Transformer communication, the recurrent output head, temporal-difference and generalized advantage estimation, PPO losses, gradient computation and the final token-weighted update run in the learner. General neural computation is unsuitable for direct execution in the EVM [26]. The coordination layer instead records the behavioral evidence, detector outputs, economic state and policy commitments needed to associate an update with its inputs. A policy hash identifies a particular parameter snapshot, while interaction commitments identify the records used for an episode. This supports checking whether two participants refer to the same data and model. A hash is not a proof that the committed model produced an action, that a submitted loss or gradient was calculated correctly, or that physical telemetry is truthful. Such checks require the corresponding records and an agreed observation source. Likewise, a signed

submission authenticates its sender without establishing the accuracy of its contents. These distinctions separate tamperevident coordination from behavioral verification. Tuple submission can overlap off-chain computation, but the learner must use a consistent policy version and economic state. An update that depends on an unsettled balance transition must wait for the required state; asynchronous submission alone does not establish an end-to-end latency bound. C. Solidity Implementation and Geth Architecture The software stack comprises Solidity 0.8.0 contracts, Geth 1.13.14 execution nodes, and a Python 3.9.21 learner connected through Web3.py 7.4.0 and HTTP-RPC. Truffle provides contract compilation/deployment interfaces and the application binary interface used for submissions and state queries [41]. The intended placement is a private Ethereum network coordinating authorized participants. Execution-client configuration, validator operation and the chosen finality policy are separate deployment concerns; the module description does not establish consensus performance. Contract arithmetic represents numerical quantities using scale 106 , giving six decimal places for scaled values. Detector decisions must preserve the strict comparison in Section IV-B, P including ties. For q eligible agents, let Q = D , B = i i P 2 D and x = qD − Q, with both sums over eligible i i i i agents. Squaring clears the standard deviation from the test of Section IV-B, which at k = 1.5 becomes the divisionfree comparison xi > 0 and 4x2i > 9(qB − Q2 ), avoiding a rounded mean or standard deviation in the decision. The same eligibility set defines the balance sum used for normalization. Token arithmetic must account for division residue explicitly so that distributed compensation and burned amounts reconcile with the slashed deposits. D. Workload and IoT Placement With K sampling boundaries and N agents, interaction collection produces N K agent records. At a 32-step interval and a 256-step episode limit, K ≤ 8. Under one submission per sampled record, collection plus separate detection and incentive calls requires at most 8N + 2 requests for those operations. This count excludes deployment, deposit handling, additional policy-stage commitments and retries; it is not a measurement of the complete transaction workload. Record volume scales with N K, and balance accounting scans the participating agents. Gas consumption, block capacity and communication delay additionally depend on contract storage, payloads and network configuration. For a multi-operator automated guided vehicle fleet, coordinator nodes can host the learner and blockchain interfaces while vehicles execute the transferred policy locally. Recommended and measured vehicle positions supply the behavioral comparison. The chain coordinates training and its economic consequences, rather than serving each navigation decision. Deployment suitability therefore depends on both trustworthy telemetry and device-specific control requirements; neither an edge-control timing budget nor a network-throughput claim follows from the MAPF task results.

9

TABLE IV S IMULATION PARAMETERS Parameter

Value

Training environment Grid; number of agents Start and goal assignment Training adversaries Obstacle density Episodes; maximum steps

40 × 40; 8 Random unique positions 3 or 5 of 8 agents Triangular (0, 0.33, 0.50) 1,838; 256 per episode

Detection and token mechanism Residual sampling Detection and settlement Sensitivity; reward factor Deposit; exclusion threshold Compensation factor

Every 32 steps At episode end k = 1.5; β = 0.1 s = 1; Smin = 0.1s λ ∈ {0, 0.5, 1}

Evaluation environment Grid; agent populations Obstacle densities Episodes per condition Adversarial testing Honest testing

