Glossary

The fourth and newest family of Sybil-resistance: binding an actor — human or AI agent — to a responsible principal who can be identified, sanctioned, and removed. It reframes the door question for the agentic era from "are you human?" (neither necessary nor sufficient once benign agents act for accountable people) to "who is answerable for this?" Industry expressions include staking-and-slashing, Vouched's "Know Your Agent" (launched May 22, 2025), and the OpenAI/Stripe Agentic Commerce Protocol. It is EigenTrust's "ban the actor, not the artifact" carried one era forward.

A user account that has existed long enough, and posted enough innocuous activity, to read as a real person to both humans and automated filters. Aged accounts are bought and sold as a commodity — in the low single-digit to low double-digit dollars apiece — precisely because their age is the credential.

A server-side Telegram setting (channels.toggleAntiSpam) that lets the platform apply stricter automated spam filtering inside a group. A blunt instrument: useful against crude floods, useless against a fluent AI persona that looks exactly like a member.

A signed, machine-verifiable statement that some claim about a subject is true — "this wallet completed KYC," "this person is over eighteen." On-chain attestation frameworks such as the Ethereum Attestation Service (EAS) let attestations be issued, looked up, and revoked without a central database. Attestations are the raw material of portable reputation.

A shared banlist, hosted at cas.chat, that aggregates spammer identifiers across many Telegram groups so that an account banned in one place is flagged everywhere subscribers query it. CAS appears early in this book as the first crude, centralized, fragile attempt at portable reputation.

The 2001 result by Eric Friedman and Paul Resnick that when online identities are free to abandon and replace, communities slide toward a "dues-paying" equilibrium in which newcomers are distrusted by default — because a fresh newcomer and a cheat who just shed a ruined name are indistinguishable. The result is conditional, not inevitable, but its lesson is load-bearing for this book: the problem was never identity, it was cheap identity. Reputation needs a costly-to-shed anchor to attach to.

Any defense that decides whether a message is spam by inspecting the message itself — its words, links, images, or metadata. The dominant paradigm for two decades, undone by AI-generated language that carries no tell to detect.

A rented toolkit that empties a victim's crypto wallet once the victim is tricked into signing a malicious approval. Operators take a commission — roughly 20 percent in the Inferno-to-Angel-to-Lucifer lineage tracked by Flare — and handle the laundering. DaaS is the clearest proof that this is an industry: the attacker no longer needs to build anything, only to drive traffic.

A 2003 reputation algorithm (Kamvar, Schlosser, and Garcia-Molina) that computes global trust scores from local peer ratings across a network. Its enduring lesson for this book is not the math but the prescription: ban the malicious actor, not the bad artifact, because an unbanned actor produces unlimited bad artifacts. EigenTrust also concedes the field's central dependency — that without a cost of entry, the scoring is gameable.

The book's framing for the approaches the field is converging on, presented as composable layers rather than competing alternatives, each adding a property the previous lacked: (1) reputation — earned trust from accumulated history (PGP web-of-trust, eBay feedback, Advogato, EigenTrust/OpenRank); (2) identity — a persistent, costly anchor for that history, including biometric authentication (wallets, attestations, DIDs/VCs, passkeys, priced-entry forums, eIDAS wallets); (3) proof of personhood — uniqueness, one living human per enrollment (World ID, BrightID, Human Passport); (4) accountability — a traceable chain to an answerable principal (staking/slashing, Know Your Agent). None is a silver bullet; the engineering question is which combination fits which room, and the binding constraint is adoption, not invention.

An identity aggregator (formerly Gitcoin Passport, after Holonym's acquisition announced in February 2025) that bundles many separate verifications, or "stamps," into one portable score. Its reach — roughly two million users and thirty-five million credentials — is company-stated, not independently audited, and counts cumulative rather than active users.

The regulated process of verifying a real-world identity, inherited from finance. In open communities it is mostly absent. Its agentic-era successor concept is Know Your Agent — see Accountability.

An application of EigenTrust to the Farcaster social graph, built by Karma3Labs, that ranks accounts by trust propagated from a seed set. Its Sybil-resistance is conditional, not categorical — it is only as good as the trust of the seeds, and a corrupted seed set corrupts the whole ranking.

