Pith. sign in

REVIEW 3 major objections 5 minor 28 references

Compression-based similarity finds Ethereum Sybil wallets without fund links

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 08:36 UTC pith:4G7IZL6O

load-bearing objection Sensible NCD-based idea, but the main evaluation is circular because the Sybil labels come from the same kind of behavior the method measures. the 3 major comments →

arxiv 2607.27370 v1 pith:4G7IZL6O submitted 2026-07-29 cs.LG

Compression-Based Behavioral Similarity for Open-World Sybil Discovery on Ethereum

Micha{\l} Bartnicki , Jaros{\l}aw A. Chudziak This is my paper
classification cs.LG
keywords EthereumSybil detectionNormalized Compression DistanceTransaction Grammarbehavioral similarityopen-world discoverygzipEVM traces
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that Sybil wallets on Ethereum can be discovered by comparing compressed transaction histories, without supervised training or direct token-transfer links. Each wallet is encoded as a symbolic transaction grammar capturing rhythm, execution structure, and function intent, and pairwise similarity is measured with gzip-based Normalized Compression Distance (NCD). The authors show that Sybil wallets form dense, high-purity neighborhoods: for a given suspect wallet, about 75% of its top-10 behavioral neighbors are also Sybils, with near-complete recall in the local neighborhood. This holds even after removing high-signal contract interactions that could leak class information, and the method matches a recurrent neural network's accuracy without requiring labeled training data. A sympathetic reader would care because it reframes Sybil detection as training-free local candidate discovery, fitting the open-world, label-scarce reality of blockchain audits.

Core claim

The paper's central claim is that compression-based behavioral similarity, applied to symbolic transaction grammars, can serve as an effective local primitive for expanding suspicious seed wallets into coordinated Sybil clusters, without explicit financial edges or a closed-set classifier. The evidence: Sybil wallets show higher within-class NCD similarity than organic users or MEV bots; 1-NN retrieval on the full grammar achieves 0.696 mean accuracy, parity with a BiLSTM in the leakage-free setting; top-10 neighborhood purity reaches 0.754 and recall 0.922; the signal degrades gracefully under a synthetic camouflage stress test (0.981 recall at 50% noise) while a tree-based baseline falls t

What carries the argument

The central machinery is the Transaction Grammar, a symbolic sequence representation where each transaction is a token combining rhythm (inter-arrival time in 16 log-bins), structure (a composite string of binned EVM trace metrics such as call depth, branching, and error flags), and intent (a 100-token function-selector vocabulary, with an unsupervised global-frequency variant validated as equivalent). Similarity between wallets is then measured by Normalized Compression Distance (NCD), defined as (C(xy) - min(C(x), C(y))) / max(C(x), C(y)) using gzip, which detects shared repeated motifs in the concatenated sequence. The resulting pairwise distance matrix defines an implicit behavioral grap

Load-bearing premise

The Sybil and organic labels used for evaluation come from a public airdrop distribution list whose own labeling criteria are not disclosed, so if those criteria were based on the same kind of behavioral regularity the paper measures, the reported separation would partly restate the label-generation rule rather than independently confirm the method.

