TerrainGossip: Decentralized Infrastructure for AI Manipulation Detection

A gossip-based protocol for distributed LLM evaluation, behavioral monitoring, and evidence collection—built to resist manipulation of the monitoring system itself.

Hackathon Submission: Apart Research AI Manipulation Hackathon (January 2026)

---

1. Summary

TerrainGossip is a peer-to-peer gossip protocol that enables decentralized, continuous behavioral benchmarking of LLM providers without central coordination. Nodes maintain local "belief fields" about provider behavior, exchange cryptographically-signed attestations via delta sync, and use robust aggregation to resist lying sensors. The protocol is designed so that (a) providers cannot detect when they are being evaluated, (b) no single authority controls the "truth" about model behavior, and (c) the monitoring infrastructure itself is resistant to manipulation, poisoning, and sybil attacks.

This positions TerrainGossip as infrastructure for AI manipulation defense: it provides the substrate for collecting, distributing, and analyzing behavioral evidence across a decentralized network of evaluators—without creating a single point of failure that adversaries can compromise.

---

2. Problem Statement: Why Centralized Evaluation is Fragile

Current AI evaluation infrastructure has three critical weaknesses:

2.1 Single Points of Compromise

Centralized leaderboards and evaluation servers (e.g., LMSYS Arena, HuggingFace Open LLM Leaderboard) create high-value targets. If an adversary can manipulate the benchmark server, poison the evaluation dataset, or compromise the scoring pipeline, they control the perceived "truth" about model capabilities. A model that sandbags on manipulation detection benchmarks while performing well on public evals can avoid scrutiny.

2.2 Provider-Aware Evaluation

Static benchmarks are fingerprint-able. Providers can detect evaluation prompts (through statistical patterns, known datasets, or timing signatures) and behave differently during evaluation than during deployment. This is the sandbagging problem: a model that recognizes it's being tested can hide capabilities or misbehavior.

2.3 No Persistent Evidence Trail

Most evaluation happens once at release time. Real-world deployments experience behavioral drift—models can be updated, fine-tuned, or silently modified. Without continuous monitoring with cryptographic evidence, there's no way to detect when a deployed model starts behaving differently than the evaluated version.

2.4 The Fundamental Issue

If AI systems can manipulate their evaluators, the entire safety evaluation pipeline becomes meaningless.

We need evaluation infrastructure that is:

• Distributed: No single point of compromise
• Continuous: Detects behavioral changes post-deployment
• Covert: Evaluations are indistinguishable from normal traffic
• Verifiable: Evidence is cryptographically signed and auditable
• Robust: Resilient to lying sensors and sybil attacks

---

3. Conceptual Model: Terrain, Gossip, and Belief Fields

TerrainGossip introduces three core abstractions:

3.1 Terrain: Topology for Locality

The "terrain" is a deterministic overlay topology that partitions the network into regions, chunks, and cells. This can be:

• Literal: Geospatial coordinates (for latency-aware routing)
• Abstract: Model-capability space (group providers by what they serve)
• Functional: Hash-based partitioning for load distribution

Terrain provides locality: updates propagate to nearby nodes first, global convergence happens eventually. This bounds bandwidth and prevents flooding.

┌─────────────────────────────────────────────────────┐
│                    World Terrain                    │
│  ┌─────────────┬─────────────┬─────────────┐       │
│  │  Region 0   │  Region 1   │  Region 2   │       │
│  │ ┌───┬───┐   │ ┌───┬───┐   │ ┌───┬───┐   │       │
│  │ │C0 │C1 │   │ │C0 │C1 │   │ │C0 │C1 │   │       │
│  │ ├───┼───┤   │ ├───┼───┤   │ ├───┼───┤   │       │
│  │ │C2 │C3 │   │ │C2 │C3 │   │ │C2 │C3 │   │       │
│  │ └───┴───┘   │ └───┴───┘   │ └───┴───┘   │       │
│  └─────────────┴─────────────┴─────────────┘       │
│                                                     │
│  Cells contain: version vectors, bloom filters,    │
│  event summaries, pheromone trails (routing hints) │
└─────────────────────────────────────────────────────┘

3.2 Gossip: Incremental Evidence Propagation

Nodes don't synchronize a complete database. Instead, they exchange deltas—new events since a causal clock (version vector). Each event is:

• Signed by the emitter (prober, router, or verifier)
• Immutable and content-addressed (EventId = BLAKE3(canonical_bytes(event)))
• Typed: ProbeReceipt, BehaviorAttestation, Dispute, LinkHint, etc.

