envname-P envname#1

#  ethp2psim: Evaluating and deploying privacy-enhanced peer-to-peer routing
protocols for the Ethereum network

Ferenc Béres  István András Seres  Domokos M. Kelen  András A. Benczúr

###### Abstract

Network-level privacy is the Achilles heel of financial privacy in
cryptocurrencies. Financial privacy amounts to achieving and maintaining
blockchain- and network-level privacy. Blockchain-level privacy recently
received substantial attention. Specifically, several privacy-enhancing
technologies were proposed and deployed to enhance blockchain-level privacy.
On the other hand, network-level privacy, i.e., privacy on the peer-to-peer
layer, has seen far less attention and development.

In this work, we aim to provide a peer-to-peer network simulator, ethp2psim,
that allows researchers to evaluate the privacy guarantees of privacy-enhanced
broadcast and message routing algorithms. Our goal is two-fold. First, we want
to enable researchers to implement their proposed protocols in our modular
simulator framework. Second, our simulator allows researchers to evaluate the
privacy guarantees of privacy-enhanced routing algorithms. Finally, ethp2psim
can help choose the right protocol parameters for efficient, robust, and
private deployment.

##  1 Introduction

Ethereum is the most popular public blockchain according to the number of
issued transactions. Ethereum’s public ledger is completely transparent: every
account’s balance and transaction history is visible to everyone. In numerous
applications, this level of transparency is undesirable. There are numerous
privacy-enhancing technologies described in the literature: mixers [13, 15,
18], stealth addresses [20], and confidential transactions [5, 22]. Some of
these protocols have already been deployed and are continuously serving the
Ethereum community by enhancing their privacy on the blockchain [2, 21].

However, blockchain privacy alone is not enough to achieve financial privacy.
Users should be able to broadcast transactions in a privacy-preserving manner.
Specifically, no adversary should be able to link cryptocurrency addresses to
their actual users’ unique identifiers, e.g., IP addresses, by logging
network-level communication between Ethereum full nodes. This problem is even
more pronounced in proof-of-stake Ethereum, where consensus participants must
regularly broadcast privacy-critical messages such as blocks and attestations.
Previous work has already shown various attacks on privacy that exploited
peer-to-peer (P2P) information [3, 8, 12]. To enhance the privacy of
cryptocurrency users, several privacy-enhanced broadcast and routing
algorithms were proposed [4, 7, 14].

In this work, we provide the following contributions.

  * •

We develop an open-source simulator, ethp2psim, that allows anyone to
implement and evaluate various privacy-enhanced broadcast and message routing
algorithms.

  * •

Using our simulator, we evaluate the privacy guarantees of existing privacy-
enhanced message routing algorithms on the Ethereum P2P layer.

  * •

We identify several trade-offs between privacy, robustness, and efficiency.
The quantification of these trade-offs can inform the deployment of these
protocols.

The rest of this paper is organized as follows. In Section 2, we present the
related work on privacy on the P2P layer of cryptocurrencies. In Section 3, we
introduce the pertinent background knowledge on privacy-enhanced message
routing algorithms. Section 4 describes our system and threat model of
Ethereum’s P2P layer. We introduce ethp2psim in Section 6 and evaluate state-
of-the-art routing protocols in Section 7. Finally, we conclude our work in
Section 8.

##  2 Related work

###  2.1 Privacy-enhanced transaction broadcasting

Dandelion [4] and Dandelion++ [7] are the two most important related works. In
Dandelion(++), users (nodes in the P2P graph) do not directly broadcast their
transactions. Rather, each user flips a biased coin, and with probability $p$,
they broadcast their transaction, while with probability $1-p$, they forward
their message to a single randomly selected neighbor. Dandelion(++) offers a
privacy-enhanced routing algorithm with minimal implementation complexity.
Specifically, Dandelion is implemented and deployed on the Monero network. In
our work, we also adapted ideas from the mixnet literature, specifically onion
routing [16], and applied it in the context of PoS Ethereum.

###  2.2 Evaluating privacy-enhanced routing protocols

Serena et al. observed that privacy-preserving routing algorithms incur larger
delays and less robustness on message delivery [17]. Sharma et al. evaluated
the anonymity guarantees of several anonymity schemes used by cryptocurrencies
(e.g., Dandelion and Dandelion++) and found they provide little to no
anonymity guarantees [19]. In their work, they also build a simulator to
evaluate previous routing protocols. However, their simulator is not modular
and does not consider numerous Ethereum-specific subtleties that severely
change the anonymity analysis.

##  3 Preliminaries

In this section, we present the pertinent background knowledge on Ethereum’s
P2P protocol.

###  3.1 Participants

We assume that the following participants run full nodes in the Ethereum P2P
network. These participants can be cast into two main categories: validators
(i.e., attestors, aggregators, block proposers) and regular users. The main
difference is that regular users do not participate in the consensus
algorithm. Hence, they only broadcast regular transactions and not consensus-
critical messages. For each type of participant, our goal is to devise a
protocol that allows no adversary to link the message (e.g., attestation,
block, or transaction) to its originator.

#### Attestors.

Every validator must broadcast an attestation in each epoch once in a specific
slot.

#### Aggregators.

Designated attestors collect several attestations, i.e., BLS signatures, and
batch them. Afterward, they forward the batched signatures to their neighbors

#### Block proposers.

Validators are selected to propose new blocks according to their stake amount.
Since the stake distribution is public information, we cannot hope to achieve
a larger degree of anonymity than the Shannon entropy of the stake
distribution.

#### Users.

Users occasionally broadcast transactions. They are not necessarily
validators.

###  3.2 The topology of the Ethereum P2P network

Ethereum’s P2P network is a dynamically changing graph. It is a permissionless
network, i.e., nodes can join or leave it whenever they want. Therefore,
obtaining a precise description of the Ethereum P2P graph at any given time is
nearly impossible. Our simulations rely on this dynamically evolving graph’s
publicly available static measurements (i.e., snapshots).

In its simplest form, one might assume that the Ethereum P2P graph is a random
regular graph since the default Ethereum client randomly selects a fixed
number of peers to connect with. However, the real graph might look different
as users can modify their client software’s P2P settings. We model Ethereum’s
P2P graph as a weighted, directed graph, where weights on the edges denote the
pairwise latencies on that particular connection. Gencer et al. [9] measured
the peer-to-peer latency of Ethereum peers. They found that Ethereum’s P2P
latencies follow a distribution with a $171ms$ average and a standard
deviation of $76ms$. The Ethereum P2P graph is measured and described by
Cortes and Bautista [6]. They found that the Ethereum2 P2P graph is a heavily
centralized network that exhibits a spoke-hub distribution. We also obtained a
snapshot of the Goerli testnet, which we believe is sufficiently similar to
the mainnet P2P topology. In our simulations, we used the aforementioned
results of these measurement studies to approximately model Ethereum’s P2P
network.

