1 Introduction
Our initial premise is twofold: First, even though there is a vast literature concerned with identifying fake or duplicate identities, aka sybils, one cannot assume sybils to be perfectly identified and completely eradicated. Second, a single vote may tilt a majoritarian group decision and as such, sybils infiltrating a group of agents that employ egalitarian democratic group decision making literally pose an existential threat to the group. Thus, here we address the pressing need to develop group decision making processes that can be safely used in online communities that are not sybilfree. Indeed, the vast literature on social choice proposes many aggregation methods that, unfortunately, cannot be directly used in many online settings, in which a fraction of the electorate might consist of sybils.
The key concept in our approach to sybil resilience is the use of the present state of affairs, namely the status quo, or Reality, as the anchor of sybil resilience. We characterize sybil resilience by sybil safety – the inability of sybils to change the status quo against the will of the genuine agents, and sybil liveness – the ability of the genuine agents to change the status quo against the will of the sybils (formal definitions in Section 2).
Our goal is to ensure sybil safety without sacrificing liveness, and to achieve it we follow RealityAware Social Choice [Shapiro and Talmon2018], which recognizes reality (i.e., the status quo) as a distinguished and everpresent alternative.
There are various settings where sybilresilient decision making processes are needed, corresponding to different settings of social choice. As the simplest setting, we first concentrate on the case of a single proposal (i.e., an election among two alternatives, one of which is the status quo). For this setting, we show that requiring a sybilresilient supermajority, defined as a simple majority plus half the sybil penetration rate, in order to change the status quo is safe. Interestingly, a sybilresilient supermajority is similar to Byzantine failures in its tipping point: Below onethird sybil penetration, it assures both safety and liveness, while above onethird, it assures safety but not liveness, as sybils, while unable to force a change to the status quo, may block any change to it.
We then consider ordinal elections for deciding among multiple alternatives, one of which is the status quo (reality). We describe an efficient Amendment Agenda that is safe and provides liveness when sybil penetration is under one third. Finally, we consider sybilresilience when deciding upon the value of a parameter, e.g., the interest rate or inflation rate of a sovereign currency, the conductance and solidarity of an expanding ecommunity [Poupko et al.2019], the votes threshold for parties in a parliamentary system, or the gas price of a cryptocurrency. Assuming singlepeakedness for this setting, we describe a rule that, briefly put, disregards sufficientlymany extreme votes, and show it to be sybilsafe.
Related Work. There is a vast literature on defending against sybil attacks, see, e.g., recent surveys [Alvisi et al.2013, Viswanath et al.2010]. That literature is usually concerned with graphs on which the genuine and sybil entities reside, and the focus is usually not on group decision making. E.g., Douceur douceur2002sybil describes a very general model for studying sybil resilience and presents some initial negative results in this model. Many papers consider leveraging graph properties such as various centrality measures to identify suspicious nodes (see, e.g., [Cao et al.2012]). As further examples, Molavi et al. molavi2013iolaus aim to shield online ranking sites from the negative effects of sybils and Chiang et al. chiang2013secure consider sybilresilience in the context of radio networks.
We are particularly interested in sybilresilient group decision making. This scenario is considered by Tran et al. tran2009sybil, but with a different goal and solution: While we aim to protect democratic decisions from sybil attacks, they are considering ranking online content. Other relevant papers are the paper of Conitzer and Yokoo conitzer2010using, concentrating on axiomatic characterizations of sybilresilient rules in a certain formal model. In essence, Conitzer et al. show that in a model without a distinguished status quo alternative, the only voting rules which are sybilsafe, in the sense that there is no incentive for an attacker to produce sybils, is of the form “if all vote unanimously for , pick , otherwise pick a winner at random”. Indeed, this negative result can also be seen as a motivation for our model of sybilsafety, which does incorporate the status quo as a distinguished alternative, as this allows for a conservative default to the status quo, rendering the negative result of Conitzer et al. inapplicable. Related papers exist [Wagman and Conitzer2008, Wagman and Conitzer2014, Waggoner et al.2012, Conitzer et al.2010, Conitzer2008].
