Threat Model
What Entros defends against, and what falls outside the protocol's surface.
This model separates current controls from research goals. The browser client is an untrusted input source. The private service and on-chain programs verify bounded properties of what the client submits.
Tier 1: naive automation
This adversary replays stored signals, calls public client code with synthetic inputs, or automates the browser flow.
The server issues a fresh phrase and curve. It compares the transcript with the issued phrase and applies capture-policy checks. Browser and client-integrity signals add risk evidence. They do not create hardware-backed provenance.
Public T1 through T3 campaigns contain 16,000 attempts. The public report records zero observed passes for those tested generators and configurations.
Tier 2: coordinated wallet automation
This adversary controls many wallets and can generate different submissions for each wallet.
The private service computes a server-side fingerprint and compares it with fingerprints registered to other wallets. Rate limits and fees bound request volume. The detection policy decides whether a capture passes.
Population-level uniqueness remains an open evidence question. Current code uses a full registry scan and one configured Hamming-distance policy. Offline evaluation and larger human cohorts must establish its operating curve.
Tier 3: human-assisted duplication
One person can operate multiple wallets and complete genuine captures. Synthesis checks do not address this case because the submitted signals can be human-generated.
Cross-wallet comparison may identify close fingerprints. Its sensitivity depends on within-person drift and cross-person separation. Entros is measuring those distributions before claiming one-person-one-Anchor enforcement.
Applications can combine a fresh Entros result with Anchor age, Trust Score, recency, rate limits, and their existing eligibility rules.
Tier 4: behavioral synthesis
This adversary generates challenge-matching audio, motion, touch, or feature summaries.
T4a measured one prerecorded, arbitrary-content attack class across four conditions. The observed pass rates were 100%, 10%, 0%, and 0%. The final wave observed zero passes in 1,000 attempts, with a 95% confidence interval of [0%, 0.37%].
T4b tested 200 full-stack attempts across two named TTS model families and 58 voices. No attempt reached the chain. These results apply to the tested models and campaign configurations. T5 remains open.
What the integrator controls
Entros is designed to provide evidence of live human control for a wallet. Integrators choose the policy for each action.
A Trust Score summarizes active weekly verification bins and account age. last_verification_timestamp records recency. A fresh verification provides the strongest current signal for an action. See Trust Score: what to gate on.
What is out of scope
- Wallet compromise. If an attacker controls the user's keypair, the Anchor follows. The protocol assumes the wallet is held by the legitimate user.
- Coercion. A human verifying under duress produces a real verification. Protocol-level defense against coerced participation is a research question. The practical response is per-application thresholds and a live check at the point of the action.
- Browser provenance. A hostile browser can replace sensor APIs or submit computed evidence. Current server checks limit accepted submissions. Planned native attestation adds a higher-assurance capture tier.
- Legal identity and attributes. Entros does not verify a name, age, credential, nationality, or account ownership outside the connected wallet.
Where to look next
- Anonymity Ring - the current private validation service and decentralization plan
- Trust Score - the score formula and integration policy
- Roadmap: Near-term - the external audit and mainnet gates