Multivalued Consensus: General Adversaries Require More Communication

Abstract: We study $n$-party fault-tolerant consensus against general (non-threshold) adversaries. We describe an infinite family $Z_\mathsf{proj}<sup>{n,d}$ of $Q<sup>d$-satisfying $n$-party adversary structures based on finite projective geometry which cause error-free $R$-round protocols for interactive consistency on $L$-bit inputs to require $Ω(Ln<sup>{2+1/d})$ bits of expected communication. Likewise, $Z_\mathsf{proj}<sup>{n,d}$ causes error-free byzantine agreement and broadcast to cost $Ω(Ln<sup>{1+1/d})$ bits. In every case, the lower bound is $Ω(L_{\mathsf{out}} \cdot n<sup>{1+1/d})$ bits, where $L_{\mathsf{out}}$ is the output length. The family $Z_\mathsf{proj}<sup>{n,d}$ also causes reliable broadcast and byzantine agreement to cost $Ω(Ln<sup>{1+1/d})$ bits of expected communication in asynchronous networks. Moreover, there exists a related family $Z_\mathsf{2\textsf-proj}<sup>{n,d}$ of $Q<sup>d$-satisfying adversary structures that make core set agreement cost $Ω(Ln<sup>{2+1/d})$ bits. These asynchronous lower bounds hold against send-omission adversaries, even if the protocol uses cryptography. Their basis is that if a quorum of non-faulty parties agree on an output and terminate, then the messages they sent before terminating must suffice for the parties outside the quorum to also terminate with the same output. Surprisingly, if we do not require the parties to terminate (stop sending messages) after they output, then these bounds no longer hold. We show this by designing a non-terminating omission-tolerant reliable broadcast protocol that can for any parameter $δ&gt; 1$ be tuned to cost $(1 + \frac{1}{δ- 1})Ln + O(δn<sup>2\log(δn))$ bits, which is of independent interest. Lastly, we show how to get termination with $O(Ln^{1+1/d} + n^2\log n)$ bits (assuming the $Q<sup>d$ condition), and thus prove our asynchronous lower bounds tight.

• The paper establishes error-free communication lower bounds of Ω(Ln^(1+1/d)) for multivalued agreement against general Q^d adversaries, a factor of Ω(n^(1/d)) above threshold-adversary costs.
• It uses finite projective geometries, entropy arguments, and cut-and-paste indistinguishability to prove lower bounds for broadcast, Byzantine agreement, interactive consistency, and core set agreement.
• The paper shows that termination causes the asynchronous bottleneck: non-terminating protocols can approach baseline costs, while a termination wrapper achieves the matching O(Ln^(1+1/d) + n² log n) bound.

This paper establishes communication complexity lower bounds for multivalued agreement tasks against general (non-threshold) adversaries, showing that for every integer $d \geq 1$, $Q^d$-satisfying adversary structures exist that force error-free agreement on $L$-bit inputs to cost $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$ bits, where $L_{\mathsf{out}}$ is the output length. This is a factor of $\Omega(n^{1/d})$ above the baseline $\Omega(L_{\mathsf{out}} \cdot n)$ bound that is tight against threshold adversaries corrupting $\Theta(n)$ parties. The paper also identifies termination as the precise bottleneck in the asynchronous setting and demonstrates, via a non-terminating reliable broadcast protocol, that this bottleneck can be circumvented entirely if parties are allowed to run forever.

Background and motivation

An adversary structure $\mathcal{Z}$ is a down-closed family of subsets of the party set $[n]$, and it satisfies the $Q^d$0 condition if no $Q^d$1 or fewer sets in $Q^d$2 cover $Q^d$3. Threshold adversaries tolerating $Q^d$4 faults are special cases of $Q^d$5 adversaries. While feasibility of agreement against general adversaries is well understood—each task studied here requires $Q^d$6 exactly when its threshold analogue requires $Q^d$7—the efficiency question had not been resolved. Existing efficient protocols for long inputs rely on erasure/error-correcting code techniques that exploit threshold structure; translating them naively to general adversaries degrades complexity from $Q^d$8 to $Q^d$9 because the guaranteed number of correct parties inside a quorum can drop to $L$0. The paper answers whether this degradation is fundamental.

Adversary structures from projective geometry

The lower bounds rest on two families of adversary structures built from the $L$1-dimensional finite projective geometry $L$2 for prime powers $L$3, inspired by Maekawa's use of projective lines for mutual exclusion quorums.

The structure $L$4 partitions parties into sets $L$5 and $L$6 of size $L$7. Parties in $L$8 are bijected with points of $L$9; the adversary may always corrupt any subset of $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$0, and additionally may pick any hyperplane $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$1 and corrupt all points of $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$2 not incident to $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$3. Each party of $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$4 lies in exactly a $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$5 fraction of the hyperplane quorums—a property central to all double-counting arguments. Note that obtaining such a quorum structure requires letting the adversary corrupt $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$6 parties, which is why these bounds genuinely require general adversaries.

