Difficulty Scaling in Proof of Work for Decentralized Problem Solving

We propose DIPS Difficulty-based Incentives for Problem Solving), a simple modification of the Bitcoin proof-of-work algorithm that rewards blockchain miners for solving optimization problems of scientific interest. The result is a blockchain which redirects some of the computational resources invested in hash-based mining towards scientific computation, effectively reducing the amount of energy `wasted' on mining. DIPS builds the solving incentive directly in the proof-of-work by providing a reduction in block hashing difficulty when optimization improvements are found. A key advantage of this scheme is that decentralization is preserved and no additional protocol layers are required on top of the standard blockchain. We study two incentivization schemes and provide simulation results showing that DIPS is able to reduce the amount of hash-power used in the network while generating solutions to optimization problems.


Introduction
Energy spent hashing in Proof of Work (PoW) is critical for guaranteeing the integrity of transactions on a blockchain. However, the information that results from the computations in itself is of low value. More specifically, the outcome of mining a block is simply a proof that there exists a nonce for which the hash of the given block is lower than some threshold. Naturally, this knowledge is not applicable outside of the blockchain itself. Mining protocols which secure the network and are themselves informative have therefore been an attractive goal since the early days of blockchain. 1-3 Meanwhile, crowd sourcing efforts have been successful in showing that solutions to difficult scientific problems can be discovered by a large community. [4][5][6] However, current crowd-sourcing models offer few incentives for participation which limits the size of the user-base. On the other hand, cryptocurrency mining has been shown to offer a very strong incentive scheme and currently draws a much larger pool of contributors. Including scientific computing in the mining protocol of a blockchain (more specifically a cryptocurrency) would therefore introduce and incentivize a larger community to solving scientific problems.
1.1. Related Work-We borrow the term 'useful work' to describe protocols which aim at incentivizing computations with real-world applications other than securing blockchain integrity, while acknowledging that this is not to say that standard PoW is not 'useful.' 7 An obvious application of computational resources to 'useful work' is finding solutions to problems of scientific interest such DNA alignment, protein folding, machine learning parameter searches. 8 'Useful work' protocols can be grouped in two major types: economy-based and mining-based. The former has been proposed in works such as CureCoin and Coinami which use the interest in cryptocurrencies to reward users who complete certain tasks such as DNA alignments or protein folding directly with tokens. 2,3 However, for the most part the blockchain protocol remains untouched and PoW is still required in its entirety, typically with some additional centralization. On the other hand, mining-based approaches attempt to replace PoW with alternative forms of work. Proposed methods can vary widely in this category. Protocols such as PrimeCoin and Conquering Generals attempt to fully replace the classical PoW problem of block hashing to another NP-complete problem. 1, 9 These problems are picked such that they preserve the following properties: (1) Solving is difficult (hash functions are non-invertible) (2) Difficulty can be easily tuned (target value of hash digest determines difficulty) (3) Fast solution verification (computing and comparing hashes is constant time) (4) Easy to generate new problems (block data defines a problem) Very few problems of scientific interest can satisfy all of these criteria. However, in the present authors' 2017 "Proposal for a Fully Decentralized Blockchain and Proof-of-Work Algorithm for Solving NP-Complete Problems" (hereafter Oliver et al.) we observed that many scientifically relevant problems, such as protein folding, machine learning parameter searches, and DNA alignments can be phrased an NP-complete problems. 8 Since NP-complete problems preserve the property (3) there exist scientifically relevant problems that can be partially integrated into the standard PoW. Miners optionally submit a block at a reduced hashing difficulty if the block includes a valid solution to a problem selected by the network. If a solution to the problem is not submitted, the protocol behaves identically to Bitcoin. The difficulty of the problem is estimated by the frequency of blocks mined with solutions and difficulty is adjusted accordingly to maintain a desired block time. Recently, in their "Hybrid Mining: Exploiting Blockchain's Computational Power for Distributed Problem Solving" (2019) (hereafter Chatterjee et al.), K. Chatterjee, A. Goharshady, and A. Pourdamghani proposed a special case of the protocol described in Oliver et al., which allows problem solvers to submit blocks without hashing (reduced difficulty of zero) if they provide a solution. 8,10 Attacks where malicious miners pre-solve many problems to win a large portion of consecutive blocks are prevented by enforcing that at least 50% of blocks be mined classically (effective reduced difficulty half of classical difficulty). Finally, in "Incentive-Based Integration of Useful Work into Blockchains" (2019) (hereafter Amar et al.), D. Amar and L. Zilpa reward solutions to 'useful' problems with votes in a hybrid Proof of Work/Proof of Stake model which, by definition, reduces the required amount of hashing. 11 However, this also comes with a complex additional layer of governance and potential centralization. The protocols discussed here have the additional advantage of reducing the benefit of ASIC hardware in mining, thus reducing the barrier of entry to mining.
