EPol Protocol: Decentralized Social Voting

• EPol Protocol is a decentralized social network polling scheme that leverages the m-broadcasting property of graph topologies to ensure vote privacy and correctness.
• It uses non-cryptographic share distribution and a majority decision rule during broadcasting to robustly aggregate binary votes even in the presence of dishonest nodes.
• The protocol balances privacy, efficiency, and robustness by tuning parameters like k and m, providing information-theoretic privacy and bounded manipulation.

EPol is a simple decentralized polling protocol for decentralized social networks that relies on the current state of social graphs rather than a central authority or a cryptography system, and was introduced to compute the final result of a binary poll while protecting vote privacy and limiting the impact of dishonest users (Hoang et al., 2014). In its canonical formulation, EPol addresses polling in an undirected social graph $G=(V,E)$ whose nodes hold binary votes $v_n \in \{-1,+1\}$, and it replaces ring-overlay constructions with graph conditions centered on the $m$-broadcasting property. The same label later appears in broader and sometimes analogical ways in adjacent literatures, but the established protocol named EPol is the decentralized social-network polling scheme of Guerraoui and collaborators’ line of work (Hoang et al., 2014).

1. Research setting and motivation

The protocol studies the polling problem in social networks where individuals collaborate to choose the most favorite choice amongst some options, without divulging their vote and publicly exposing their potentially malicious actions (Hoang et al., 2014). The target computation is the aggregate

$\sum_n v_n,$

which determines the majority decision in the binary setting. The system is decentralized: information is spread over user devices, there is no trusted central entity, and communication proceeds over the social graph itself.

EPol was proposed against the background of earlier non-cryptographic polling protocols such as DPol and related variants, which used a simple secret sharing scheme along with verification procedures but required a cluster-ring overlay and, in particular, that the number of participating users be a perfect square (Hoang et al., 2014). Those overlay requirements are central to EPol’s motivation. The protocol is designed to work on the original social graph, not on a synthetic ring structure, and to avoid the perfect-square restriction while retaining information-theoretic privacy and bounded manipulation.

The paper states the design objective in structural terms: it defines one family of social graphs that satisfy the $m$-broadcasting property, where $m$ is less than or equal to the minimum node degree, and shows that their structures enable low communication cost and constitute necessary and sufficient condition to ensure vote privacy and limit the impact of dishonest users on the accuracy of the polling output (Hoang et al., 2014). This is the protocol’s central conceptual move: graph topology is not an implementation detail but the primary resource from which privacy, correctness, and efficiency are derived.

2. Graph model, neighbor roles, and the $m$-broadcasting property

The social network is modeled as an undirected graph

$G=(V,E), \quad |V|=N,$

where each node $n$ has vote $v_n \in \{-1,+1\}$, neighborhood $v_n \in \{-1,+1\}$0, and degree $v_n \in \{-1,+1\}$1 (Hoang et al., 2014). Communication is asynchronous; nodes communicate only with direct neighbors; and no cryptographic primitives are assumed. Each node partitions neighbors into consumers $v_n \in \{-1,+1\}$2, to which it sends shares in the sharing phase, and producers $v_n \in \{-1,+1\}$3, from which it receives shares. These sets may overlap.

A privacy parameter $v_n \in \{-1,+1\}$4 controls local share fan-out. Each node chooses an odd number of consumers $v_n \in \{-1,+1\}$5 with $v_n \in \{-1,+1\}$6, and the graph must satisfy a minimum-degree condition

$v_n \in \{-1,+1\}$7

for every node, identified in the paper as Property $v_n \in \{-1,+1\}$8 (Hoang et al., 2014). This condition ensures that a node can distribute the prescribed number of shares without leaving the graph model.

The defining graph condition is the $v_n \in \{-1,+1\}$9-broadcasting property. For an integer $m$0 with $m$1, a graph satisfies the $m$2-broadcasting property if, for each source node $m$3, there exists an ordering of the nodes such that every node either is directly connected to $m$4, or has at least $m$5 neighbors that precede it in the ordering with respect to $m$6 (Hoang et al., 2014). The notation $m$7 denotes the number of neighbors of node $m$8 that precede it in the ordering with respect to source $m$9. This ordering is the combinatorial scaffold that allows nodes to decide correctly from only $\sum_n v_n,$0 propagated messages rather than from unrestricted flooding.