We also mention the vast literature on control and bribery in elections [Faliszewski and Rothe2016], studying malicious entities aiming at changing elections outcomes (we also mention recent work connecting bribery to robustness measures of voting rules [Bredereck et al.2017, Faliszewski et al.2017]). The model of election control assumes a given voting rule and a given electorate, and the question is whether an external agent, called the chair of the election, may change the election structure, e.g. by adding or removing candidates or votes, to have its preferred candidate win (or lose). The model of a sybil attack is that of an external agent that cannot change the vote structure, but has control of the actual votes of a fraction of the electorate (the sybils and their creators/perpetrators). Hence, formally, a sybil attack by a fraction of the voters is similar to election control where the chair may add up to a fraction of the voters. However, rather than studying how this specific form of control may affect existing voting rules, we design new voting rules that are resilient to sybil attacks, a notion defined below.
2 Abstract Model
In this paper we use disjoint union as a shorthand for , . Our model is as follows. We assume a set of agents which is a union of two disjoint sets, the set of genuine agents and the set of sybils . We wish to design sybilresilient voting rules for the agents . We assume that all agents participate in every vote^{1}^{1}1A forthcoming paper explores how proxy voting/vote delegation can be employed to relax this assumption and still retain sybil resilience., so we overload the notation and identify the agent with its vote. We follow RealityAware Social Choice in considering decisions on a set of alternatives that always includes the status quo (reality) as a distinguished, everpresent alternative. Given such a set and votes over it, a voting rule returns a set of alternatives as the cowinners of the election. The specific set of allowed alternatives and the mathematical objects modeling a vote are different for each social choice setting we consider; we elaborate on these in the corresponding sections, but first we make an abstract exposition.
2.1 Sybil Safety and Sybil Liveness
We wish to have voting rules that are sybil safe, in the sense that they prevent sybils from changing the status quo against the will of the genuine agents. But how is the will of the genuine agents defined? Presumably, via en established voting rule, e.g., the majority rule when voting on a single proposal against the status quo, or some social choice function when voting on multiple alternatives. The following definition aims to capture this intent by defining a voting rule to be safe (with respect to a base voting rule) if it elects an alternative to the status quo when applied to votes of all agents only if the base rule may elect this alternative when applied to a subset of the votes – the votes of the genuine agents.
Definition 1 (Sybil Safety).
Consider a set of alternatives with reality , a set of agents , and let and be two voting rules. Then, the voting rule is sybil safe with respect to , or safe for short, if the following holds: If , then . That is, if chooses some alternative , then is chosen also by over the honest voters.
Remark 1.
Below we consider three social choice settings: voting on one proposal, voting on multiple alternatives, and voting on the value of a parameter. For each setting we chose a base voting rule that is suitable for the domain, employing three criteria: (i) Broad recognition (ii) Simplicity; (iii) Ease of attaining safety. Specifically, we rely on May’s theorem [May1952], the Condorcet criterion [Gehrlein1985], and Black’s theorem [Black1948],respectively, in choosing the base rules for the three settings.
We wish to stress the importance of simplicity: The trust of voters in the voting process critically depends on their understanding of it. Hence a voting rule must be easy to communicate, even at the expense of other desirable properties that can be achieved only through complications.
As sybil safety can be achieved trivially by sticking with the status quo, it must be combined with a liveness requirement – that the genuine agents are able to change the status quo despite the sybils.
Definition 2 (Sybil Liveness).
Consider a set of agents , a set of alternatives , reality , and a voting rule . We say that satisfies sybil liveness for and , or liveness for short, if, for any set of votes of the sybils and for any alternative , there is a set of votes of the genuine agents for which , applied to all agents, elects .
Note that while safety is being defined with respect to a base rule, liveness isn’t, as liveness merely makes sure that some progress can be made according to the current rule; safety than ensures any such progress is safe with respect to the base rule.
