Black Marlin: DAG Byzantine Broadcast Protocol

• Black Marlin is a DAG-based Byzantine atomic broadcast protocol that ensures consensus in partially synchronous networks by ordering blocks consistently despite Byzantine faults.
• It employs deterministic round-robin anchor selection and support thresholds to achieve optimal communication and low latency without relying on reliable broadcast or common coin.
• The design mitigates latency bottlenecks and improves throughput compared to traditional leader-based and DAG protocols, making it significant for distributed consensus applications.

Searching arXiv for the specified paper and closely related DAG-based consensus context. Black Marlin is a DAG-based Byzantine atomic broadcast protocol for partially synchronous networks that orders blocks or transactions consistently among honest parties despite Byzantine faults, while attempting to remove latency bottlenecks associated with earlier DAG-based designs. It is presented as the first Directed Acyclic Graph (DAG)-based Byzantine atomic broadcast protocol in a partially synchronous setting that forgoes both reliable broadcast (RBC) and common coin primitives (Ignacio et al., 20 Aug 2025). The protocol combines deterministic round-robin anchor selection, support thresholds, and a commit rule over a locally maintained DAG to obtain atomic broadcast, with claimed optimal latency of 3 rounds of communication in the honest case and 4.25 rounds in expectation under maximal Byzantine corruption, while maintaining communication complexity $\mathcal{O}(n^2)$ and amortized communication complexity $\mathcal{O}(n)$ (Ignacio et al., 20 Aug 2025).

1. Problem setting and protocol objective

Black Marlin is designed for the Byzantine atomic broadcast problem in partially synchronous networks. Its objective is to ensure that honest parties agree on a single total order of delivered blocks even when some parties behave arbitrarily. The motivating distinction is between leader-based systems, such as Paxos, PBFT, and HotStuff, which may incur leader bottlenecks and expensive view changes, and DAG-based systems, which improve throughput by allowing many parties to contribute in parallel but often depend on RBC and/or a common coin (Ignacio et al., 20 Aug 2025).

The protocol targets a specific gap: DAG-based atomic broadcast under partial synchrony without using either RBC or a common coin. In the formulation given for atomic broadcast, the protocol must satisfy Validity, Agreement, Integrity, and Total order, except with negligible probability. The stated partial-synchrony distinction is standard: validity and liveness are guaranteed after GST, whereas safety properties hold during both synchrony and asynchrony (Ignacio et al., 20 Aug 2025).

This design goal is significant because earlier DAG protocols typically relied on RBC for safe dissemination and on a common coin to break symmetry or guarantee progress in asynchronous settings. Black Marlin instead uses deterministic round-robin anchor election and timeouts, which is feasible in the partially synchronous model. This suggests that some of the conventional dependency of DAG-based consensus on heavy broadcast and randomization primitives is model-contingent rather than fundamental.

2. DAG structure and local state

Black Marlin proceeds in rounds and maintains a local DAG of blocks. Each block contains a round number, a creator identifier, strong references to blocks from the immediately previous round, and weak references to older blocks (Ignacio et al., 20 Aug 2025). The DAG provides the causal structure from which support, commit conditions, and final deterministic delivery order are derived.

The paper introduces the following notation for a party’s local view (Ignacio et al., 20 Aug 2025):

Symbol	Meaning
DAG(r)	Set of blocks from round r
past(B)	Blocks reachable from B through strong and weak links
strong(B)	Blocks reachable from B through strong links only
supp(B)	Number of parties’ blocks in the next round that include B in strong references

These notions define the central dependency relation. A block’s position in the DAG is not merely archival; it determines whether the block can become an anchor, whether that anchor can later be committed, and how blocks are eventually delivered in total order. The weak-reference/history mechanism is also tied to garbage collection and memory retention. The paper states that memory remains $\mathcal{O}(n)$, even in long executions, provided the estimated network delay is only overestimated by a constant factor (Ignacio et al., 20 Aug 2025).