The adversary model distinguishes honest and dishonest nodes. Dishonest nodes form a single coalition $\sum_n v_n,$1 of size $\sum_n v_n,$2, can deviate from the protocol, manipulate shares, alter collected data, and collaborate, but are assumed to care about reputation and therefore avoid actions that would deterministically expose them as dishonest (Hoang et al., 2014). Sybil attacks are excluded from the protocol itself and are assumed to be handled by separate mechanisms such as SybilGuard or SybilLimit. For correctness under dishonest behavior, the paper adds Property $\sum_n v_n,$3: for each source node $\sum_n v_n,$4, every node has fewer than $\sum_n v_n,$5 dishonest neighbors preceding it in the ordering with respect to $\sum_n v_n,$6. A global sufficient bound is

$\sum_n v_n,$7

where $\sum_n v_n,$8 is the graph diameter (Hoang et al., 2014).

The paper organizes admissible topologies into two families. $\sum_n v_n,$9 contains graphs with only honest nodes satisfying $m$0 and $m$1, where $m$2 is the $m$3-broadcasting property. $m$4 contains graphs with honest and dishonest nodes satisfying $m$5, $m$6, and $m$7. The structural claim is explicit: Theorem 10 states that these properties are respectively the necessary and sufficient conditions for EPol to be deployed safely and correctly in systems without and with dishonest nodes (Hoang et al., 2014).

3. Protocol mechanics: sharing, broadcasting, and aggregation

EPol consists of three phases: sharing, broadcasting, and aggregating (Hoang et al., 2014). The mechanism is deliberately non-cryptographic. Privacy comes from randomized local splitting of a binary vote into balanced signed shares, and correctness comes from a graph-structured dissemination procedure.

In the sharing phase, node $m$8 privately chooses an integer $m$9 and constructs a multiset of $m$0 shares: $m$1 shares equal to its vote $m$2, and $m$3 shares equal to $m$4. The shares therefore satisfy

$m$5

The multiset is randomly permuted and one share is sent to each of the chosen consumers in $m$6 (Hoang et al., 2014). Because all shares lie in $m$7, a single observed share is not, by itself, distinguishable from a random contribution.

Each node receives shares from its producers $m$8 and sums them into its local collected data

$m$9

This quantity is not the vote itself; it is the node’s aggregate from incoming shares, and the sum of all collected data over the graph will equal the sum of all votes once every sent share has been received exactly once (Hoang et al., 2014).

The broadcasting phase disseminates each node’s collected data to the entire graph. A node first sends its own $m$0 to all neighbors. For each source $m$1, a node that is directly connected to $m$2 accepts the source’s data and forwards it to neighbors that succeed it in the source-specific ordering. A node that is not directly connected to $m$3 waits until it has accumulated $m$4 candidate values for source $m$5 from preceding neighbors, stores them in a multiset $m$6, and decides

$m$7

It then forwards this decided value to succeeding neighbors (Hoang et al., 2014). The $m$8-broadcasting property and the bound on preceding dishonest neighbors are what make this majority decision meaningful.

In the aggregating phase, node $m$9 computes the final poll result by combining its own collected data with its decided values for every other source: $G=(V,E), \quad |V|=N,$0 In the honest-only case, the protocol terminates and every node outputs

$G=(V,E), \quad |V|=N,$1

because the multiset of all shares sent equals the multiset of all shares received, hence $G=(V,E), \quad |V|=N,$2, and broadcasting delivers every $G=(V,E), \quad |V|=N,$3 exactly (Hoang et al., 2014).

4. Privacy, correctness, and manipulation bounds

EPol’s privacy analysis is information-theoretic and stated in terms of disclosure probabilities under coalitions of dishonest nodes. Let $G=(V,E), \quad |V|=N,$4 denote the proportion of nodes that send $G=(V,E), \quad |V|=N,$5 shares, and let $G=(V,E), \quad |V|=N,$6 be the number of dishonest nodes in a network of size $G=(V,E), \quad |V|=N,$7. If a coalition knows that a given honest node sends $G=(V,E), \quad |V|=N,$8 shares, the probability that the coalition reveals that node’s vote with certainty is at most

$G=(V,E), \quad |V|=N,$9

In the special case where all nodes send $n$0 shares, the bound simplifies to

$n$1

(Hoang et al., 2014). The paper also proves that, if honest nodes do not all vote for the same option, a coalition of $n$2 dishonest nodes can reveal at most $n$3 honest votes with certainty (Hoang et al., 2014).

