Round number
Which training round this block records.
05 · The ledger
A record nobody can quietly rewrite.
Every round, EARN commits its trust table, coverage and a hash of every hospital's history to an append-only chain. The contract is built and tested on a local Hardhat chain; every round below is a real round EARN produced. EARN itself ran on an oracle evidence signal, because the real signal sits under its bar at Gate G0a - so these are real mechanics, not a validated method.
Try it
Tamper with a past round.
100 real rounds from the exploratory EARN run (natural split, no attack, seed 42). Hashes are the Python ledger's SHA-256 chain; each round was also committed to the EarnLedger contract.
A new round is committed every few seconds. Click a block to inspect it.
Block 6
Previous block hash5769c32b81…ab5a
This block hash409b4fe185…070f
Trust table T(k,c)8863c69722…2657
History hashesa4bdb9ab7f…ece1
Coverage n(c)MEL 6 · NV 6 · BCC 3 · AK 3 · BKL 5 · DF 4 · VASC 3 · SCC 2
Largest trust rise0.100 ≤ 0.1 ✓
On-chain block hash (keccak)0x81c52a22…877a
Gas to commit193,224
Real EARN rounds (S1, no attack, seed 42) from the exploratory oracle-evidence run, replayed on the EarnLedger contract on a local Hardhat chain. Hashes are the Python ledger's SHA-256 chain; the on-chain keccak block hash is shown too.
Each block
What gets committed every round.
Why a blockchain
Two jobs a plain database can't do on its own.
Locks the history
When only one or two hospitals hold a disease, the only evidence is a hospital's own past. If that record could be rewritten, an attacker would fabricate a consistent past and pass the check. The check only means something on an append-only record.
Binds the coordinator
The contract rejects any trust value rising faster than the fixed step, so even whoever runs aggregation can't quietly boost a hospital.
submit T(centre 0, MEL) 0.00 → 0.30
✕ reverted: StepTooLarge(0, 0, 3000) (max step 0.10)
Tried on the real final table of all 24 runs - rejected every time.
Fair criticism
A signed append-only log kept by a trusted third party would achieve much of this. Our answer: in a federation of competing hospitals there is no mutually trusted third party. We state this plainly rather than overclaim.
Cost
What the chain costs per round.
2,400 real EARN rounds from 24 runs (both splits, every attack, three seeds) replayed on Hardhat in-process chain (automine), chainId 31337; Solidity 0.8.24, optimizer 200 runs.
Gas per round
183,781
median 183,478 · max 282,365 · deploy 667,469
One transaction stores 48 trust values, 8 coverage counts and the history hash. Rounds where trust moves a lot cost more storage writes.
Latency per round
1.13 ms
median 0.99 · max 3.97 ms
Send to receipt on a local, instantly-mining chain. A public chain adds block time (seconds) - still small next to a training round.
Checks on real data
- On-chain trust equals Python's✓ all runs
- History hash verifies✓ all runs
- Forged boost rejected✓ all runs
- EARN aggregation, per round3.8 ms
- FedAvg, per round0.3 ms
What the ablation found
Against attacks A1-A3, making the history editable (the "no ledger" ablation) changed nothing measurable: those attackers never needed to rewrite their past. The chain's other job - stopping a coordinator from boosting trust - held on every real round.
Follow-up · when the specialist turnsExploratory · oracle evidence
The lock catches the insider - but can't stop the damage.
Pre-registered after the main study (D7): the only hospital holding the rare diseases on the specialist split (centre 2) is honest for 15 rounds, then attacks. With one holder, EARN can only check a hospital against its own locked history. Mean of seeds 42, 43, 44.
The turned specialist's trust
Vascular-lesion row, per round.
Detected
With the locked history, trust falls to 0.06 by round 19. With an editable history it never leaves 1.00.
Not protected
Rare-disease F1 still falls from 0.555 to 0.000 - as it does under FedAvg - and trust climbs back to 1.00 by round 30. EARN's trust only removes a bonus, so the attacker keeps its normal share; and a running-average history slowly absorbs the new behaviour. The pre-registered bar (a 0.05 rare-F1 gain from the lock) was not met.