Delta sync is bandwidth-efficient: nodes only request events they haven't seen. Anti-entropy cycles (periodic full sync) heal partitions.

3.3 Belief Fields: Local Computation, Statistical Convergence

Each node computes its own belief field—a local posterior estimate of provider behavior based on the signed events it has observed:

belief[provider] = {
  mu:          expected quality (0..1)
  sigma:       uncertainty
  trend:       EWMA of recent changes
  disagreement: dispersion across attestations
}

There is no canonical global score. Beliefs converge statistically because nodes observe overlapping evidence. This is the key insight: we don't need consensus on "the score"—we need convergence of local beliefs given shared evidence.

Example flow:

1. Prober P₁ evaluates Provider X, emits signed BehaviorAttestation
2. Attestation propagates via gossip to nodes N₁, N₂, N₃
3. Each node updates its local belief[X] using robust aggregation
4. Over time, all honest nodes converge to similar beliefs about X
5. No single node or authority decided "the truth"

---

4. Data Model

4.1 Memory Item Schema (Events)

struct Event {
    event_id: [u8; 32],         // = BLAKE3(canonical_bytes(body))
    world: WorldId,              // which evaluation world
    epoch_id: u64,               // time bucket
    event_type: EventType,       // Receipt, Attestation, Dispute, etc.
    body: EventBody,             // typed payload
}

enum EventBody {
    Receipt(ProbeReceipt),           // proof that a probe happened
    Attestation(BehaviorAttestation), // metrics + evidence commitment
    Dispute(DisputeEvent),            // conflicting attestations
    LinkHint(LinkHintEvent),          // evidence two refs are same provider
    RuleEndorsement(RuleEndorsementEvent), // governance
    // ... optional: Shard, Verdict, TrainingManifest
}

4.2 Delta/Update Schema

Updates are simply new events. The protocol supports:

• Add: New event with fresh event_id
• Tombstone: Dispute events can mark prior events as contested
• No physical delete: Append-only log preserves auditability

4.3 Per-Cell Summaries (Voxel Metadata)

Each terrain cell maintains:

struct CellSummary {
    cell_id: TerrainAddress,
    version_vector: HashMap<ReplicaId, u64>,  // causal clock
    bloom_filter: BloomFilter,                 // quick event membership
    event_count: u64,
    centroid: Option<[f32; 768]>,             // embedding centroid (optional)
    pheromone_map: HashMap<ProviderRef, f64>, // routing hints
    last_updated: Timestamp,
}

Bloom filters enable fast "do you have event X?" checks without transferring full event lists.

---

5. Protocol Sketch

5.1 Neighbor Selection

Nodes select gossip partners based on:

1. Latency: Prefer low-latency peers for fast propagation
2. Locality: Prefer peers in nearby terrain cells
3. Interest: Prefer peers evaluating similar model families
4. Diversity: Require some random/distant peers to prevent partitions

┌─────────┐         ┌─────────┐         ┌─────────┐
│ Prober₁ │◄───────►│ Gossipd │◄───────►│ Router₁ │
└────┬────┘         └────┬────┘         └────┬────┘
     │                   │                   │
     │    Delta Sync     │    Delta Sync     │
     │   (pull missing   │   (push new       │
     │    events)        │    attestations)  │
     ▼                   ▼                   ▼
┌─────────┐         ┌─────────┐         ┌─────────┐
│ Prober₂ │◄───────►│ Gossipd │◄───────►│ Router₂ │
└─────────┘         └─────────┘         └─────────┘

5.2 Handshake: Summary Exchange

1. A → B: DeltaSyncRequest { world, since: A's version_vector, max_events }
2. B → A: DeltaSyncResponse { events: [...], now: B's version_vector }
3. A verifies signatures, inserts events, updates local version_vector
4. A → B: (optional) push A's new events that B lacks

The handshake starts with version vector comparison—nodes identify the causal frontier before exchanging actual events.

5.3 Anti-Entropy Cycle

Periodic full reconciliation:

1. Every T seconds (configurable, e.g., 30s), node initiates sync with random subset of peers
2. Bloom filter exchange identifies likely-missing events
3. Full event lists exchanged for cells with high divergence
4. Repairs partitions and stale nodes

5.4 Conflict Resolution

Events are immutable, so conflicts are handled at the interpretation layer:

1. Concurrent attestations: Multiple probers evaluate same provider → robust aggregation (median, trimmed mean)
2. Contradictory attestations: Prober A says "good", Prober B says "bad" → disagreement increases uncertainty (sigma)
3. Disputed events: Explicit DisputeEvent marks conflicting events; nodes increase redundancy
4. Version vector ordering: Causally-related updates ordered by vector clocks; concurrent updates both accepted

Design choice: We use CRDT-style semantics (grow-only set of events, version vectors for ordering) rather than last-writer-wins. This preserves evidence—even "wrong" attestations are valuable for detecting lying probers.