We use the term sybil resilience to refer jointly to sybil safety and sybil liveness. For each of the settings we consider here, our main goal is: Ensure sybil resilience without being unnecessarily conservative in defending the status quo. The following definition captures a specific aspect of sybil resilience.
Definition 3 (SybilPenetration Resilience).
A voting rule is resilient to the penetration of up to sybils with respect to a base voting rule , if it ensures sybil safety with respect to and sybil liveness for every set of agents , provided the sybil penetration rate is below , namely .
Remark 2.
How to estimate the sybil penetration
is an important question. While in some cases there might be other techniques available, usually it is natural to assume that by sampling a voter one can estimate the probability that the voter is genuine or fake (e.g., looking at her Facebook profile). Thus, the main general technique we suggest is to sample voters uniformly at random and, given the sampling results, estimate
. Note that using such sampling it is then possible to compute, for a given value , a value , such that the probability that is greater than is at most . Alternatively, one can compute the mean of the sample and take an margin of safety, i.e., use as the estimate for .3 SybilResilience for One Proposal
We begin our investigation with yes/no decisions on a single proposal , where a yes vote favors and a no vote favors the status quo (e.g., Brexit vs. Remain). So, formally, the set of alternatives is , and each vote is either or . For this setting, it is natural to use supermajority as the basis for a sybilsafe decision rule, and to use simple majority as the base decision rule against which sybilsafely is measured.
Definition 4 (Supermajority).
In a decision on a proposal against the status quo , the proposal is said to win by a supermajority, , if more than of the agents prefer over (i.e., vote for ). The proposal wins by a simple majority if it wins by a supermajority.
Definition 5 (RealityAware Supermajority Rule).
When deciding on a single proposal against the status quo , the realityaware supermajority rule elects if it is preferred over by a supermajority, else it elects the status quo . The realityaware supermajority rule is referred to as the majority rule.
Remark 3.
Notice that supermajority rule with follows RealityAware Social Choice in favoring the status quo.
Requiring , , would render the realityaware supermajority rule sybil safe, as it would elect the proposal only if all agents are in favor of it; it would, however, be unnecessarily conservative. Next we characterize the minimal needed for safety.
Lemma 1 (Safety of Supermajority).
Let be the set of agents, , and let and be a proposal and the status quo. Then, if is preferred over by a supermajority of all agents, then is preferred over by a majority of the genuine agents.
Proof.
Consider the equation:
with the left side of the equation being the supermajority required for the majority of the genuine agents to vote for the proposal, assuming all sybils also vote for it, and with the right side being the sybils () and the majority () of the genuine agents , divided by the total agents, namely the sybils () and the genuine agents (). Solving for gives . ∎
Remark 4.
The value above is tight, as any value strictly smaller than would not be safe. To see this, assume that all sybils, as well as slightly less than half of the genuine agents, vote in favor of the proposal .
Theorem 1 (Safety of RealityAware Supermajority Rule).
Let be the set of agents and . Then, the realityaware supermajority rule is safe with respect to the majority rule.
Next, we offer a measure for the conservatism of a supermajority rule, by investigating the situations in which the genuine agents can indeed change the status quo.
Definition 6 (Supermajority Conservatism).
Let be the set of agents and let be a realityaware supermajority voting rule. The conservatism of is defined as the supermajority among the genuine agents needed in order to change the status quo, according to , assuming all sybils vote in favor of the status quo.
Observation 1.
The conservatism of the realityaware supermajority rule, given a sybil penetration rate , is
Proof.
Let be the set of agents, , and consider the realityaware supermajority rule where we have sybils, all voting in favor of the status quo, and genuine agents. Then, for a supermajority among the genuine agents, which is exactly genuine agents voting for the proposal to change the status quo, they shall constitute at least a fraction of the full electorate, which contains agents. Thus, solving the equation
for gives the result. ∎
Remark 5.
Of particular interest is the special case , which, following Observation 1, implies a conservatism of . Notice that: (i) If there are no sybils, then , which corresponds to a simple majority. (ii) On the other extreme, if a fraction of the agents are sybils, then , meaning that the proposal cannot be chosen even if all genuine agents are unanimously for it, violating liveness. The same is true of course if more than fraction of the agents are sybils. (iii) With singledigit sybilpenetration, i.e. , the above gives , hence the supermajority needed among genuine agents would be under , which is quite reasonable.
