Threat Model

The threat model is structured by the kind of adversary, not by the kind of attack. Each tier is what a different class of adversary can do, and what the protocol's response is.

Tier 1—Naive automation

A scripted attempt to bypass the device-side capture flow. Replays a stored signal, calls the SDK with synthetic inputs, fakes the wallet adapter handshake.

The checks that decide the outcome run on the validator, not in the browser. Each session receives a new phrase and curve, so a stored capture answers the wrong challenge, and the validator transcribes the submitted audio to compare it against the phrase it issued. Feature vectors face distribution checks in the Anonymity Ring, and the verifier program rejects proofs that don't match the on-chain commitments.

Public adversarial test count at this tier: 16,000 attempts across T1–T3 combined, all rejected.

Tier 2—Coordinated bot farm

Multiple wallets, a script library, modest budget. Tries to mass-mint Anchors and farm low Trust Scores at scale.

The device-fingerprinting layer makes single-device farming visible. Re-using captured signals across wallets is detected by the ring's cross-Anchor analysis. The protocol fee per verification means each Anchor carries a recurring cost to hold; the time decay on the Trust Score makes "rush a high score" infeasible. Sustained high scores require sustained, distinct activity per Anchor.

Tier 3—Human-in-the-loop farms

Real humans behind multiple wallets, performing real captures. The hardest tier of farming because it bypasses any synthesis detection—the signals are genuine human signals.

The protocol's response has two parts. Every capture is scored by the detection stack regardless of how many Anchors the operator holds, and the ring's cross-Anchor analysis compares captures across wallets — the layer that applies here is behavioral overlap, not synthesis detection, and its sensitivity is bounded by how much a person can vary their own behavioral signature. On top of that, an operator running N Anchors performs N captures every re-verification window, each twelve seconds plus the protocol fee, and the Trust Score per Anchor decays without that work.

What this means in practice: a genuine human performing every capture by hand defeats synthesis detection by not using synthesis. What remains against them is cross-Anchor comparison plus the per-Anchor cadence requirement, which integrators tune through the threshold to the value being protected.

Tier 4—Behavioral synthesis

Adversarial models that attempt to synthesize the full 308-feature vector convincingly enough to pass the ring's checks and the device's pipeline.

This is the active research surface. The Anonymity Ring's check stack is the layer designed to make synthesis hard. T4a was structured as a four-wave study against one canonical attack class—pre-recorded human voice paired with procedural motion and touch—to measure each defense layer's specific contribution. Wave 1 (50 attempts, 100% pass) established the counterfactual with cross-modal temporal coupling running in log-only mode. Wave 2 (10 attempts, 10% pass) enabled temporal enforcement. Wave 3 (20 attempts, 0% pass) added phrase content binding. Wave 4 (1,000 attempts, 0% pass, 95% CI [0%, 0.37%]) confirmed the result at scale. T4b extended the program to real-time synthesized voice—two independent TTS model families and 58 synthetic voices, all speaking the issued challenge phrase: the synthesized audio clears the texture checks, but the full production stack rejected every attempt (0% across 200 attempts). Each study closes one canonical class; the program continues against new ones.

What the integrator controls

The protocol proves that a human operates a wallet. Whether that human is present when your application acts is a question your gate asks, and Entros gives you two fields to ask it with.

A Trust Score read tells you how consistently a wallet has verified. Pairing it with last_verification_timestamp bounds how long ago. Running a verification at the point of a gated action answers it outright, which is why claims, votes and treasury actions are worth the extra step. See Trust Score: what to gate on.

What is out of scope

• Wallet compromise. If an attacker controls the user's keypair, the Anchor follows. The protocol assumes the wallet is held by the legitimate user.
• Coercion. A human verifying under duress produces a real verification. Protocol-level defense against coerced participation is a research question. The practical response is per-application thresholds and a live check at the point of the action.

Where to look next

• Anonymity Ring—the validator set that runs Tier 4 defenses
• Trust Score—how the score's decay shape is itself a defense
• Roadmap: Near-term—the external audit and what's next after Tier 4