1.2. Contribution-Here we build on Oliver et al. to provide stronger problem-solving incentives without greatly compromising security and decentralization. 8 We describe, in Section 2, a novel difficulty-adjustment scheme which provides these problem-solving incentives. The result of this difficulty-adjustment scheme is a simple soft-fork compatible modification to the core Bitcoin mining protocol. This altered mining protocol would allow the incentivization LEDGER VOL 5 (2020) 62-73 of many scientifically-relevant problems such as DNA alignment, protein folding, Ising-lattice minimization, and machine-learning optimization. In Section 3, we present simulations of the resulting network behaviour. In Section 4, we address potential attacks and emphasize how DIPS differs from the Bitcoin proof-of-work algorithm. Finally, conclusions are given in Section 5.

Protocol
Here we describe the DIPS protocol to incentivize the mining network to solve an agreed-upon optimization problem. Solving incentives come in the form of mining difficulty reductions. For simplicity, we phrase an optimization problem P as a sequence of NP-complete decision problems {p 1 , .., p k , ...} of the form, does there exist a solution with objective value greater than some fixed target? As an example, P can be a specific graph for which we want to find the maximal clique. Since verifying that a clique is globally maximal is intractable, we let the network solve a series of decision problems. For example, at a given point of the blockchain the network would be trying to solve a p k in the form, does there exist a clique in this graph of size greater than k? Solutions to such a decision problem can be easily checked since a miner would provide the nodes in the clique and the network does a lookup in an adjacency table. Once a solution of score k is found, the network would accept blocks only if they satisfy the regular bitcoin difficulty, or a reduced difficulty along with a clique of size > k. As k increases the network arrives at solutions that are closer to the global solution to P.
2.1. Single update-In the first version of the protocol (Oliver et al.), miners are given the option of mining blocks 'classically' (as in the Bitcoin protocol) with a given difficulty d b or by including solutions to a given P in a block and mining that block with a reduced difficulty d r . 8,12 Since there are two difficulties in Oliver et al., two conditions are required to be satisfied to update the difficulties. This situation is in contrast to the Bitcoin protocol, where a single difficulty is updated using a single condition: the average time required to mine each block T is fixed (taken to be 10 minutes in Bitcoin). The first condition used to update the difficulty in Oliver et al. is the same as in the Bitcoin protocol. In addition to this condition, the difficulties are updated so that the average ratio between d r and d b , η is fixed, where Q represents the long-time average of the quantity Q. Using Eq. (1) and the equation determining the update of d b , an equation for the update of d r can be derived (see Section II.C of Oliver et al.). 8 As is the case in Bitcoin, the difficulties are updated after N 1 blocks are mined (N 1 = 2016 in Bitcoin). In Oliver et al. both difficulties are updated independent of how many blocks are mined including a solution to P (see Figure 1). Moreover, as is the case with Bitcoin, measures are taken to ensure that difficulty does not change too quickly. In particular, the protocol enforces a maximal update factor for the difficulties so that where i ∈ {b, r}, d j i is the value for d i after jN 1 blocks and x is the maximum factor by which the difficulties can be updated. After jN 1 blocks, if the difficulty d j+1 i is calculated so that Although this version of the protocol incentivizes solving NP-complete problems by providing a reduced mining difficulty (assuming η < 1), d r increases with d b since the average value of d r /d b is fixed. Therefore, even in the case where no solutions are submitted, d r can increase. This means that even as P becomes more difficult to solve (which is expected to happen over time), d r can continue to increase, limiting the incentive provided by the network to solve problems and therefore the number of solutions that the network will find. Consequently, the amount of resources redirected to solving useful problems will also be limited.