40 × 40; 8, 32, 64, 128 0%, 15%, 30% 100 37.5% or 62.5% adversaries All agents follow the policy

VI. P ERFORMANCE E VALUATION A. Experimental Setup Task. MAPF represents coordinated navigation in applications such as automated guided vehicle fleets, intelligent transportation and drone swarms [6], [42]. We instantiate BECTDE on the SCRIMP backbone [7]: agents choose among four cardinal movements and staying, using local obstacle, goal and peer observations with recurrent Transformer-based communication. This task fixes the outcome map of Section IV-B to the successor grid cell under Euclidean distance, with the most probable feasible move as the reference action. ∗ The residual is then di,u = ∥pexec i,u − pi,u ∥2 , the distance in exec grid cells between the executed cell pi,u and the reference cell p∗i,u , leaving the mechanism unchanged from its general form. Rewards penalize collisions and idling and reward goal achievement and exploration. The overt adversarial behaviors follow the AMAPF setting [40]: static blocking, occupation of goal regions, and stagnant or repetitive movement. Their effect on the residual depends on the realized trajectory and the active population; persistence alone does not establish detectability. Setup. Training uses eight agents on a 40×40 grid with randomly assigned unique starts and goals, at most L = 256 steps per episode, and triangular obstacle density with minimum zero, mode 33% and maximum 50%. Training runs for 1,838 episodes. Residuals are sampled every h = 32 steps, giving at most eight samples per episode, and are settled at episode end with sensitivity k = 1.5. Testing covers N ∈ {8, 32, 64, 128} and obstacle densities 0%, 15% and 30%, with 100 episodes per cell. Larger populations transfer the N = 8 policy without retraining. The computing platform is an Intel Core i7-13700 with 32 GB memory and an RTX 3090 Ti. Table IV summarizes the MAPF setup. We examine two test conditions: adversaries remain present in the adversarialtesting comparison, while all agents behave honestly in the compensation study. Both conditions use the same backbone, training population, map family and evaluation grid.

Metrics and baselines. We report collision rate (CO) and success rate (SR). CO is defined as honest-agent obstacle/boundary collisions per honest-agent time step; agent– agent contacts are separate. SR is the percentage of test episodes in which all honest agents reach their goals within the time limit: Nsuccess Ncollision . (14) , SR = 100 CO = 100 P E T N e e honest,e CO and SR are interpreted jointly: low collision frequency alone cannot distinguish safe progress from stalled navigation. Training goal arrivals provide additional context for learned behavior. The baselines add the elements of the closed loop one at a time on a common backbone, and several of them instantiate the defining mechanism of a closely related design. SCRIMP [7], a state-of-the-art learning-based MAPF method and the backbone of BE-CTDE, is trained without any defense. On-Chain CTDE adds the blockchain coordination pipeline without detection or incentives; as in LearnChain [24], the chain records training but leaves every agent’s influence unchanged. BE-CTDE Lite adds the detector of Section IV-B without the token economy, so flags are recorded but flagged agents still contribute equally. Token-enabled BE-CTDE adds the token economy of Section IV-C and balance-weighted aggregation, with λ ∈ {0, 0.5, 1}. It shares contract-automated penalties and rewards with Tian [31], and its λ = 0 variant burns all slashed stake as in burn-based incentive designs [20]; unlike both, it also turns balances into aggregation weights. Instantiating these mechanisms on one backbone, rather than reproducing each full algorithm, keeps every comparison within a single training and evaluation protocol. B. Performance Under Adversarial Training and Testing The adversarial-testing condition places adversaries in both training and testing, using malicious-agent ratios of 37.5% and 62.5%. Metrics concern honest agents. The larger-N rows are zero-shot population transfers, and test-time policy execution requires no chain interaction. Table V reports CO and SR. Minority adversaries. Full BE-CTDE achieves 100% SR at N = 8 across all densities, compared with 96–97% for Lite and zero for SCRIMP. At N = 32 and 30% obstacles, its CO is 23.09% versus Lite’s 27.88%, a 4.79-percentage-point (pp) reduction; SR rises from 92% to 97%. At N = 128, increasing congestion in the fixed grid reduces SR, but full BE-CTDE retains the advantage over Lite. Majority adversaries. Full BE-CTDE achieves SR of at least 93% at N ≤ 32. At N = 64 and 15% obstacles, CO falls from Lite’s 37.10% to 24.00%, the largest reduction at 13.10 pp (35.3%), while SR increases from 89% to 95%. Compared with SCRIMP, the relative CO reductions are 66.4% at N = 32, 15% obstacles, and 81.0% at N = 64, zero obstacles. These comparisons describe task performance; the contrasts do not isolate every implementation difference between methods. Full BE-CTDE has lower CO and higher SR than Lite in all 24 ratio/population/density cells. The largest SR difference is 7 pp. This consistency across test conditions is useful evidence of the task-level benefit, but the cells share trained policies

