papers/hanzo-dso/sections/06-sybil-resistance.tex

\section{Sybil Resistance}

\label{sec:sybil}

\subsection{Stake-Based Identity}

Each participant must stake $D_{\min}$ tokens (default: 25 \$AI) per submission.
Sybil attacks require splitting stake across multiple identities.

\begin{proposition}[Sybil Cost]
\label{prop:sybil-cost}
An adversary with total stake $S_{\text{adv}}$ creating $k$ Sybil identities
has per-identity stake $S_{\text{adv}} / k$. Since weights are proportional to
stake (Eq.~\ref{eq:weights}), the total adversarial weight is:
\begin{equation}
    W_{\text{adv}} = \sum_{j=1}^k \frac{S_{\text{adv}}}{k} \cdot q_j = S_{\text{adv}} \cdot \bar{q}_{\text{adv}},
\end{equation}
which is independent of $k$. Sybil splitting provides no advantage in weighted
median aggregation.
\end{proposition}

\subsection{Quality Gate}

Submissions with quality $q_i < q_{\min}$ (default: 0.3) are filtered before
aggregation. This creates a two-tier defense:

\begin{enumerate}[leftmargin=1.5em]
    \item \textbf{Bond requirement:} Each submission requires stake, making
          mass submission expensive.
    \item \textbf{Quality threshold:} Low-quality submissions are discarded
          regardless of stake, and their bonds are subject to slashing.
\end{enumerate}

\begin{theorem}[Sybil Resistance]
\label{thm:sybil}
Under the DSO protocol, an adversary needs total stake
\begin{equation}
    S_{\text{adv}} > \frac{W_H}{2 \bar{q}_{\text{adv}}}
\end{equation}
to influence the aggregated prior, where $W_H$ is total honest weight and
$\bar{q}_{\text{adv}}$ is the average quality score of adversarial submissions.
If the adversary's submissions are random noise, $\bar{q}_{\text{adv}} \approx 0.5$,
requiring $S_{\text{adv}} > W_H$. If quality gating rejects adversarial
submissions (i.e., $\bar{q}_{\text{adv}} < q_{\min}$), the adversary has zero
influence regardless of stake.
\end{theorem}

\subsection{Bond and Slashing Mechanism}

Submission of prior $E_i$ requires bond $D_i \geq D_{\min}$. The bond is
governed by:

\begin{definition}[Slashing Conditions]
Bond $D_i$ is slashed (partially burned) when:
\begin{enumerate}[leftmargin=1.5em]
    \item The validated quality $q_i' < q_{\min}$ and a challenger submits a
          valid proof (counter-examples on holdout tasks).
    \item The Merkle proof verification fails (data integrity violation).
    \item The submission is identified as duplicate of a previous entry.
\end{enumerate}
\end{definition}

The slashing procedure:
\begin{align}
    \text{Burn amount} &= \sigma \cdot D_i \quad (\text{default } \sigma = 0.5), \\
    \text{Challenger reward} &= (1 - \sigma) \cdot D_i, \\
    \text{Remaining} &= 0.
\end{align}

This creates a bounty for identifying malicious submissions, incentivizing
active monitoring by honest participants.

% ============================================================================
% 7. GOSSIP PROTOCOL
% ============================================================================