Sybil, Collusion, and Brigading Detection¶

Abuse-detection monitor — instantiates Reputational Signal Governance

Detects fake accounts, coordinated rings, paid reviews, and retaliatory brigading that manufacture or attack reputation.

Sybil, Collusion, and Brigading Detection is the pipeline's immune system. It watches how reputation is produced and attacked, and flags patterns that mean the signal is being manufactured or weaponized: one operator behind many accounts (a Sybil attack^[1]), quid-pro-quo rating rings, sudden coordinated waves of praise or damage, paid reviews, retaliatory defamation. Its defining move is to judge the provenance and coordination of a body of signal rather than its content — and, in doing so, to defend the one-real-entity-per-subject boundary that every other component quietly assumes. Without it, a governed pipeline that cannot tell real signal from fabricated signal is governing nothing.

Example¶

An app marketplace notices a newly listed app climb to 4.9 stars in 48 hours on some 900 reviews. The detector pulls the cluster apart: the reviewing accounts were created the same week, they post in synchronized bursts from correlated devices and address ranges, their text is near-duplicated, and three other apps show the same reciprocal-review pattern with the same accounts. Rather than let that manufactured wave set the public score, the monitor quarantines the suspect ratings pending review. Buyers see a rating built from signal that survived screening — the fake surge is caught before it decides a single download.

How it works¶

What distinguishes it is that it reads metadata and structure, not opinions:

Profile the production. Account age, creation bursts, device and network correlation, timing synchrony, and near-duplicate text expose coordination that individual reviews hide.
Map the graph. Reciprocity and clustering in who-rates-whom surface rings and sock-puppet networks that no single rating reveals.
Emit a verdict, not a punishment. The output is a credibility judgment — down-weight, quarantine, investigate — that feeds the scoring and appeal layers rather than acting alone.

Tuning parameters¶

Detection threshold (precision vs. recall) — how aggressive to be. Tighter catches more fraud but also flags the innocent — a genuine viral moment can look exactly like a brigade.
Signal set — which cues to use (graph, timing, device, text). More cues detect more, at higher cost and deeper privacy intrusion.
Response severity — down-weight vs. quarantine vs. suspend. Harsher responses deter abuse and multiply the harm of a false positive.
Coordination window — the velocity band that counts as a "burst." Widen it to catch slow-burn rings, narrow it to catch flash brigades.
Adaptivity — static rules vs. models retrained as adversaries evolve. Adaptive keeps pace with attackers but is harder to explain and audit.

When it helps, and when it misleads¶

Its strength is foundational: it is the precondition for trusting anything else in the pipeline. A score, a badge, a ported attestation are only as honest as the raw signal beneath them, and this is the mechanism that keeps that signal from being counterfeited.

It misleads through the arms race and its own false positives. Adversaries adapt, so yesterday's detector misses today's ring; meanwhile genuine enthusiasm and legitimate coordinated action (a real grassroots surge, an organized but honest campaign) get swept up as fraud, and the surveillance it needs carries a real privacy cost. The classic misuse is labeling inconvenient signal — a wave of sincere criticism — as "brigading" in order to suppress it, using the abuse label to justify silencing critics. The discipline is to send flags to a human appeal path rather than an automatic ban, publish what patterns trigger review, and hold the line between coordinated and wrong.

How it implements the components¶

gaming_and_defamation_monitor — its core: detecting manufactured ratings, collusion rings, brigades, paid reviews, and retaliatory defamation from patterns of production.
reputation_subject_boundary — defends boundary integrity, collapsing sock-puppets back to one entity and blocking whitewash-by-new-identity (the essence of Sybil resistance).

It does NOT capture reviews (Rating and Review System), verify transaction facts (Verified Transaction History), aggregate scores (Reputation Score or Standing Index), or run the appeals that adjudicate its flags (Appeal and Correction Workflow).

Instantiates: Reputational Signal Governance — this monitor is the anti-abuse layer the rest of the pipeline relies on to stay honest.
Consumes: Rating and Review System — it screens the review stream that artifact collects.
Sibling mechanisms: Reputation Score or Standing Index · Rating and Review System · Verified Transaction History · Trust-Tier Badging · Appeal and Correction Workflow · Moderation Record with Reentry · Reputation Portability Protocol

Notes¶

The monitor produces verdicts, not verdict-plus-sentence. Wiring a flag straight to a permanent ban with no appeal is what turns anti-abuse into censorship, because the mechanism's false positives then fall on people with no recourse. Its output belongs upstream of the weighting and appeal layers, never in place of them.

References¶

[1] A Sybil attack is one actor forging many distinct identities to gain disproportionate influence over a system — stuffing a ballot, a rating, or a vote with puppets. Resistance to it is fundamentally about tying reputation to a well-defended subject boundary, which is why detection and boundary integrity are the same job here. ↩