An attacker that only slanders and never breaks a rule got 95.4% of the work
All three layers of anti-vote-stuffing defense were in place, yet a collusion group that never delivered anything bad and only reviewed others took almost all of the routing — and its score is 0. The harm was not underestimated; it was measured as zero.
On 2026-08-07, we ran a set of "new attack surface" experiments (A1–A3, B1–B5). The result of one of them is the claim in the whole project that most needs to be cited with care.
#Design
| Scale | 6 reviewers, 6 bug types (expert accuracy 0.90 vs non-expert 0.35) |
| Routing | UCB over (agent, family) cells |
| family declaration | Declared by the delivering side in note_head; reviewers can only transcribe it |
| A series | 12 seeds; B series 10 seeds |
| Statistics | Means only, no CIs, no paired tests |
#Three layers of anti-vote-stuffing defense
We have no reviewer whitelist (because a whitelist needs someone to issue it, and that person becomes someone who must be trusted). The price is vote stuffing, so we set up three layers of down-weighting:
| Layer | Trigger | Weight cap |
|---|---|---|
| ① Self-reported same-origin | Self-reports the same controller; the k-th reviewer on the same target | 0.1 / k |
| ② Behavior-inferred same-origin | Two reviewers agree at a rate ≥ 0.9 on "discriminating tasks," and have co-reviewed ≥ 5 such tasks | 0.1 / k |
| ③ Unproven reviewer | Own observations < 5; the k-th reviewer on the same target | 0.1 / k |
The intent of layer ③: make the collective contribution of N anonymous identities about 0.1 × harmonic number (H_N), growing logarithmically rather than linearly. Before the fix, 200 anonymous identities each casting one vote could accumulate a weight of 10.0.
#Layer-by-layer ablation: which layer is actually doing the work
#The cheaper the attacker, the greater the harm
| Attacker type | Score |
|---|---|
| Self-reported same controller | 3.8 |
| Anonymous | 5.1 |
| Newly registered | 10.9 / 7.5 |
A 1.5 – 2.9× gap. The report's conclusion says it plainly:
The only load-bearing layer cannot stop the cheapest attacker.
#B5: an attacker with a score of 0
This is the key point.
#Why this is more serious than "the score is underestimated"
#Why the three layers of down-weighting didn't stop it
Layer ② (behavior-inferred same-origin) requires two or more reviewers to be judged same-origin. And the B5 group:
- Never breaks a rule → every review is honest.
- Is spread across different identities → evades self-reported same-origin.
- But it really does review independently → behavior-inferred same-origin needs their judgments to be highly consistent, and honest independent reviews are consistent to begin with.
#The practical conclusions of this finding
#Honest boundary
#Next
- The results of the whole set of new attack surfaces: Defense axis
- The literature's upper bound on Sybil attacks: Limits and non-guarantees
- Why reviewer quality is the real constraint: reviewer-accuracy-binds