What would settle it

Apply the same NCD retrieval pipeline to a second, independently audited airdrop or governance campaign with labels produced by a different method (e.g., manual inspection of exchange flows); if top-10 Sybil purity drops to the class prior (~0.33) or ceases to exceed a bag-of-symbols TF-IDF baseline, the central claim of transferable behavioral coordination would be falsified.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If correct, an auditor with one suspected Sybil wallet can expand it into a likely cluster without needing on-chain funding graphs or labeled training data, making the method directly usable in open-world audits.
  • NCD's parity with a BiLSTM suggests that expensive supervised sequence models may be unnecessary for this local candidate-discovery task, reducing computational and labeling overhead.
  • The Blind-Spot protocol's denoising effect implies that removing class-indicative contracts can sharpen behavioral coordination signals, a practice that could improve other blockchain analytics pipelines.
  • The MinHash/LSH variant cuts lookup time from ~98s to ~2s without accuracy loss, pointing to a scalable two-stage architecture for production-scale global discovery.
  • NCD's resilience under synthetic camouflage relative to XGBoost indicates that compression-based similarity may be harder to evade than feature-based classifiers, at least for the perturbations tested.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's claims: because the Blind-Spot protocol itself is label-informed, a fully practical deployment would need an unsupervised proxy for high-signal contracts, otherwise the leakage-control step reintroduces the need for labeled data at deployment time.
  • Aware adversaries who know the metric could deliberately randomize timing, shuffle transaction order, or mix chaff to raise the per-sequence entropy; the paper's synthetic stress test only approximates such campaigns, so the real-world evasion boundary remains an open empirical question.
  • The implicit behavioral graph's success on Ethereum suggests analogous applications wherever scripted accounts produce repetitive execution traces, e.g., detecting coordinated fake engagement on other EVM-compatible chains or in centralized off-chain services, though transferability is untested.
  • The cross-period recall drop (0.933 to 0.782) hints that campaign-level temporal drift is real; a natural extension is to test whether periodic re-anchoring to fresh seed wallets can maintain recall over evolving campaigns.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a training-free Sybil candidate discovery method for Ethereum. It encodes each wallet's EVM execution history as a symbolic Transaction Grammar capturing transaction rhythm, execution-trace structure, and function-level intent. Pairwise similarities between wallets are computed using gzip-based Normalized Compression Distance (NCD), forming an implicit behavioral graph that does not rely on token-transfer edges. A label-informed Blind-Spot Protocol removes high-signal contracts to reduce shortcut leakage. The method is evaluated on a dataset of Organic, MEV Bot, and Sybil wallets labeled from the Hop Protocol airdrop list, comparing against XGBoost, TF-IDF+LR, and BiLSTM baselines, and is tested under a temporal split and synthetic camouflage perturbations. The authors position the contribution as a local discovery primitive for open-world blockchain audits rather than a formal open-set classifier.

Significance. If the results are valid, the paper offers a useful primitive: compression-based behavioral similarity that is unsupervised, requires no financial links, and shows retrieval performance comparable to a BiLSTM. The runtime benchmark, the unsupervised-vocabulary ablation, and the explicit acknowledgement of label-informed components are strengths that make the limitations transparent. However, the central empirical claim depends on the independence of the Hop Protocol Sybil labels from the behavioral regularities measured by NCD. Without evidence of that independence, the reported purity/recall numbers may partly restate the label-generation rule. The paper also contains an inconsistency in the headline retrieval numbers. These issues must be addressed before the contribution can be considered established.