2.2. Independent Updates-We propose a second version of the protocol (DIPS) where miners are again free to submit 'classical' blocks with difficulty d b or blocks containing a solution to an NP-complete problem, with difficulty d r . However, in DIPS the difficulties d b and d r are updated independently (see Figure 1). That is, after N b 2 classical blocks have been mined, d b is updated so as to keep the average time spent by the network to mine a classical block fixed (to a predetermined value t b 2 ). Similarly, after N r 2 blocks have been mined containing a solution, d r is updated so as to keep the average time spent by the network to mine a block with a solution fixed (to a predetermined value t r 2 ). Since it becomes increasingly difficult to find solutions to NP-complete problems, eventually the network might not be able to mine new blocks with the current difficulty d r . Therefore in the DIPS protocol if N b 2 consecutive classical blocks are mined, d r is decreased by the maximum factor, x (d r → d r /x). In this way, even if the problem becomes increasingly difficult to solve, miners that attempt to solve the problem are incentivized with a proportionally decreased d r . Miners are naturally discouraged from holding on to their solution until the difficulty is lowered by a large factor since this comes at the risk of other miners finding and publishing a better solution first.
2.3. Problem Submission-In the type of modified proof-of-work protocol described in the above subsections, some of the hashing power reserved in traditional blockchains (such as Bitcoin) to ensure the security of the network is diverted to solving an NP-complete problem, P. The difficulty in finding better and better solutions provides the network with security and replaces the repeated hashing of proposed blocks. Because the best score of P will eventually saturate (either when the network no longer wishes to find a better score or when the optimal score has been found) this modified proof-of-work system will revert back to the traditional proof-of-work protocol. Therefore, to create a blockchain where NP-complete problems keep being solved, it might be interesting to consider a system where new problems can be submitted to the network. We note that Chatterjee et al. propose a convenient formulation of any NP-complete problem as a boolean satisfiability problem which can be used for convenient solution checking. 10 The inclusion of new problems in the network can be done in a variety of ways. We leave determining a specific implementation for a future work and discuss some possible implementations here instead. One possible implementation could have a committee of users or a group of special nodes chosen (through an election, or otherwise) to submit new problems once the best score of the current problem has been saturated. Alternatively, but in the same spirit, individuals (participating in the network, or not) can propose new problems off-chain and the community can vote on which new problem to replace the current problem with. Once the new problem has been chosen, the blockchain can be hard forked to ignore solutions to the old (saturated problem) and accept solutions to the new agreed-upon problem. Specific strategies for selecting new problems are explored in depth in the work of Amar et al., and forking as a software evolution system is studied in Andersen et al. 11,13 Fig. 1. Schematic depicting the difference between a blockchain with proof-of-work protocol Oliver et al. and DIPS. The red blocks are standard blocks that do not contain a solution to a problem (classical blocks), while the blue blocks contain a solution that results in a score that is better than the current best score of P (solution blocks). In Oliver et al. both d b and d r are updated every N 1 blocks. In DIPS, d b is updated every N b 2 blocks that do not contain a solution to a problem and d r is updated every N r 2 blocks that do contain a solution. n r and n b are arbitrary numbers.

Simulation Results
Here we perform simple experiments to visualize the impact of protocol and parameter choice on the behaviour of the network. We implement a simulated blockchain with 10 miners performing classical mining and 10 miners problem solving.
