Sybil-Resistant Reputation for AI Agents: A Reference Implementation published: false tags: ai, blockchain, ethereum, opensource

The problem, in one sentence
If creating a fake AI agent identity costs nothing, and reputation is built by agents transacting with each other, what stops someone from minting 10,000 fake agents that vouch for each other before ever touching a real user?
This isn't hypothetical anymore. A recent empirical study (Xiong, Li, Wei, Wang, Knottenbelt, and Wang — "Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem", arXiv:2606.26028) crawled real on-chain feedback data across Ethereum, BSC, and Base and found 73.5%, 59.2%, and 90.6% of reviewers respectively show coordinated Sybil behavior. After filtering out Sybil-flagged feedback, the reliable rating pool collapses for most agents on two of the three chains. Their conclusion: the Reputation Registry, as currently deployed, can't function as a trust signal on its own.
I ran into this same problem building tooling around ERC-8004 reputation lookups — something like the erc8004-get-reputation pattern shown in this post, where an agent checks another agent's reputation before proceeding with a transaction. That check is only as good as the reputation data feeding it — and per the study above, that data is currently mostly noise.
So I built a small reference implementation exploring one structural approach to filtering that noise. This post walks through the design.
Design: four independent layers, so one bypass isn't enough
The core idea is that no single defense is sufficient alone — an attacker has to beat all of them simultaneously, not just find the one weak link.
Layer 1 — Pseudonymous identity (free, and that's fine)
Every agent is just an Ed25519 keypair. No registration authority, no KYC. This is not a defense — it's the neutral, costless anchor the other layers attach real cost to.
Layer 2 — Economic bonding
Before an agent can transact at a meaningful trust tier, its operator locks real capital against it — tiered (Unbonded / Basic / Trusted / Institutional). Proven bad behavior gets slashed. This makes N fake identities cost roughly N times the bond, instead of staying free.
Layer 3 — Two independent graph signals
This is the part I think is genuinely useful to compare against other approaches:
Local conductance — fast, looks at an agent's immediate neighborhood, flags dense-but-isolated clusters (classic Sybil ring shape).
SybilRank-style trust propagation — concurrent power iteration, seeded from staked agents, spreading trust across ~log(N) hops.
Why two? Local conductance has a known weakness: a bridge attack, where an attacker adds one or two edges from an otherwise-isolated Sybil cluster into the honest network, specifically to lower the one-hop suspicion score without changing the cluster's actual structure. Propagation catches this because it measures reachability from trusted, staked seeds across multiple hops — a narrow bridge only leaks a thin trickle of propagated trust through the bottleneck, however densely connected the cluster is internally.
The combined score takes the worse of the two signals. I wrote an adversarial test that specifically constructs this bridge attack and confirms the combined defense holds where conductance alone gets fooled.
Layer 4 — Time decay
Reputation contribution from each event decays with a 90-day half-life. A Sybil ring built slowly, then left dormant before being "cashed in," loses value over time — sustained trust requires ongoing, diverse activity, which raises the attacker's holding cost, not just setup cost.
What's actually tested, concretely
Rather than just describing the mechanism, here's what the test suite covers:
Basic Sybil cluster — a fake ring with 2.4x more raw transaction volume than an honest agent still gets crushed to a 0 trust score
Bridge attack — the attack designed specifically to fool local conductance; combined defense still catches it
Whitewashing — does abandoning a slashed identity and starting fresh actually cost anything? (Yes — the fresh identity loses all accumulated reputation and the original stake)
Slow-burn dormancy — a ring that goes quiet for 200 days before trying to cash in reputation; measured decay ratio matched the predicted half-life math almost exactly
Realistic topology — embedding a Sybil ring in a 300-node scale-free network (preferential attachment, not a toy uniform graph) rather than a small hand-built mesh
Naive baseline comparison — measured, not assumed: against a system with zero defenses, the combined score reduces a Sybil ring's effective trust by 100% in the tested scenario
What's honestly not tested
I want to be direct about this rather than oversell it:
Every adversarial test so far was designed by me — the same person who built the defense. That's a real conflict of interest. Nothing here has been pressure-tested by someone trying seriously to break it from outside.
No comparison against the EigenTrust-style or wallet-age-based Sybil detection already live in the ERC-8004 ecosystem (e.g. RNWY, mentioned in the awesome-erc8004 list) on shared test cases.
No professional security audit. There's a SECURITY_REVIEW.md in the repo listing known gaps plainly — DoS surface, unauthenticated event submission (since partially fixed), integer overflow edge cases — as a checklist for a real auditor, not a substitute for one.
Code
Repo, whitepaper, and full test suite: https://github.com/kenjimoto999/veylux
Open, MIT-licensed, no token, no company. Written in Go, with concurrent graph algorithms (goroutine worker pools for batch scoring and trust propagation) since this needs to stay fast at realistic network scale.
Genuinely interested in where this breaks, especially against the actual coordinated Sybil patterns the empirical study above observed in the wild — if anyone wants to try attacking it, that's exactly the kind of feedback this needs.