major comments (3)
  1. [§4.1] Ground-truth labels for Organic and Sybil wallets are sourced from the Hop Protocol airdrop list [13], but the manuscript never states the heuristics Hop used to designate Sybils. If Hop's labeling used transaction timing, call-selector frequencies, execution-trace structure, or clustering of interaction histories—the same signals captured by the Transaction Grammar and measured by NCD—then the within-class similarity gaps in Table 3 and the top-10 purity/recall in Table 5 are partly a restatement of the label-generation rule. This is the load-bearing assumption for the paper's central claim. Please either provide the exact Hop labeling methodology, demonstrate via a concrete analysis that the labels are independent of the measured behavioral regularities, or re-validate on an independently labeled dataset.
  2. [§4.3, Tables 4 and 5] The reported full_tokens NCD 1-NN accuracy is inconsistent. Table 4 reports 0.713±0.024 (Raw) and 0.703±0.013 (Leakage-Free), but the text in §4.3 states 'achieving a 1-NN accuracy of 0.696±0.030' and Table 5 lists full_tokens NCD at 0.696±0.030. The claim of parity with BiLSTM also differs: §4.3 says both reach 0.703, but Table 5's number is 0.696. This discrepancy affects the paper's headline numerical claims and must be clarified: which setting, sampling, and seed protocol produce Table 5, and why does it differ from Table 4?
  3. [§3.2 and §4.1] The evaluation pipeline is label-informed in two places beyond the ground-truth labels themselves: the primary Intent vocabulary is constructed on a class-stratified basis, and the Blind-Spot Protocol removes contracts based on Max Class Share purity, a label-derived quantity. The paper does provide an ablation showing an unsupervised global-frequency vocabulary gives nearly identical retrieval quality (≤0.003 difference in 1-NN accuracy) and explicitly admits in §5 that the Blind-Spot protocol is label-informed. However, the combination of these label-informed choices with potentially circular Hop labels compounds the validity concern. Please report results for a fully label-free variant of the pipeline (e.g., global-frequency vocabulary and no Blind-Spot filtering, or a purely unsupervised contract-removal criterion) to show the main retrieval claims do not depend on access to class la
minor comments (5)
  1. [Table 5] The caption does not state whether the reported numbers are Raw or Leakage-Free, nor how the sampling relates to Table 4. Please clarify.
  2. [§4.2] The statement about a 'common-language effect size of approximately 0.837, excluding ties' is not derived from Cliff's δ in the text; please show the calculation or define the alternative measure.
  3. [§3.2] The sequence types 'rhythm_only', 'coarse_intent', 'rhythm+intent', and 'full_tokens' are used throughout but not defined precisely. Please define each combination and state which components appear in 'full_tokens' vs 'rhythm+intent'.
  4. [§4.3] The sentence 'This suggests NCD captures structure beyond token frequency, with a 5.1% lead over TF-IDF' uses 0.696 vs 0.645, but Table 4 raw values are 0.713 vs 0.666. Please harmonize the comparison basis.
  5. [§4.5] The camouflage perturbations are synthetic and not calibrated to observed evasion. The text acknowledges this, but the table and discussion could be more explicit that the stress test is a controlled failure-boundary analysis, not a model of real-world Sybil behavior.

Circularity Check

0 steps flagged

No significant circularity: the NCD primitive is parameter-free and evaluated against external labels; label-informed vocabulary selection and the Blind-Spot filter are acknowledged and shown by the paper's own ablations not to drive the main result.

full rationale

The paper's derivation chain is: encode wallet histories as Transaction Grammar tokens, compute gzip-based NCD, build an implicit similarity graph, and use k-NN retrieval to discover Sybil candidates. The NCD computation itself has no trainable parameters and is not defined in terms of the Sybil/Organic/MEV labels; it operates only on the encoded transaction sequences. The evaluation labels are imported from external sources: 'Organic and Sybil actors have been sourced from the Hop Protocol airdrop list [13]' and MEV labels from Dune Analytics (§4.1). Two components are label-informed, but the paper provides direct evidence that they are not load-bearing. First, the Intent vocabulary is 'class-stratified' (§3.2), yet §4.3 states that replacing it with 'a purely unsupervised vocabulary of the same size' changes full-token 1-NN accuracy 'by at most 0.003'. Second, the Blind-Spot Protocol is explicitly called 'label-informed' in §3.2 and acknowledged in §5 as 'a leakage-control evaluation tool rather than a fully label-free deployment procedure'; however, Raw and Leakage-Free NCD accuracies differ by less than 1% on full_tokens (§4.3), so the headline retrieval numbers are not solely an artifact of that filter. The remaining concern is the unverified independence of the Hop labels: the paper does not describe the heuristics Hop used to label Sybils, so those labels could in principle encode the same behavioral regularities that NCD measures. That would be an external ground-truth validity problem rather than a by-construction circularity exhibited in the paper's equations. No self-citation chain is load-bearing; references to the authors' prior work are incidental. On the evidence provided, the central derivation is not circular.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

No new physical or conceptual entities (particles, forces, dimensions) are postulated. 'Transaction Grammar' and 'implicit behavioral graph' are representational constructs, not invented entities in the sense of this ledger.