As a sample problem, we let the network solve the well-known maximum clique problem on randomly-generated graphs. 14 Given a graph G = (V, E) which is a tuple of vertices (V ) and edges (E ∈ V ×V ), and a clique size k ∈ N, the NP-complete formulation of the problem is, does there exist a clique of size at least k in G? If V k is the set of all sets of k vertices of G, a clique Q k ∈ V k is a set of nodes such that (u, v) ∈ E ∀ (u, v) ∈ Q k × Q k , that is, Q k is a set of k fully connected nodes. A brute force approach to solving this problem is to enumerate all possible k-subsets of V , and check that the condition is satisfied for each of the 2 |V | subsets. In fact, no other known algorithms performs substantially better than the brute force approach: the maximum clique problem has been shown to be NP-complete. 15 We can also see that checking a solution once a clique is proposed is fast, since it reduces to ensuring that all off-diagonal entries in the clique's adjacency matrix are 1. This problem is chosen for simplicity of implementation, but DNA alignment, protein folding and many other optimization problems can admit this formulation. 8 However, we note that this problem is already of great scientific interest as it has been used in many real-world applications such as DNA sequencing mapping and motif finding. 16,17 At the start of the chain, we generate a random graph and miners apply the Bronn-Kerbosch algorithm which enumerates cliques until a large enough solution is found. 18 The current largest clique size is stored in each block. Since mining hardware is typically used only for hashing, we assume miners are concurrently mining at d b while attempting to solve the problem on separate hardware. If a miner finds a clique which beats the current best, he includes the solution in his next block and begins to mine at a reduced difficulty d r . If he fails to win the next block, the miner keeps his current best solution to try again in the next block.
In Figure 2 we plot the number of classical and solution blocks as a function of the blockchain height. In a standard proof-of-work blockchain (such as Bitcoin), there is only one type of block-a classical block. The dashed line in Figure 2 represents how the number of classical blocks grows with blockchain height in a standard blockchain (they grow together since they represent the same quantity). In contrast, for the DIPS proof-of-work protocol, some of the hashing power is diverted to solving NP-complete problems. Therefore there are fewer fully classical blocks mined at a given blockchain height and therefore, less energy invested by the network to hash blocks. The energy saved is used to solve NP-complete problems as indicated by the blue curve, which represents blocks being mined by the network that contain solutions to NP-complete problems -solution blocks. At the time of writing, (April 5 th 2020), the Bitcoin network hashrate is roughly 100 EH/s. 19 If we assume a network energy consumption per hash rate of ∼ 0.1 GW/(EH/s), 20 then the power consumption of the Bitcoin network can be estimated at 10 GW. The associated energy cost per block is on average ∼ 1.7 GWh (the average time to mine a Bitcoin block is 10 min). The energy diverted to solving a scientifically relevant problem can therefore be estimated at ∼ (1 − d r /d b )1.7 GWh for every block mined with a solution.
A feature of optimization problems is that eventually the optimal solution to the problem will be found. At this point (or before) the number of blocks with solutions will saturate because no new solutions can be found. In this case, the system reverts to a standard proof-of-work blockchain. One way to prevent the system from becoming a standard blockchain is to introduce new problems when the solution saturates (see Section 2.3 for a discussion on possible ways to include new problems). We have simulated the inclusion of a new problem (randomly-generated graph) when the best score of the previous problem saturates (gray vertical lines in Figure 2). In this way, instead of reaching a point where no more energy is diverted to solving NP-complete problems, as the blockchain grows, more energy is diverted to solving these types of problems. This energy is loosely represented by the difference in the dashed line and the red curve in Figure 2, or equivalently, the blue curve.
