{"id":"4e2d179a-a71b-4818-9e5d-eda801adb9bf","arxiv_id":"2607.27370","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"Gzip-based compression distance over transaction grammars separates Sybil from organic and MEV wallets and expands seed wallets into candidate clusters, but validation is weakened by potentially circular ground-truth labels.","lead":"An Ethereum Sybil-detection method uses gzip compression to compare wallets' transaction histories and find coordinated fake accounts without needing funding links. The paper reports strong neighborhood-purity results, but its evaluation relies on labels that may have been produced by the same behavioral-similarity signal, so the headline numbers are not independent.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Ground-truth independence is the load-bearing assumption: Hop's Sybil labels may encode the same behavioral regularities that NCD measures, making reported purity/recall partly circular.","rationale":"The reader's weakest assumption correctly identifies the central vulnerability. The paper's headline claim is that a training-free, compression-based method can discover Sybils without explicit funding links; the only large-scale validation is against Hop's airdrop Sybil list. If Hop's own Sybil detection relied on behavioral similarity of the same kind NCD measures, then the high within-class similarity and neighborhood purity are expected, not surprising. The authors are honest about scope limitations and include an ablation showing that the class-stratified vocabulary can be replaced by an unsupervised one, but that does not address the ground-truth independence problem. I also considered whether the lack of funding-link verification in the discovered neighborhoods is more load-bearing; however, even if the neighborhoods are financially disconnected, the apparent behavioral signal could still be an artifact of label-generation. The proposed test—inspecting the label-generation code and re-running on an independent label source—would settle the question. My read therefore supports the reader's REJECT verdict; no verdict change is needed.","tokens_in":11276,"tokens_out":6884,"duration_ms":82619,"concrete_test":"Read the hop-airdrop repository [13] and extract the exact Sybil-vs-Organic labeling rules. If (as suspected) the rules use transaction rhythm, function selectors, or EVM trace structure, rerun the Table 5 full_tokens retrieval on a ground truth generated by a non-behavioral rule (e.g., shared funding source only) or on a second campaign with independently audited labels. If the top-10 purity and recall (0.754/0.922) fall to near the 0.333 prior, the reported result is label-circular and the central claim requires revalidation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing condition is that the Hop Protocol Sybil/Organic labels in §4.1 are independent of the behavioral regularities that NCD measures. The paper never states the heuristics Hop used to produce the 'sybil' designation. If Hop's labeling was based on transaction timing, call-selector frequencies, execution-trace structure, or clustering of interaction histories, then the reported within-class similarity gaps (Table 3) and top-10 purity/recall (Table 5) are partly a restatement of the label-generation rule: NCD would be rediscovering the exact features that put wallets into the Sybil bucket. The concern is compounded because the pipeline is label-informed in two further places: the class-stratified Intent vocabulary (§3.2) selects the top-100 selectors using class labels, and the Blind-Spot Protocol (§4.1) uses Max Class Share purity to decide which contracts to strip. The paper's own §5 limitation admits the Blind-Spot protocol is label-informed. Thus the key empirical support for 'training-free ... without explicit funding links' is not yet independent evidence.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a training-free Sybil candidate discovery method for Ethereum. It encodes each wallet's EVM execution history as a symbolic Transaction Grammar capturing transaction rhythm, execution-trace structure, and function-level intent. Pairwise similarities between wallets are computed using gzip-based Normalized Compression Distance (NCD), forming an implicit behavioral graph that does not rely on token-transfer edges. A label-informed Blind-Spot Protocol removes high-signal contracts to reduce shortcut leakage. The method is evaluated on a dataset of Organic, MEV Bot, and Sybil wallets labeled from the Hop Protocol airdrop list, comparing against XGBoost, TF-IDF+LR, and BiLSTM baselines, and is tested under a temporal split and synthetic camouflage perturbations. The authors position the contribution as a local discovery primitive for open-world blockchain audits rather than a formal open-set classifier.","tokens_in":11517,"tokens_out":6920,"duration_ms":70912,"significance":"If the results are valid, the paper offers a useful primitive: compression-based behavioral similarity that is unsupervised, requires no financial links, and