Five candidate dissemination models
We are not proposing a dissemination design — we are deriving one. Five candidate models, M1 to M5, each define a different rule set for how nodes connect to their peers and forward messages. All are measured against one shared bar, the good graph: every message of every honest publisher must reach all other honest nodes. And all face the same adversary — a fraction μ of silent Byzantine nodes that receive every message and never relay one.
The guarantee has to come from links that are drawn once per epoch and then serve every message of every publisher for that whole epoch — the formal analyses call this the standing structure, and it covers both link kinds: relay links and publishing links. Only a structure that persists across messages can promise every message; per-message randomness cannot. The prototype node works exactly this way: it establishes its links during a sync phase, and only then accepts messages for propagation.
Every model can clear the bar. The question is what it costs. Each has a parameterisation that reaches the target at the reference network size and adversarial fraction, and each sizing rule grows with the target, so a stricter bound is always reachable by buying more links. What separates the models is the price, and it is charged on two different axes. One is standing: the links every node has to hold, maintain and repair, whether or not anything is published. The other is charged per message: how many copies of it the network transmits before every honest node has it. Both spread severalfold across the family for the same guarantee, and they pull against each other, because giving publishing its own links cuts the copies carried per message but adds to the links each node must hold. So the design problem is to find the cheapest structure that still clears the bar, while keeping the surface an adversary can attack as small as possible. The parameter sweeps that put figures to each axis are still running.
A bad graph is rarely a broken network. Anything short of full strong connectivity counts as bad, and in practice the failures are not large splits but single stranded nodes. A node whose outgoing links all landed on adversaries is a dead end, and dead ends dominate the tail. A bad graph does not mean a message went undelivered, though: that depends on which node publishes. A stranded node fails only as a publisher, and is invisible to everyone else's dissemination. In the comparison run so far, every run delivered to every eligible node, including those whose topology scored bad. So the experiments score the topology for all publishers at once, and separately the worst case any single publisher would see.
The animation below plays each model's construction and forwarding rules at toy scale.