The absence of RBC makes the structure of block references especially important. The protocol uses signed messages and careful block inclusion and history rules to compensate for the lack of a separate reliable dissemination primitive. A plausible implication is that the DAG itself acts as a persistence and consistency carrier: once a supported anchor is sufficiently embedded in later rounds, its causal footprint becomes unavoidable for honest parties.

3. Deterministic anchor election and round progression

Black Marlin elects an anchor in every round via a deterministic round-robin rule. The designated anchor creator for round r is denoted RR(r) (Ignacio et al., 20 Aug 2025). A round has an anchor if the designated party produces a block in that round, and a block is a supported anchor when it is created by RR(r) and receives support from at least n-f parties in the next round (Ignacio et al., 20 Aug 2025).

The paper defines (Ignacio et al., 20 Aug 2025):

• anchor(r): there exists a block in DAG(r) created by RR(r)
• suppAnchor(r): there exists such an anchor block with support at least n-f

This deterministic anchor selection replaces the common coin. Rather than probabilistically breaking symmetry, the protocol fixes a schedule and relies on partial synchrony plus support conditions for progress. The text further claims that Black Marlin is the first DAG-based Byzantine atomic broadcast protocol in partial synchrony that elects an anchor in every round, does not use reliable broadcast, and does not use a common coin (Ignacio et al., 20 Aug 2025).

Round progression requires that parties wait until they have received enough blocks from at least n-f parties and either the current round’s anchor together with the previous two anchors satisfy the support conditions, or a timeout fires (Ignacio et al., 20 Aug 2025). Timeouts serve to prevent deadlock under Byzantine behavior or adverse delay; when the network behaves well, the protocol is described as responsive because it progresses at the actual network speed rather than a pessimistic upper bound (Ignacio et al., 20 Aug 2025).

The interaction between round-robin selection and support thresholds is central. Determinism alone would not suffice if later rounds could omit or equivocate on designated anchors. The support requirement ensures that an anchor is not merely syntactically designated but also causally acknowledged by a sufficiently large next-round quorum.

4. Commit rule and atomic broadcast semantics

Consensus is achieved through a commit rule based on chains of supported anchors. After round r, the protocol attempts to commit the anchor block from round r-2 (Ignacio et al., 20 Aug 2025). That anchor is committed only when three conditions hold: it is the designated anchor of its round, it has support from at least n-f parties in round r-1, and the anchor from round r-1 is also supported by at least n-f parties in round r (Ignacio et al., 20 Aug 2025).

The commit procedure is recursive. If there is a higher-round block in the causal future of a candidate block B, the protocol commits that higher-round block first; otherwise, it deterministically topologically sorts the blocks in past(B) and delivers them (Ignacio et al., 20 Aug 2025). The resulting effect is a common committed chain across honest parties.

The formal atomic broadcast specification is given as follows (Ignacio et al., 20 Aug 2025):

• Validity: If an honest party i invokes ab-broadcast(B,i,r) after GST, then party i eventually outputs ab-deliver(B,i,r).
• Agreement: If an honest party outputs ab-deliver(B,i,r), then all honest parties eventually output ab-deliver(B,i,r).
• Integrity: For any party i and round r, every honest party outputs ab-deliver(B,i,r) at most once, and if i is honest, then i must have invoked ab-broadcast(B,i,r).
• Total order: If one honest party outputs one delivery before another, all honest parties must preserve that order.

The paper explicitly notes that the validity property applies to blocks broadcast after the network becomes synchronous, while the safety properties hold during both synchrony and asynchrony (Ignacio et al., 20 Aug 2025). This places Black Marlin squarely within the standard partial-synchrony framework: liveness is conditional on post-GST timing assumptions, but safety is not.

A plausible implication is that the protocol’s elimination of RBC and common coin does not weaken the abstract broadcast contract; rather, it shifts the proof burden onto DAG monotonicity, support comparability, and the propagation properties of supported anchors.

5. Safety and liveness analysis

The formal security analysis is divided into safety, which holds even during the asynchronous period, and liveness, which is guaranteed only after GST (Ignacio et al., 20 Aug 2025). Several lemmas support the main theorem that Black Marlin implements atomic broadcast.

