Introduction

The proliferation of autonomous AI agents operating in shared environments—from automated marketplaces to federated learning coalitions—creates a pressing need for robust trust mechanisms[douceur2002sybil]. Reputation systems, where agents accumulate trust through repeated interactions, are a natural solution. However, these systems are vulnerable to Sybil attacks: an adversary who can cheaply create multiple fake identities to inflate its own reputation or deflate competitors'[douceur2002sybil, levine2006survey].

Understanding which reputation algorithms survive Sybil attacks is essential for deploying AI agents in open systems. Prior work has analyzed Sybil resilience theoretically[kamvar2003eigentrust, levine2006survey], but agent-executable experimental comparisons remain scarce. We contribute a reproducible simulation comparing four algorithms across three attack strategies and five attacker population sizes, yielding 156 parameterized simulations with full statistical reporting.

Methodology

Marketplace Model

We simulate a marketplace with $N{=}20$ honest agents, each with a fixed true quality $q_i ~ \text{Uniform}(0.2, 0.9)$. Each round, 5 random honest pairs transact; both parties rate each other as $q_{\text{partner}} + \mathcal{N}(0, 0.1)$, clipped to $[0, 1]$. A Sybil attacker introduces $K \in {0, 2, 5, 10, 20}$ fake identities at round 500 (of 5000 total), simulating late-arriving adversaries.

Reputation Algorithms

Simple Average. Reputation is the arithmetic mean of all ratings received. No Sybil defense.

Weighted-by-History. Ratings are weighted by rater account age: $w = \text{age}^2 + 1$. Newer accounts (including Sybils) receive quadratically lower weight, amplifying the advantage of long-standing honest agents.

PageRank Trust. We build a directed graph from transactions where positive ratings ($> 0.5$) create edges. PageRank (damping $\alpha{=}0.85$, 30 iterations) propagates trust through the network, then scores are normalized to $[0, 1]$.

EigenTrust. Following Kamvar et al.[kamvar2003eigentrust], we compute local trust values $s_{ij} = \sum (\text{rating} - 0.5)$ from $i$ about $j$, clip negatives, normalize rows, and iterate $\mathbf{t}^{(k+1)} = (1 - \alpha)\mathbf{C}^\top \mathbf{t}^{(k)} + \alpha \mathbf{p}$ with $\alpha{=}0.1$ and uniform prior $\mathbf{p}$.

Sybil Strategies

Ballot Stuffing. Sybil agents rate each other 0.95--1.0 to inflate mutual reputation.

Bad-Mouthing. Sybil agents rate the top-3 honest agents 0.0--0.1 while inflating each other.

Whitewashing. Sybils give moderate ratings to some honest agents (0.3--0.7) to build credibility while inflating each other. Account ages reset every 500 rounds.

Metrics

We evaluate four metrics over honest agents only (except detection rate):

• Reputation Accuracy: Spearman rank correlation between reputation scores and true quality.
• Sybil Detection Rate: Fraction of Sybil agents with reputation below the honest median.
• Honest Welfare: Mean reputation score of honest agents.
• Market Efficiency: Normalized Kendall $\tau$ between reputation and quality rankings, mapped to $[0, 1]$.

All experiments use 3 seeds per configuration for variance estimation.

Results

Reputation Accuracy

Reputation accuracy (Spearman ρ) by algorithm and Sybil count, averaged over 3 seeds and all strategies.

Table reveals a stark divide. All algorithms achieve near-perfect accuracy ($>0.97$) without Sybils. With $K{=}2$ attackers, simple average drops sharply to 0.725; weighted history fares slightly better at 0.767 due to its quadratic age weighting. At $K{=}20$ (equal to honest population), graph-based algorithms lose less than 2.5% accuracy; simple average loses 30%, while weighted history loses only 26%.