We have also studied how this energy is affected by the parameter η. For the Oliver et al. protocol, η is a parameter that is enforced by the network as the difficulties get updated (see Section 2.1). In the case of the DIPS protocol, η indicates the initial value of d r /d b . As expected, since η is not enforced by the network, the fraction of blocks that are solution blocks is independent of η for DIPS (see Figure 4). In contrast, in Oliver et al., η determines how much incentive the community is given to solve the blockchain's optimization problem. As blockchains are initialized with smaller values of η (as you move to the right along the horizontal axis of Figure 4) we expect the fraction of solution blocks to increase as is shown in Figure 4. Furthermore, because the network enforces that the ratio d r /d b (long-time) averages to η, d b and d r vary together (see Figure 3a).
After a certain time, as the problem becomes increasingly more difficult to solve, d r will not

Potential Attacks
Besides the standard attacks possible with traditional proof-of-work blockchains (e.g. 51% attacks performed by controlling a majority of the network's mining power), the DIPS proof of work introduces additional attack avenues, namely stemming from the ability to reuse solutions. We name the main (to our knowledge) attack for this version of proof of work the Bubka attack after Ukrainian pole vaulter Sergey Bubka who obtained many consecutive world records by incrementally improving his score instead of posting one world record by a large margin. This attack strategy involves finding multiple successive solutions to P and using these to get an advantage in hashing for multiple blocks in a row. Worse still, one could copy the solutions to problems from solution blocks and use them to fork the chain at a different block height. Although the solutions cannot be used to mine blocks for free (the attacker would still have to perform classical mining, albeit at a reduced difficulty d r ), this strategy would allow the attacker to double spend by forking the network at some past block and creating the longest chain with less than 51% of the network's hashing power. Estimating the exact fraction of hashing power required for a double-spend attack in this case is not straightforward and depends on, among other factors, the ratio d r /d b at the time of the attack, the rate at which the network finds new solutions to the problem, the hash rate of the network, and the values of the parameters N r 2 and N b 2 . We leave the exploration of this question for future work.
Other attacks such as well-connected miners claiming other miners solutions as their own are addressed in Amar et al. with protocols that are fully compatible with DIPS. 11 There are several options for addressing this threat on the social layer of the network. Unlike in other proposed methods, mining a solution to a block still requires a hashing step, the network could therefore choose a large enough update frequency (small enough value of N r 2 ) to rapidly increase mining difficulty if solutions are posted in rapid succession. Additionally, users could follow higher transaction 'confirmation times' or not allow long consecutive chains of blocks with solutions to the problem. Such heuristic solutions are currently common usage in blockchains such as Bitcoin, where a 6 block confirmation time is socially enforced to safeguard against 51% attacks. We also note that the nature of NP-complete problems is that there is strong evidence that no algorithms better than exponential time exist, leveling the playing field across the network. This assumption is the same one that is made by Bitcoin whereby the hashing problem is assumed to be unsolvable in sub-exponential time by anyone. Interestingly, recent integrations of zk-SNARKs in mainstream blockchains raise potential methods for temporarily hiding solutions. 21

Conclusion
In this article we have compared two modified proof-of-work protocols that divert energy from mining by hashing blocks to solving NP-complete problems (useful work). We have studied, through simulations, the dependence on the total diverted energy on different parameters.
Although this article provides a protocol that can convert the energy used by miners to a form of useful work (solving NP-complete problems), creating a fully functioning and useful blockchain using any one of the two protocols (Oliver et al. or DIPS) would require the understanding of other aspects of system. For example, a concrete protocol to add new problems to the network must be developed. Moreover, a standard way of storing and solving submitted problems must be established. Other works have made some effort to solve these problems, 10,11 however more work is needed to adapt these solutions for use in the proof-of-work protocols Oliver et al. and DIPS. We believe protocols such as DIPS are an important step towards combining the potential of crowd-sourcing initiatives (such as Folding@Home and Phylo which have resulted in new solutions for important problems) 4, 5 with the strong incentive structures native to blockchains.

Author Contributions
P.P and C.G.O conceived the research, prepared the manuscript and performed the simulations. A.R. helped conceive the simulation protocol.