shows retrieval performance comparable to a BiLSTM. The runtime benchmark, the unsupervised-vocabulary ablation, and the explicit acknowledgement of label-informed components are strengths that make the limitations transparent. However, the central empirical claim depends on the independence of the Hop Protocol Sybil labels from the behavioral regularities measured by NCD. Without evidence of that independence, the reported purity/recall numbers may partly restate the label-generation rule. The paper also contains an inconsistency in the headline retrieval numbers. These issues must be addressed before the contribution can be considered established.","major_comments":[{"comment":"Ground-truth labels for Organic and Sybil wallets are sourced from the Hop Protocol airdrop list [13], but the manuscript never states the heuristics Hop used to designate Sybils. If Hop's labeling used transaction timing, call-selector frequencies, execution-trace structure, or clustering of interaction histories—the same signals captured by the Transaction Grammar and measured by NCD—then the within-class similarity gaps in Table 3 and the top-10 purity/recall in Table 5 are partly a restatement of the label-generation rule. This is the load-bearing assumption for the paper's central claim. Please either provide the exact Hop labeling methodology, demonstrate via a concrete analysis that the labels are independent of the measured behavioral regularities, or re-validate on an independently labeled dataset.","section":"§4.1"},{"comment":"The reported full_tokens NCD 1-NN accuracy is inconsistent. Table 4 reports 0.713±0.024 (Raw) and 0.703±0.013 (Leakage-Free), but the text in §4.3 states 'achieving a 1-NN accuracy of 0.696±0.030' and Table 5 lists full_tokens NCD at 0.696±0.030. The claim of parity with BiLSTM also differs: §4.3 says both reach 0.703, but Table 5's number is 0.696. This discrepancy affects the paper's headline numerical claims and must be clarified: which setting, sampling, and seed protocol produce Table 5, and why does it differ from Table 4?","section":"§4.3, Tables 4 and 5"},{"comment":"The evaluation pipeline is label-informed in two places beyond the ground-truth labels themselves: the primary Intent vocabulary is constructed on a class-stratified basis, and the Blind-Spot Protocol removes contracts based on Max Class Share purity, a label-derived quantity. The paper does provide an ablation showing an unsupervised global-frequency vocabulary gives nearly identical retrieval quality (≤0.003 difference in 1-NN accuracy) and explicitly admits in §5 that the Blind-Spot protocol is label-informed. However, the combination of these label-informed choices with potentially circular Hop labels compounds the validity concern. Please report results for a fully label-free variant of the pipeline (e.g., global-frequency vocabulary and no Blind-Spot filtering, or a purely unsupervised contract-removal criterion) to show the main retrieval claims do not depend on access to class la","section":"§3.2 and §4.1"}],"minor_comments":[{"comment":"The caption does not state whether the reported numbers are Raw or Leakage-Free, nor how the sampling relates to Table 4. Please clarify.","section":"Table 5"},{"comment":"The statement about a 'common-language effect size of approximately 0.837, excluding ties' is not derived from Cliff's δ in the text; please show the calculation or define the alternative measure.","section":"§4.2"},{"comment":"The sequence types 'rhythm_only', 'coarse_intent', 'rhythm+intent', and 'full_tokens' are used throughout but not defined precisely. Please define each combination and state which components appear in 'full_tokens' vs 'rhythm+intent'.","section":"§3.2"},{"comment":"The sentence 'This suggests NCD captures structure beyond token frequency, with a 5.1% lead over TF-IDF' uses 0.696 vs 0.645, but Table 4 raw values are 0.713 vs 0.666. Please harmonize the comparison basis.","section":"§4.3"},{"comment":"The camouflage perturbations are synthetic and not calibrated to observed evasion. The text acknowledges this, but the table and discussion could be more explicit that the stress test is a controlled failure-boundary analysis, not a model of real-world Sybil behavior.","section":"§4.5"}],"recommendation":"major_revision","confidential_remarks":"The novelty and formulation are interesting, and the authors are transparent about several limitations. The main blocker is the ground-truth independence question: the Hop Protocol labels are the entire basis of the empirical claims, and the paper does not document how Hop generated them. If the authors can provide that documentation or an independent replication, the paper could be strengthened substantially. The numerical inconsistency between Tables 4 and 5 also needs a careful correction. I recommend major revision rather than rejection because the issues, while load-bearing, are addressable in principle and the core unsupervised-discovery idea has potential value for the blockchain analytics community."