In the current implementation of subnets:

1. The subnet's "work rewards" are distributed immediately once the escrow is settled, rather than at the end of the epoch.
2. The subnet's stats do not count towards "bitcoin-style rewards"

Subnets are inherently at a higher risk of being hijacked than the mainnet.

Since "bitcoin-style rewards" presently outweigh the "work rewards", we have to be aware of the risks a hijacked subnet could pose for the network at large, and the possibility of a dishonest host significantly tilting the scales in their favor.

With the current protocol, as outlined in ./proposals/inference, allowing subnet stats to count towards "bitcoin-style rewards" could pose a great risk. If a dishonest actor takes over a subnet (rare as it may be), they would be able to post a settlement tx on mainnet claiming to have served 1 million inferences (therefore receiving an undeserved amount of bitcoin-style rewards), or claiming that other hosts in the subnet missed 1 million inferences. Even with an extremely low chance of a subnet being hijacked, such an event could still cause disproportionate damage.

We must limit the damage a hijacked subnet can cause, by e.g., limiting the number of inferences a host can claim to have done.

A simple initial solution could be to set a global limit. E.g., all subnets can run up to 500 inferences. If a settlement tx claims to have run more than that, then the bitcoin-style rewards are capped to 500 inferences.

Alternatively, if we can calculate the lower bound of how much an inference request can cost, then the mainnet can infer what the maximum number of inferences can be claimed from an escrow settlement.

A related attack vector is "subnet grinding", where a dishonest actor, acting as both User and Host, repeatedly creates/settles subnets (without running any inferences) until they're allocated to a subnet where they do have a supermajority of the subnet's weight, and thus can hijack it.

This can be prevented by charging a fee per subnet. Since all subnets have to be settled in order for the user to receive their unspent tokens back, it doesn't matter whether the fee is charged per subnet creation or per settlement.

A simple implementation could be to charge N tokens per host / N tokens per nonce produced.

• This assumes that all subnets must produce at least 1 nonce before it can be settled. And at the moment, the 1st finalization round (seed reveal) does produce nonces.

As long as the fees paid per subnet exceed the total amount of rewards the dishonest actor could possibly exploit, then subnet grinding would be economically unviable.

TBD: calculate how high this fee would have to be.

As a sidenote: charging N tokens per host would also play well together with another idea we've discussed.

We may want to let the user decide the size of the subnet.

• The user would be naturally incentivized to create large subnets (e.g., with 128 hosts), since they offer the best security.