One lemma states that every honest message block(B', j, r) received by an honest party i is valid (Ignacio et al., 20 Aug 2025). This is a foundational well-formedness property: honest parties extend only correctly structured and verifiable blocks.

A second lemma establishes uniqueness of anchors. Given two honest parties and blocks from the same round, if both blocks satisfy the anchor condition in their respective views, then the blocks are equal (Ignacio et al., 20 Aug 2025). The proof uses the threshold condition $n \ge 3f+1$. Since honest parties support at most one block per party per round, two distinct blocks cannot both obtain support from at least n-f parties. This prevents divergent anchor choices among honest parties.

A third lemma states that if a block $B$ from round r satisfies the anchor condition in some honest party’s view, then every valid block from round $r' \ge r+2$ satisfies $B \in past(B')$ (Ignacio et al., 20 Aug 2025). This causal propagation property is critical: once a block becomes a supported anchor, sufficiently later valid blocks must include it in their causal history. In effect, supported anchors become structurally unavoidable.

Another lemma shows that committed blocks form a chain: if honest parties commit blocks $B_i$ and $B_j$, then either $B_i = B_j$, or $\mathcal{O}(n)$0, or $\mathcal{O}(n)$1 (Ignacio et al., 20 Aug 2025). Committed blocks are therefore comparable by causal order. Combined with deterministic topological sorting inside the commit procedure, this yields total order.

The paper’s theorem states that Black Marlin (Algorithm 1) implements atomic broadcast (Ignacio et al., 20 Aug 2025). The proof is structured by the four properties. Validity follows because some committed anchor eventually contains the broadcast block in its past; Agreement follows because once one honest party delivers a block, all honest parties eventually do so; Integrity follows from uniqueness and provenance constraints; and Total order follows from the recursive commit rule together with the chain property (Ignacio et al., 20 Aug 2025).

The liveness argument after GST proceeds through several steps: honest messages arrive within $\mathcal{O}(n)$2, honest anchors are supported without timeout, some honest party eventually becomes the round-robin anchor, anchors are eventually committed with the stated probability, and every broadcast block eventually lies in the past of future committed blocks (Ignacio et al., 20 Aug 2025). This makes the liveness proof probabilistic only in the sense used for expected latency under Byzantine corruption; the protocol’s progress mechanism itself remains deterministic apart from adversarial placement of corruptions relative to the round-robin schedule.

6. Latency, communication, and resource bounds

The principal latency claim is that Black Marlin achieves optimal 3 rounds of communication in the honest case and 4.25 rounds in expectation with Byzantine faults (Ignacio et al., 20 Aug 2025). These are described as actual communication rounds rather than counts of RBC instances. The latency accounting reflects the fact that a block broadcast in round r becomes committed as the anchor from round r-2 when round r finishes, creating a 2-round pipeline delay plus support propagation (Ignacio et al., 20 Aug 2025).

The paper gives the following expected-round bound after GST (Ignacio et al., 20 Aug 2025):

$\mathcal{O}(n)$3

and the resulting expected end-to-end latency:

$\mathcal{O}(n)$4

At the corruption threshold $\mathcal{O}(n)$5, this yields

$\mathcal{O}(n)$6

The key lemma states that, after GST, given a round r, the probability that honest party i commits a block in r is at least $\mathcal{O}(n)$7, and therefore the expected number of rounds until a block is committed is at most $\mathcal{O}(n)$8 (Ignacio et al., 20 Aug 2025). The argument is that both the anchor from round r-2 and the anchor from round r-1 must be honest, each is honest with probability $\mathcal{O}(n)$9, and both are honest with probability at least $\mathcal{O}(n)$0 (Ignacio et al., 20 Aug 2025). Under the maximal corruption case $\mathcal{O}(n)$1, the text remarks that honest parties commit a block every at most 9/4 rounds (Ignacio et al., 20 Aug 2025).