##  4 Modelling Ethereum’s P2P layer

###  4.1 Threat Model

We assume an active local adversary, i.e., an adversary can only observe
communication that passes through them. It is well-known that one can only
have anonymous communication against active global adversary if mixnets are
employed. In the case of Ethereum, the applicability of mixnets is
questionable as they incur considerable latencies that are detrimental to
achieving consensus. Therefore, we do not consider the global active adversary
model.

###  4.2 Anonymity Goals

We want to achieve the following anonymity goals by applying privacy-enhanced
message routing protocols.

#### Unlinkability

Our main goal is that the adversary should not be able to link on-chain (e.g.,
Ethereum addresses) and off-chain (e.g., IP addresses) identities. A stronger
anonymity notion would be sender unlinkability, i.e., the adversary should not
be able to tell whether two messages were sent by the same user or not.
Currently, there is no message routing protocol that would achieve this
stronger notion of privacy.

#### Robustness

A privacy-enhanced message routing protocol must be robust. In particular,
messages must reach the vast majority of the network even if a considerable
fraction of the network is adversarial, and timeliness should not be impacted
by possible network issues in a small number of nodes.

#### Latency

Ethereum’s PoS consensus protocol demands low latency of every participant.
Participants with high network latency might miss rewards or worse may be
punished by not broadcasting certain messages, i.e., inactivity leak.

#### Long-term feasibility

Any privacy-enhancing technique should be studied by considering its
properties on long time scales, as participants might use the same off- and
on-chain identities for years.

#### Spam prevention

When messages are forwarded in plain text, it is relatively easy to filter out
spam messages. However, if we want to move towards routing protocols that
forward encrypted messages, then it is more challenging to fend off spam
messages. Even in the latter case, we want to prevent spam messages from being
forwarded on the P2P layer.

#### Ease of implementation

Ideally, we want to apply a message routing protocol that is easy to implement
and deploy, as implementation complexity inherently implies an increased
attack surface.

##  5 P2P privacy solutions

###  5.1 Dandelion and Dandelion++

Dandelion [4] and Dandelion++ [7] are the primary hop-by-hop routing algorithm
to enhance privacy on the P2P level. In a nutshell, in both protocols,
messages can be in two phases: stemming (or sometimes anonymity) and spreading
(sometimes broadcast) phase. In the stemming phase, nodes flip a biased coin
and decide whether to forward the message to a random neighbor, i.e., continue
with the stem phase or broadcast the message. Dandelion is implemented and
deployed by the Monero cryptocurrency. Recently, Sharma et al. [19] showed
that these protocols provide little to no anonymity guarantees in most
realistic scenarios.

Even worse, for both of these protocols, there also exists an Ethereum-
specific timing side-channels attack. In this attack, an adversary might be
able to infer its position in the anonymity phase of a given message in the
knowledge of slot starting times. This valuable information can lead to a loss
of anonymity in these protocols.

###  5.2 Onion routing

Our solution to Ethereum P2P network-level privacy is an onion routing based
message protocol that we detail in a separate document [11]. Here we remark
that a crucial difference between hop-by-hop routing and onion routing is that
in onion routing, all messages are encrypted during the anonymity phase, while
they are plain-text during the broadcast phase. The advantage of this approach
is that the adversary cannot know whether two cyphertexts belong to the same
message. However, major challenges are robustness, latency, and spam
protection.

An onion routing inspired P2P privacy protocol for Ethereum can take two
paths. First, it would either use the public Tor network [10] or implement and
deploy an integrated Tor-like overlay network on top of the currently existing
Ethereum P2P graph. There are pros and cons. We summarize theoretical
anonymity guarantees and implementation challenges in more depth in a separate
document [11].

##  6 ethp2psim: a peer-to-peer network simulator for Ethereum

In this section, we describe in detail our ethp2psim simulator. The simulator
is open-source and available at https://github.com/ferencberes/ethp2psim. This
simulator aims to enable researchers to implement privacy-enhanced message
routing protocols and evaluate their anonymity guarantees in the context of
PoS Ethereum.

Our simulator is written in Python and follows object-oriented design
patterns. The simulator consists of the following main classes that are also
described in the related
documentation111https://ethp2psim.readthedocs.io/en/latest/?badge=latest.

###  6.1 Network

This class defines the P2P network in which users can evaluate their
protocols. The default P2P graph is regular (see Listing 2). However, the
simulator can work with user-defined P2P graphs as well. Currently, we use a
P2P graph obtained from the Goerli testnet as shown in Listing 1.

⬇

from ethp2psim.network import *

nw_gen = NodeWeightGenerator(’stake’)

ew_gen = EdgeWeightGenerator(’normal’)

goerli = GoerliTestnet()

net = Network(nw_gen, ew_gen, graph=goerli.graph)

Initialize a P2P network based on Goerli testnet data. Channel latencies (edge
weights) are sampled from a normal distribution, while node weights are
proportional to the distribution of staked Ether values.

###  6.2 Message

This class describes the messages that are forwarded and broadcast between P2P
participants. We think of messages as attestations, blocks, or transactions.
We abstract away the metadata of messages, e.g., message type or size.

###  6.3 Protocol

This class defines and implements the various message-spreading protocols we
want to evaluate. Currently, we implemented and considered a simple broadcast
to all algorithms, Dandelion [4], Dandelion++ [7], and a variant of our Onion
routing based algorithm [11].

Since our simulator is highly modular (see Listing 2), we hope to receive
contributions from the community to evaluate novel message-spreading
algorithms.

⬇

from ethp2psim.network import *

from ethp2psim.protocols import BroadcastProtocol

from ethp2psim.adversary import Adversary

nw_gen = NodeWeightGenerator(’stake’)

ew_gen = EdgeWeightGenerator(’normal’)

# random 3 regular graph with 10 nodes

net = Network(nw_gen, ew_gen, 10, 3)

protocol = BroadcastProtocol(net, broadcast_mode=’all’)

# adversary controls a random 10adversary = Adversary(protocol, 0.1)

# message originating from node 0

msg = Message(0)

msg.process(adversary)

# message was sent to 3 neighbors of node 0

print(len(msg.queue))

# output: 3

First, we initialize a random regular P2P network along with a broadcast to
all neighbor protocol and the related adversary. Next, we create a message
originating from node $0$, and we start to propagate it on the P2P network by
calling the _msg.process_ function.

###  6.4 Adversary

This class contains the implementation of various adversarial strategies
aiming to reduce anonymity guarantees provided by the implemented routing
protocols. At the time of writing, we have implemented several general- and
protocol-specific adversarial strategies.

Regarding the positioning of the corrupted nodes, the adversary might corrupt
nodes randomly in the P2P graph or selectively target central nodes (e.g.,
nodes with a high degree or Betweenness) as seen in Listing 3. Therefore, we
can evaluate which faults cause more significant anonymity losses.