A phishing-resistant login standard in which a biometric (fingerprint or face) is checked locally on the user's device and never leaves it; the server receives only a cryptographic assurance that the check passed. It is biometric authentication — a one-to-one "does this credential belong to this body?" check — not proof of personhood's one-to-many uniqueness check. A trust-the-authenticator model: it binds a credential durably to a body, cheaply, within that trust boundary. Part of the identity family.

A long-con investment-romance fraud in which the victim is cultivated over weeks before being drained. The FBI's IC3 reported roughly $7.2 billion in crypto-investment-fraud losses in 2025 — the category pig-butchering dominates. The grotesque name (from the Mandarin shā zhū pán) describes "fattening" the victim before slaughter.

Smuggling instructions into the text an AI model reads so that the model obeys the attacker instead of its operator. OWASP ranks it the top large-language-model risk (LLM01:2025); in this book it appears both as a way attackers jailbreak models and as a way they hijack defenders' AI moderators.

The third family of Sybil-resistance: a mechanism that tries to establish that an account is backed by one distinct living human — the one-to-many uniqueness question ("one human, one enrollment"), which is harder than the one-to-one authentication a passkey performs. The term was introduced by Bryan Ford and colleagues at a EuroS&P workshop in 2017. Approaches include biometrics (World ID's iris scan), social vouching (BrightID), and aggregation (Human Passport). Crucially, proof-of-personhood is not Sybil-immune: as the DeSoc paper concedes, an attacker can recruit or rent real humans, each of whom passes the test once but on the attacker's behalf. And in the agentic era it is increasingly the wrong question — see Accountability.

The first and oldest family of Sybil-resistance: trust built from accumulated history. Its digital lineage runs from PGP's web of trust (1991) and eBay feedback (1996) through Advogato's group trust metric (1999) to EigenTrust (2003) and its modern incarnation OpenRank. It provides earned trust but collapses when the underlying identity is cheap to discard (Friedman–Resnick), which is why it needs the identity family beneath it.

A trust signal that travels with an identity from one community to another, so that standing earned or lost in one room follows the person everywhere. CAS was its crudest ancestor; attestations and on-chain trust graphs are its modern form.

A property of modern verifiable credentials (formalized in the W3C Verifiable Credentials Data Model 2.0, which reached Recommendation status on May 15, 2025, with formats such as SD-JWT) that lets a holder prove one fact — "over eighteen," "a verified human" — without revealing everything else the credential contains. It is how identity can become costly to fake without becoming a surveillance dragnet.

A non-transferable token, proposed in the 2022 "Decentralized Society" paper, meant to encode commitments, credentials, and affiliations that cannot be sold because they are bound to a single account. SBTs are an attempt to make reputation stick to a person rather than circulate as a tradable asset.

One actor wearing many faces. Named and formalized by John Douceur in 2002, who proved that without a central authority an entity can forge a number of identities scaling with its resources, and that no amount of inspecting the identities can collapse the many back down to the one. It is the structural problem at the center of this book.

The property of a system that raises the cost of presenting many distinct identities, so that one actor cannot cheaply appear as many. No open system achieves it categorically (Douceur, 2002); the realistic goal is to make a credible additional identity cost the attacker something real. This book treats Sybil-resistance not as a single mechanism but as a property the four families collectively confer — reputation, costly identity, proof of personhood, and accountability — composed for the room at hand. Most individual mechanisms (EigenTrust, social-graph personhood, aggregators) are conditionally rather than categorically Sybil-resistant.

Restricting entry to a community based on holding a particular token or NFT, commonly via services like Collab.Land across Telegram and Discord. It gates on a possession, not a person, so it inherits that asset's weaknesses — rental, flash-loan bypass, and shared wallets — which mitigations such as minimum hold times only partly blunt.

A protocol that lets a Telegram Mini App authenticate that a user controls a particular wallet keypair. It proves control of a key — not the existence of a human behind it, and not any verified attribute of that human. No KYC, no biometric, no personhood; a useful primitive that is frequently mistaken for an identity layer it was never built to be.

A tamper-evident, cryptographically signed claim that a holder can present and a verifier can check without contacting the issuer. The W3C data model standardizes the format; VCs are the connective tissue of the four families described in Part VI.

A decentralized reputation model, originating with PGP in 1991, in which users vouch for one another's keys or identities and trust is followed along chains of vouches rather than issued by a central authority. The ancestor of the reputation family — and a cautionary one: Douceur (2002) showed a web of trust does not, by itself, achieve Sybil-resistance, because an attacker who mints identities freely can manufacture the vouches too.