papers/hanzo-dso/sections/13-security-analysis-extended.tex

\section{Security Analysis (Extended)}

\label{app:security}

\subsection{Formal Sybil Resistance Proof}

\begin{theorem}[Sybil Resistance under Stake Splitting]
Let adversary $\mathcal{A}$ have total stake $S_A$ and create $k$ identities
with stakes $S_1, \ldots, S_k$ where $\sum_j S_j = S_A$. For any aggregation
function $F$ that is a weighted median with weights proportional to stake, the
output $F(\{E_i\}_{i \in H} \cup \{E_j'\}_{j=1}^k)$ is identical regardless
of $k$.
\end{theorem}

\begin{proof}
The weighted median depends only on the total weight on each side of any
candidate value. For adversarial values, the total weight is:
\begin{equation}
    W_A = \sum_{j=1}^k S_j \cdot q_j \leq S_A \cdot \max_j q_j,
\end{equation}
which is maximized when all stake is concentrated ($k = 1$) with the highest
possible quality score. Splitting stake across $k > 1$ identities can only
reduce total weight (if quality varies) or keep it the same (if all identities
achieve the same quality). Thus, Sybil splitting is weakly dominated.
\end{proof}

\subsection{Data Poisoning Resistance}

\begin{proposition}[Poisoning Detection]
A targeted poisoning attack that inverts $p$ fraction of a prior's
recommendations is detected by holdout validation with probability:
\begin{equation}
    P(\text{detect}) = 1 - (1 - p)^k \geq 1 - e^{-pk},
\end{equation}
where $k$ is the number of holdout validation samples. For $p = 0.1$ and
$k = 30$, detection probability is $\geq 95.2\%$.
\end{proposition}

\subsection{Denial of Service Resistance}

The bond requirement creates a linear cost for submission flooding:
\begin{equation}
    \text{Cost}_{\text{flood}}(m) = m \cdot D_{\min} + \text{gas}(m),
\end{equation}
where $m$ is the number of spam submissions. At $D_{\min} = 25$ \$AI and
typical gas costs, flooding $10{,}000$ submissions costs $> 250{,}000$ \$AI,
making sustained DoS economically infeasible.