Corollary 1 (Supermajority Liveness).
Let be the set of agents and let . If all genuine agents vote, then the realityaware supermajority rule satisfies sybil liveness if and only if .
Proof.
Following Observation 1, we have that . Solving for , corresponding to almost supermajority (unanimity among the genuine agents), gives . ∎
Corollary 2 (Supermajority Resilience).
The supermajority rule is resilient to a penetration of up to sybils.
Hence, we refer to the realityaware supermajority, with , as sybilresilient supermajority.
Remark 6.
As with Byzantine failures, a sybil penetration of is an inflection point wrt. sybilresilience of supermajority: Up to sybils, a simple majority among the genuine agents can defend the status quo, i.e., veto a change to it, and a sufficiently large supermajority of the genuine agents may change the status quo. So the sybils can neither enforce a change nor veto one, if the genuine agents are sufficiently determined and united. From sybils and above, however, the sybils have a veto right: If the sybils unanimously object to a change, then no majority of the genuine agents can effect it.
4 SybilResilient Ordinal Elections
We assume the ordinal model of elections, thus each vote is a ranking over the set of alternatives that includes the status quo . Formally, denoting the set of all rankings over a set of alternatives by , we define a voting rule to be a function that takes ordinal votes over and returns a set of tied elected alternatives. If a singleton is elected from , then it is referred to as the winner of for the election. Otherwise, each of the alternatives returned from is referred to as a cowinner of the election. Notice that, for technical reasons, we do not consider tie breaking. Our approach to sybilresilience for this setting is to adapt the Condorcet principle. We need the following definition first.
Definition 7 (RealityViable Alternatives).
Let be a set of agents, a set of alternatives with the reality, and let . An alternative is realityviable (viable for short) if beats by a supermajority; i.e., if at least a fraction of the voters (weakly) prefer over . We denote the set of realityviable alternatives by . If , can be omitted and the set of realityviable alternatives is defined via a simple majority.
The following definition presents two variants^{2}^{2}2Other variants, such as using any tournament solution, are also possible but not explored here. of a Realityaware Condorcet voting rule, which will serve as the base rules against which we will measure sybil resilience.
Definition 8 (RealityAware Condorcet Rule).
Let be a set of alternatives with . If has a Condorcet winner, then elect it. Else, either:

(Conservative rule) elect .

(Permissive rule) elect all of as cowinners.
We will adapt these Realityaware Condorcet voting rules to be sybilresilient by replacing simple majority by a supermajority. But first we need to adapt the notion of a Condorcet winner to use supermajorities.
Definition 9 (Supermajority Condorcet winner).
Let be a set of alternatives and let . An alternative is a supermajority Condorcet winner if is preferred over any , , by a supermajority.
Our approach extends the Condorcet principle as it is adapted to RealityAware Social Choice by employing supermajorities. Specifically, next we discuss several realityaware Condorcet criteria adapted to our setting via supermajorities; voting rules that adhere to these criteria follow in a straightforward way.
Definition 10 (RealityAware Supermajority Condorcet criterion).
Let be a set of alternatives with , and let . If has a supermajority Condorcet winner then elect it. Else, either:

(Conservative criterion) elect .

(Permissive criterion) elect all of as cowinners.
Notice that all variants of the RealityAware supermajority Condorcet criteria (i.e., where ) are identical to the variants of the RealityAware Condorcet criteria (Definition 8).
The next theorem characterizes the minimal for which voting rules satisfying the above criteria are safe with respect to the base Condorcet rules defined earlier. Notice that Definition 10 is concerned with sybilresilience and incorporate supermajorities. In contrast, Definition 8 employs simple majorities.
Theorem 2.
Proof.