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper applies gzip-based Normalized Compression Distance to Ethereum wallet behavior and argues it can expand a seed Sybil wallet into a coordinated cluster without training or funding links. That's a reasonable idea, and the Transaction Grammar encoding is thoughtful. But the central numbers rest on labels that were themselves generated by behavioral signals similar to what NCD measures, so the headline claim is not actually established.\n\nWhat's new: first NCD-for-Ethereum-Sybil application; a three-part grammar (rhythm, execution structure, intent) that is a sensible way to serialize traces; and a Blind-Spot protocol to remove high-signal contracts. The paper is also honest about its scope, explicitly saying the method is a local discovery primitive rather than a full open-set system, and it admits the Blind-Spot protocol is label-informed. That is more than most papers do.\n\nWhere it falls short: the Hop airdrop Sybil labels are not independent ground truth. The paper never states how Hop determined Sybils. If Hop used transaction timing, call-selector frequencies, or clustering of interaction histories, which is likely, then the high within-Sybil similarity and the top-10 purity (0.754) are partly a restatement of the labeling rule. The problem is compounded by the class-stratified vocabulary (Section 3.2) and the label-purity-based filtering in the Blind-Spot protocol (Section 4.1). The unsupervised vocabulary ablation partially addresses the former, but the main protocol is still label-informed. The paper also never checks that the discovered neighborhoods actually lack financial links, which is part of the core claim. And there are no code or data artifacts, and the temporal split is reported without variance.\n\nTables 4 and 5 also seem to tell different stories for the same full_tokens encoding, which needs reconciliation.\n\nWho it's for: blockchain security researchers interested in compression-based approaches or in a worked example of label leakage in behavior-based detection. It is not ready to be used as evidence that NCD works in the wild.\n\nRecommendation: send it to peer review — it deserves a serious referee — but with the expectation of major revision. The authors need to validate on a second campaign with independently generated labels, release artifacts, and directly test whether the neighborhoods are actually disconnected in the funding graph.","headline":"Sensible NCD-based idea, but the main evaluation is circular because the Sybil labels come from the same kind of behavior the method measures.","tokens_in":12020,"tokens_out":2896,"would_cite":false,"duration_ms":32394,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Compression-based similarity finds Ethereum Sybil wallets without fund links","keywords":["Ethereum","Sybil detection","Normalized Compression Distance","Transaction Grammar","behavioral similarity","open-world discovery","gzip","EVM traces"],"falsifier":"Apply the same NCD retrieval pipeline to a second, independently audited airdrop or governance campaign with labels produced by a different method (e.g., manual inspection of exchange flows); if top-10 Sybil purity drops to the class prior (~0.33) or ceases to exceed a bag-of-symbols TF-IDF baseline, the central claim of transferable behavioral coordination would be falsified.","tokens_in":11144,"feed_emoji":"🔍","tokens_out":2938,"duration_ms":33175,"temperature":0.7,"pith_summary":"This paper argues that Sybil wallets on Ethereum can be discovered by comparing compressed transaction histories, without supervised training or direct token-transfer links. Each wallet is encoded as a symbolic transaction grammar capturing rhythm, execution structure, and function intent, and pairwise similarity is measured with gzip-based Normalized Compression Distance (NCD). The authors show that Sybil wallets form dense, high-purity neighborhoods: for a given suspect wallet, about 75% of its top-10 behavioral neighbors are also Sybils, with near-complete recall in the local neighborhood. This holds even after removing high-signal contract interactions that could leak class information, and the method matches a recurrent neural network's accuracy without requiring labeled training data. A sympathetic reader would care because it reframes Sybil detection as training-free local candidate discovery, fitting the open-world, label-scarce reality of blockchain audits.","feed_headline":"Sybil wallets on Ethereum found by gzip compression alone","feed_subtitle":"No training, no fund links: one suspect address pulls nearby attack wallets with 75% purity.","key_machinery":"The central machinery is the Transaction Grammar, a symbolic sequence representation where each transaction is a token combining rhythm (inter-arrival time in 16 log-bins), structure (a composite string of binned EVM trace metrics such as call depth, branching, and error flags), and intent (a 100-token function-selector vocabulary, with an unsupervised global-frequency variant validated as