The structure $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$7 uses three sets $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$8 of size $\Omega(L_{\mathsf{out}} \cdot n^{1+1/d})$9, with points of $L_{\mathsf{out}}$0 labeling pairs of parties across $L_{\mathsf{out}}$1 and $L_{\mathsf{out}}$2. The adversary gets two "hits," each consisting of picking a hyperplane and corrupting non-incident parties in one of $L_{\mathsf{out}}$3 or $L_{\mathsf{out}}$4. Its key additional feature is a minimal quorum $L_{\mathsf{out}}$5 of size $L_{\mathsf{out}}$6, which is needed to force large core sets in the core set agreement lower bound.

Both structures satisfy $L_{\mathsf{out}}$7 because hyperplanes of $L_{\mathsf{out}}$8 form a $L_{\mathsf{out}}$9-wise intersecting family. Although each structure exists only for specific values of $\Omega(n^{1/d})$0 (of the form $\Omega(n^{1/d})$1 or $\Omega(n^{1/d})$2), an appendix argument using the prime number theorem shows the bounds extend to all sufficiently large $\Omega(n^{1/d})$3 for fixed $\Omega(n^{1/d})$4.

Synchronous lower bounds

For interactive consistency (all-to-all broadcast of $\Omega(n^{1/d})$5-bit inputs), the paper proves that for all $\Omega(n^{1/d})$6, any $\Omega(n^{1/d})$7-round randomized error-free protocol tolerating byzantine $\Omega(n^{1/d})$8-adversaries requires $\Omega(n^{1/d})$9 bits of expected communication whenever $\Omega(L_{\mathsf{out}} \cdot n)$0. Reductions then yield $\Omega(L_{\mathsf{out}} \cdot n)$1 bits for byzantine agreement and broadcast when $\Omega(L_{\mathsf{out}} \cdot n)$2: interactive consistency reduces to $\Omega(L_{\mathsf{out}} \cdot n)$3 sequential broadcast instances, and broadcast reduces to agreement plus one round of direct sender transmission costing $\Omega(L_{\mathsf{out}} \cdot n)$4 bits.

The proof combines three ingredients. A combinatorial lemma shows that if expected cross-communication between every (quorum, outside-party) pair exceeds some value $\Omega(L_{\mathsf{out}} \cdot n)$5, total communication must be $\Omega(L_{\mathsf{out}} \cdot n)$6, since each party belongs to only $\Omega(L_{\mathsf{out}} \cdot n)$7 quorums. An entropy argument establishes that the bidirectional transcript between any minimal quorum $\Omega(L_{\mathsf{out}} \cdot n)$8 and any party $\Omega(L_{\mathsf{out}} \cdot n)$9 must carry at least $\Theta(n)$0 bits of entropy under i.i.d. uniform inputs. Finally, a cut-and-paste indistinguishability argument proves the entropy claim: if the transcript entropy were smaller, two input assignments $\Theta(n)$1 would share a transcript, and byzantine parties could simulate world $\Theta(n)$2 toward $\Theta(n)$3 while simulating $\Theta(n)$4 toward $\Theta(n)$5, forcing disagreement on some input—breaking error-freedom.

Two restrictions deserve emphasis. First, the error-free requirement is essential: authenticated protocols with negligible failure probability achieve $\Theta(n)$6 bits against any adversary structure, so hashing defeats the lower bound. Second, the minimum input length $\Theta(n)$7 exists because untagged silence can encode metadata (e.g., a round number and sender ID in a single bit); the paper notes the restriction disappears in a tagged-message model or under entropy-based accounting, where the bounds hold for all $\Theta(n)$8 and even Las Vegas round complexities.

Asynchronous lower bounds

In the asynchronous setting, the paper proves three lower bounds against efficient send-omission adversaries, holding even if output safety need only hold with constant probability ($\Theta(n)$9 for reliable broadcast, $\mathcal{Z}$0 for byzantine agreement, $\mathcal{Z}$1 for core set agreement), and even though explicit efficient adversaries preclude cryptographic circumvention:

Task	Structure	Bound	Condition
Reliable broadcast	$\mathcal{Z}$2, $\mathcal{Z}$3	$\mathcal{Z}$4	$\mathcal{Z}$5
Byzantine agreement	$\mathcal{Z}$6, $\mathcal{Z}$7	$\mathcal{Z}$8	$\mathcal{Z}$9
Core set agreement	$[n]$0, $[n]$1	$[n]$2	all $[n]$3

All three require terminating protocols—correct parties must stop sending messages upon outputting. The proofs use a scheduling strategy in which the adversary lets traffic flow freely within a quorum set until its members terminate, exploiting the fact that they cannot distinguish fault-free execution from one where outsiders are silent faulty parties. Once the quorum terminates, agreement forces outsiders to learn the output from quorum messages alone, and Fano's inequality plus the data processing inequality yield transcript entropy lower bounds converted to bit complexity via a prefix-free encoding argument. For core set agreement, an additional scheduling phase forces the agreed core set to be the large quorum $[n]$4 of size $[n]$5, with a careful union-bound analysis over validity-violation events showing each party's output must contain all $[n]$6 bits of correct tuples with probability at least $[n]$7.