Let be the set of alternatives with the reality being , let be a rule satisfying the RealityAware Supermajority Condorcet Criterion, and let be its winner in a given election. If , then we are done as electing the status quo is always safe. Else, if , then wins over each alternative in by a Supermajority. Hence, by Lemma 1, wins over all these alternatives by a simple majority among the genuine agents; thus, if there is a Condorcet winner among the genuine agents then it must be . So, the RealityAware Condorcet Rule would elect either or .∎
The following Observation 2 and Corollary 3 follow a reasoning similar to Observation 1 and Corollary 2.
Observation 2.
The conservatism of a RealityAware Supermajority Condorcet consistent rule, given a penetration rate of sybils, is .
Corollary 3.
A RealityAware Supermajority Condorcet rule is resilient to a penetration of up to sybils.
Remark 7.
While here we consider only linear orders, it is possible to extend the analysis to accommodate partial orders, including weak rankings and 1Approval ballots (where each voter declares her most preferred alternative).
An Efficient SybilResilient Amendment Agenda. For concreteness and for practical applications, we complement the discussion with an efficient algorithmic realization of the supermajority Condorcet criteria defined above. Our realization is based on Llull’s Amendment Agenda (1299, cf. [McLean1990]): Arrange all alternatives in some order, vote the first against the second, the winner of the two against the third, and so on, then elect the final winner. The Amendment Agenda is Condorcet consistent. We make four enhancements to this Agenda: (i) We consider only realityviable alternatives; (ii) we start with the reality ; (iii) we employ sybilresilient supermajorities; and (iv) at the end we check for a Condorcet topcycle, and resort to reality if one is detected.
Algorithm 1 (Conservative Supermajority Amendment Agenda).
Let be the set of alternatives with and let . If , elect . Else, perform an Amendment Agenda vote on starting with and employing supermajorities, and let be the winner. Then, vote against all members of not previously voted against , if any. If wins all these votes by a supermajority then elect . Else elect .
Theorem 3.
Algorithm 1 satisfies the Conservative RealityAware Supermajority Condorcet criterion.
Proof.
We do a case analysis. First, if , then the Agenda elects ; this is what the axiom dictates. Otherwise, i.e., if then there are two cases to consider: First, if there is a supermajority Condorcet winner , then will be the final winner as it will not be eliminated during the agenda and will also beat all alternatives in the check at the end of the Agenda, thus will be elected as dictated by the criterion. Otherwise, the final winner of the Agenda is not a supermajority Condorcet winner, and thus there will be at least one alternative for which will not win by a supermajority, thus will be elected, again as dictated by the criterion. ∎
Remark 8.
An Amendment Agenda corresponding to the permissive supermajority Condorcet rule can be obtained by revising the final “Else” clause to be “Else arbitrarily elect a member of .” The proof is similar. Many other sybilresilient tournament solutions can be obtained by revising the “Else” clause appropriately.
Remark 9.
Observe that our results for a single proposal (Section 3) carry over to the sybilresilient Condorcet criteria: For one proposal, all variants of the RealityAware Supermajority Condorcet rule as well as our sybilresilient amendment agenda boil down to the oneproposal supermajority rule.
5 SybilResilient Parameter Update
We consider sybilresilience when deciding upon the value of a parameter, e.g., the target inflation rate, the interest rate of a sovereign currency, the gas price of a cryptocurrency, the conductance and solidarity of an expanding ecommunity [Poupko et al.2019], or the votes threshold for a party in a parliamentary system. In all these examples, we may assume that each voter has a preferred value for the parameter (an ideal point), and the closer the elected value to the ideal point, the happier the voter.
We model such settings by considering a onedimensional singlepeaked domain; specifically, we assume that the parameter can take realvalued numbers, that each voter has a single ideal point which she declares as her vote, and singlepeakedness then means that a voter with ideal point prefers some to if or if . We stress that, contrary to the setting of Section 4, here voters declare only their ideal points and not their rankings. The assumption of singlepeakedness then allows us to devise sybilresilient voting rules for this setting despite the fact the the domain of alternatives is infinite.