⬇

from ethp2psim.network import *

from ethp2psim.protocols import BroadcastProtocol

from ethp2psim.adversary import Adversary

seed = 42

# Generate a random Barabási-Albert graph with 20 nodes

G = nx.barabasi_albert_graph(20, 3, seed=seed)

nw_gen = NodeWeightGenerator(’stake’)

ew_gen = EdgeWeightGenerator(’normal’)

# use the Barabási-Albert graph as a P2P network

net = Network(nw_gen, ew_gen, graph=G, seed=seed)

protocol = BroadcastProtocol(net, broadcast_mode=’all’, seed=seed)

# select 4 highest degree nodes to be adversaries

adv_nodes = net.get_central_nodes(4, ’degree’)

# initialize adversary

adversary = Adversary(protocol, adversaries=adv_nodes, seed=seed)

print(adversary.nodes)

# output: [5, 0, 4, 6]

Four nodes with the highest degree are set to be adversarial nodes from a
random Barabási-Albert
graph333https://networkx.org/documentation/stable/reference/generated/networkx.generators.random_graphs.barabasi_albert_graph.html.
Note that by setting the random seed, you can get reproducible results.

###  6.5 Simulator & Evaluator

The simulator class defines the experiments we wish to run on a specific P2P
graph topology with a particular routing algorithm against a specific
adversarial strategy. After simulating multiple messages, we can use the
Evaluator to calculate the deanonymization power of the adversary with respect
to various performance metrics:

  * •

hit ratio: The fraction of messages where the adversary correctly identified
the originator.

  * •

inverse rank: We take the average of $\frac{1}{r_{m}}$ values over the
messages where $r_{m}$ is the rank of the originator for a given message $m$
in the adversary’s ordered list of possible candidates for the originator of
$m$.

  * •

entropy: the average of Shannon entropies over all messages.

  * •

NDCG: the average normalized discounted cumulative gain [1] over all messages.
Basically, we take the average of $\frac{1}{log_{2}(1+r_{m})}$ as only the
originator is considered to be the single relevant hit among the candidates.

The generated report includes the average ratio (message_spread_ratio) of
nodes reached by messages in the P2P network.

⬇

from ethp2psim.network import *

from ethp2psim.protocols import DandelionProtocol

from ethp2psim.adversary import DandelionAdversary

from ethp2psim.simulator import Simulator, Evaluator

seed = 42

# Sample staked ether amounts as node weights

nw_gen = NodeWeightGenerator(’stake’)

# Sample channel latencies from a normal distribution

ew_gen = EdgeWeightGenerator(’normal’)

net = Network(nw_gen, ew_gen, num_nodes=100, k=20, seed=seed)

# A message is broadcasted with a 40protocol = DandelionProtocol(net, 0.4,
broadcast_mode=”sqrt”, seed=seed)

# Adversary controls 10adversary = DandelionAdversary(protocol, 0.1,
active=False, seed=seed)

# 20 random messages are simulated where originators are selected with respect
to their stakes

simulator = Simulator(adversary, num_msg=20, use_node_weights=True,
verbose=False, seed=seed)

simulator.run()

# The first sent heuristic is used to determine the first broadcaster for each
message

evaluator = Evaluator(simulator, estimator=’first_sent’)

print(evaluator.get_report())

# output: {’estimator’: ’first_sent’, ’hit_ratio’: 0.2, ’inverse_rank’: 0.35,

# ’entropy’: 2.05, ’ndcg’: 0.48, ’message_spread_ratio’: 1.0}

Evaluating the efficacy of an adversary controling 10% of P2P network nodes
against Dandelion. The main goal of the adversary is to determine the
originator node for each $20$ simulated message.

##  7 Evaluation

In this section, we evaluate the privacy guarantees of various network
anonymity protocols. Furthermore, we analyze the effect of different network
topologies and active adversaries on privacy and robustness. We detail the
following four experimental measurements.

###  7.1 Deanonymization performance

First, let’s start with a simple experiment where we compare the
deanonymization power of the adversary when it uses the first-reach or the
first-sent heuristics to determine the originator for each message. These
estimator strategies are used to guess the first node that broadcasted a given
message based on the observations of all adversarial nodes. In short, an
adversary using the first-reach heuristic predicts a node to be the first
broadcaster if it is the first node that it heard the message from. On the
other hand, using the channel latency information of adjacent channels, a
first-sent estimator tries to identify the neighbor that first sent the
message to any of the adversarial nodes. Naturally, the two predictions might
not coincide as the triangle inequality does not necessarily hold for P2P
network latency.

Figure 5: Evaluation of the first sent and first reach estimators for three
performance metrics (i.e., hit ratio, inverse rank, NDCG) with respect to
multiple protocols (colors) and adversary ratios (x-axis).

In this experiment, we use a random $50$ regular graph with 1000 nodes to
compare the two heuristics against multiple protocols. Not surprisingly, our
results in Figure 5 show that the adversary with the first-sent estimator
performs significantly better. However, we highlight that only the hit ratio,
inverse rank, and normalized discounted cumulative gain [1] (NDCG) can reflect
this behavior where ground truth information about message sources is compiled
into the evaluation.

Figure 6: The Shannon entropy of the first sent and first reach estimators for
various message spreading algorithms.

Unfortunately, entropy does not depend on the ground truth. It only measures
the uncertainty of the predicted distribution but not its closeness to the
ground truth. Nevertheless, the entropy for Dandelion++ is higher than for
Dandelion in Figure 6. The prediction entropy for broadcast to all and our
onion routing based protocol is zero as the predicted distribution only
contains the most likely candidate. A possible future work could include
additional less-likely candidates as well in the prediction distribution, this
way better reflecting the knowledge of the adversary.

In Figure 5, it is interesting to see how Dandelion can confuse the adversary
compared to simple broadcasting in terms of hit ratio (e.g., first-sent
performance drops from $0.5$ to $0.3$ in case of $10\%$ adversarial nodes)
which might indicate that it is overly restrictive, as it doesn’t contain
information about much of the predicted distribution. Instead, _our
recommendation is to use inverse rank or NDCG for evaluation_. These metrics
can better reflect that despite the higher uncertainty introduced by
Dandelion(++), the adversary can still make a good educated guess in the
knowledge of the current anonymity graph (i.e., line-graph for Dandelion). For
example, in Figure 5, it is quite shocking to see the change in inverse rank
from $0.5$ to $0.4$, which means that on average Dandelion improves only half
a rank for the predicted message source, in the case of $10\%$ adversarial
nodes.

###  7.2 Different network topologies

In Figure 7, we observe how different graph topologies, such as a random
regular graph and a scale-free graph (Goerli testnet’s topology), affect the
adversary’s deanonymization power measured by various different metrics (e.g.,
hit ratio, inverse rank, NDCG). The deanonymization performance is displayed
with respect to the ratio of adversarial nodes (see the x-axis) in the P2P
network.

Figure 7: The effect of different network topologies on the adversaries’
deanonymization power.

Here, we make four main observations related to privacy:

  * •

The achieved privacy is quite brittle in the case of $0.2$ adversary ratio:
$0.5$ $\mathit{inverse\\_rank}$ for Dandelion with 0.5 broadcast probability
means that the adversary outputs a vector of candidates and on average, the
true originator is put to the 2nd place.

