When there is no center

Four banks are each hit by fragments of the same fraud ring. No single bank sees enough to identify it; the pattern exists only across all four. The obvious fix is a shared platform, and it never gets built. Whoever hosts it holds their competitors’ customer data and transaction patterns. Nobody will be that party, and nobody will accept a rival being it.

Efforts like this stall on governance rather than technology, and they stall for years. The coordinator is impermissible — not because it is hard to build, but because being trusted with rivals’ data is a position no participant will grant another.

What each bank can exchange instead is its judgment — this account pattern carries a ring signature — and a pointer back to itself. Never the customer records. Each bank decides for itself what it admits, and from whom.

A rare-disease treatment response needs evidence from hospitals in Germany, the UK and Japan. Any one site has too few cases to conclude anything. Data-protection law, national health-data rules and institutional review boards each independently forbid the patient records leaving their jurisdiction. There is no legal entity permitted to hold all three countries’ data — not a vendor, not a university, not a regulator.

The coordinator is legally impossible, not merely unbuilt. Federated learning exists largely because of this scenario, which is what makes it credible rather than hypothetical — and the boundary is worth stating plainly: federated approaches serve this well when the sites agree on a shared label space and can run synchronized rounds. Where that agreement does not exist, or membership will not hold still long enough to establish it, they cannot run.

An earthquake takes out regional infrastructure. The emergency operations center is offline — or intact but cut off, which is operationally the same thing. Backhaul is down, so nothing in the cloud is reachable. On the ground: fire crews, a hospital, utility repair teams, a search-and-rescue unit that flew in this morning, and volunteers with equipment nobody has catalogued. They can reach each other over local radio and wifi. They can reach nothing else.

Each holds a piece nobody else has. The utility crew knows which grid sections are live. The hospital knows its remaining capacity. Search-and-rescue knows which buildings are cleared. Fire knows which roads are passable. Every one of those facts is nearly worthless where it sits and decisive when combined — and the thing that was supposed to combine them is rubble.

The coordinator is unavailable precisely when it matters most. This is not a governance problem or a legal one. The standard answer — a redundant failover center — assumes the network reaching it survives, and here that is the assumption that failed.

There is a second problem underneath the first: nobody knows who is in the network today. That volunteer unit was on no roster this morning. Whatever decides whose reports to trust has to be earned locally, within hours, from behavior rather than from a directory.

A logistics network: carriers, ports, customs brokers and shippers join and leave weekly, run different systems, and use different words for the same event. A central platform needs to know who is in the network and how each participant’s data maps to everyone else’s. By the time onboarding and schema mapping are finished, the membership has moved.

The coordinator’s grouping knowledge is unearnable. This one is the most demanding to explain and the most important scientifically, because it is where our own evidence pushes back hardest on us.

In our experiments, a central server that is handed the correct grouping beats the mesh at every level we tested — comfortably, and in every one of twenty paired runs. Strip that oracle away and have the same server work the grouping out from data, and it falls behind the mesh. The value was never in the aggregation. It was in knowing which participants belong together, and that is exactly what nobody can be handed here.