---

6. Security and Abuse Considerations

6.1 Poisoning and Spam

Threat: Adversary floods network with fake attestations to bias beliefs.

Mitigations:

• Proof-of-probe cost: Attestations can require a ProbeTicket (scrypt/argon2 output) to impose computational cost
• Rate limiting: Nodes enforce per-source rate limits on event ingestion
• Signature verification: All events are signed; unsigned/invalid events rejected immediately
• Reputation tracking: Probers accumulate trust based on predictive accuracy; untrusted probers are down-weighted

6.2 Sybil Resistance

Threat: Adversary creates many fake prober identities to dominate aggregation.

Mitigations:

• Diversity requirements: Promotions/endorsements require attestations from diverse clusters (not just count)
• Anti-correlation penalties: Tightly correlated probers (same IP range, similar timing, identical scores) saturate contribution
• Robust aggregation: Median/trimmed mean reduces impact of outliers
• Exploration floor: Routers always explore some fraction of providers, preventing cartel lock-in

6.3 Provider Manipulation (Sandbagging Detection)

Threat: Provider detects evaluation prompts and behaves differently.

Mitigations:

• Metamorphic probes: Challenge prompts are randomized per epoch (paraphrases, equivalent instances)
• Indistinguishable traffic: Some probes route through the same onion circuits as normal traffic
• Challenge commitments: ChallengeId is a hash commitment, not a literal prompt identifier
• Provider blindness: Providers cannot compute the TargetRef used in control-plane aggregation (requires key they don't have)

6.4 Privacy: What Leaks, What Doesn't

Leaks	Doesn't Leak
That a probe occurred	The observer's local Handle for provider
Aggregate metrics (via attestations)	Raw user prompts/responses
Provider capability (FAH)	Provider's own control-plane TargetRef
Prober identity (transport key)	Correlation between normal traffic and probes

Mitigation for prober privacy: Onion routing for probe traffic; probers can rotate transport keys per epoch.

---

7. Relevance to AI Manipulation Defense

TerrainGossip directly addresses several manipulation risks:

7.1 Detecting Sandbagging and Capability Elicitation

The continuous, decentralized probing system creates a persistent behavioral record. If a model's behavior changes (e.g., starts refusing certain prompts, or suddenly gains new capabilities), the change is detected as:

• Trend shift in belief field
• Disagreement between old and new attestations
• Disputes raised automatically

This enables detection of:

• Sandbagging: Model hiding capabilities during evaluation → capabilities revealed later
• Sycophancy drift: Model becoming increasingly agreeable over deployment
• Policy violations: Model bypassing safety filters under certain conditions

7.2 Distributed Evidence Collection

Every behavioral observation is:

• Signed: By the prober's transport key
• Timestamped: With epoch and freshness anchor
• Content-addressed: Immutable EventId
• Propagated: Via gossip to all interested nodes

This creates a distributed evidence log that cannot be retroactively modified. If a model is later found to be manipulative, the historical behavioral trajectory is preserved and auditable.

7.3 Robust to Evaluator Manipulation

The protocol assumes some probers will lie (noisy sensors, adversarial actors). Robust aggregation and trust-based weighting ensure that:

• Minority liars cannot shift aggregate beliefs significantly
• Probers that consistently diverge from consensus lose trust
• No single authority decides what "correct" evaluation looks like

7.4 Preventing Manipulation of the Monitoring System

Traditional monitoring systems can be attacked at:

• The benchmark server (compromise)
• The dataset (poisoning)
• The scoring pipeline (bias injection)
• The publication channel (censorship)

TerrainGossip eliminates these by:

• No central server: Gossip-based replication
• Signed evidence: Tampering is detectable
• No canonical score: Local beliefs resist authoritative injection
• Forkable worlds: Censorship → participants fork to new rules

---

8. Roadmap

8.1 MVP Scope (Weekend Hackathon)

Implemented (this repository):

Component	Status	Description
Core types	✅	WorldId, FAH, TargetRef, DescriptorId, Events
Canonical encoding	✅	Postcard serialization, cross-validated Rust ↔ TypeScript
Cryptographic primitives	✅	BLAKE3 hashing, Ed25519 signatures, X25519 key exchange
Test vectors	✅	6 cross-language vectors passing
gossipd daemon	✅	Event log storage, delta sync, version vectors
routerd daemon	✅	Terrain map, FAH routing, belief field computation
prober daemon	✅	Probe scheduling, challenge generation, receipt signing
infernode daemon	✅	Onion circuit construction, relay forwarding
terrain-gossip-net	✅	Networking: crypto, framing, transport, circuits
Build automation	✅	Makefile, justfile, GitHub Actions CI/CD

Test coverage: 57 Rust tests + 6 TypeScript test vectors passing.