  * •

Dandelion(++) with the least broadcasting probability ($p=0.125$) provides the
highest privacy among the considered Dandelion(++)-style protocols.

  * •

The results are promising for our onion routing based protocol where the
efficiency of the adversary is less affected by the ratio of adversarial nodes
in the P2P network.

  * •

In general, the Goerli testnet exhibits more privacy across all metrics.

###  7.3 Broadcast settings

Next, in Figure 8, observe the significant change in the results when a
message is propagated to all neighbors instead of a random square root of them
(as we did it in former experiments) during the broadcast phase. It is quite
shocking that an adversary controlling $10\%$ of all nodes can be almost sure
about the identity of the message source in the case of a simple broadcast
protocol. Clearly, Dandelion(++) can significantly decrease the
deanonymization performance of the adversary, but it has a high price in terms
of robustness, detailed in the next section.

Figure 8: The effect of different broadcast settings on the adversaries’
deanonymization power measured in inverse rank.

###  7.4 Robustness against active and passive adversaries

In our next experiment, we consider two types of adversaries. A passive
adversary that follows the protocol and only logs the timestamp information
when its nodes encounter messages. We also implemented an active adversary
that does not forward messages at all. In Figure 9, we show that this is
especially problematic for Dandelion(++). Imagine that an active adversary
sits in the stem (anonymity) phase of Dandelion(++). Basically, if a message
encounters an adversarial node on the line graph, then it will never be
broadcasted. The more and more adversaries censor messages, the larger the
portion of messages that are not heard by nodes in the P2P network. This is
even more concerning when the high-degree nodes are compromised (e.g.,
$\mathit{adversary\\_centrality}$=’degree’). Note that the random regular
graph is more robust against (active) adversaries than the Goerli testnet.

Figure 9: Messages reach fewer nodes if central nodes actively block them.

In Figure 10, once again, we see the low levels of privacy (measured in
inverse rank in this figure) provided by various privacy-enhanced routing
algorithms. It is easy to see that in our setting, active and passive
adversaries have the same power to deanonymize messages. Deanonymization
results are slightly better for the Goerli testnet’s topology, i.e., the
adversary is less powerful on a scale-free graph. In our experiments, the
random regular graph has a higher edge density. Hence, the adversary can make
a more informed guess about the originator of the messages.

Figure 10: Active and passive adversaries have the same power to deanonymize
messages. Deanonymization results are slightly better for the Goerli testnet’s
topology.

##  8 Conclusion

In this work, we developed ethp2psim a network privacy simulator of Ethereum’s
P2P layer that allows the development, testing, and evaluation of privacy-
enhanced message routing algorithms such as Dandelion(++), onion routing, or
any custom-specified algorithm. We considered several existing privacy-
preserving routing algorithms and evaluated their privacy guarantees using
this simulator.

Our simulator is open source and open to contributions. It can be enhanced in
several ways.

  * •

Due to the modular nature of ethp2psim, one might add new privacy-preserving
algorithms and novel adversarial strategies to our package.

  * •

We considered several notions of privacy such as Shannon entropy, the ratio of
deanonymized messages (hit_ratio), inverse rank, and NDCG. One might also add
other measures to evaluate the privacy and anonymity guarantees of P2P message
routing algorithms.

  * •

Several parameters and protocol internals of Ethereum’s proof-of-stake
consensus algorithm is simplified. One can refine the simulation by
incorporating a more fine-grained implementation of Proof-of-Stake Ethereum’s
protocol internals, such as network latencies and graph topologies.

We invite the Ethereum community to propose, implement, and evaluate the
robustness and privacy guarantees of novel privacy-preserving routing
algorithms using ethp2psim.

#### Acknowledgements

The development of this simulator and our research were funded by the Ethereum
Foundation’s Academic Grant Rounds 2022.

## References

  * [1] Azzah Al-Maskari, Mark Sanderson, and Paul Clough.  The relationship between ir effectiveness measures and user satisfaction.  In Proceedings of the 30th annual international ACM SIGIR conference on Research and development in information retrieval, pages 773–774. ACM, 2007.
  * [2] Ferenc Béres, István A Seres, András A Benczúr, and Mikerah Quintyne-Collins.  Blockchain is watching you: Profiling and deanonymizing ethereum users.  In 2021 IEEE International Conference on Decentralized Applications and Infrastructures (DAPPS), pages 69–78. IEEE, 2021.
  * [3] Alex Biryukov, Dmitry Khovratovich, and Ivan Pustogarov.  Deanonymisation of clients in bitcoin p2p network.  In Proceedings of the 2014 ACM SIGSAC conference on computer and communications security, pages 15–29, 2014.
  * [4] Shaileshh Bojja Venkatakrishnan, Giulia Fanti, and Pramod Viswanath.  Dandelion: Redesigning the bitcoin network for anonymity.  Proceedings of the ACM on Measurement and Analysis of Computing Systems, 1(1):1–34, 2017.
  * [5] Benedikt Bünz, Shashank Agrawal, Mahdi Zamani, and Dan Boneh.  Zether: Towards privacy in a smart contract world.  In Financial Cryptography and Data Security: 24th International Conference, FC 2020, Kota Kinabalu, Malaysia, February 10–14, 2020 Revised Selected Papers, pages 423–443. Springer, 2020.
  * [6] Mikel Cortes-Goicoechea and Leonardo Bautista-Gomez.  Discovering the ethereum2 p2p network.  In 2021 Third International Conference on Blockchain Computing and Applications (BCCA), pages 81–88. IEEE, 2021.
  * [7] Giulia Fanti, Shaileshh Bojja Venkatakrishnan, Surya Bakshi, Bradley Denby, Shruti Bhargava, Andrew Miller, and Pramod Viswanath.  Dandelion++ lightweight cryptocurrency networking with formal anonymity guarantees.  Proceedings of the ACM on Measurement and Analysis of Computing Systems, 2(2):1–35, 2018.
  * [8] Giulia Fanti and Pramod Viswanath.  Anonymity properties of the bitcoin p2p network.  arXiv preprint arXiv:1703.08761, 2017.
  * [9] Adem Efe Gencer, Soumya Basu, Ittay Eyal, Robbert van Renesse, and Emin Gün Sirer.  Decentralization in bitcoin and ethereum networks.  In International Conference on Financial Cryptography and Data Security, pages 439–457. Springer, 2018.
  * [10] kaiserd.  A tor-based validator anonymity approach (incl. comparison to dandelion), Nov 2022.
  * [11] Domokos M Kelen, Ferenc Béres, István A Seres, and András A Benczúr.  Integrated onion routing for peer-to-peer validator privacy in the ethereum network.  Available at https://info.ilab.sztaki.hu/ kdomokos/OnionRoutingP2PEthereumPrivacy.pdf.
  * [12] Philip Koshy, Diana Koshy, and Patrick McDaniel.  An analysis of anonymity in bitcoin using p2p network traffic.  In Financial Cryptography and Data Security: 18th International Conference, FC 2014, Christ Church, Barbados, March 3-7, 2014, Revised Selected Papers 18, pages 469–485. Springer, 2014.
  * [13] Sarah Meiklejohn and Rebekah Mercer.  Möbius: Trustless tumbling for transaction privacy.  Proceedings on Privacy Enhancing Technologies, 2018(2):105–121, 2018.
  * [14] David Mödinger, Henning Kopp, Frank Kargl, and Franz J Hauck.  Towards enhanced network privacy for blockchains.  In Proc. of the 38th IEEE Int. Conf. on Distributed Computing Systems (ICDCS), 2018.
  * [15] Alexey Pertsev, Roman Semenov, and Roman Storm.  Tornado cash privacy solution version 1.4.  2019\.
  * [16] Michael G Reed, Paul F Syverson, and David M Goldschlag.  Anonymous connections and onion routing.  IEEE Journal on Selected areas in Communications, 16(4):482–494, 1998.
  * [17] Luca Serena, Mirko Zichichi, Gabriele D’Angelo, and Stefano Ferretti.  Simulation of dissemination strategies on temporal networks.  In 2021 Annual Modeling and Simulation Conference (ANNSIM), pages 1–12. IEEE, 2021.
  * [18] István András Seres, Dániel A Nagy, Chris Buckland, and Péter Burcsi.  Mixeth: efficient, trustless coin mixing service for ethereum.  Cryptology ePrint Archive, 2019.
  * [19] Piyush Kumar Sharma, Devashish Gosain, and Claudia Diaz.  On the anonymity of peer-to-peer network anonymity schemes used by cryptocurrencies.  arXiv preprint arXiv:2201.11860, 2022.
  * [20] Peter Todd.  Stealth addresses.  Post on Bitcoin development mailing list, 2014.
  * [21] Zhipeng Wang, Stefanos Chaliasos, Kaihua Qin, Liyi Zhou, Lifeng Gao, Pascal Berrang, Ben Livshits, and Arthur Gervais.  On how zero-knowledge proof blockchain mixers improve, and worsen user privacy.  arXiv preprint arXiv:2201.09035, 2022.
  * [22] Zachary J Williamson.  The aztec protocol.  URL: https://github. com/AztecProtocol/AZTEC, 2018.