10

TABLE V P ERFORMANCE UNDER ADVERSARIAL TRAINING AND TESTING . PANELS SHOW ( A ) 37.5% AND ( B ) 62.5% MALICIOUS AGENTS ; METRIC COLUMNS CORRESPOND TO OBSTACLE DENSITIES 0%, 15%, AND 30%. CO AND SR REFER TO HONEST AGENTS . E ACH CONDITION REPORTS 100 EVALUATION EPISODES . B OLD HIGHLIGHTS FULL BE-CTDE. (a) 37.5% malicious agents CO ↓ (%) 0%

15%

(b) 62.5% malicious agents SR ↑ (%)

N

Method

8

SCRIMP 2.47 3.12 3.96 0 0 BE-CTDE Lite 10.81 19.36 23.18 97 97 BE-CTDE 8.77 17.12 21.82 100 100

CO ↓ (%)

30% 0% 15% 30%

0%

15%

SR ↑ (%)

N

Method

30% 0% 15% 30%

0 96 100

8

SCRIMP 50.46 68.55 71.94 0 BE-CTDE Lite 16.95 29.80 40.23 95 BE-CTDE 12.07 25.59 36.13 100

0 93 99

0 90 94

SCRIMP 10.92 17.26 20.73 0 32 BE-CTDE Lite 14.21 21.15 27.88 97 BE-CTDE 10.74 17.13 23.09 100

0 94 99

0 92 97

SCRIMP 78.51 82.40 83.63 0 32 BE-CTDE Lite 17.13 32.91 39.02 96 BE-CTDE 15.79 27.68 37.41 100

0 94 97

0 89 93

SCRIMP 12.17 18.78 24.74 0 64 BE-CTDE Lite 15.54 22.68 29.83 94 BE-CTDE 11.10 17.60 23.76 100

0 94 98

0 89 91

SCRIMP 89.46 92.55 93.42 0 64 BE-CTDE Lite 24.76 37.10 44.24 91 BE-CTDE 17.03 24.00 37.61 97

0 89 95

0 78 85

SCRIMP 27.93 29.45 36.17 0 128 BE-CTDE Lite 18.06 23.97 39.54 79 BE-CTDE 16.59 20.22 37.31 86

0 75 81

0 48 52

SCRIMP 90.97 92.79 95.01 0 128 BE-CTDE Lite 33.69 41.71 54.11 79 BE-CTDE 28.95 35.08 51.62 84

0 75 77

0 34 38

and are not independent training replications. Under binomial sampling of 100 test episodes, Wilson 95% intervals have approximate half-widths of 3.7 pp at 97% SR and 5.2 pp at 93% SR; these describe individual success proportions, not a confidence interval for a paired method difference. The available experiment records do not establish independent training-seed variation. C. Effect of Compensation Factor The compensation factor acts only through training: it changes balances and, through them, the aggregation weights of (11) and the timing of exclusion, whereas test-time execution involves no chain interaction. Its effect therefore resides entirely in the learned policy. Adversaries present at test time would confound this effect with interference that no training-time mechanism removes, since economic exclusion (Section IV-C) withdraws training influence without removing the agent itself. The honest-testing condition removes this interference by design: adversaries take part only in training, and every test agent follows the transferred policy. Varying λ under this condition, within the same MAPF evaluation protocol, examines the compensation effect on the learned policy and complements the adversarial-testing comparison of Section VI-B, which retains test-time adversaries. Figure 3 shows policy-loss and goal-arrival traces for three adversaries during training. The loss curves show faster decline for the compensated variants, while the goal-arrival