The communication claims are (Ignacio et al., 20 Aug 2025):

Measure	Claimed bound
Communication complexity	$\mathcal{O}(n)$2
Amortized communication complexity	$\mathcal{O}(n)$3
Memory under constant-factor delay overestimate	$\mathcal{O}(n)$4

The rationale is that each honest party sends at most one message per round; each message contains the new block and only the blocks the recipient has not yet seen; the missing-set has size $\mathcal{O}(n)$5; and with n transactions of constant size per block, the total per-round cost is $\mathcal{O}(n)$6 and the amortized cost is $\mathcal{O}(n)$7 per transaction (Ignacio et al., 20 Aug 2025). These bounds are explicitly described as optimal (Ignacio et al., 20 Aug 2025).

These complexity claims are important because low latency in DAG-based systems is often purchased with additional dissemination overhead or stronger broadcast subroutines. Black Marlin is presented as avoiding that tradeoff. This suggests that, in the partial-synchrony setting, DAG-based broadcast can approach the communication profile and latency traditionally associated with more tightly structured consensus mechanisms.

7. Empirical evaluation, limitations, and significance

The empirical evaluation compares Black Marlin against Bullshark (Ignacio et al., 20 Aug 2025). The reported setup uses local experiments on a MacBook Pro M1 Pro, with party counts 4, 10, and 13; delays $\mathcal{O}(n)$8 ms; 10 runs per point lasting 60 seconds each; transaction size 512 bytes; injection rate 50,000 tx/sec; and honest parties only (Ignacio et al., 20 Aug 2025). Delays are modeled by a Poisson distribution with mean $\mathcal{O}(n)$9, intended to keep actual delay below $n \ge 3f+1$0 with high probability (Ignacio et al., 20 Aug 2025).

Latency results reportedly show that Black Marlin consistently outperforms Bullshark by a factor of 2 to 3 (Ignacio et al., 20 Aug 2025). Two examples are given. With 10 parties and $n \ge 3f+1$1 ms, Black Marlin achieves $n \ge 3f+1$2 ms, whereas Bullshark achieves $n \ge 3f+1$3 ms. With 10 parties and $n \ge 3f+1$4 ms, Black Marlin achieves $n \ge 3f+1$5 ms, whereas Bullshark achieves $n \ge 3f+1$6 ms (Ignacio et al., 20 Aug 2025). The explanation offered is the removal of reliable broadcast, more frequent anchor selection, and lower protocol overhead (Ignacio et al., 20 Aug 2025).

Throughput is also reported as consistently higher than Bullshark’s, although the improvement is more modest than for latency (Ignacio et al., 20 Aug 2025). The paper attributes this to Bullshark’s batching and block-size behavior, which partially compensates for network delay. Memory behavior is described as robust under garbage collection: if the network delay estimate is overestimated by a constant factor, memory increases only by a constant factor, preserving $n \ge 3f+1$7 space usage (Ignacio et al., 20 Aug 2025).

The stated limitations are specific. Liveness is guaranteed only after GST; before GST, safety holds but progress need not. The 4.25-round latency is an expected bound under Byzantine corruption rather than a deterministic worst-case guarantee. The implementation comparison is limited to Bullshark because source code for more recent DAG protocols was not publicly available. The benchmarks are conducted on a single machine with synthetic delay and therefore do not constitute a full distributed deployment study (Ignacio et al., 20 Aug 2025).

The principal significance claimed for Black Marlin is that a DAG-based Byzantine atomic broadcast protocol in partial synchrony need not rely on RBC or a common coin to obtain atomic broadcast, optimal $n \ge 3f+1$8 communication, optimal $n \ge 3f+1$9 amortized communication, 3-round honest-case latency, and 4.25-round expected latency under worst-case Byzantine corruption (Ignacio et al., 20 Aug 2025). In that sense, the protocol narrows the gap between high-throughput DAG-based designs and low-latency consensus protocols. A plausible implication is that future partially synchronous DAG protocols may treat deterministic anchor schedules and support-propagation arguments as first-class alternatives to randomized symmetry breaking and heavy dissemination subroutines.