Reputation & Scarcity

Layered defenses

• Pheromone crate: a Cheng-Friedman sqrt(N) passport-key cap per kernel, a per-pair token bucket, an observation-cost commitment field, and a newcomer age-discount with N = 8 default (pheromone spec, sections 5.4 through 7).
• Reputation crate owns: a weighted LocalReputationScorecard over eight named metrics (boundary pressure, resource stewardship, least privilege, history depth, specialization, delegation hygiene, reliability, incident correlation), plus a discrete ReputationFeed / ReputationTier system (tier_0 through tier_3) with a distinct-feed gate at tier_3 for Sybil resistance.
• Arena owns: deterministic replay scoring, surfaced to reputation as an arena_survival ReputationFeed that composes into a ScoreDelta like any other feed.

The math, briefly

Let P be the number of honest peers, K the per-pair token-bucket capacity (honest passports per peer per window), and S = ceil(sqrt(P + A)) the per-kernel passport cap. An adversary running A distinct operator-orgs can present A * S passports because the cap binds per-origin-kernel, not globally. The adversarial mass fraction is f = A * S / (P * K + A * S). Solving for the safety condition f < 0.30 and approximating sqrt(P + A) ~ sqrt(P) for A << P:

# Safety condition
A * S < 0.30 * (P * K + A * S)

# Solve for max adversary org count A
A_max ~= (3/7) * P * K / ceil(sqrt(P))

# Adversary spends C dollars per passport, runs S passports per org
B_min ~= A_max * S * C
      ~= (3/7) * P * K / ceil(sqrt(P)) * ceil(sqrt(P)) * C
      ~= (3/7) * P * K * C

# sqrt(N) cancels.
#
# The cap reduces per-org passport count;
# the adversary stands up O(sqrt(P)) orgs to compensate.
# The dollar threshold does not move.
# Operator-org admission is the load-bearing scarcity, not passport issuance.

The cancellation shows that sqrt(N) shifts cost without reducing the modeled cost threshold. It does not stop a well-funded adversary; it forces them to spend the same dollars on operator-org admissions instead of on raw passport keys. Operator-org admission is a much harder budget line to scale: shell companies, registered agents, sectoral-roster fees, and audited financials all gate on per-org cost, not per-passport cost. The cancellation itself is a direct read of the pheromone spec math; the per-org dollar stack below is the docs team’s own first-order modelling.

Adversary cost model

The table maps four attack strategies against against per-deposit cost, per-passport cost, the layer that detects them, and what residual loss survives the defense.

The dollar figures are the docs team’s own first-order modelling, not values read out of the codebase or the protocol spec. The table is a conservative lower bound: it does not credit reputation weighting, revocation gossip latency, or arena-replay scoring, all of which favour the defender.

Defense composition

The three layers compose multiplicatively. Each one raises the adversary’s effective cost; their combined effect is the product of the multipliers, not the sum.

Order of effect (docs-team first-order modelling, not a spec value): substrate caps shift roughly 6x to 14x of cost over the bare baseline (a newcomer multiplier of 2x to 4x times an observation-cost multiplier of 3x); the reputation scorecard and tier system compound further (hard to model closed-form, since the distinct-feed gate at tier_3 hits Sybil clusters directly); arena replay scoring compounds again on top of that. The closed-form cost stack only captures the first layer; the second and third are why the modelling suggests the recommended defaults bind against organised-cybercrime budgets ($250K-$1.5M envelopes) in realistic federation sizes.

The sqrt(N) reframe

The cap is a cost-shifter, not a cost-reducer. It does not stop a well-funded adversary; it forces them to spend more on operator-org admissions per unit of poisoned signal. Combined with the observation-cost commitment field (which makes “sign without originating” detectable and weight-capable), the effect is to push adversarial cost from per-deposit to per-passport, and from per-passport to per-org, which is a much harder budget line to scale.

Defaults that fall out of the analysis: N = 8 newcomer-discount horizon and observation-cost commitments required for destructive subject classes are both fixed by the pheromone spec; the sqrt(N) cap is retained because, per the same modelling, tightening it to log(N) does not change the dollar budget.

Honest residuals

Three classes of attack are defended imperfectly. The doc admits this in writing rather than papering over it. Under each, the substrate-side defenses fail; mitigation has to escalate out of the protocol layer.

Sustained majority collusion

Cheng-Friedman (PODC 2005) and Fang et al. (USENIX 2020) both prove no symmetric weighting survives if more than ~50% of effective passport mass (not peer count) is adversarial under coordinated strategy. Mitigation must be exogenous: bilateral handshake admission must keep effective adversarial mass below ~30%.

What we can do:

• Tighten bilateral handshake admission per treaty: require a published roster source, not operator-mediated key exchange, for treaties whose action classes have destructive_floor >= receipt_backed.
• Run periodic out-of-band sectoral audit of operator-org admissions (defense lever D6); a chio-governance Sanction case against an issuing org collapses every passport admitted under it.
• Cap effective adversarial mass at the upstream anchor by accepting only roster sources whose admission gates have published appeals and revocation processes.

Mimicry-style slow-drift below sensor noise

Diffusion- or GAN-generated deposits can be made indistinguishable from honest deposits at any single window. Arena replay catches them only if arena coverage overlaps the mimicked subject class. Residual loss in uncovered classes must be accepted and budgeted.

What we can do:

• Expand arena coverage on a published cadence; declare uncovered subject classes explicitly in the ladder manifest so consumers can weight their queries accordingly.
• Require observation-cost commitments universally on destructive classes; mimicry has to forge a telemetry chain that survives downstream verification, multiplying per-deposit cost by m_oc (1.5x to 10x).
• Lean on the reputation scorecard’s incident-correlation and reliability metrics and the discrete tier gate, so a slow-drift attacker has to hold a high tier across many windows — and clear the distinct-feed gate at tier_3 — before its deposits carry full weight.

Cross-org operator collusion via friendly re-issuance

If two distinct operator-orgs cooperate to re-issue passports for sanctioned operators, no in-band reputation function detects this. Out-of-band governance is the only recourse: a Sanction case against the issuing org, not the passport.

What we can do:

• Publish operator-org admission audit cadence per treaty and bind it into the ladder manifest as a sector-profile parameter; an anomalous spike in admissions becomes a triggering event for governance review.
• Hold roster issuers to a published key-rotation cadence and appeals process so re-issuance against a sanctioned operator surfaces in audit logs the issuer cannot suppress.
• Model cross-issuer overlap (which operator-orgs are admitted to multiple sectoral rosters) and flag friendly-re-issuance candidates to chio-governance as a routine reporting line, not a one-off investigation.

References

• Cheng & Friedman, “Sybilproof reputation mechanisms,” PODC 2005. Cited inline in the sqrt(N) derivation and the sustained-majority residual.
• Hoffman, Zage, Nita-Rotaru, “A Survey of Attack and Defense Techniques for Reputation Systems,” ACM CSUR 2009. Standard taxonomy underpinning the adversary cost model.
• Fang et al., “Local Model Poisoning Attacks to Byzantine-Robust Federated Learning,” USENIX 2020. Cited inline alongside Cheng-Friedman in the sustained-majority residual finding.