curves separate task progress from loss convergence alone. In particular, arrivals approaching five are consistent with the five honest agents learning useful behavior, but do not establish when, or whether, the three malicious contributors were excluded. Learning to navigate interference can also change arrivals. Table VI reports CO under honest testing. At N = 8, 30% obstacles and a 37.5% training-time malicious ratio, full compensation reduces CO by 8.84 pp relative to burnonly. The largest relative reduction is 43.1%, from 20.38%

(a) Policy loss

(b) Goal arrivals

Fig. 3. Policy-loss and goal-arrival curves with three malicious agents during training. The horizontal axis is the recorded training-step counter; the curves measure learning progress, not exclusion events.

to 11.59% at N = 32, 15% obstacles and the same ratio. It improves on burn-only in all 24 cells and attains the lowest CO among the three token variants in 23/24; the exception is N = 32, 62.5% training adversaries and zero obstacles, where λ = .5 gives 14.86% versus 15.19% for λ = 1. This distinction avoids conflating the pairwise burn-only comparison with the three-variant ranking. Figure 4 reports the corresponding SR comparison. It shows the compensation advantage alongside the decline at larger populations and higher obstacle density. The honest-testing and joint-adversarial-testing results address different transfer conditions and should not be combined into a single matched ablation. Likewise, low On-Chain CTDE collision values at small populations should be interpreted with its goal-arrival behavior, without treating passivity as demonstrated solely by a collision rate. D. Relation to the Analysis The analysis of Section IV bears on the evaluated configuration in three ways. Capacity. With N = 8 and k = 1.5, Proposition 1 permits at most two flags per settlement, so no settlement can flag all three minority or all five majority adversaries, and any exclusion proceeds over several settlements. At λ = 1 the sufficient threshold P ∗ = 1/3 of Theorem 2 lies

11

TABLE VI T EST- TIME COLLISION RATE (CO, %) WITH ADVERSARIES DURING TRAINING ONLY AND HONEST AGENTS DURING TESTING . C OLUMNS UNDER EACH TRAINING RATIO CORRESPOND TO OBSTACLE DENSITIES 0%, 15%, AND 30%. λ = 0 IS THE BURN - ONLY BE-CTDE VARIANT.

37.5% malicious agents 62.5% malicious agents N Method

15%

30%

0%

15%

30%

2.45 3.09 9.52 18.14 7.81 16.35 7.42 15.30

3.67 29.63 25.82 20.79

49.67 58.50 13.51 29.16 13.06 26.22 11.96 24.84

69.72 37.08 37.42 35.20

On-Chain CTDE 10.41 15.83 BE-CTDE λ=0 13.17 20.38 32 BE-CTDE λ=0.5 11.81 16.70 BE-CTDE λ=1 9.66 11.59

18.69 31.02 26.13 20.34

74.04 79.71 17.51 29.43 14.86 26.55 15.19 25.76

82.53 39.67 37.82 31.12

On-Chain CTDE 11.89 16.54 BE-CTDE λ=0 16.25 19.94 BE-CTDE λ=0.5 14.07 19.35 BE-CTDE λ=1 10.91 15.27