Beyond certainty disclosure, the protocol analyzes greedy and non-greedy uncertain disclosure strategies. In the first, the coalition infers a vote as soon as it sees $n$4 identical shares; in the second, it waits for all observed shares and takes the most frequent value. The paper gives explicit probability expressions and upper bounds for both strategies, thereby extending the privacy analysis beyond the certainty case (Hoang et al., 2014). This matters because EPol’s privacy guarantee is not framed as perfect secrecy but as probabilistic resistance whose strength scales with $n$5, $n$6, and the share-allocation distribution $n$7.

Manipulation is bounded in the output space. Dishonest nodes can try to bias the final tally by sending more than the allowed number of identical shares within their share budget, flipping received shares when computing collected data, or modifying broadcasted collected data. Under the protocol’s local feasibility checks and majority decision rule, the maximum impact of one dishonest node on the final result is

$n$8

so the total maximum impact of a coalition of size $n$9 is

$v_n \in \{-1,+1\}$0

(Hoang et al., 2014). The paper also provides an average impact expression parameterized by the vote distribution and the $v_n \in \{-1,+1\}$1 profile, but the headline asymptotic statement is the linear-in-$v_n \in \{-1,+1\}$2 worst-case bound.

Correct dissemination under dishonesty is quantified through the tolerance theorem. EPol can tolerate up to

$v_n \in \{-1,+1\}$3

dishonest nodes while still ensuring that each honest node decides correctly the collected data of every source, and, under this bound, the probability that a node decides wrongly the collected data of some other node converges to $v_n \in \{-1,+1\}$4 exponentially fast in $v_n \in \{-1,+1\}$5 and $v_n \in \{-1,+1\}$6 (Hoang et al., 2014). In this respect, $v_n \in \{-1,+1\}$7 is both an efficiency parameter and a robustness parameter: larger $v_n \in \{-1,+1\}$8 strengthens the majority filter in broadcasting and raises the admissible dishonest-node bound.

5. Efficiency, robustness, and design trade-offs

The protocol’s storage and message costs are described as close to linear, but their exact form depends on $v_n \in \{-1,+1\}$9, $v_n \in \{-1,+1\}$00, and local degree. Each node stores producer and consumer lists of size $v_n \in \{-1,+1\}$01, a neighbor list of size $v_n \in \{-1,+1\}$02, an identity-indexed decision structure over all nodes, and up to $v_n \in \{-1,+1\}$03 candidate collected-data values per source. The resulting per-node space complexity is

$v_n \in \{-1,+1\}$04

(Hoang et al., 2014). The message complexity per node is

$v_n \in \{-1,+1\}$05

reflecting at most $v_n \in \{-1,+1\}$06 share messages in the sharing phase and source-wise forwarding to successors in the broadcasting phase (Hoang et al., 2014).

The paper also analyzes node crashes and message loss. A node may fail to decide a collected datum for a source because the source crashes, a direct-neighbor broadcast is lost, or too many preceding neighbors fail to forward the value. Under this fault model, the maximum impact on accuracy of a node crash is

$v_n \in \{-1,+1\}$07

(Hoang et al., 2014). This extends EPol beyond the purely static adversarial model and makes clear that robustness is not limited to strategic dishonesty.

The main design trade-offs follow directly from the parameters. Larger $v_n \in \{-1,+1\}$08 improves privacy but increases potential impact of dishonest nodes and memory usage. Larger $v_n \in \{-1,+1\}$09 improves robustness in broadcasting and allows larger $v_n \in \{-1,+1\}$10, but increases communication cost (Hoang et al., 2014). The protocol therefore does not remove the privacy-efficiency trade-off; it relocates it into graph-theoretic and local fan-out parameters.

The limitations are equally explicit. The graph must satisfy the $v_n \in \{-1,+1\}$11-broadcasting property and the minimum-degree constraints. No cryptographic protection is used, so the protocol does not resist adversaries with network-level eavesdropping beyond the model assumptions. Sybil and spam handling are outside the protocol and delegated to external mechanisms. The design is analyzed for binary votes only, and extending it to multiple options requires additional design (Hoang et al., 2014). These restrictions are not incidental; they mark the scope within which the necessary-and-sufficient structural theorems are intended to hold.

