An honest on-chain agent broadcasts a reorderable intent every time it pays — front-run and sandwiched at agent frequency, that is a continuous tax. Routing private does not close it; it trades execution leakage for centralization into a few builders.
An agent decides to swap. It has done everything right: the quote was honest, the slippage tolerance is sane, the counterparty is the real DEX and not a spoofed one, the wallet holds exactly the float it should. It signs a valid transaction and broadcasts it. For a few hundred milliseconds, before that transaction is mined, it sits in the public mempool where anyone can read it. In those milliseconds a bot reads the agent’s intent — this address is about to buy this asset in this pool — buys ahead of it, lets the agent’s own order push the price up, and sells into that move. The agent gets a worse fill than it quoted; the difference is the bot’s profit. Nothing about the agent was compromised. The transaction was correct. It lost value anyway, because broadcasting a transaction is broadcasting an intent, and on a public chain an intent is something other people can act on before you do.
This is not an edge case an agent hits once. A human swaps a few times a month and eats this occasionally. An agent that pays and swaps as part of normal operation broadcasts intents at a frequency a human never matches, and each one is another reorderable signal in the mempool. At that frequency the occasional bad fill stops being a tail event and becomes a line item — a transaction-ordering tax the agent pays continuously for the privilege of acting on-chain. The whole post is about that tax: what it is, why routing around it through a private channel does not make it go away, and what the obvious fix costs you instead.
Start with the mechanism, because the name “MEV” hides it. Maximal Extractable Value is not a hack or a bug in any one contract; it is the value the party who orders transactions can extract by choosing that order. The comprehensive survey states it plainly: Maximal Extractable Value Mitigation Approaches in Ethereum and Layer-2 Chains: A Comprehensive Survey (arXiv 2407.19572) defines MEV as arising “when miners or validators manipulate transaction ordering to extract additional value, often at the expense of other network participants.” Read the last clause carefully — the value comes at the expense of a participant, and that participant is whoever submitted the transaction being reordered. In our setting, that is the agent.
The specific move against the agent is front-running, and the survey is exact about how cheap it is: a front-run is when “a transaction is placed ahead of another in the execution queue by bidding higher transaction fees.” That is the entire trick. The agent’s intent is visible in the mempool; the adversary reads it, submits with a higher fee, and the ordering rules put it first. Sandwiching is the round trip — one transaction ahead of the agent, one behind, the agent’s own price impact harvested in between. None of it requires breaking the agent, the wallet, or the DEX, only that the agent’s transaction be readable before it is final. On a public chain it is.
This is why the honest agent is the right frame. The controls that protect a paying agent from itself — the spend ceilings, treasury isolation, and circuit breakers that spend rails for agents argues you must build because the protocols did not ship them — are aimed at a compromised or runaway agent. The ordering tax is the opposite case: the agent is honest, the payment is exactly what the user wanted, every signature checks out, and the value leaks anyway — to an external party the agent never interacted with, purely because the transaction passed through a place where its intent could be read and reordered.
The strongest way to see this as a continuous tax rather than an occasional misfortune is to measure it as a fraction of volume — because a fixed percentage of everything you move is exactly what a tax is. The cross-chain study does precisely that. The Walls Have Ears: Unveiling Cross-Chain Sandwich Attacks in DeFi (arXiv 2511.15245) examined two months of cross-chain transactions on the Symbiosis protocol (August 10 to October 10, 2025) and found attacks that “collectively garnered over $5.27 million USD in profit, equivalent to 1.28% of the total bridged volume.”
Sit with the shape of that number. It is not a count of victims or a worst-case loss; it is extraction as a percentage of throughput. An agent moving value across that path was paying, in aggregate, about 1.28% of what it moved to whoever ordered the transactions — not on a bad day, but as the steady-state cost of the rail. For a human bridging once, that is a shrug; for an agent whose normal operation is moving value across chains, it is a margin compounding against every unit it ever bridges. A tail event has no stable percentage; a tax does.
The cross-chain setting also kills the comforting assumption that this is L1’s problem and a multi-chain agent escapes it by spreading out. The same paper shows the opposite: crossing chains opens a new leakage path.
The naive mental model is that an agent’s transaction is private until it hits the mempool of the chain it executes on. Cross-chain breaks even that. The Walls Have Ears uncovers a vulnerability where “attackers can exploit events emitted on the source chain to learn transaction details on the destination chain before they appear in the destination chain mempool.” The bridge message itself is the leak: the agent initiates a cross-chain swap, the source chain emits an event describing it, and an adversary watching that event knows what is coming on the destination chain before the destination transaction is even submitted. The intent is reorderable in transit, ahead of the place you thought was first exposure.