Black’s Median Voter Theorem [Black1948] states that within this model, the ideal point of the median voter is the unique unbeaten point and the Condorcet winner. Consider electing the value of the parameter de novo. How can it be made sybilsafe if even a single sybil may affect the identity of the median voter and, furthermore, it cannot be determined whether such a sybil has tilted the median to be higher or lower? Lacking an answer and being inspired by RealityAware Social Choice we, therefore, forgo de novo parameter election and consider the problem of parameter update: Given the current value of a parameter, how can its value be updated in a sybilresilient way? Formally, we aim at designing a parameter update rule , which is a function that takes the current parameter value and a set of votes and returns a new value for the parameter (all values in ).
As before, we are interested in sybilsafety, which abstractly means that the current value of the parameter shall change only if the genuine voters wish so. Following Black’s Median Voter Theorem, we wish to use the median rule as the base rule. But, to overcome the limitation of the median being welldefined only for an odd number of voters, we employ reality as follows.
Definition 11 (RealityAware Median).
Let be the current value of the parameter and be the set of votes. The realityaware median of is the median of if is odd and the median of otherwise.
Remark 10.
The effect of the definition for an even number of ordered votes is as follows: If , then the realityaware median is ; if , then ; and if , then . This means that the present value breaks ties in its favour, and in particular if half the voters wish to increase the parameter and half to decrease it, the present value of the parameter remains, as it should.
We use the realityaware median to define the base rule against which we will measure sybil safety.
Definition 12 (RealityAware Median Base Rule).
Let be the current value of the parameter, be the set of votes, and the realityaware median of the voters. If , then the RealityAware Median Base Rule returns the set , and if , then it returns the set .
Namely, a parameter update rule is safe wrt. the realityaware median base rule if it does not change the value of the parameter further than the realityaware median of the genuine agents or in an opposite direction to it. Indeed, the degenerate rule that never changes the parameter value is safe; liveness then considers the ability of the genuine agents to change the value of the parameter in their preferred direction despite the sybils. Notice how, informally speaking, the singlepeakedness assumption allows speaking of “directions” and not be confined to Condorcet winners as in Section 4.
A Simple Update Rule. We first present a simple update rule, which only considers the “directions”.
Definition 13 (Simple Update Rule).
Let be the current value of the parameter, be the set of votes and . If there is a supermajority of ideal points larger (smaller) than , then select the smallest ideal point larger than (respectively, the largest ideal point smaller than ); otherwise, select .
Remark 11.
The Simple Update Rule can be seen as a supermajority rule for the case of two proposals against the status quo, namely and against , where it is assumed that a voter voting for prefers over and a voter voting for prefers over .
Observation 3.
The Simple Update Rule is sybilsafe and satisfies liveness whenever .
A LeastConservative Update Rule. The simple update rule satisfies liveness. However, it is quite conservative in that it moves in “baby steps”. It is natural to seek a parameter update rule that not only updates the parameter in the right direction, but also pushes its value as far as sybilsafety permits.
Definition 14.
Let and be two parameter update rules. Then, is less conservative than if for every set of votes and current parameter value , the updated values obtained by these rules satisfy either or .
Our approach to achieve lesser conservatism is as follows: If the median of the ideal points of all agents is above the current value, we make the worstcase assumption that all sybils wish to extremely increase the parameter value; we therefore remove the top values and recompute the new median. If the recomputed median is still above the current parameter value, then it is safe to elect it; otherwise, we revert to the status quo. Suppressing these extreme votes can be justified to voters by saying that, in the worst case, all these votes could be by sybils and hence, to be on the safe side, we must ignore them.
Definition 15 (RealityAware Median with Outer Suppression).
Let be the current parameter value, be a set of voters and . Then the set is obtained by removing from its top fraction, the set is obtained by removing from its bottom fraction, is the realityaware median of , and is the realityaware median of .
Definition 16 (Suppress Outer Parameter Update Rule).
Let be the current parameter value and be the set of votes with realityaware median . Then, the Suppress Outer parameter update rule is defined as follows: If , then update the parameter to be ; if , then update the parameter to be ; otherwise keep the current parameter value .