23.71 26.81 24.08 21.52

80.95 83.61 20.91 23.28 17.39 22.72 15.43 21.32

87.49 37.42 34.58 32.97

On-Chain CTDE 25.41 29.59 BE-CTDE λ=0 17.35 26.94 128 BE-CTDE λ=0.5 14.52 25.74 BE-CTDE λ=1 14.28 20.04

32.73 38.16 38.02 34.92

81.48 86.16 29.18 32.28 26.91 29.03 25.66 27.49

89.53 43.56 43.15 40.15

8

64

0%

On-Chain CTDE BE-CTDE λ=0 BE-CTDE λ=0.5 BE-CTDE λ=1

100 80 60 40 20 0 100 80 60 40 20 0

Success Rate (%)

0% obstacles, 37.5% malicious

8

32

64

128

Number of Agents 15% obstacles, 37.5% malicious

Success Rate (%)

100 80 60 40 20 0

BE-CTDE ( = 0.5)

8

32

64

128

Number of Agents 30% obstacles, 37.5% malicious

Success Rate (%)

Success Rate (%)

Success Rate (%)

Success Rate (%)

BE-CTDE ( = 1)

8

32

64

Number of Agents

128

BE-CTDE ( = 0)

100 80 60 40 20 0 100 80 60 40 20 0 100 80 60 40 20 0

On-Chain CTDE

0% obstacles, 62.5% malicious

8

32

64

128

Number of Agents 15% obstacles, 62.5% malicious

8

32

64

128

32

64

128

Number of Agents 30% obstacles, 62.5% malicious

8

Number of Agents

Fig. 4. SR comparison with adversaries during training and honest testing. Rows show obstacle densities 0%, 15% and 30%; columns show training-time malicious ratios 37.5% and 62.5%.

below both capacity ceilings, 2/3 and 2/5, so exclusion is attainable at both ratios, with a wide margin for the minority and almost none for the majority. In the majority regime the mechanism is therefore expected to act mainly through the balance-proportional weights of (11), which cap the retained adversaries’ direct contribution by (13), rather than through

completed removal. This is consistent with the lower majorityratio SR in Table V(b). Compensation. Compensation raises the unflagged gain b of Lemma 1 from βs to βs + λsFt /(nt − Ft ), so balances, and with them the weights of (11), shift toward unflagged agents faster as λ grows. The evaluated adversaries follow fixed disruptive behaviors, so this reweighting channel, rather than the deterrence of Theorem 1, is what the compensation study exercises; the monotone λ ordering in Table VI and the faster loss decline in Fig. 3a are consistent with it. Capacity also limits the channel: at the initial population, at least three of the five majority adversaries remain unflagged at every settlement and receive compensation. Averaged over the twelve cells, λ = 1 reduces CO relative to λ = 0 by 5.4 pp at the 37.5% training ratio and by 3.8 pp at 62.5%, in the direction this leakage predicts. Exclusion