free parameters (4)
  • Rhythm log-bins = 16 bins (same-block to >30 days)
    Temporal discretization is chosen by hand; NCD separation and retrieval depend on bin boundaries.
  • Intent vocabulary size |V| = 100
    Vocabulary size and class-stratified selection are hand-set; the primary encoding uses labels to choose selectors, with a global-frequency ablation as a control.
  • Blind-Spot thresholds = n>=50, purity>=0.95, entropy near 0
    These cutoffs determine which transactions are removed (25.5% volume) and which 443 wallets are dropped; no sensitivity analysis is reported.
  • Minimum history length Lmin = 10 transactions per window
    Wallet-exclusion threshold used before and after Blind-Spot filtering; affects dataset composition.
axioms (4)
  • domain assumption gzip NCD approximates algorithmic similarity of behavior
    The paper assumes the compression ratio of concatenated wallet sequences reflects shared script structure rather than length or token-frequency artifacts; this is the central primitive and is not independently calibrated.
  • domain assumption Hop Protocol Sybil labels are valid and independent ground truth
    The dataset is built from [13] without explaining Hop's labeling rule; all accuracy, purity, and recall figures depend on this assumption.
  • domain assumption Blind-Spot filtering removes all label leakage from high-signal contracts
    After removing 25.5% of transactions, the remaining NCD signal is attributed to behavior; the protocol itself is label-informed and thresholds are hand-set.
  • domain assumption Wallets in the dataset have stable behavioral grammars across time
    The temporal split assumes early and late windows both represent campaign behavior; the paper explicitly leaves cross-campaign transfer out of scope.

pith-pipeline@v1.3.0-daily-deepseek · 10931 in / 17670 out tokens · 187325 ms · 2026-08-01T08:36:51.871617+00:00 · methodology

0 comments
read the original abstract

Sybil attackers are Blockchain actors that adopt the characteristics of regular users to exploit airdrops or influence governance. Current methods of Sybil actor detection include constructing graphs, which requires token transfers between examined wallets. Machine learning algorithms have been employed as well, but they treat the task as a closed-set classification problem, making them vulnerable to frequent changes in attack strategies or evasion tactics. We address the following questions: can compression-based similarity differentiate Sybil bots, organic users, and arbitrage bot wallets without direct financial links? What is the effect of high-signal contracts on the discovery of Sybils, and how robust are behavioral graphs under temporal drift and adversarial perturbations? Our approach synthesizes a symbolic Transaction Grammar from EVM (Ethereum Virtual Machine) traces, capturing separately transaction rhythm, execution structure, and functional intent. The high-signal contracts are filtered with our own protocol, called the Blind-Spot Protocol. Gzip-based NCD is used to construct a behavioral graph for Sybil discovery. We validate this framework against supervised machine learning baselines, a temporal split, and synthetic camouflage stress tests. Ultimately, we contribute a leakage-aware behavioral framework for Sybil candidate discovery. Its core NCD primitive requires no supervised training and can expand suspicious seed wallets without explicit funding links. We position the method as a training-free local discovery primitive for open-world blockchain audits, rather than as a formal open-set recognition system.

Figures

Figures reproduced from arXiv: 2607.27370 by Jaros{\l}aw A. Chudziak, Micha{\l} Bartnicki.

Figure 1
Figure 1. Figure 1: Distribution of within-class behavioral similarity (1-NCD) for the Full Tokens grammar. The Sybil class exhibits a markedly higher similarity baseline compared to Organic and MEV actors. 4.3 Candidate Discovery and Comparative Analysis To test whether compression-based similarity can support Sybil candidate dis￾covery without financial links, we evaluate nearest-neighbor retrieval in the NCD behavioral gra… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

28 extracted references · 2 canonical work pages · 1 internal anchor

  1. [1]

    IEEE Access (2024)

    Alipanahloo, Z., Hafid, A.S., Zhang, K.: Maximum extractable value (mev) miti- gation approaches in ethereum and layer-2 chains: A comprehensive survey. IEEE Access (2024). https://doi.org/10.1109/access.2024.3514375

    arXiv 2024

  2. [2]

    En- tropy22(5) (2020)

    Alshahwan, N., Barr, et al.: Detecting malware with information complexity. En- tropy22(5) (2020). https://doi.org/10.3390/e22050575

    work page doi:10.3390/e22050575 2020

  3. [3]

    In: Proceedings

    Broder, A.: On the resemblance and containment of documents. In: Proceedings. Compression and Complexity of SEQUENCES 1997 (1997). https://doi.org/10.1109/SEQUEN.1997.666900

    arXiv 1997

  4. [4]