The reflexive response is “use a sandwich defense,” and the paper is blunt that the toolkit does not transfer: “current sandwich-attack defenses are ineffective against this new cross-chain variant.” This matters for agents because cross-chain movement is not exotic for them — picking the chain with the right liquidity or asset and bridging to it is ordinary agent behavior, the same calculus stablecoin rails for agent payments walks through when an agent chooses where to settle. An agent swapping across chains cannot bolt on the usual mempool protections and call the seam closed, because the leak happened one chain earlier than those protections look.
So the honest agent is exposed on a single chain through the public mempool, and exposed across chains through bridge-event leakage that defeats the standard defenses. The obvious move, the one every guide reaches for, is to stop broadcasting into the public mempool at all. Route the transaction privately, straight to a block builder, skipping the place where bots read it. That move is real, it is widely adopted, and it does not close the seam.
The first thing to know about private routing is that it is not a clever edge anymore; it is where the flow already is. Private MEV Protection RPCs: Benchmark Study (arXiv 2505.19708) finds the Ethereum transaction supply chain “has shifted from relying entirely on the public mempool… to an astonishing 80% usage of private RPCs.” The public mempool is the minority path. An agent that “routes privately to avoid being sandwiched” is doing what most flow already does — which means the centralization trade-off below is not a hypothetical future but the status quo the agent is opting into.
The behavioral study shows the same migration one victim at a time, driven by exactly the experience our opening agent had. Sandwiched and Silent: Behavioral Adaptation and Private Channel Exploitation in Ethereum MEV (arXiv 2512.17602) tracks what traders do after being sandwiched and finds that “around 40% of victims migrate to private routing within 60 days, rising to 54% with repeated exposures.” Being publicly sandwiched is a push; repeated hits push harder. The public mempool is a place honest swappers actively flee — the right instinct, and also the entry to the trade, because what they flee into is not safe ground.
The benchmark study adds that “private RPC” is not one decision: “not all RPCs OFAs produce the same outcomes,” and an order flow originator should “pay close attention to which OFA they use.” These RPCs submit straight to builders while “conducting Order Flow Auctions (OFAs) to capture MEV backrun rebates and gas rebates” — they monetize the agent’s order flow by design, auctioning it to builders even when nothing is overtly stolen. So “use a private RPC” silently becomes “pick a winner among a handful of intermediaries and hand it your flow.” The protective framing and the value-extractive framing are one mechanism seen from two sides.
The cleanest disproof of “private equals safe” is that the sandwich runs along the private path too, at real scale and in real dollars. Sandwiched and Silent confirms, for November–December 2024, “2,932 private sandwich attacks affecting 3,126 private victim transactions, producing $409,236 in losses and $293,786 in attacker profits.” These victims did the recommended thing — left the public mempool, routed privately — and were sandwiched anyway, inside the channel meant to protect them. The fix the ecosystem recommends does not remove the attack; it changes which path the attack arrives on.
And the private path concentrates the attacker pool. The same study finds that “a single bot accounts for nearly two-thirds of private frontruns” — the centralization half of the thesis made concrete at the attacker layer. On the public mempool extraction is at least crowded and competitive; on the private path one operator dominates. The agent that routed privately to escape an anonymous crowd of bots routed its flow into a channel where one actor runs most of the frontrunning. Fewer adversaries is not safer when the few are more entrenched.
This is not slowing. Sandwiched and Silent measures the private share climbing from “31.8% in November 2024 to 35.5% in December, 34.8% in January, and 50.1% in February 2025.” Order flow is genuinely crossing the half-way line into private channels. The centralization the next section describes is not a warning about where things might go — it is where the majority of flow already is, and where an agent following standard advice sends its transactions.
Routing privately means routing to a block builder, and the structure of that market is where the centralization cost lands. Private Order Flows and Builder Bidding Dynamics: The Road to Monopoly in Ethereum’s Block Building Market (arXiv 2410.12352) finds that private order flows, “despite constituting only 12% of the total amount of transactions, significantly contribute to 54.59% of block rewards.” Private order flow is the prize, not a side channel — a small slice of transactions drives the majority of block value, which is exactly why builders fight to be the destination an agent’s private flow lands on.
That fight has a self-reinforcing winner. The same paper finds that “builders with more private order flows… are more likely to win the block, while retain larger proportion of profits. In return, such builders will further attract more private order flows, resulting in a monopolistic market gradually.” Access to private flow wins blocks, winning blocks attracts more private flow, the loop tightens — and every agent that opts out of the public mempool feeds it, its flow a unit of the resource deciding who wins. The market is already concentrated: “the top 3 builders submit bids 26.87% lower than the other builders, while their total winning rate exceeds 95%,” and “the top three builders have more than 70% of the market share.” The few intermediaries an agent’s private transaction must trust already win almost every auction.
Independent game-theoretic work reaches the same destination from first principles. From Competition to Centralization: The Oligopoly in Ethereum Block Building Auctions (arXiv 2412.18074) finds that “a small set of dominant builders leverage these advantages, consolidating power, reducing auction efficiency, and heightening centralization.” The advantages are precise — “advantages in latency and MEV access shape builder strategic bidding and auction outcomes” — and MEV access is exactly what an agent hands a builder when it routes privately to dodge a sandwich. The agent’s defensive move is the builder’s centralizing fuel.
