{"ID":22952708,"CreatedAt":"2026-09-17T02:12:05.498442134Z","UpdatedAt":"2026-09-20T18:11:56.143995915Z","DeletedAt":null,"paper_url":"https://arxiv.org/abs/2609.18778","arxiv_id":"2609.18778","title":"Vigil: Accountable Liveness against Selective Silence","abstract":"BFT accountability is well understood for safety violations, and recent work attributes global liveness violations; \\emph{recipient-selective} silence remains unresolved. A selectively silent adversary withholds messages from some honest nodes while behaving correctly toward others. It can stall consensus yet evade every existing mechanism. We initiate a systematic study of accountability against selective silence. Negatively, a lone attacker silent toward at most $f$ honest nodes is indistinguishable from an honest node, yielding a universal lower bound $K_{\\mathrm{SI}} \\ge f{+}1$ on the \\emph{silence identification threshold}; moreover, any feedback-free repair after a silence-induced violation costs $Θ(n^3)$. Positively, \\textsc{Vigil}, a Tendermint variant, matches these bounds with attack-adaptive forwarding, via bitmap cross-attestation, core-based membership, and challenge--response auditing. It pays $O(n)$ authenticators per node when no selective silence occurs (plus $Θ(n^2)$ bitmap metadata bits per node), relays in proportion to the attack's width (sub-threshold silence can force up to $n^3/27$ relays per view, a cost we price exactly), and majority-accuses any node silent toward more than a tunable resilience $τ_A$ of honest peers ($K_{\\mathrm{SI}} = τ_A{+}1$, optimal at $τ_A = f$). We also price the residual sub-threshold griefing surface exactly and extend identification to $x$-partial synchrony. Real-network experiments on a three-region WAN, together with a simulator held to exact equality with every closed form, confirm each threshold and cost: at $2\\%$ loss, an $f{+}1$ accusation bar falsely accuses $91.2\\%$ of honest nodes, while our majority bar accuses $0.002\\%$.","short_abstract":"BFT accountability is well understood for safety violations, and recent work attributes global liveness violations; \\emph{recipient-selective} silence remains unresolved. A selectively silent adversary withholds messages from some honest nodes while behaving correctly toward others. It can stall consensus yet evade eve...","url_abs":"https://arxiv.org/abs/2609.18778","url_pdf":"https://arxiv.org/pdf/2609.18778v1","authors":"[\"Jiawei Cheng\",\"Huiping Sun\",\"Rui Zhou\",\"Jinjue Zhou\",\"Zhong Chen\"]","published":"2026-09-16T15:01:16Z","proceeding":"cs.DC","tasks":"[\"cs.DC\"]","methods":"[]","has_code":false}