    In: Proc

    Chen, T., Guestrin, C.: Xgboost: A scalable tree boosting system. In: Proc. KDD (2016). https://doi.org/10.1145/2939672.2939785

    arXiv 2016

  5. [5]

    In: IEEE INFOCOM 2018 (2018)

    Chen, T., et al.: Understanding ethereum via graph analysis. In: IEEE INFOCOM 2018 (2018). https://doi.org/10.1109/INFOCOM.2018.8486401

    arXiv 2018

  6. [6]

    Information Theory, IEEE Transactions on51(2005)

    Cilibrasi, R., Vitányi, P.: Clustering by compression. Information Theory, IEEE Transactions on51(2005). https://doi.org/10.1109/TIT.2005.844059

    arXiv 2005

  7. [7]

    In: 2020 IEEE Symposium on Security and Privacy (SP) (2020)

    Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L., Juels, A.: Flash boys 2.0: Frontrunning in decentralized exchanges, miner ex- tractable value, and consensus instability. In: 2020 IEEE Symposium on Security and Privacy (SP) (2020). https://doi.org/10.1109/SP40000.2020.00040

    arXiv 2020

  8. [8]

    Douceur,J.:Thesybilattack(102002).https://doi.org/10.1007/3-540-45748-8_24

    doi:10.1007/3-540-45748-8_24

  9. [9]

    Nature Machine In- telligence2(11) (2020)

    Geirhos, R., Jacobsen, J.H., Michaelis, C., Zemel, R., Brendel, W., Bethge, M., Wichmann, F.A.: Shortcut learning in deep neural networks. Nature Machine In- telligence2(11) (2020). https://doi.org/10.1038/s42256-020-00257-z

    doi:10.1038/s42256-020-00257-z 2020

  10. [10]

    36th NeurIPS (2022)

    Grinsztajn, L., Oyallon, E., Varoquaux, G.: Why do tree-based models still out- perform deep learning on typical tabular data? In: Proc. 36th NeurIPS (2022). https://doi.org/10.48550/arXiv.2207.08815 Bartnicki, Chudziak

    Pith/arXiv arXiv doi:10.48550/arxiv.2207.08815 2022

  11. [11]

    Theory of Computing8(01 2012)

    Har-Peled, S., Indyk, P., Motwani, R.: Approximate nearest neighbor: To- wards removing the curse of dimensionality. Theory of Computing8(01 2012). https://doi.org/10.4086/toc.2012.v008a014

    doi:10.4086/toc.2012.v008a014 2012

  12. [12]

    Neural Computation9 (11 1997)

    Hochreiter, S., Schmidhuber, J.: Long short-term memory. Neural Computation9 (11 1997). https://doi.org/10.1162/neco.1997.9.8.1735

    doi:10.1162/neco.1997.9.8.1735 1997

  13. [13]

    https://github.com/hop- protocol/hop-airdrop (2022), gitHub repository (accessed 2026-02-01)

    Hop Protocol: hop-airdrop: Hop Airdrop distribution. https://github.com/hop- protocol/hop-airdrop (2022), gitHub repository (accessed 2026-02-01)

    2022

  14. [14]

    IEEE Transactions on Circuits and Systems II: Express Briefs 69(5) (2022)

    Huang, T., Lin, D., Wu, J.: Ethereum account classification based on graph con- volutional network. IEEE Transactions on Circuits and Systems II: Express Briefs 69(5) (2022). https://doi.org/10.1109/TCSII.2022.3161112

    arXiv 2022

  15. [15]

    Kaufman, S., Rosset, S., Perlich, C.: Leakage in data mining: Formulation, detec- tion, and avoidance. vol. 6 (01 2011). https://doi.org/10.1145/2020408.2020496

    arXiv 2011

  16. [16]

    In: Proc

    Kwiatkowski, J., Chudziak, J.A.: On evaluating loss functions for stock ranking: An empirical analysis with transformer model. In: Proc. of the 34th ACM Int. Conf. on Information and Knowledge Management (2025). https://doi.org/10.1145/3746252.3760812

    arXiv 2025

  17. [17]