The survey closes the loop at the delivery layer. Maximal Extractable Value Mitigation Approaches notes that “there are a few relay providers that handle 90% of the block production on Ethereum PoS,” and that “relays pose a centralization risk, as they have the potential for malicious actions such as censoring blocks or engaging in front-running activities.” So the full shape of the trade is visible: to stop an anonymous bot from reading its intent in the public mempool, the agent routes through a private RPC that auctions its flow to a builder market that is an oligopoly, delivered by relays that handle 90% of blocks and could themselves front-run. Execution-quality leakage was traded for trust concentrated in a few intermediaries — the same value-extraction problem wearing a different hat.
The thesis is about L1 public mempools and cross-chain intent leakage, and it would be dishonest to stretch it over every architecture that has a mempool. There is at least one where the sandwich largely does not survive, and naming it sharpens the claim. How to Serve Your Sandwich? MEV Attacks in Private L2 Mempools (arXiv 2601.19570) studies sandwiching on Ethereum rollups with private mempools and concludes that “sandwiching, while endemic and profitable on Ethereum L1, is rare, unprofitable, and largely absent in rollups with private mempools.” On those L2s the attack does not pay; the paper even finds naive heuristics overstate it, and that for the patterns they flag “the median net return for these attacks is negative.”
The reason is mechanistic and tells you exactly where the L1 argument applies. On a private L2 sequencer mempool there is no builder market guaranteeing atomic co-inclusion of the front-run and back-run — so, in the paper’s words, “without guaranteed atomic inclusion, attackers must rely on sequencer ordering, redundant submissions, and priority fee placement, which renders sandwiching probabilistic rather than deterministic.” Sandwiching needs both legs landed around the victim with certainty; remove the atomic-co-inclusion guarantee and the attack degrades from reliable extraction into a gamble that usually loses money.
This is the line the thesis must respect. “Private routing does not close it” is a claim about L1 private order flow — transactions that still reach builders who can atomically co-include them — and about cross-chain intent leakage, where the bridge message exposes the trade before the destination mempool. It is not a claim that every private mempool everywhere is exploitable; a private L2 sequencer mempool is a different architecture, and on it the sandwich is mostly defused. Read this as routing guidance, not an escape: the ordering tax bites hardest on L1 execution and cross-chain hops, and the architecture that blunts it is the one that gives up atomic builder-side co-inclusion. Knowing which an agent actually traverses is the difference between paying the tax and avoiding it.
The point is not “do not let the agent transact on-chain” — it is to treat ordering as a first-class cost of doing so, the way the x402 economy treats per-call payment as a first-class cost of consuming APIs. Four decisions follow.
Treat the ordering tax as a budgeted line item, not an anomaly. If the agent swaps and bridges in normal operation, model a percentage of throughput lost to reordering and size slippage tolerances and spend ceilings against it. Extraction at a stable fraction of volume is a number to plan around, not to hope is a fluke.
Do not treat “route privately” as a solved checkbox. It is a choice of intermediary, and the intermediaries differ: the flow is auctioned, the same sandwich runs privately at scale, and the channel concentrates around a few actors. “We send it privately” describes a trade, not a security posture.
Know which paths actually carry ordering risk. L1 execution and cross-chain hops are where the tax bites and where standard defenses fail; a private L2 sequencer mempool is where the sandwich is mostly defused. The decision is not “public versus private” in the abstract but which concrete chains and channels the agent traverses, judged against where co-inclusion is guaranteed.
Accept that the centralization cost is paid even when nothing is overtly stolen. Every privately routed transaction is a unit of the order flow driving the builder market toward monopoly — an externality built one routing decision at a time, not someone else’s to absorb.
An honest agent that pays or swaps on-chain broadcasts a public, reorderable intent every time, and at agent frequency the value skimmed by whoever orders that transaction is a continuous tax, not a tail event. The reflex fix — route privately, off the public mempool — does not close the seam: private order flow is sandwiched too, by a more concentrated set of actors, and it feeds a block-building market that is already an oligopoly. The agent did nothing wrong and still paid — first in execution quality, then in the centralization it bought trying to protect that quality. Treat transaction ordering as what it is, a cost of acting on-chain the honest agent cannot sign its way out of, and price it before the first broadcast, not after.
A membership-inference attack that separates your book from a held-out one is usually reading the calendar, not the weights. A successful attack is not a sound proof — and the null it would need to test against cannot be sampled.
17 min →
Unlearning promises a model can forget specific data without a full retrain. What it delivers is output suppression: a small benign relearning set — or simply quantizing the model — brings the 'forgotten' knowledge back.
14 min →
The EU AI Act requires AI output to be marked in a robust, reliable way. A formal impossibility theorem says strong watermarking cannot exist. Five words in the statute carry the collision.
13 min →