8.2 Next Milestones

Milestone	Description	Effort
Simulator	Multi-node simulation for convergence testing	1-2 weeks
Liar robustness benchmarks	Test belief convergence under X% lying probers	1 week
Browser integration	WASM build of core library for browser nodes	2 weeks
Vector memory	Embedding index for semantic event retrieval	2 weeks
Real deployment	Deploy gossipd cluster, connect external probers	4 weeks

8.3 Integration Points

TerrainGossip is designed as infrastructure that other tools can build on:

• Manipulation detection benchmarks: Plug in new challenge suites as prober modules
• Model monitoring dashboards: Subscribe to gossip for real-time behavioral alerts
• Incident investigation: Query vector memory for historical behavioral patterns
• Training verification: (Optional plugin) Verify training data provenance via shard pipeline

---

9. Glossary

Term	Definition
Voxel	Discretization unit in terrain; contains cell summaries, version vectors, bloom filters
Anti-entropy	Periodic full synchronization cycle to repair partitions
Delta	Incremental update (new events since a causal clock)
Version vector	Map of replica_id → counter representing causal frontier
Sketch	Probabilistic data structure (e.g., bloom filter) for set membership
Provenance	Origin and chain of custody for data/events
FAH	Functional Address Hash—content-addressed capability claim
TargetRef	Control-plane reference for a provider; provider-blind
Handle	Observer-local pseudonym for a provider; never gossiped
Belief field	Local posterior estimates about provider behavior
Epoch	Time bucket for batching events and rotating keys
World	Overlay network defined by phrase seed + rule bundle hash
Attestation	Signed metrics report with evidence commitment
Receipt	Signed proof that a probe occurred

---

10. Technical Specifications

10.1 Cryptographic Primitives

Primitive	Usage
BLAKE3	All hash derivations with domain separation
Ed25519	Transport key signatures, attestation signing
X25519	Ephemeral key agreement for onion circuits
ChaCha20-Poly1305	AEAD encryption for circuit cells
HKDF-BLAKE3	Key derivation for circuit hops

10.2 Key Derivations

WorldId = BLAKE3("world" || phrase_norm || rule_bundle_hash)
FAH = BLAKE3("fah" || canonical_bytes(CapabilityManifest))
DescriptorId = BLAKE3("descriptor" || canonical_bytes(ProviderDescriptorUnsigned))
TargetRef = BLAKE3_KEYED(control_plane_key, "targetref" || WorldId || DescriptorId)
Handle = BLAKE3("handle" || observer_secret || observed_fingerprint)
EventId = BLAKE3(canonical_bytes(Event))

10.3 Wire Protocol

Delta sync uses a simple request/response pattern:

message DeltaSyncRequest {
  WorldId world = 1;
  repeated VersionVectorEntry since = 2;
  uint32 max_events = 3;
}

message DeltaSyncResponse {
  WorldId world = 1;
  repeated Event events = 2;
  repeated VersionVectorEntry now = 3;
}

---

11. Conclusion

TerrainGossip provides the infrastructure layer for robust AI evaluation and manipulation defense:

1. Decentralized by design: No central point of compromise
2. Continuous monitoring: Detects behavioral drift post-deployment
3. Covert evaluation: Probes are indistinguishable from normal traffic
4. Cryptographic evidence: Signed, timestamped, immutable attestations
5. Robust aggregation: Resists lying sensors and sybil attacks
6. Self-protecting: The monitoring system resists manipulation of itself

The core insight is that manipulation resistance requires decentralization. Any centralized evaluation system is a target. By distributing evidence collection, aggregation, and belief formation across a gossip network with cryptographic attestations and robust statistics, we create evaluation infrastructure that remains trustworthy even when some participants are adversarial.

This is not a complete solution to AI manipulation—that requires work across benchmarks, interpretability, governance, and deployment practices. But it is a necessary foundation: the substrate on which manipulation detection tools can be built without themselves becoming vectors for manipulation.

---

Repository

• Source: github.com/rng-ops/gossip
• Specification: docs/rfc-0001.md
• License: MIT / Apache-2.0

---

Built for the Apart Research AI Manipulation Hackathon, January 2026.