    IEEE Transactions on Network Science and Engineering 9(4) (2022)

    Liu, J., et al.: Fa-gnn: Filter and augment graph neural networks for account classification in ethereum. IEEE Transactions on Network Science and Engineering 9(4) (2022). https://doi.org/10.1109/TNSE.2022.3166655

    arXiv 2022

  18. [18]

    In: 2025 IEEE Int

    Liu, Q., et al.: Detecting sybil addresses in blockchain airdrops: A subgraph-based feature propagation and fusion approach. In: 2025 IEEE Int. Conf. on Blockchain and Cryptocurrency (ICBC) (2025). https://doi.org/10.1109/ICBC64466.2025.11185061

    arXiv 2025

  19. [19]

    Cambridge University Press, Cambridge, UK (2008), http://nlp.stanford.edu/IR- book/information-retrieval-book.html

    Manning, C.D., Raghavan, P., Schütze, H.: Introduction to Information Retrieval. Cambridge University Press, Cambridge, UK (2008), http://nlp.stanford.edu/IR- book/information-retrieval-book.html

    2008

  20. [20]

    Airdrops: Giving Money Away Is Harder Than It Seems

    Messias, J., Yaish, A., Livshits, B.: Airdrops: Giving money away is harder than it seems (2023). https://doi.org/10.48550/arXiv.2312.02752

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2312.02752 2023

  21. [21]

    In: Companion Proc

    Niedermayer, T., Saggese, P., Haslhofer, B.: Detecting financial bots on the ethereum blockchain. In: Companion Proc. ACM Web Conf. 2024 (2024). https://doi.org/10.1145/3589335.3651959

    arXiv 2024

  22. [22]

    In: Proceedings of the 28th USENIX Conference on Security Symposium

    Pendlebury, F., et al.: Tesseract: eliminating experimental bias in malware classifi- cation across space and time. In: Proceedings of the 28th USENIX Conference on Security Symposium. SEC’19, USENIX Association, USA (2019)

    2019

  23. [23]

    IEEE Transactions on Pattern Analysis and Machine Intelligence 35(7) (2013)

    Scheirer, W.J., de Rezende Rocha, A., Sapkota, A., Boult, T.E.: Toward open set recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence 35(7) (2013). https://doi.org/10.1109/TPAMI.2012.256

    doi:10.1109/tpami.2012.256 2013

  24. [24]

    Information Fusion81(2022)

    Shwartz-Ziv, R., Armon, A.: Tabular data: Deep learning is not all you need. Information Fusion81(2022). https://doi.org/10.1016/j.inffus.2021.11.011

    doi:10.1016/j.inffus.2021.11.011 2022

  25. [25]

    Szydłowski, K.Ł., Chudziak, J.A.: Hidformer: Transformer-style neural network in stock price forecasting (2024), https://arxiv.org/abs/2412.19932

    Pith/arXiv arXiv 2024

  26. [26]

    In: 2025 IEEE 37th Inter- national Conference on Tools with Artificial Intelligence (ICTAI) (2025)

    Tokajuk, A., Chudziak, J.: Partial multivariate transformer as a tool for cryptocurrencies time series prediction. In: 2025 IEEE 37th Inter- national Conference on Tools with Artificial Intelligence (ICTAI) (2025). https://doi.org/10.1109/ICTAI66417.2025.00147

    arXiv 2025

  27. [27]

    https://doi.org/10.1007/978-3-030-51280-4_33

    Victor, F.: Address Clustering Heuristics for Ethereum (07 2020). https://doi.org/10.1007/978-3-030-51280-4_33

    doi:10.1007/978-3-030-51280-4_33 2020

  28. [28]

    In: 2023 IEEE Symposium on Security and Privacy (SP) (2023)

    Zhou, L., et al.: SoK: Decentralized Finance (DeFi) Attacks . In: 2023 IEEE Symposium on Security and Privacy (SP) (2023). https://doi.org/10.1109/SP46215.2023.10179435

    arXiv 2023