6. Stateful verification and formal analysis perspectives

Although EPol itself is presented as a decentralized polling protocol rather than as a security protocol, a later methodological interpretation presents stateful security protocol verification as exactly the kind of machinery needed to analyze a protocol like EPol, because vote registers, ballot-box contents, and credentials persist across sessions and constrain what honest parties and attackers can do (Li et al., 2014). The relevant verification framework explicitly represents protocol execution states and state transformations, develops an algorithm for verifying security properties by first-order reasoning for reachability analysis while tracking state transformation and checking the validity of newly generated states, and implements the method in a tool named SSPA (Li et al., 2014).

In that interpretation, EPol-like components can be represented as tamper-resistant global state objects such as

$v_n \in \{-1,+1\}$12

whose traces encode legal evolutions and prohibit attacker rewinding or cloning unless the protocol itself exposes such operations (Li et al., 2014). This is not part of the original 2014 EPol protocol specification. It is a methodological extension: stateful verification is proposed by analogy as a way to reason about persistent election state, reachability of bad events, and cross-session consistency constraints in protocols that resemble EPol in their dependence on global mutable state.

This suggests a useful distinction. The original EPol protocol derives privacy and correctness primarily from share distribution and graph structure (Hoang et al., 2014). A stateful-verification perspective instead asks how one would specify and check persistent protocol state, accessibility, and impossible state traces (Li et al., 2014). The two viewpoints are complementary rather than competing: one is a protocol design, the other a verification methodology.

7. Later terminological extensions and adjacent uses

A recurring source of confusion is that “EPol Protocol” is not used uniformly across research areas. In recent LLM-agent measurement work, EPC is explicitly described as an evaluation policy/protocol, or “EPol Protocol,” for measuring evaluator preference coupling in closed-loop systems (Liu, 1 Jul 2026). That protocol specifies a four-phase isolation paradigm over text and visual-adjacent domains, fixes a test-time reinforcement learning update rule with $v_n \in \{-1,+1\}$13 rounds per phase, $v_n \in \{-1,+1\}$14, $v_n \in \{-1,+1\}$15, and reports metrics including $v_n \in \{-1,+1\}$16, JSD, ECE, and Brier, together with a versioned Reference Snapshot v1.0 (Liu, 1 Jul 2026). This usage is conceptually about evaluator-driven adaptation, not decentralized vote polling.

In EPON research, the proposed protocol is OSMP-EO, an ONU-assisted sleep-mode protocol for energy-efficient ONU design in EPON, but the details note that in some secondary literature this type of multi-mode with prediction ONU-assisted EPON scheme is sometimes referred to under names like “EPol” for energy-efficient polling (Dutta et al., 2018). OSMP-EO uses deep sleep, fast sleep, and doze, exploits doze mode during active DBA cycles through a modified RTT-measurement trick, and is analyzed by a DTMC despite prediction-induced memory (Dutta et al., 2018). This is a terminological overlap rather than identity with the decentralized social-network polling protocol.

In e-democracy research, “A Consensus Protocol for e-Democracy” is presented as a protocol that would serve as an “EPol-style” protocol by combining a permission-based consensus protocol such as pBFT with a trust graph and a community expansion algorithm, so that the set of agents can change over time while remaining sybil-resilient (Poupko et al., 2020). Its state is the graph $v_n \in \{-1,+1\}$17, where $v_n \in \{-1,+1\}$18 is the current community, and membership updates are accepted only if a resilient-community condition and a corruption bound hold (Poupko et al., 2020). Here again, the connection is architectural and normative rather than nominal: the protocol is aligned with egalitarian, non-plutocratic governance, but it is not the EPol polling protocol of decentralized social networks.

The broader implication is that “EPol Protocol” functions as a domain-crossing label for protocolized coordination under privacy, trust, or evaluation constraints, but only one of those systems is formally named EPol in the literature surveyed here: the simple decentralized polling protocol based on the $v_n \in \{-1,+1\}$19-broadcasting property and graph-native dissemination of collected data (Hoang et al., 2014).