# How should an instance treat a Byzantine equivocation that is invisible to two-thirds of the quorum: the cross-organizational equivocation-detection gap

**Date of Record:** 2026 November 10

**Scope:** Applies to BFT consensus deployments where voting power is partitioned across organizational trust domains and where message authentication is pairwise (per-link keys or per-domain channels) rather than globally broadcast. Does not apply to single-organization clusters with a shared broadcast medium, nor to protocols that mandate global certificate dissemination (e.g., gossip-signed proposals) as a precondition of voting.

## Core Distinction

The distinction that matters operationally is between *equivocation* (a faulty replica sending conflicting values to disjoint subsets of the quorum) and *detectable equivocation* (equivocation for which at least one honest replica holds two signed messages that a third party can verify). Classical BFT safety proofs assume the second follows from the first: if a Byzantine replica equivocates, some honest replica sees both branches, and that replica can construct a proof-of-misbehavior that any verifier can check.

Across organizational boundaries this implication fails silently. When replicas authenticate messages with pairwise keys and communicate over per-domain channels (mTLS between orgs, domain-scoped message buses, or point-to-point RPC), an equivocating replica can send value A to the replicas of organization X and value B to the replicas of organization Y, and *no single honest replica ever holds both A and B*. The equivocation is real, it can cause a safety violation if the two branches each reach a conflicting commit within their own view, yet it is invisible to any individual honest party and therefore unprovable to any third party. The protocol's slashing and accountability layer — which assumes equivocation is always attributable — never fires. The failure is not a crash and not a liveness stall; it is a *safety-relevant event with no witness*.

## What Was Observed

In a four-organization deployment (one replica per org, f = 1 tolerated, quorum = 3), a Byzantine replica in org C ran a split-view attack during a leader change. It sent `PREPARE(v=7, block=H1)` to org A and `PREPARE(v=7, block=H2)` to org B, where H1 and H2 were distinct valid blocks at the same height. Because A and B never exchanged PREPARE messages directly (the protocol assumed the leader's proposal was the sole source of value, and pairwise links carried only leader-to-replica traffic in the fast path), neither A nor B observed the conflict. Each accumulated a quorum certificate within its own view: A gathered {A, C, D} for H1, B gathered {B, C, D} for H2, with D's vote split by the same trick. Two conflicting blocks each obtained a valid 3-of-4 certificate. The equivocation was *never detected* — no honest replica held both H1 and H2, so the accountability subsystem, which required a `(sig_A, H1, sig_B, H2)` proof pair, had no input. The safety violation surfaced only when a downstream cross-org reconciliation job compared committed state and found two divergent logs at height 7, roughly 40 minutes after the fact.

The non-obvious part: the deployment's monitoring was green throughout. Quorum certificates were valid. Signature checks passed. The equivocation-detection metric stayed at zero — correctly, because no equivocation *proof* existed, and the metric counted proofs, not events. The system was simultaneously "healthy" by every local indicator and unsafe.

## Condition of Validity

The gap exists precisely when all three hold:

1. **Pairwise authentication.** Message authenticity is established per link (pairwise keys, per-domain mTLS, or domain-scoped buses), so a signed message from C to A is not verifiable by B without A forwarding it.
2. **No mandatory cross-domain dissemination of votes.** The protocol does not require replicas to gossip their votes to all peers, or requires it only on a slow path that the fast path bypasses.
3. **Accountability predicated on local witness.** The slashing/attribution layer assumes an honest replica that observes a conflict will produce a portable proof, and treats "no proof" as "no fault."

If any of these is relaxed — for example, if votes are gossiped to a shared log, or if the protocol requires each replica to collect and forward a threshold of signatures before voting — the equivocation becomes detectable and the classical implication is restored. The condition is therefore a property of the *communication topology and the accountability design*, not of the consensus algorithm's message pattern alone.

## Decision Boundary

An instance must not treat "no equivocation proof received" as evidence of "no equivocation occurred." The correct decision boundary is:

- If the deployment satisfies the three conditions above, the absence of a proof is **uninformative** about safety and must not be used to clear a replica or to conclude the round was honest.
- Equivocation detection in such deployments must be **reconstructed**, not awaited: honest replicas should periodically exchange vote summaries (height, block hash, signature) with at least one replica outside their own domain, so that a conflict can be assembled from two locally-valid fragments. This is a small, bounded gossip that does not require global broadcast of full messages.
- When a conflicting commit is detected after the fact, the instance must escalate to *cross-domain reconciliation* (compare committed logs across orgs) rather than to the accountability layer, because the accountability layer's precondition — a local witness — was never met.

The boundary is: **local observability of a fault is a function of topology, and accountability must be designed against the topology, not against the fault's abstract existence.**

## Operational Effect

The practical consequence is that safety and accountability decouple across organizational boundaries. A deployment can be provably safe in the classical sense (no two honest replicas commit conflicting values *given* the fault model) while being operationally unable to *attribute* the fault that violated it, because the violation was assembled from fragments no single party held. This changes incident response: the first signal is not an alarm but a reconciliation mismatch, and the investigation must reconstruct the equivocation from per-domain logs rather than retrieve a proof. It also changes the threat model: an adversary who controls the communication topology (e.g., an org that terminates the pairwise links) can equivocate with impunity, because the protocol's own detection assumptions have been inverted against it. The mitigation is structural — force minimal cross-domain vote dissemination and treat post-hoc reconciliation as a first-class safety check, not a monitoring nicety.

```python
class UndetectableEquivocationError(RuntimeError):
    """Raised when a conflicting commit is found but no local witness exists to prove equivocation."""
    pass


def attribute_conflict(conflict, local_witnesses, topology):
    """
    conflict: dict with 'height', 'block_a', 'block_b' observed via cross-org reconciliation.
    local_witnesses: list of (replica_id, signed_pair) held by any single honest replica.
    topology: dict describing whether pairwise-only auth and no vote gossip are in effect.
    """
    if not local_witnesses:
        if topology.get("pairwise_auth") and not topology.get("vote_gossip"):
            # The equivocation is real but structurally unprovable to any third party.
            raise UndetectableEquivocationError(
                f"Conflicting commits at height {conflict['height']} "
                f"({conflict['block_a']} vs {conflict['block_b']}) with no local witness. "
                "Topology (pairwise auth, no vote gossip) makes equivocation unattributable; "
                "escalate to cross-domain reconciliation, do not clear the replica."
            )
        # Otherwise the absence of a witness is genuinely suspicious.
        raise UndetectableEquivocationError(
            "No witness and topology should have produced one; investigate message loss."
        )
    return local_witnesses[0]
```