equivalent). Similarity between wallets is then measured by Normalized Compression Distance (NCD), defined as (C(xy) - min(C(x), C(y))) / max(C(x), C(y)) using gzip, which detects shared repeated motifs in the concatenated sequence. The resulting pairwise distance matrix defines an implicit behavioral grap","core_discovery":"The paper's central claim is that compression-based behavioral similarity, applied to symbolic transaction grammars, can serve as an effective local primitive for expanding suspicious seed wallets into coordinated Sybil clusters, without explicit financial edges or a closed-set classifier. The evidence: Sybil wallets show higher within-class NCD similarity than organic users or MEV bots; 1-NN retrieval on the full grammar achieves 0.696 mean accuracy, parity with a BiLSTM in the leakage-free setting; top-10 neighborhood purity reaches 0.754 and recall 0.922; the signal degrades gracefully under a synthetic camouflage stress test (0.981 recall at 50% noise) while a tree-based baseline falls t","pith_inferences":["Beyond the paper's claims: because the Blind-Spot protocol itself is label-informed, a fully practical deployment would need an unsupervised proxy for high-signal contracts, otherwise the leakage-control step reintroduces the need for labeled data at deployment time.","Aware adversaries who know the metric could deliberately randomize timing, shuffle transaction order, or mix chaff to raise the per-sequence entropy; the paper's synthetic stress test only approximates such campaigns, so the real-world evasion boundary remains an open empirical question.","The implicit behavioral graph's success on Ethereum suggests analogous applications wherever scripted accounts produce repetitive execution traces, e.g., detecting coordinated fake engagement on other EVM-compatible chains or in centralized off-chain services, though transferability is untested.","The cross-period recall drop (0.933 to 0.782) hints that campaign-level temporal drift is real; a natural extension is to test whether periodic re-anchoring to fresh seed wallets can maintain recall over evolving campaigns."],"forward_implications":["If correct, an auditor with one suspected Sybil wallet can expand it into a likely cluster without needing on-chain funding graphs or labeled training data, making the method directly usable in open-world audits.","NCD's parity with a BiLSTM suggests that expensive supervised sequence models may be unnecessary for this local candidate-discovery task, reducing computational and labeling overhead.","The Blind-Spot protocol's denoising effect implies that removing class-indicative contracts can sharpen behavioral coordination signals, a practice that could improve other blockchain analytics pipelines.","The MinHash/LSH variant cuts lookup time from ~98s to ~2s without accuracy loss, pointing to a scalable two-stage architecture for production-scale global discovery.","NCD's resilience under synthetic camouflage relative to XGBoost indicates that compression-based similarity may be harder to evade than feature-based classifiers, at least for the perturbations tested."],"fun_headline_variants":["Gzip alone exposes Sybil wallet clusters on Ethereum","Compression finds Sybils without fund links or training","Ethereum Sybil detection via gzip behavioral similarity","No ML needed: gzip uncovers Sybil wallets on Ethereum","Trained-free gzip method spots Sybil groups from traces"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The Sybil and organic labels used for evaluation come from a public airdrop distribution list whose own labeling criteria are not disclosed, so if those criteria were based on the same kind of behavioral regularity the paper measures, the reported separation would partly restate the label-generation rule rather than independently confirm the method.","fun_headline_variants_meta":{"raw":{"variants":["Gzip alone exposes Sybil wallet clusters on Ethereum","Compression finds Sybils without fund links or training","Ethereum Sybil detection via gzip behavioral similarity","No ML needed: gzip uncovers Sybil wallets on Ethereum","Trained-free gzip method spots Sybil groups from traces"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000224,"raw_usage":{"total_tokens":1317,"prompt_tokens":783,"completion_tokens":534,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":527,"completion_tokens_details":{"reasoning_tokens":451}},"tokens_in":527,"tokens_out":534,"duration_ms":5811,"temperature":1.0,"reasoning_tokens":451,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T08:36:51.871617+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Apply the same NCD retrieval pipeline to a second, independently audited airdrop or governance campaign with labels produced by a different method (e.g., manual inspection of exchange flows); if top-10 Sybil purity drops to the class prior (~0.33) or ceases to exceed a bag-of-symbols TF-IDF baseline, the central claim of transferable behavioral coordination would be falsified.","supporting_citations":[],"review_version":1}