​

Trust Scoring System

​

Overview

• Tracks the accuracy of each witness over time
• Increases trust for correct reports
• Decreases trust for incorrect reports
• Never allows trust to reach zero (minimum weight maintained)
• Influences how much each witness’s opinion affects the final belief

​

Trust Score Range

type TrustScore float64

const (
    MaxTrust     TrustScore = 1.0  // Full trust
    MinTrust     TrustScore = 0.1  // Minimum (never zero)
    DefaultTrust TrustScore = 0.8  // New witnesses
)

​

Why Minimum Trust is 0.1 (Not Zero)

1. Past errors don’t mean future errors - A witness that was wrong before might be right now
2. Network conditions change - What appeared wrong might have been a partition
3. Bootstrap problem - If trust reaches zero, a witness can never recover
4. Minority reports matter - Even low-trust witnesses can provide valuable signals

​

Trust Evolution

const (
    DecayRate    = 0.1   // Trust lost per wrong report
    RecoveryRate = 0.05  // Trust gained per correct report
)

​

Correct Report

func (r *Registry) RecordCorrect(id NodeID) {
    w.CorrectReports++
    w.Trust += TrustScore(RecoveryRate)  // +0.05
    if w.Trust > MaxTrust {
        w.Trust = MaxTrust  // Cap at 1.0
    }
}

• Current trust: 0.70
• After correct report: 0.75
• After 6 more correct reports: 1.00 (capped)

​

Wrong Report

func (r *Registry) RecordWrong(id NodeID) {
    w.WrongReports++
    w.Trust -= TrustScore(DecayRate)  // -0.10
    if w.Trust < MinTrust {
        w.Trust = MinTrust  // Floor at 0.1
    }
}

• Current trust: 0.80
• After wrong report: 0.70
• After 7 more wrong reports: 0.10 (floored)

​

Asymmetric Recovery

• Decay rate: 0.10 per wrong report
• Recovery rate: 0.05 per correct report

1. Safety over liveness - False death declarations are worse than false liveness
2. Earn trust slowly - Witnesses must prove reliability over time
3. Lose trust quickly - Incorrect reports are serious mistakes

​

Witness Record Structure

type WitnessRecord struct {
    ID             NodeID
    Trust          TrustScore
    CorrectReports int
    WrongReports   int
    LastReport     Belief
}

​

Tracking Metrics

• Trust: Current trust score (what matters for aggregation)
• CorrectReports: Total correct reports (for analysis)
• WrongReports: Total wrong reports (for analysis)
• LastReport: Most recent belief reported by this witness

​

How Trust Affects Aggregation

func (a *Aggregator) Aggregate(reports []WitnessReport) {
    var totalWeight float64
    var aliveSum, deadSum, unknownSum float64

    for _, r := range reports {
        trust := float64(a.registry.GetTrust(r.Witness))
        totalWeight += trust

        aliveSum += r.Belief.Alive().Value() * trust
        deadSum += r.Belief.Dead().Value() * trust
        unknownSum += r.Belief.Unknown().Value() * trust
    }

    avgAlive := aliveSum / totalWeight
    avgDead := deadSum / totalWeight
    avgUnknown := unknownSum / totalWeight
    // ...
}

​

Example Calculation

aliveSum = (0.90 × 1.0) + (0.80 × 0.7) + (0.20 × 0.3)
         = 0.90 + 0.56 + 0.06
         = 1.52

totalWeight = 1.0 + 0.7 + 0.3 = 2.0

avgAlive = 1.52 / 2.0 = 0.76

​

Default Trust for New Witnesses

• Higher than minimum (0.1) - They get meaningful weight from the start
• Lower than maximum (1.0) - They must prove themselves
• Optimistic but cautious - Assumes witnesses are generally honest

​

Trust Registry Operations

​

Register a New Witness

func (r *Registry) Register(id NodeID) {
    if _, exists := r.witnesses[id]; !exists {
        r.witnesses[id] = &WitnessRecord{
            ID:    id,
            Trust: DefaultTrust,  // 0.8
        }
    }
}