# High-field NMR study of the spin correlations in the spin-cluster mineral
Na2Cu3O(SO4)3

Long Ma1<EMAIL_ADDRESS>J. X. Li1 L. S. Ling1 Y. Y. Han1 L. Zhang1 L. Hu1
<EMAIL_ADDRESS>W. Tong1 C. Y. Xi1 Li Pi1,2 1Anhui Province Key Laboratory of
Condensed Matter Physics at Extreme Conditions, High Magnetic Field
Laboratory, Chinese Academy of Sciences, Hefei 230031, China
2 Hefei National Research Center for Physical Sciences at the Microscale,
University of Science and Technology of China, Hefei 230026, China

###### Abstract

We report NMR study on the spin correlations in the spin-cluster based mineral
Na2Cu3O(SO4)3 with magnetic fields ranged from 1 T to 33 T. The long-range
magnetic order is observed from both the sudden spectral broadening at $T_{N}$
and critical slowing down behavior in the temperature dependence of spin-
lattice relaxation rates ($1/T_{1}(T)$). The hump behavior of $1/T_{1}(T)$
persists to $\mu_{0}H=7.25$ T, above which a spin excitation gap is observed
from the thermally activated temperature dependence of $1/T_{1}$. The gap size
shows a linear field dependence, whose slope and intercept respectively yield
an effective magnetic moment of 2.54 $\mu_{B}$ and a 0.94 meV spin excitation
gap under zero magnetic field. These results indicate the existence of short-
range order and prominent easy-plane spin anisotropy, which are important for
understanding the spin excitation spectrum in A2Cu3O(SO4)3.

Novel quantum phenomena can be realized in either periodic arrays of spin-
clusters or lattices of magnetic ions. Recently, the minerals A2Cu3O(SO4)3
(A=K, Na or A2=KNa) attract many research interests in the field of quantum
magnetism after their discovery in the natural worldStarova et al. (1991);
Lander et al. (2017); Siidra et al. (2017). Every Six CuO4 plaquettes form one
Cu6-hexamer, which behaves as the cluster with effective spin $S=1$ at low
temperaturesFujihala et al. (2018). The strong intra-hexamer exchange strength
and eight lowest-lying states of the hexamer are unambiguously determined by
inelastic neutron scattering (INS)Furrer et al. (2018).

The magnetic interaction between Cu6-hexamers is studied from both
experimental and theoretical approachFujihala et al. (2018); Furrer et al.
(2021); Nekrasova et al. (2020). For all the three compounds, the magnetic
susceptibilities share a similar temperature dependenceNekrasova et al.
(2020). They first show Curie-Weiss-like upturn upon cooling, then drop at
lower temperatures, leading to a broad maxima around $T=6\sim 7$ K. The
magnetic ordering at $T_{N}=2.9\sim 4.7$ K is observed in the temperature
dependence of specific heat or magnetic susceptibilityNekrasova et al. (2020).
Below $T_{N}$, opening of the spin excitation gap is verified by INS
measurementsFujihala et al. (2018); Furrer et al. (2018). At $T=1.5$ K, the
excitation energy from the $S=1$ ground state ranges from 0.6 meV to 1.7 meV
for A= Na and KFurrer et al. (2018). This gapped excitation is first proposed
as a consequence of the cluster-based Haldane stateFujihala et al. (2018).
Contrastively, the _ab initio_ calculations demonstrate the two-dimensional
inter-hexamer interactions in the crystalline $bc$-planeNekrasova et al.
(2020). The spin gap is attributed to the magnetic anisotropy of the square
lattice, instead. The subsequent INS measurements support the two-dimensional
characteristic of the magnetic interactionsFurrer et al. (2021),while no
direct evidence for the magnetic anisotropy is reported up to now.

Studying how the spin system responds to applied magnetic fields is a useful
way to explore the magnetic interactions in quantum magnets. For the present
A2Cu3O(SO4)3 compound, previous INS studies were performed under a zero
magnetic fieldFujihala et al. (2018); Furrer et al. (2018, 2021), thus the
field dependence of the spin excitations is still lacked although highly
demanded. As a local probe sensitive to low-energy spin excitations, nuclear
magnetic resonance (NMR) is very suitable for tracking the evolution of spin
excitations under magnetic fields.

In this article, we employ NMR to study the spin excitation evolution in
Na2Cu3O(SO4)3 with applied magnetic fields up to 33 T. The magnetic ordering
is monitored by the sudden spectral broadening across $T_{N}$ at the low field
side, also the critical slowing down behavior near $T_{N}$ from the
temperature dependence of spin-lattice relaxation rates(SLRRs). For
$H_{c}<\mu_{0}H\leq 7.25$ T ($H_{c}$ is the critical field where the moments
are partially polarized), the $\lambda$-peak centered at $T_{N}$ gradually
evolves into the hump-like behavior in $1/T_{1}(T)$, indicating suppression of
the critical fluctuations by the applied magnetic field. For higher field
intensities, the gapped spin excitation dominates the low temperature SLRRs as
indicated by the thermally activated behavior. The gap size shows a linear
field dependence up to the present 33 T with a negative intercept. Based on
the two-dimensional spin coupling model, this indicates prominent single ion
anisotropy with a positive value, demonstrating the easy-plane anisotropy of
the spin system.