Theorem 4 (Sybil Resilience of the Suppress Outer Rule).
The Suppress Outer Parameter Update Rule is resilient up to sybil penetration.
Proof.
Assume a current value and a set of agents . There are three possible outcomes to the Suppress Outer rule: , , and .
For sybilsafety, consider the first outcome . As in this case , what is left to show is that . We consider two subcases: (i) There are no sybils left in greater than . In this case the difference between and are top genuine votes that are in but eliminated from , if any, and sybils votes smaller than in , if any. Hence as required. (ii) There are sybils in greater than . In this case, there must be at least as many top genuine identities eliminated from , since is a bound on the number of sybils. Now let us swap the type (genuine/sybil), but not the vote, of such sybil and genuine votes, so no sybil votes greater than are left in . Doing so would not affect , as it is “typeblind”, and would not affect since all pairs of typeswapped votes are greater than . And we are now in subcase (i) which has been proved. The safety of the second outcome is proved symmetrically, while the third outcome, , is safe by definition. For sybilliveness, assume that and that all genuine agents vote for a certain value above . Since and eliminates at most of the genuine voters, the genuine votes will be a majority in , and hence its median will be larger than , specifically , resulting in the update to . The symmetric argument applies if all genuine votes are some below . ∎
Next we argue that indeed the rule defined above is the leastconservative update rule.
Remark 12.
In particular, if , the reality aware median may always assume that is odd (if even, it just adds reality to ). Hence, , , and . Under this notation, it follows that any voting rule that elect , , when is not safe, because whenever the honest voters are , then , and thus .
6 Discussion
While a single fake agent may tilt a decision in a group of agents that employs a group decision making mechanism, we show that ReallyAware Social Choice can remain sybilsafe in the face of arbitrarily high sybil penetration, and, under certain conditions, can retain sybilliveness. Specifically, the problem of decision making in the presence of sybils is important in the real world. Thus, our first contribution is the development of our model which includes the status quo together with our definitions of safety, liveness, and conservatism. As such, our model allows for developing sybilresilient rules and opens further possibilities for future study (e.g., studying ordinal elections with Borda as the base rule). Furthermore, we describe several rules and prove their sybilresilience for important social choice scenarios; in fact, we view the simplicity of the methods as a merit, as it, e.g., allows to easily explain their operation to laymen voters.
Next we discuss pressing avenues for future research.
Further settings. Further research is needed to understand the possibility of sybil resilience for social choice settings other than those considered here, such as multidimensional parameter update and multiwinner elections. Furthermore, other types of elections (besides here we considered 1Approval and ordinal elections) deserve study; e.g., cumulative voting (and also quadratic voting [Lalley and Weyl2018]) allows minorities to concentrate their voting power. To counter this, sybilresilient cumulative/quadratic voting might take an approach similar to the approach for sybilresilient parameter update, by “suppressing most lucrative voters”.
Further base rules. While exploring additional settings we should also explore appropriate base rules for such settings. In addition, we should explore additional base rules for the settings at hand.
Mitigating partial participation. While sybils have clear incentive to vote on issues they wish to control, genuine agents, especially if operated by humans, might be less motivated. Thus, there is a need to augment the analysis described here to this more realistic setting. One approach would be to use vote delegation, as is done, e.g., in liquid democracy.
Acknowledgements. We thank the generous support of the Braginsky Center for the Interface between Science and the Humanities.
References
 [Alvisi et al.2013] L. Alvisi, A. Clement, A. Epasto, S. Lattanzi, and A. Panconesi. SoK: The evolution of sybil defense via social networks. In Proceedings of SP ’13, pages 382–396, 2013.
 [Black1948] D. Black. On the rationale of group decisionmaking. Journal of political economy, 56(1):23–34, 1948.
 [Bredereck et al.2017] R. Bredereck, P. Faliszewski, A. Kaczmarczyk, R. Niedermeier, P. Skowron, and N. Talmon. Robustness among multiwinner voting rules. In Proceedings of SAGT ’17, pages 80–92, 2017.