and retention. Lemma 1 holds at every evidencebearing settlement whatever Smin is, but the reported Smin = 0.1s lies outside Assumption 1: a retained balance below s cannot fund the next deposit. If such a balance ends participation, s is the effective retention threshold and (10) applies with Smin replaced by s, giving E[Tjex ] ≤ Sj (0)/ε, at most 4Sj (0) settlements for p = 0.5 and λ = 1; otherwise the bound remains a conditional design result for these trials. Corollary 2 describes the regime in which updates draw on retained honest contributors. The 100% SR at N = 8 in Table V and the goal-arrival plateau at five, the honest count, in Fig. 3b are the outcomes that regime produces; they are consistent with it without identifying when, or whether, individual adversaries were excluded. Nonnegative honest expected drift likewise does not rule out a losing trajectory. VII. C ONCLUSION BE-CTDE makes blockchain an active training-management layer for cooperative learning. A trajectory residual links executed behavior to an auditable token mechanism, and retained balances set each agent’s contribution to the shared policy update, so behavioral verification, economic accountability, and learning influence operate within one CTDE workflow. Experiments on multi-agent path finding show that BE-CTDE succeeds far more often under attack than the state-of-the-art SCRIMP planner, including with an adversarial majority, and consistently collides less than variants that only flag deviations or that burn forfeited stake instead of redistributing it. Future work will extend BE-CTDE to broader threat models, further task domains, and deployment in multi-operator IoT systems. R EFERENCES [1] M. Zhou, J. Luo, J. Villella, Y. Yang, D. Rusu, J. Miao, W. Zhang, M. Alban, I. Fadakar, Z. Chen et al., “Smarts: An open-source scalable multi-agent rl training school for autonomous driving,” in Conference on robot learning. PMLR, 2021, pp. 264–285. [2] X. Chen, Y. Deng, H. Ding, G. Qu, H. Zhang, P. Li, and Y. Fang, “Vehicle as a service (VaaS): Leverage vehicles to build service networks and capabilities for smart cities,” IEEE Communications Surveys & Tutorials, vol. 26, no. 3, pp. 2048–2081, 2024. [3] O. Aouedi, T.-H. Vu, A. Sacco, D. C. Nguyen, K. Piamrat, G. Marchetto, and Q.-V. Pham, “A survey on intelligent Internet of Things: Applications, security, privacy, and future directions,” IEEE Communications Surveys & Tutorials, vol. 27, no. 2, pp. 1238–1292, 2025.