The polycrystalline sample of Na2Cu3O(SO4)3 was synthesized by a solid-state
reaction method as described elsewhereFujihala et al. (2018). Our NMR
measurements were conducted on 23Na nuclei ($\gamma_{n}=11.262$ MHz/T,
$I=3/2$) with a phase-coherent NMR spectrometer. The magnetic field below 16 T
was generated by a superconducting magnet with high homogeneity, and a water-
cooled resistive magnet was used for higher magnetic fields. The spectrum was
obtained by integrating or summing up the spectral weight by sweeping the
frequency or field with the other fixed. The SLRR ($1/T_{1}$) was measured
with the inversion-recovery sequence, and calculated by fitting the time
dependence of the nuclear magnetization ($M(t)$) to
$M(t)/M(\infty)=1-0.1\exp[-(t/T_{1})^{\beta}]-0.9\exp[-(6t/T_{1})^{\beta}]$.
The stretching exponent $\beta$ reflects the distribution of SLRR in the
sample.

Figure 1: (color online) (a) Schematic crystal structure of Na2Cu3O(SO4)3 as
seen against $a$-axis. The Na atoms are not shown for the clearance. (b) A
sketched description of the two dimensional magnetic coupling between the
spin-clusters carrying $S=1$.

The Na2Cu3O(SO4)3 adopts a monoclinic structure with the $C2/C$
structureFujihala et al. (2018). In Fig.1(a), we show the crystal structure
viewed against $a$-axis according to the atomic coordinatesNekrasova et al.
(2020). Cu6-hexamers are shown by the dark red polyhedra. The energy gap
between the triplet ground state and first excited singlet state is larger
than 12 meV by the recent INS resultsFurrer et al. (2018). As a result, the
low temperature magnetism can be treated as interacting spin clusters ($S=1$)
with high accuracy. By chelation with nonmagnetic oxyanions (SO4)2-, the
inter-hexamer interactions are about two order of magnitude weaker than the
intra-hexamer onesFurrer et al. (2021). We schematically show the two-
dimensional spin coupling between the nearest cluster neighbors in Fig.1(b) as
proposed by the calculations and INS measurementsNekrasova et al. (2020);
Furrer et al. (2021).

Figure 2: (color online) (a) Field-swept 23Na NMR spectra at different
temperatures with the resonance frequency $f_{0}$ fixed at 22.58 MHz. (b) 23Na
NMR spectra at $T=1.8$ K with different fixed frequencies $f_{0}$. The
corresponding resonance fields without line shift are 2 T, 4 T, 4.5 T, 5.6 T
and 7.25 T, respectively. (c) Typical 23Na NMR spectra under $\mu_{0}H=10$ T
at various temperatures. (d) Temperature dependence of Knight shifts under
different field intensities. Inset: A enlarged version of the Knight shifts at
$\mu_{0}T=2$ T.

In Fig.2(a) and (c), we show 23Na NMR spectra at different temperatures
respectively under $\mu_{0}H\sim 2$ T and $\mu_{0}H=10$ T. The former are
obtained by integrating the spectral intensity during sweeping field, while
the later are obtained by summing up the spectral weight with the frequency
swept. Each spectrum consists of a single central peak and a broad background.
At $T=10$ K, the full width at half maximum (FWHM) of the central peak is
$49.3$ Gauss ($\sim 52$ kHz) for $\mu_{0}H\approx 2$ T and 286 kHz for
$\mu_{0}H=10$ T, nearly proportional to the field intensity. However, the
spectral width of the background signal is $\sim 2$ MHz for both fields,
showing negligible field dependence. The nuclear quadrupole interaction with
non-zero local electric field gradient (EFG) results in the satellite peaks,
whose frequency distance from the central peak is very sensitive to the
applied field direction, while independent on the field intensity in the
strong field regimeAbragam (1961). The broad background signal is the
consequence of the random alignment between the field direction and the
principle axis of EFG, and the quadrupole frequency $\nu_{Q}$ is roughly
estimated to be $\sim 2$ MHzSM . The central peak line width is mainly
contributed by anisotropic and distributed Knight shift (relative line shift
with respect to the Larmor frequency).

The magnetic order under low magnetic fields can be detected by 23Na spectra.
With sample cooling down, the central peak shows a sudden broadening below
$T_{N}=3$ K, and further develops into a line shape with flattop at $T=1.8$ K
(See Fig.2(a)). This phenomenon indicates setup of the static internal field,
also the occurrence of magnetic orderingYamada and Sakata (1986). We further
show the NMR spectrum at $T=1.8$ K under different magnetic fields in
Fig.2(b). To get rid of the central peak broadening effect from anisotropic
Knight shifts, the field-swept spectra are shown with the field intensity
divided by the resonance field of the fixed frequency. With the field
increasing to 4 T, the flattop feature disappears, the sharp peak restores,
and the relative line width gets narrower. When the field goes higher, the
central peak becomes sharper and develops to be asymmetric. The evolution with
field intensity is caused by the magnetic moment alignment by applied field
and demonstrates a partially polarized state under moderate field intensities.
This is consistent with the weak kink observed from the field dependence of
magnetizationNekrasova et al. (2020). The asymmetric line shape in the
paramagnetic state is the typical powder pattern resulting from anisotropic
Knight shiftHiga et al. (2017). We calculate the Knight shift at the most
sharp part of the central line, and show its temperature dependence in
Fig.2(d). All the Knight shifts show an upturn behavior with temperature
decreasing. The Knight shifts under $\mu_{0}H=2$ T show a maximum at $T\sim 5$
K, consistent with the previous magnetic susceptibility measurementsNekrasova
et al. (2020).

Figure 3: (color online) The temperature dependence of the spin-lattice
relaxation rate $1/T_{1}$ for a wide magnetic field range. We use log-log plot
here to show the drastic temperature dependence of $1/T_{1}$ at low
temperatures more clearly. The gray straight line is the power law fitting to
the low temperature $1/T_{1}$ for $\mu_{0}H=5.6$ T and 7.25 T. The linear plot
of $1/T_{1}(T)$ at $\mu_{0}H=10$ T is shown in the inset to emphatically the
overall $1/T_{1}(T)$ at high temperatures.

