ZAPs, a reward attribution framework that combines economic contribution scoring with adversarial robustness, is presented, and it is shown that the maximum reward obtainable from any protocol is bounded by that protocol's global volume share.
Abstract
Incentive programs are central to user acquisition in decentralized finance, but many reward systems rely on raw volume, transaction count, and wallet count, making them vulnerable to bots and sybil operations. We present ZAPs, a reward attribution framework that combines economic contribution scoring with adversarial robustness. A composite activity score uses protocol-specific percentile normalization to limit whale dominance while preserving differentiation among users. A two-layer weighting mechanism combines protocol share within sector and sector share within the ecosystem, which reduces the profitability of farming small protocols. We show that the maximum reward obtainable from any protocol is bounded by that protocol's global volume share. ZAPs also introduces a four-layer defense stack consisting of transaction-level integrity checks, a parallel anomaly ensemble, post-distribution behavioral memory, and graph-based sybil clustering. The anomaly ensemble combines a one-class reconstruction model with an isolation forest and applies graduated rather than binary penalties. On 1,073 labeled malicious wallets covering 124,638 transactions, the ensemble achieves 0.923 +/- 0.013 ROC-AUC, compared with 0.891 +/- 0.016 for the reconstruction model alone, when the isolation forest is trained on benign wallets. Training it on the pooled population reverses its polarity and removes the ensemble gain. Controlled simulations reduce adversarial reward capture by 30-90 percent while legitimate-user scenarios change by 1-8 percent. Live campaigns recorded a 56 percent reduction in sybil allocation, a 49 percent increase in quality-wallet participation, and a 50 percent reduction in sell pressure.
Machine learning-based credit scoring is increasingly central to Peer-to-Peer (P2P) lending, yet its resilience to adversarial manipulation, where applicants strategically alter self-reported inputs to secure favourable decisions, remains poorly understood. Most adversarial-robustness evidence comes from image and text domains and evaluates a single attack against a matching defence, offering little guidance on how defences generalise across attack types in tabular credit data. We address this with a systematic train-test robustness benchmark on a large Lending Club subset, spanning three model families (logistic regression, a feed-forward neural network, and a transformer for tabular data) and four attacks confined to applicant-mutable features: Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Salt-and-Pepper (S&P) noise, and DeepFool, plus a mixed-attack regime. Across a full grid evaluated with stratified cross-validation, adversarial training sharply improves robustness against the attack it is trained on and transfers well within the gradient-based family, but transfers weakly to non-gradient corruption, so single-attack defences overstate real-world resilience. Mixed training delivers the most balanced robustness across heterogeneous attacks while preserving clean-test performance, supporting multi-attack stress testing in credit-model governance.
Gijs A. F. Niewzwaag, Marijn G. S. Veth, Manuele Massei et al.· 0 citations
In many advanced recommender systems (e.g., GNN-based), local smoothing mechanisms would distill collaborative signals but could inadvertently amplify targeted data poisoning threats. Existing defenses predominantly relied on rigid binary filtration strategies. However, such structural deletion of suspicious nodes often compromises graph connectivity, leading to a severe robustness-fidelity dilemma. To fill this gap, we propose SiPo (Silencing the Poison), a novel framework that shifts the paradigm from node removal to gradient silencing. SiPo leverages unsupervised granular ball computing to adaptively capture adversarial topological micro-clusters within the feature space. Subsequently, it geometrically collapses high-risk nodes towards a non-informative singularity via a global gravity gating mechanism. This operation blocks the backpropagation path of malicious gradients, effectively suppressing attacks while preserving the collaborative signals of normal users. Theoretical analysis confirms that SiPo enforces a compression of the local Lipschitz constant. Furthermore, extensive experiments on four public datasets demonstrate that SiPo not only significantly reduces attack success rates but also consistently improves recommendation performance. The implementation code is available at: https://github.com/KREML0/SiPo.