12

[4] X. He and C. Lv, “Toward intelligent connected E-mobility: Energyaware cooperative driving with deep multiagent reinforcement learning,” IEEE Vehicular Technology Magazine, vol. 18, no. 3, pp. 101–109, 2023. [5] C. Gao, X. He, H. Dong, H. Liu, and G. Lyu, “A survey on fault-tolerant consensus control of multi-agent systems: trends, methodologies and prospects,” International Journal of Systems Science, vol. 53, no. 13, pp. 2800–2813, 2022. [6] J.-M. Alkazzi and K. Okumura, “A comprehensive review on leveraging machine learning for multi-agent path finding,” IEEE Access, vol. 12, pp. 57 390–57 409, 2024. [7] Y. Wang, B. Xiang, S. Huang, and G. Sartoretti, “Scrimp: Scalable communication for reinforcement-and imitation-learning-based multiagent pathfinding,” in 2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2023, pp. 9301–9308. [8] T. Arnold, G. Briggs, and M. Scheutz, “Only those who can obey can disobey: The intentional implications of artificial agent disobedience,” in International Conference on Autonomous Agents and Multiagent Systems. Springer, 2022, pp. 130–143. [9] Z. Deng, Y. Guo, C. Han, W. Ma, J. Xiong, S. Wen, and Y. Xiang, “AI agents under threat: A survey of key security challenges and future pathways,” ACM Computing Surveys, vol. 57, no. 7, pp. 1–36, 2025. [10] A. A. Khan, A. A. Laghari, Z. A. Shaikh, Z. Dacko-Pikiewicz, and S. Kot, “Internet of Things (IoT) security with blockchain technology: A state-of-the-art review,” IEEE Access, vol. 10, pp. 122 679–122 695, 2022. [11] D. Puthal, N. Malik, S. P. Mohanty, E. Kougianos, and G. Das, “Everything you wanted to know about the blockchain: Its promise, components, processes, and problems,” IEEE Consumer Electronics Magazine, vol. 7, no. 4, pp. 6–14, 2018. [12] J. Meijers, P. Michalopoulos, S. Motepalli, G. Zhang, S. Zhang, A. Veneris, and H.-A. Jacobsen, “Blockchain for v2x: Applications and architectures,” IEEE Open Journal of Vehicular Technology, vol. 3, pp. 193–209, 2022. [13] L. Cao, “Decentralized AI: Edge intelligence and smart blockchain, metaverse, Web3, and DeSci,” IEEE Intelligent Systems, vol. 37, no. 3, pp. 6–19, 2022. [14] Y. Li, Q. Fang, J. Bai, S. Chen, F. Juefei-Xu, and C. Feng, “Among us: Adversarially robust collaborative perception by consensus,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 186–195. [15] Y. Zhao, Z. Xiang, S. Yin, X. Pang, Y. Wang, and S. Chen, “MADE: Malicious Agent Detection for Robust Multi-Agent Collaborative Perception,” in 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 2024, pp. 13 817–13 823. [16] J. D. Harris and B. Waggoner, “Decentralized and collaborative AI on blockchain,” in 2019 IEEE international conference on blockchain (Blockchain). IEEE, 2019, pp. 368–375. [17] J. D. Harris, “Analysis of models for decentralized and collaborative AI on blockchain,” in Blockchain–ICBC 2020: Third International Conference, Held as Part of the Services Conference Federation, SCF 2020, Honolulu, HI, USA, September 18-20, 2020, Proceedings 3. Springer, 2020, pp. 142–153. [18] J. Weng, J. Weng, J. Zhang, M. Li, Y. Zhang, and W. Luo, “DeepChain: Auditable and privacy-preserving deep learning with blockchain-based incentive,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 5, pp. 2438–2455, 2019. [19] E. Zanardo, “LearningChain: A novel blockchain-based meritocratic marketplace for training distributed machine learning models,” in Proceedings of the Computational Methods in Systems and Software. Springer, 2022, pp. 152–169. [20] F. Zhao, B. Yang, Z. Su, C. Li, and Y. Ding, “A blockchain-enabled privacy-preserving and incentive mechanism-driven federated learning scheme for IoV,” Computer Networks, vol. 264, p. 111262, 2025. [21] J. Shen, H. Sheng, S. Wang, R. Cong, D. Yang, and Y. Zhang, “Blockchain-based distributed multiagent reinforcement learning for collaborative multiobject tracking framework,” IEEE Transactions on Computers, vol. 73, no. 3, pp. 778–788, 2023. [22] H. Chang, Y. Liu, and Z. Sheng, “Distributed multi-agent reinforcement learning for collaborative path planning and scheduling in blockchainbased cognitive internet of vehicles,” IEEE Transactions on Vehicular Technology, vol. 73, no. 5, pp. 6301–6317, 2023. [23] A. Mishra, Y. Garg, O. J. Pandey, M. K. Shukla, A. V. Vasilakos, and R. M. Hegde, “A novel resource management framework for blockchainbased federated learning in IoT networks,” IEEE Transactions on Sustainable Computing, vol. 9, no. 4, pp. 648–660, 2024. [24] H. Sami, R. Mizouni, H. Otrok, S. Singh, J. Bentahar, and A. Mourad, “LearnChain: Transparent and cooperative reinforcement learning on