Next, we begin to study the inter-hexamer magnetic interaction via the
evolution of low-energy spin excitations with applied magnetic fields. In
Fig.3, we show 23Na SLRR $1/T_{1}$ as a function of temperature with magnetic
fields ranging from 1 T to 33 T. The temperature dependence of the stretching
exponent $\beta$ and some typical fitting curves are shown in the supplemental
materialsSM . With the sample cooling down from $T=260$ K to 140 K, weak
temperature dependence is observed from $1/T_{1}(T)$, which is followed by an
upturn behavior below the crossover temperature $T^{*}\sim 120$ K (See Fig.3
inset). This crossover behavior is consistent with the slope change observed
from the magnetic susceptibility measurementsNekrasova et al. (2020), both of
which should result from frozen out of the excited singlet state of
Cu6-hexamer at low temperatures. With temperature far below $T^{*}$, the $S=1$
spin-cluster based description is very precise for the spin system in
Na2Cu3O(SO4)3.

Prominent field dependence is observed from the $1/T_{1}(T)$ in the low
temperature range. Under a $\mu_{0}H=1$ T or 2 T below the critical field
$H_{c}$Nekrasova et al. (2020), the $1/T_{1}$ shows rapid rise below $T=5$ K,
then further drops steeply below $T_{N}$, forming a sharp peak centered at
$T_{N}$. This behavior results from the critical slowing down of spin
fluctuations near the phase transitionMoriya (1962); Ziolo et al. (1988),
widely observed in various magnetic compounds. With the applied field
intensity exceeding $H_{c}$(e.g. $\mu_{0}H=4$ T), a hump behavior still exist
as a shadow of previous sharp peaks in the low temperature $1/T_{1}(T)$, which
survives to a higher field $\mu_{0}H=7.25$ T. This phenomenon reflects the
suppression of the critical spin fluctuations by applied magnetic field.

The low temperature $1/T_{1}$ at $\mu_{0}H=5.6$ T and 7.25 T precisely shows a
power-law temperature dependence as shown by the straight line in Fig.3. The
scattering of magnons off nuclear spins dominates the low temperature
$1/T_{1}$ in this magnetic insulator. For $T\gg\Delta$ where $\Delta$ is the
magnon gap, $1/T_{1}$ follows either a $1/T_{1}\propto T^{3}$ behavior due to
a two-magnon Raman process or a $1/T_{1}\propto T^{5}$ behavior due to a
three-magnon processBeeman and Pincus (1968). For $T\ll\Delta$, the $1/T_{1}$
will show a thermally activated behavior. The persistent power-law behavior of
$1/T_{1}(T)$ down to $T=1$ K suggests a very small magnon excitation gap,
which is consistent with the field dependence of the magnon gap as discussed
below. The power law index of 5.37 suggests that the nuclear relaxation is
dominated by three-magnon Raman process.

Figure 4: (color online) The spin excitation gap size (in K) as a function of
the applied magnetic field intensity. The solid straight line is a linear fit
to the data. Inset: The $1/T_{1}$ plotted as a function of the inverse
temperature $1/T$ on semilog coordinate. The red lines show the gapped
behavior shown by $1/T_{1}(T)$. The zero field spin gap size range given by
INS measurements is marked by the light blue bar at the left side.

Thermally activated temperature dependence of $1/T_{1}$ is observed after the
critical fluctuation is fully suppressed by applied magnetic fields. The
$1/T_{1}(T)$ can be well fitted by the gapped function
$1/T_{1}=A\exp(-\Delta/T)$, which is demonstrated by the dashed lines in
Fig.3. To show this gapped behavior more clearly, we replot the $1/T_{1}$
versus the reciprocal of temperature ($1/T$) in a log-linear scale (See Fig.4
inset). The slope of straight lines is directly proportional to the gap size
$\Delta$, whose field dependence is shown in Fig.4. The field dependence of
the gap size can be well reproduced by a simple linear function, which is
shown by the solid line. The slope and intercept are determined to be 1.71 K/T
and -10.86 K, respectively. The continuous linear dependence for $8.6$ T
$\leq\mu_{0}H\leq 33$ T indicates the $S=1$ spin-cluster description holds
true for the studied field range.

The field dependence of the spin excitation gap can be understood with the
Heisenberg spin model with single-ion anisotropy. The Hamiltonian can be
written as,

$\begin{split}H=D\sum_{i}(S_{i}^{z})^{2}+g\mu_{B}B\sum_{i}S_{i}^{z}+\\\
J\sum_{i,j}[S_{i}^{z}S_{j}^{z}+\frac{1}{2}(S_{i}^{+}S_{j}^{-}+S_{i}^{-}S_{j}^{+})].\end{split}$

The $D$ parameterizes the single-ion anisotropy, determining the easy-axis or
easy-plane spin orientation. The $J>0$ measures the antiferromagnetic exchange
coupling strength, which is treated as isotropic firstly for simplicity. The
second term describes the Zeeman splitting raised by applied field.

For $D\gg nJ$ ($n$ is the coordination number), the $S^{z}=0$ state is
energetically favorable. The spin excitation energy $\Delta E(\mathbf{k})$ of
the collective spin wave can be expressed as $\Delta
E(\mathbf{k})=D+nJ\gamma_{\mathbf{k}}\mp g\mu_{B}B$, where
$\gamma_{\mathbf{k}}$ denotes the structure factorGhosh et al. (2013). With
the anisotropic exchange coupling strength $J$ included, similar field
dependence of the spin gap size can be also obtained just with a modified spin
gap at zero fieldGhosh et al. (2014). The negative branch fits quite well with
the field dependence of the spin excitation gap show in Fig.4. The slope of
the solid straight line yields a magnetic moment of 2.54 $\mu_{B}$, comparable
with the reported 2.84 $\mu_{B}$ determined by low-temperature magnetic
susceptibility. By reversing the fitting line to the positive $\Delta$-axis
symmetrically, the zero field gap $\Delta_{0}$ is suggested to be 10.86 K
(0.94 meV), just locating in the gap range $0.6\sim 1.6$ meV observed from
INSFurrer et al. (2021).

One essential basis for the above analysis is the existence of collective
magnons or paramagnons. In conventional three-dimensional magnets, the spin
wave excitation gap in the long-range ordered state originates from the spin
anisotropy, which closes above $T_{N}$ due to thermal fluctuationsNekrasova et
al. (2020). In the present Na2Cu3O(SO4)3, the zero field spin gap at $T=1.5$ K
below $T_{N}$ can be described as a consequence of the Heisenberg spin model
with single-ion anisotropyNekrasova et al. (2020). With the temperature
exceeding $T_{N}$, although the spin excitation peak is broadened and in-gap
states appear, the overall characteristics for the spin gap are maintained in
the energy spectra of neutronsFurrer et al. (2018). This suggests the
existence of short range order above the ordering temperature. For
$\mu_{0}H>8.6$ T, the spin gap exceeds the energy scale defined by $T_{N}$,
and finally reaches $\Delta\sim 50$ K at $\mu_{0}H=33$ T. Based on the
verified two-dimensional magnetic interaction in the present sample, we
propose the persistent short range order under applied magnetic fields, which
supports the paramagnon excitations above $T_{N}$.