Yunmeng Zhao, Jun Shen, Shenbao Yu et al.· Proceedings of the 32nd ACM...· 0 citations
Self-evolving language models improve by proposing candidate updates and keeping whatever raises a visible score. When that score is an imperfect proxy for the capability one actually wants, sustained selection widens the gap between the two. This is reward hacking. We introduce HackProbe, a monitor that attaches to an arbitrary self-evolving loop through two black-box hooks, with no access to weights or activations. It keeps a secret, distribution-fixed comparison core, whose frozen distribution makes its capability proxy comparable across generations, alongside a rotated fresh layer that hardens the bank against co-adaptation. Four tests built on that proxy cover the level gap, a scale-aligned divergence with online change-point detection, capability stagnation, and a conditional confidently-wrong rate; a Sidak correction turns them into a calibrated family-wise p-value. Diagnosis alone recovers nothing, so a risk-aware immunization layer reselects an honest candidate from the proposal pool using the core together with a purely structural gaming footprint, disclosing at most log2 Pi bits per generation to the host. We prove a detectability bound that converts a target error rate into an explicit probe-size budget, and we delimit what probe rotation does and does not buy. On a controlled prompt-level host with four injected hacking channels and ground-truth labels, HackProbe reaches 0.763 AUROC against 0.663 for the strongest baseline and cuts the false-positive rate from 0.706 to 0.434. Its bandwidth-limited reselection is the only immunization level that returns more true capability under hacking, 5.2 points on average, than it forfeits on clean runs, 4.7; per-channel effects are mostly not individually significant.
Rongxin Yang, Yang Liu, Shang Luo et al.· 0 citations
Machine-learning-based network intrusion detection systems (NIDS) are increasingly evaluated with synthetic adversarial traffic, yet reported evasion rates often do not distinguish between structurally infeasible flow records and feasible network behavior. In generative NIDS research, synthetic data is more often used for augmentation than for validity-constrained adversarial generation. DiffuVader addresses this gap with a family-conditioned discrete diffusion model over a structured four-token state space. Generated samples require no gradient, query-feedback, or surrogate access and are evaluated against frozen detectors using valid evasion rate (VER), which credits only structurally valid, family-plausible samples. Evaluation uses the network-layer partition of the O-RAN testbed corpus NetsLab5GORAN-IDD under a session-disjoint chronological split with five sampling-seed uncertainty estimates. DiffuVader achieves 99.99% validity and plausibility while matching weighted replay in full-token distributional fidelity without direct row replay. A token-marginal control shows that token support alone is insufficient and learned cross-group structure is required for valid flow recovery. Per-family and duplicate analyses separate detector blindness from generator capability. Despite replay-scale fidelity, valid evasion is not reducible to exact decoded-row replay. Offline hardening exposes a trade-off between attack robustness and generated-benign calibration.
Hamed Fard, Ilya Komarov, Gerhard Wunder· International Conference on...· 0 citations
Game Theoretic Anticipatory Continual Graph Learning (GT-ACGL), a framework that casts fraud detection as a continuous Stackelberg game between a defender and an adaptive adversary, and encourages decision boundaries that remain comparatively stable under strategic structural perturbation.
Hui-Jie Fan, Yanan Jiao, M. Wang et al.· Scientific Reports· 1 citation
Trusted monitoring has a cheap, trusted model score a stronger untrusted model's actions, and a diverse ensemble of them beats a single stronger monitor at matched cost. They are built by minimising average pairwise correlation, and that paper's twelve monitors shared one base model, leaving open what supplies the diversity. We study 24 open-weight monitors spanning nine pretraining lineages and a 29x range of detection skill (pAUC at 10 percent FPR, 0.028 to 0.803) on backdoored code. The metric used to build panels does not predict what a panel is for, and we can say why. Agreement on attack items splits into a shared-detectability signal component and an idiosyncratic error component, which predict ensemble gain with opposite sign (Spearman -0.25 and +0.26), so their sum, the metric actually used, predicts it barely at all (+0.05); the cancellation holds in 7 of 8 evaluations. Skill acts on signal (+0.53) while error stays flat (-0.01), which is why a monitor's own skill predicts its agreement with the pool (Spearman 0.84, n = 24, permutation p below 0.0001). Pretraining lineage is the obvious way to buy decorrelation, and it does not pay. At matched member capability, cross-lineage panels detect no better (permutation p = 0.13), and lineage barely moves the metric either (+0.064, p = 0.18). We report that against ourselves: on our own 22-monitor pool the same test read +0.104 at p = 0.037 until two monitors were added. An earlier pool topping out at pAUC 0.23 had already invalidated another analysis. Such a quantity is a property of the pool assembled. Panel gain over the best member falls monotonically with panel skill (-0.66 at k = 2, -0.70 at k = 3), and no correlation-weighted selection beats picking the single best monitor out of sample. Across six attacker models the gain result holds in all six, the agreement and cancellation results in five of six.
Anik Jha· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