A consequence of the reliable broadcast bound is that the echo-based protocol of Hadzilacos and Toueg is optimal among terminating protocols tolerating up to $[n]$8 send-omission faults, since such an adversary subsumes $[n]$9.

Non-terminating reliable broadcast: PullCast

To show termination is essential, the paper presents PullCast, a deterministic, perfectly secure reliable broadcast protocol against any general-omission adversary that does not terminate. For any parameter $Q^d$00, PullCast costs $Q^d$01 bits and $Q^d$02 messages, with latency $Q^d$03. It uses Reed-Solomon erasure codes with parameters $Q^d$04 and a dynamic pull-based symbol request mechanism: each party tracks how many symbols it has received and requests the next needed symbol from whichever party last served it, so fast responders serve more requests—a pattern familiar from BitTorrent but uncommon in fault-tolerant consensus literature.

Because servers must remain alive indefinitely to answer dynamic requests, no terminating lower bound applies. The paper sketches how PullCast could be hardened against byzantine faults (assuming $Q^d$05) via Merkle-tree proofs attached to symbols and a fault-tolerant request deduplication mechanism, at a cost increase to $Q^d$06 overhead terms. Compositions sketched in the discussion show that non-terminating core set agreement and byzantine agreement also admit $Q^d$07 and $Q^d$08 bit solutions respectively for large $Q^d$09.

Two implications follow. First, Locher's $Q^d$10 bit lower bound for a restricted class of reliable broadcast protocols does not extend to all non-terminating protocols, contradicting his conjecture. Second, the paper gives a simple terminating crash-fault-tolerant reliable broadcast protocol costing $Q^d$11 bits (sender sends input, then reliably broadcasts "OK"), showing the lower bounds do not transfer to crash faults either—so Locher's bound fails to generalize in both directions.

Tightness via a termination protocol

The asynchronous lower bounds are shown tight for all sufficiently large $Q^d$12 against any $Q^d$13 send-omission adversary. The paper first proves that every $Q^d$14-satisfying structure admits a non-empty set $Q^d$15 with $Q^d$16 for all $Q^d$17, via a greedy peeling argument. The termination protocol Term then has each party in $Q^d$18 distribute an erasure-coded symbol of the agreed output using a $Q^d$19-code, with a relay step ensuring totality. Composed after any uniform-agreement protocol $Q^d$20 (such as PullCast), Term guarantees that if any correct party outputs from $Q^d$21, every correct party terminates with the same output, at a cost of $Q^d$22 bits and latency 2. Thus terminating reliable broadcast against $Q^d$23 general-omission adversaries costs $Q^d$24 bits, matching the lower bound. A byzantine-tolerant variant for $Q^d$25 is sketched using Merkle proofs and a quadratic reliable agreement instance on root hashes.

Limitations and open questions

Several caveats qualify the results. The synchronous lower bounds apply only to error-free protocols, and the paper can only conjecture—not prove—that they are tight; matching synchronous upper bounds remain open. The asynchronous lower bounds require termination with probability 1; extension to high-probability termination is conjectured but not formalized, and would require conditioning input distributions on good termination events. The minimum-input-length requirements stem from the untagged communication model and vanish under tagged messaging or entropy-based accounting. The paper also leaves open whether the Dolev-Reischuk-style quadratic message lower bounds apply to its adversary structures—it suspects they do not, and that $Q^d$26-message byzantine broadcast may be possible—and poses the unstudied question of when general-adversary-tolerant protocols can balance communication load evenly across correct parties. Regarding the $Q^d$27 threshold, the authors report believing based on subsequent work that Locher's bound holds for all well-balanced reliable broadcast protocols, deferring formal treatment.

Conclusion

This paper demonstrates that general $Q^d$28 adversaries fundamentally inflate the communication cost of multivalued agreement by a factor of $Q^d$29 over threshold adversaries, through explicit projective-geometry adversary structures and entropy-based double-counting arguments covering five classical tasks in both synchronous and asynchronous models. It further isolates termination as the exact source of the asynchronous lower bounds, exhibiting a near-baseline-cost non-terminating protocol and a matching $Q^d$30 termination wrapper that together render the asynchronous bounds tight. The main unresolved question is whether the synchronous error-free lower bounds admit matching protocols.