Short range order in magnetic materials usually result from magnetic
frustration or/and anisotropic spin coupling. In the classical frustrated
antiferromagnet YMnO3 with an ordered ground state, persistent paramagnon
excitations are observed far above the Neel temperature in a short-range
mannerDemmel and Chatterji (2007). In rare-earth kagome systems, Nd3Ga5SiO14,
Pr3Ga5SiO14 and Pr3BWO9 with cooperative paramagnetic ground state, the
paramagnon excitations in the dynamical spin-clusters are verified by magnetic
resonance studiesGhosh et al. (2014, 2013); Zeng et al. (2021). For
anisotropic coupled spin chain CsMnCl3, prominent spin excitations are found
to persist to $2T_{N}$Skalyo et al. (1970). Even in the two-dimensional
ferromagnet CrI3, the paramagnon excitations also appear above $T_{C}$Chen et
al. (2020), where these Goldstone modes are more unstable than that in
antiferromagnets. In the present Na2Cu3O(SO4)3, anisotropic magnetic
interactions are indicated by the existing spin excitation gap and its field
dependence. The short-range order should mainly be caused by the anisotropic
spin coupling. The short range order persists to higher temperatures under
stronger magnetic fields, which is consistent with the increasing spin gap.
The magnetic frustration is likely absent here as indicated by the previous
calculations and INS resultsNekrasova et al. (2020); Furrer et al. (2021).

Finally, we discuss connections between the zero field spin gap and the
present high field one. From our study, the spin excitation gap at zero field
is predicated by the linear fitting intercept, exactly matching the gap size
reported by INS studyFurrer et al. (2021). This fact suggests common magnetic
interactions for the entire magnetic field range, together emphasizing the
spin anisotropy of the Cu6 spin-clusters.

In conclusion, we have performed NMR study on the spin-cluster based mineral
Na2Cu3O(SO4)3 within a ultra-wide magnetic field range. Under low fields, the
long-range magnetic order is monitored by a sudden broadening of the resonance
line across $T_{N}$. Correspondingly, the critical slowing down behavior is
observed near $T_{N}$ from $1/T_{1}(T)$. The hump behavior in $1/T_{1}(T)$
persists to $\mu_{0}H=7.25$ T, much higher than $H_{c}$ where the magnetic
moments are partially polarized. With higher field up to the studied
$\mu_{0}H=33$ T, the low temperature $1/T_{1}(T)$ is dominated by a thermally
activated behavior, indicating gapped spin excitations in the high field
region. The gap size show a linear field dependence, whose slope and intercept
respectively yields an effective magnetic moment of 2.54 $\mu_{B}$ and 0.94
meV spin excitation gap at zero field. The high field spin gap and its field
dependence indicate the underlying paramagnon excitations supported by short
range order and prominent easy-plane spin anisotropy which should play an
important role in the spin excitation spectrum of A2Cu3O(SO4)3.

This research was supported by the National Natural Science Foundation of
China (Grants No. 11874057, 21927814 and 21972145) and the Collaborative
Innovation Program of Hefei Science Center, CAS (2021HSC-CIP002). A portion of
this work was supported by the High Magnetic Field Laboratory of Anhui
Province.

## References

  * Starova et al. (1991) G. L. Starova, S. K. Filatov, V. S. Fundamensky, and L. P. Vergasova, Mineral. Mag. 55, 613 (1991).
  * Lander et al. (2017) L. Lander, G. Rousse, D. Batuk, C. V. Colin, D. A. D. Corte, and J.-M. Tarascon, Inorg. Chem. 56, 2013 (2017).
  * Siidra et al. (2017) O. I. Siidra, E. V. Nazarchuk, A. N. Zaitsev, E. A. Lukina, E. Y. Avdontseva, L. P. Vergasova, N. S. Vlasenenko, S. K. Filatov, R. W. Turner, and G. A. Karpov, Eur. J. Mineral. 29, 499 (2017).
  * Fujihala et al. (2018) M. Fujihala, T. Sugimoto, T. Tohyama, S. Mitsuda, R. A. Mole, D. H. Yu, S. Yano, Y. Inagaki, H. Morodomi, T. Kawae, et al., Phys. Rev. Lett. 120, 077201 (2018).
  * Furrer et al. (2018) A. Furrer, A. Podlesnyak, E. Pomjakushina, and V. Pomjakushin, Phys. Rev. B 98, 180410(R) (2018).
  * Furrer et al. (2021) A. Furrer, A. Podlesnyak, E. Pomjakushina, and V. Pomjakushin, Phys. Rev. B 104, L220401 (2021).
  * Nekrasova et al. (2020) D. O. Nekrasova, A. A. Tsirlin, M. Colmont, O. Siidra, H. Vezin, and O. Mentre, Phys. Rev. B 102, 184405 (2020).
  * Abragam (1961) A. Abragam, _The Principles of Nuclear Magnetism_ (Oxford University Press, Oxford, 1961).
  * (9) See Supplemental Material at [URL inserted by publisher] for simulations of the frequency-swept spectrum of the present powder sample, typical recovery curves of the nuclear magnetization, temperature dependence of the stretching exponent, and field dependence of the magnetization at different temperatures.
  * Yamada and Sakata (1986) Y. Yamada and A. Sakata, J. Phys. Soc. Jpn. 55, 1751 (1986).
  * Higa et al. (2017) N. Higa, Q. P. Ding, M. Yogi, N. S. Sangeetha, M. Hedo, T. Nakama, Y. Onuki, D. C. Johnston, and Y. Furukawa, Phys. Rev. B 96, 024405 (2017).
  * Moriya (1962) T. Moriya, Prog. Theor. Phys. 28, 371 (1962).
  * Ziolo et al. (1988) J. Ziolo, S. Torre, A. Rigamonti, and F. Borsa, J. Appl. Phys. 63, 3095 (1988).
  * Beeman and Pincus (1968) D. Beeman and P. Pincus, Phys. Rev. 166, 359 (1968).
  * Ghosh et al. (2013) S. Ghosh, S. Datta, H. D. Zhou, M. Hoch, C. R. Wiebe, P. Schlottmann, and S. Hill, Phys. Rev. B 88, 094414 (2013).
  * Ghosh et al. (2014) S. Ghosh, S. Datta, H. D. Zhou, M. J. R. Hoch, C. R. Wiebe, P. Schlottmann, and S. Hill, Phys. Rev. B 90, 224405 (2014).
  * Demmel and Chatterji (2007) F. Demmel and T. Chatterji, Phys. Rev. B 76, 212402 (2007).
  * Zeng et al. (2021) K. Y. Zeng, F. Y. Song, Z. M. Tian, Q. Chen, S. Wang, B. Liu, S. Li, L. S. Ling, W. Tong, L. Ma, et al., Phys. Rev. B 104, 155150 (2021).
  * Skalyo et al. (1970) J. Skalyo, G. S. Jr., S. A. Friedberg, and H. Kobayashi, Phys. Rev. B 2, 4632 (1970).
  * Chen et al. (2020) L. B. Chen, J. H. Chung, T. Chen, C. R. Duan, A. Schneidewind, I. Radelytskyi, D. J. Voneshen, R. A. Ewings, M. B. Stone, A. I. Kolesnikov, et al., Phys. Rev. B 101, 134418 (2020).