Blockchain,” Future Generation Computer Systems, vol. 150, pp. 255– 271, 2024. [25] M. Wendl, M. H. Doan, and R. Sassen, “The environmental impact of cryptocurrencies using proof of work and proof of stake consensus algorithms: A systematic review,” Journal of Environmental Management, vol. 326, p. 116530, 2023. [26] M. Wohrer and U. Zdun, “Smart contracts: security patterns in the ethereum ecosystem and solidity,” in 2018 International Workshop on Blockchain Oriented Software Engineering (IWBOSE). IEEE, 2018, pp. 2–8. [27] Y. Liu, P. Liu, W. Jing, and H. H. Song, “PD2S: A privacy-preserving differentiated data sharing scheme based on blockchain and federated learning,” IEEE Internet of Things Journal, vol. 10, no. 24, pp. 21 489– 21 501, 2023. [28] Y. Kuang, J. Chen, Y. Zhang, X. Chen, S. Chen, and X. Liu, “BRITEFL: Blockchain-based reputation and incentive token enhanced federated learning for IoT ecosystems,” Future Generation Computer Systems, vol. 185, p. 108642, 2026. [29] Z. Chen, J. Yi, X. Zhu, Q. Wang, J. Yao, and W. Luo, “A swarm intelligence enabled multi-agent reinforcement learning scheme for computational task offloading in Internet of Things blockchain,” Future Generation Computer Systems, vol. 182, p. 108446, 2026. [30] H. Pasupathy, L. A. Sridhar, P. Sivakumar, S. D, and K. J. C, “Decentralized secure multi-agent path planning using federated reinforcement learning and blockchain,” PeerJ Computer Science, vol. 12, p. e3443, 2026. [31] K. Tian, “Blockchain-enhanced incentive-compatible mechanisms for multi-agent reinforcement learning systems,” Scientific Reports, vol. 15, p. 42841, 2025. [32] P. Blanchard, E. M. E. Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Advances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017, pp. 119–129. [33] D. Yin, Y. Chen, K. Ramchandran, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” in Proceedings of the 35th International Conference on Machine Learning (ICML), ser. PMLR, vol. 80, 2018, pp. 5650–5659. [34] S. Li, J. Guo, J. Xiu, R. Xu, X. Yu, J. Wang, A. Liu, Y. Yang, and X. Liu, “Byzantine robust cooperative multi-agent reinforcement learning as a Bayesian game,” in Proceedings of the International Conference on Learning Representations (ICLR), 2024. [35] A. K. Murimi, “BARD-MARL: Byzantine-agent detection for learned communication in multi-agent reinforcement learning,” arXiv:2606.20701, 2026. [Online]. Available: https://arxiv.org/abs/ 2606.20701 [36] H. Wu and D. Klabjan, “Robust softmax aggregation on blockchain based federated learning with convergence guarantee,” arXiv:2311.07027, 2023. [Online]. Available: https://arxiv.org/abs/2311. 07027 [37] R. B. Myerson, “Optimal auction design,” Mathematics of Operations Research, vol. 6, no. 1, pp. 58–73, 1981. [38] X. Tu, K. Zhu, N. C. Luong, D. Niyato, Y. Zhang, and J. Li, “Incentive mechanisms for federated learning: From economic and game theoretic perspective,” IEEE Transactions on Cognitive Communications and Networking, vol. 8, no. 3, pp. 1566–1593, 2022. [39] S. Xuan, M. Wang, J. Zhang, W. Wang, D. Man, and W. Yang, “An incentive mechanism design for federated learning with multiple task publishers by contract theory approach,” Information Sciences, vol. 664, p. 120330, 2024. [40] M. Ivanová and P. Surynek, “Adversarial multi-agent path finding is intractable,” in 2021 IEEE 33rd International Conference on Tools with Artificial Intelligence (ICTAI). IEEE, 2021, pp. 481–486. [41] R. Dhanvardini, P. Martina, R. Vijay, R. Amirtharajan, and P. Pravinkumar, “Development and Integration of dApp with blockchain smart contract Truffle Framework for user interactive applications,” in 2023 International Conference on Computer Communication and Informatics (ICCCI). IEEE, 2023, pp. 1–6. [42] Z. Zong, M. Zheng, Y. Li, and D. Jin, “MAPDP: Cooperative multiagent reinforcement learning to solve pickup and delivery problems,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 9, 2022, pp. 9980–9988.

Related documents

• BE-CTDE: Blockchain-Enabled Multi-Agent Reinforcement Learning with Anomaly Detection and Token Economics#1456944
• Hierarchical proof of trust a Byzantine fault tolerant federated learning framework for industrial IoT applications.#371734
• Detection of Security Attacks in Industrial IoT Networks: A Blockchain and Machine Learning Approach#134038
• Intelligent and Energy-efficient Security Architecture for Renewable Energy Systems Based on Blockchain and Machine Learning#192157
• Blockchain-Linked Auditable Decision Management for Telecom/IoT Fraud-Control Requests#361410