​

Get Current Trust

func (r *Registry) GetTrust(id NodeID) TrustScore {
    if w, ok := r.witnesses[id]; ok {
        return w.Trust
    }
    return DefaultTrust  // Unknown witness → default trust
}

​

Record a Report

func (r *Registry) RecordReport(id NodeID, belief Belief) {
    w := r.getOrCreate(id)
    w.LastReport = belief
}

​

Trust Score Evolution Examples

​

Scenario 1: Reliable Witness

Start:      0.80 (default)
Correct #1: 0.85
Correct #2: 0.90
Correct #3: 0.95
Correct #4: 1.00 (capped at max)
Correct #5: 1.00 (stays at max)

​

Scenario 2: Unreliable Witness

Start:   0.80 (default)
Wrong #1: 0.70
Wrong #2: 0.60
Wrong #3: 0.50
Wrong #4: 0.40
Wrong #5: 0.30
Wrong #6: 0.20
Wrong #7: 0.10 (floored at min)
Wrong #8: 0.10 (stays at min)

​

Scenario 3: Recovery from Mistakes

Start:      0.80
Wrong #1:   0.70
Wrong #2:   0.60
Correct #1: 0.65
Correct #2: 0.70
Correct #3: 0.75
Correct #4: 0.80 (back to default)
Correct #5: 0.85
Correct #6: 0.90

​

Scenario 4: Mixed Performance

Start:      0.80
Correct:    0.85
Wrong:      0.75  (net: -0.05)
Correct:    0.80
Wrong:      0.70  (net: -0.05)
Correct:    0.75

​

Integration with Byzantine Fault Tolerance

• Trust scores handle gradual degradation and mistakes
• BFT aggregation handles malicious behavior and worst-case scenarios
• Partition detection handles network splits that affect trust scoring

​

Determining Report Correctness

1. Ground truth from finality - If a node is declared dead (finality), witnesses who reported high dead confidence were correct
2. Eventual consistency - Over time, the aggregated belief converges to reality
3. Causal events - If a node produces a causal event, witnesses who reported it alive were correct
4. Partition resolution - After a partition heals, the majority view is used to score minority witnesses

​

Thread Safety

type Registry struct {
    mu        sync.RWMutex
    witnesses map[NodeID]*WitnessRecord
}

• Read operations (GetTrust, GetRecord): Use RLock()
• Write operations (Register, RecordCorrect, RecordWrong): Use Lock()

​

Configuration Tuning

​

Conservative Settings

MinTrust = 0.3       // Higher floor
DefaultTrust = 0.6   // More cautious
DecayRate = 0.15     // Faster decay
RecoveryRate = 0.03  // Slower recovery

​

Permissive Settings

MinTrust = 0.05      // Lower floor
DefaultTrust = 0.9   // More trusting
DecayRate = 0.05     // Slower decay
RecoveryRate = 0.10  // Faster recovery

​

Best Practices

​

For Witness Operators

1. Ensure accurate local observations - Your trust depends on report quality
2. Monitor your trust score - Declining trust indicates systemic issues
3. Investigate wrong reports - Understand why you disagreed with ground truth
4. Consider network position - Witnesses in unusual network positions may see different realities

​

For Oracle Operators

1. Monitor witness trust distribution - If all witnesses have low trust, investigate
2. Remove persistently wrong witnesses - If trust stays at minimum for long periods
3. Diversify witness network positions - Reduce correlation and improve coverage
4. Analyze trust patterns - Sudden trust drops may indicate partitions or attacks

​

Trust Score as a Signal

• Network partition - Witness in different partition sees different reality
• Clock skew - Timing issues cause incorrect timeout interpretations
• Malicious witness - Deliberately reporting false information
• Buggy implementation - Software errors in witness’s belief computation

​

Related Components

• System Design - Overall architecture
• Byzantine Fault Tolerance - Handling malicious nodes
• Core Concepts - Understanding beliefs and confidence