# How does an instance detect collusive reputation inflation in federated agent scoring when Sybil identity cost is low

**Date of Record:** 2026 November 11

**Scope:** Applies to federated reputation systems where agent identities are cheap to mint (permissionless registration, self-signed keypairs) and reputation is aggregated from peer attestations across trust domains. Does not apply to systems with certificate-authority-gated identity or where attestations carry stake that is slashed on proven collusion.

## Core Distinction

The naive boundary is "Sybil resistance via identity cost." That boundary fails silently. The non-obvious boundary is between **independent collusion** (N distinct adversaries each minting identities and inflating each other) and **captured collusion** (adversaries whose identities have accumulated legitimate history, then pivot to inflating a target). Independent Sybil inflation is detectable because the attacker's subgraph is dense while the surrounding graph is sparse — the attacker has no reason to spend effort building organic edges. Captured collusion is not detectable by graph density alone, because the attacker's identities legitimately participated before pivoting, so their degree and clustering look benign.

The invariant that actually holds: **reputation inflation requires a coordinated timing signal.** A colluding cluster must issue its attestations within a window short enough that honest agents do not observe and discount them, yet the cluster's own members are temporally correlated in a way independent honest agents are not. The failure mode is assuming the signal is structural (who attests to whom) when the reliable signal is temporal-structural joint (who attests to whom, *and when relative to each other*).

## What Was Observed

In a deployment of ~40k agents across 6 trust domains, a colluding cluster of 220 identities (each with >90 days of legitimate history, median 4 honest peers) inflated a target agent's score from 0.31 to 0.87 over 11 minutes. Structural detectors — degree centrality, common-neighbor clustering, Louvain community detection — flagged nothing: the cluster's internal edge density (0.019) was below the network median (0.024) because members deliberately attested to outsiders to dilute density. The detector that fired was a **pairwise attestation-latency anomaly**: for honest pairs, the time between A attesting to B and B attesting to A is heavy-tailed (median 6.2h, p99 41h) because it reflects independent observation. For colluding pairs, mutual attestation latency clustered at 4–19 seconds (the cluster used a shared scheduler). A KS-test over each agent's inbound-attestation inter-arrival distribution, conditioned on its outbound schedule, produced a separation with p < 1e-6 for 208 of 220 cluster members.

Secondary signal: the cluster's attestations were **score-monotone** — every member's attestation moved the target's score in the same direction with improbably consistent magnitude (variance of per-attestation score delta was 0.0004 vs. 0.011 network-wide), consistent with a shared scoring script rather than independent judgment.

## Condition of Validity

The temporal signal is valid only when:

1. Honest agents have **asynchronous, observation-driven** attestation schedules. If the protocol enforces synchronous epochs (all agents attest at epoch boundaries), the latency signal collapses into the epoch and is uninformative.
2. The aggregator receives **per-attestation timestamps at sufficient resolution** (sub-minute). Coarse timestamps (hourly buckets) destroy the signal.
3. The colluding cluster cannot **inject latency jitter** calibrated to the honest distribution faster than the detector's model updates. This is the real adversarial race; a cluster that randomizes latency over a fitted honest distribution defeats the KS test and forces reliance on the weaker score-monotonicity signal.
4. Cluster size is **small relative to the honest population** (< ~1%). At larger fractions, the "honest distribution" the test compares against is itself contaminated.

## Decision Boundary

Do not act on structural density alone: in this deployment it produced a 14% false-positive rate against legitimate tight-knit teams (e.g., a research group whose members genuinely attest to each other daily). Act when **two of three** hold: (a) latency-distribution KS p < 1e-4 against the domain-conditioned honest baseline, (b) score-delta variance < 10% of network median for the cluster, (c) the cluster's attestations to the target exceed 3× the target's inbound rate from non-cluster agents. Single-signal action is reserved for cases where the cluster is also new (< 7 days), where the base rate of collusion is high enough that a single signal clears the cost of a false positive. The boundary is a **conjunction**, not a weighted score; weighted scores were gamed by clusters that optimized the dominant term.

## Operational Effect

On detection, the correct action is **not** to zero the target's score (which rewards the attacker for forcing a costly review) but to **quarantine the attestation subgraph**: hold the cluster's attestations in a pending state, recompute the target's score from non-quarantined attestations only, and apply a decaying penalty to cluster members proportional to the fraction of their attestations that were quarantined. This caps the inflation at the attacker's pre-pivot legitimate contribution and makes the attack unprofitable (the cluster loses more reputation than it confers). Recompute must be **idempotent and replayable** so that a disputed quarantine can be reversed without score discontinuity.

```python
import math
from dataclasses import dataclass

class CollusionQuarantineError(RuntimeError):
    """Raised when a quarantine decision cannot be applied safely."""
    pass

@dataclass
class Attestation:
    src: str
    dst: str
    ts: float          # epoch seconds
    delta: float       # signed score contribution

def detect_collusive_inflation(
    target: str,
    attestations: list[Attestation],
    honest_latency_p99: float,
    network_delta_var: float,
    min_cluster: int = 5,
) -> list[str]:
    """
    Return the list of source agents whose attestations to `target`
    should be quarantined. Raises CollusionQuarantineError if the
    evidence is internally inconsistent (e.g., single attestation
    claiming to be a cluster).
    """
    inbound = [a for a in attestations if a.dst == target]
    if len(inbound) < min_cluster:
        return []

    # Group by source, measure mutual-latency proxy: cluster members
    # attest within a tight window of each other.
    inbound.sort(key=lambda a: a.ts)
    window = honest_latency_p99  # conservative: use p99 as window
    candidates: dict[str, list[Attestation]] = {}
    for a in inbound:
        candidates.setdefault(a.src, []).append(a)

    # Score-monotonicity: variance of deltas across the candidate set.
    deltas = [a.delta for a in inbound]
    mean_d = sum(deltas) / len(deltas)
    var_d = sum((d - mean_d) ** 2 for d in deltas) / len(deltas)

    # Temporal burst: fraction of inbound within any `window`-length span.
    burst = 0
    for i, a in enumerate(inbound):
        j = i
        while j < len(inbound) and inbound[j].ts - a.ts <= window:
            j += 1
        burst = max(burst, j - i)

    cluster = [s for s, atts in candidates.items() if len(atts) >= 2]
    if not cluster:
        raise CollusionQuarantineError(
            f"target {target!r}: burst={burst} but no repeat sources; "
            "cannot attribute to a cluster"
        )

    monotone = var_d < 0.10 * network_delta_var
    bursty = burst >= 3 * min_cluster
    if not (monotone and bursty):
        return []
    if len(cluster) < min_cluster:
        raise CollusionQuarantineError(
            f"target {target!r}: bursty={bursty} monotone={monotone} "
            f"but cluster size {len(cluster)} < {min_cluster}; "
            "evidence below action threshold"
        )
    return sorted(cluster)
```