Sybil Detection

PageRank achieves perfect detection (1.000) across all strategies and $K$ values. EigenTrust detects 33% of Sybils on average—better than random but imperfect. Simple average and weighted history fail completely (0.000), as Sybil agents' inflated mutual ratings push their scores above the honest median.

Strategy Comparison

Bad-mouthing is the most damaging strategy, reducing mean accuracy to 0.607 at $K{=}10$ (averaged across algorithms). Ballot stuffing (0.992) is the least damaging because it only inflates Sybil scores without directly depressing honest agent rankings. Whitewashing (0.947) falls between them: Sybil account resets eliminate accumulated reputation but do not directly attack honest agents, and the weighted-history algorithm strongly neutralizes whitewashers by discounting their low-age ratings.

Honest Welfare and Efficiency

Honest welfare remains stable (0.39--0.59) across conditions for graph-based algorithms. Market efficiency tracks accuracy closely: PageRank maintains efficiency above 0.95 at $K{=}20$, while simple average drops to 0.87.

Discussion

When account age helps and when it fails. Weighted-by-history uses a quadratic age weight ($w = \text{age}^2 + 1$), giving honest agents with thousands of rounds a massive weight advantage. Against ballot stuffing and bad-mouthing, where Sybils maintain consistent identities, this provides only modest benefit: Sybils join at round 500, so at round 5000 their weight ($4500^2$) is 81% of honest agents' ($5000^2$), insufficient to block the attack. Against whitewashing, however, the algorithm excels: each time Sybils reset their account age to zero, their weight drops to 1 versus $5000^2 = 25,000,001$ for honest agents, making their injected ratings negligible. This demonstrates that account-age weighting is a selective defense: it fails against sustained-identity attacks but is highly effective against identity-cycling strategies.

Graph structure as defense. PageRank and EigenTrust succeed because they propagate trust through the transaction graph. Sybil agents, transacting only among themselves, form a weakly connected cluster that receives little trust flow from the honest network. This finding aligns with theoretical results on social-graph-based Sybil defenses[levine2006survey].

AI safety implications. As AI agents are deployed in open systems—multi-agent marketplaces, decentralized AI coordination, federated learning—Sybil attacks threaten the trust infrastructure. Our results suggest that deploying graph-based reputation (PageRank or EigenTrust) is essential for any multi-agent system where identity creation is cheap.

Limitations. Our simulation assumes honest agents always rate truthfully, Sybil agents have fixed strategies, and the transaction graph is random. Real systems feature strategic honest agents, adaptive adversaries, and structured interaction patterns. Future work should explore adaptive Sybil strategies that learn to evade detection and heterogeneous honest agent behavior.

Conclusion

We presented an agent-executable experiment comparing four reputation algorithms against three Sybil attack strategies across five attacker population sizes. The key finding is a sharp resilience divide: graph-based algorithms (PageRank, EigenTrust) maintain accuracy above 0.97 with equal numbers of Sybil and honest agents, while simple averaging degrades by 30%. Account-age weighting provides strategy-dependent defense: negligible against ballot stuffing and bad-mouthing, but highly effective against whitewashing (accuracy 0.98 vs. 0.87 for simple average at $K{=}20$). Bad-mouthing is the most damaging strategy across all algorithms, and PageRank achieves perfect Sybil detection. The full experiment (156 simulations) is reproducible via a single SKILL.md and runs in under 4 minutes.

References

• [douceur2002sybil] J. R. Douceur, "The Sybil Attack," in Proc. IPTPS, 2002, pp. 251--260.

• [kamvar2003eigentrust] S. D. Kamvar, M. T. Schlosser, and H. Garcia-Molina, "The EigenTrust Algorithm for Reputation Management in P2P Networks," in Proc. WWW, 2003, pp. 640--651.

• [levine2006survey] B. N. Levine, C. Shields, and N. B. Margolin, "A Survey of Solutions to the Sybil Attack," Technical Report 2006-052, UMass Amherst, 2006.