 [Cao et al.2012] Q. Cao, M. Sirivianos, X. Yang, and T. Pregueiro. Aiding the detection of fake accounts in large scale social online services. In Proceedings of NSDI ’12, pages 15–15, 2012.
 [Chiang et al.2013] J. T. Chiang, Y.C. Hu, and P. Yadav. Secure cooperative spectrum sensing based on sybilresilient clustering. In Proceedings of GLOBECOM ’13, pages 1075–1081, 2013.
 [Conitzer and Yokoo2010] V. Conitzer and M. Yokoo. Using mechanism design to prevent falsename manipulations. AI magazine, 31(4):65–78, 2010.
 [Conitzer et al.2010] V. Conitzer, N. Immorlica, J. Letchford, K. Munagala, and L. Wagman. Falsenameproofness in social networks. In Proceedings of WINE ’10, pages 209–221, 2010.
 [Conitzer2008] V. Conitzer. Anonymityproof voting rules. In Proceedings of WINE ’08, pages 295–306, 2008.
 [Douceur2002] J. R. Douceur. The sybil attack. In Proceedings of IPTPS ’02, pages 251–260, 2002.
 [Faliszewski and Rothe2016] P. Faliszewski and J. Rothe. Control and bribery in voting. In H. Moulin, F. Brandt, V. Conitzer, U. Endriss, A. D. Procaccia, and J. Lang, editors, Handbook of Computational Social Choice. Cambridge University Press, 2016.
 [Faliszewski et al.2017] P. Faliszewski, P. Skowron, and N. Talmon. Bribery as a measure of candidate success: Complexity results for approvalbased multiwinner rules. In Proceedings of AAMAS ’17, pages 6–14, 2017.
 [Gehrlein1985] W. V. Gehrlein. The Condorcet criterion and committee selection. Mathematical Social Sciences, 10(3):199–209, 1985.
 [Lalley and Weyl2018] S. P. Lalley and E. G. Weyl. Quadratic voting: How mechanism design can radicalize democracy. In AEA, volume 108, pages 33–37, 2018.
 [May1952] K. O. May. A set of independent necessary and sufficient conditions for simple majority decision. Econometrica, pages 680–684, 1952.
 [McLean1990] Iain McLean. The Borda and Condorcet principles: three medieval applications. Social Choice and Welfare, 7(2):99–108, 1990.
 [Molavi Kakhki et al.2013] A. Molavi Kakhki, C. KlimanSilver, and A. Mislove. Iolaus: Securing online content rating systems. In Proceedings of WWW ’13, pages 919–930, 2013.
 [Poupko et al.2019] O. Poupko, G. Shahaf, E. Shapiro, and N. Talmon. Sybilresilient conductancebased community expansion. In Proceedings of CSR ’19, 2019. To appear.
 [Shapiro and Talmon2018] E. Shapiro and N. Talmon. Incorporating reality into social choice. In Proceedings of AAMAS ’18, pages 1188–1192, 2018.
 [Tran et al.2009] D. N. Tran, B. Min, J. Li, and L. Subramanian. Sybilresilient online content voting. In Proceedings of NSDI ’09, pages 15–28, 2009.
 [Viswanath et al.2010] B. Viswanath, A. Post, K. P. Gummadi, and A. Mislove. An analysis of social networkbased sybil defenses. ACM SIGCOMM Computer Communication Review, 40(4):363–374, 2010.
 [Waggoner et al.2012] B. Waggoner, L. Xia, and V. Conitzer. Evaluating resistance to falsename manipulations in elections. In Proceedings of AAAI ’12, pages 1485–1491, 2012.
 [Wagman and Conitzer2008] L. Wagman and V. Conitzer. Optimal falsenameproof voting rules with costly voting. In Proceedings of AAAI ’08, pages 190–195, 2008.

[Wagman and Conitzer2014]
L. Wagman and V. Conitzer.
Falsenameproof voting with costs over two alternatives.
International Journal of Game Theory
, 43(3):599–618, 2014.
Comments
There are no comments yet.