Sustained Participation as a Security Resource: The Bounded Participation Channel Homayoun Maleki
Nekane Sainz
Jon Legarda
Igor Santos-Grueiro
arXiv:2609.35300v1 [cs.CR] 28 Sep 2026
DeustoTech, University of Deusto DeustoTech, University of Deusto DeustoTech, University of Deusto International University of La Rioja (UNIR) Bilbao, Spain Bilbao, Spain Bilbao, Spain Logroño, Spain [email protected] [email protected] [email protected] [email protected]
Abstract—Can sustained, per-identity participation be engineered into a security resource? Doing so requires verifying it—window by window—so that no adversary can amortize it. Most anti-Sybil defenses answer a different question: they price identity creation, not identity survival. Once admitted, an adversary sustains thousands of accounts for free—CAPTCHAs and Proof-of-Personhood verify only at the door, and resourcebased defenses such as compute or capital amortize across identities instead of pricing them individually. We introduce the Bounded Participation Channel (BPC), a formal primitive that closes this gap. BPC repeatedly issues fresh, identity-bound challenges under a strict deadline, enforced by four structural properties—identity binding, freshness, real-time response, and bounded per-channel throughput—that together yield a provable cost theorem: sustaining s identities over T windows costs C(s, T ) ≥ sT /τh . The guarantee is solveragnostic, holding regardless of whether a channel is operated by a human, an AI system, or a hybrid. We give a hash-based construction with a publicly verifiable procedure under standard cryptographic assumptions, characterize four admissible challenge families, and evaluate two against three frontier models—GPT-4o, Gemini 2.5 Flash, and Claude Sonnet 4.5—across 600 trials. Despite near-perfect accuracy (97–100%), every model remains throughput-bounded, exhibiting single-digit τh from either latency or correctness limits. The finding is simple but consequential: solvability does not imply unlimited throughput—so sustained participation can be verified, window by window, and thereby engineered into a security resource with a provable, linear cost floor, independent of who or what supplies it: unlike resources that can be pooled, stockpiled, or transferred, this one must be re-earned by every identity, in every window, for as long as the system relies on it. Verified this way, sustained participation becomes a security resource any system can rely on, wherever the real question is not who joined, but who is still showing up. Index Terms—Sybil resistance, continuous participation verification, identity amplification, bounded participation channels, . A substantially different preliminary version of this work, under the earlier design name Human Challenge Oracle, was previously posted as a non-peer-reviewed preprint by a subset of the authors [1].
cost-based security, resource asymmetry, throughput-bounded participation, authentication, open systems security
1. Introduction Open systems increasingly depend on large populations of pseudonymous participants. Online communities, collaborative platforms, governance mechanisms, gaming ecosystems, social platforms, blockchain-based systems, and anti-abuse infrastructures must all confront the same fundamental problem: a single adversary can cheaply create and coordinate many identities. The challenge, however, is not merely preventing identity creation. It is ensuring that maintaining many active identities incurs cost that grows proportionally with both the number of identities and the duration for which they remain active. This problem is intensifying, not receding. Automated programs generated a record 53% of global web traffic in 2025, with AI-driven bot attacks up more than twelvefold year over year [2]. As autonomous AI agents become legitimate participants in open systems—not just adversaries impersonating humans—the operative question shifts. It is no longer only “is this participant a human or a bot?” but increasingly “is this one independent agent, or one process posing as a thousand?” A mechanism answering the second question must be agnostic to what operates a given identity— a person, a script, or a language model—by design, not as an afterthought bolted onto a human-detection scheme. This is the setting the rest of the paper targets. This distinction is fundamental, and most existing defenses get it backwards. They treat Sybil resistance as an admission problem: verify an identity once, then assume continued participation remains meaningful. But an adversary does not need cheap identities—it needs identities that stay cheap to keep alive. What open systems actually require is a cost structure in which maintaining s active identities over T time windows necessarily incurs cost C(s, T ) = Ω(sT ),
growing jointly with both identity count and participation horizon. Why existing approaches fall short. CAPTCHAs [3] exploit perceptual asymmetries at admission time but are fundamentally one-shot: once an account is created, continued
participation incurs no proportional recurring cost. Proof-ofPersonhood systems [4], [5] raise the cost of the ceremony but provide no mechanism for continuously pricing participation afterward. Social-graph and behavioral defenses [6]–[11] address related aspects of abuse but establish no explicit lower bound on the cost of maintaining many identities over time. The limitation is structural: none of these approaches ties continued participation to a resource whose recurring cost is guaranteed rather than merely possible. The relevant question is therefore not merely whether a resource is scarce or reusable, but whether continued participation requires fresh resource expenditure in each time window [12]. Sustained, per-identity participation is a promising candidate precisely because—unlike compute or capital—it cannot be pooled or transferred between identities [12]. This raises the question this paper answers: Can sustained, per-identity participation be engineered into a security resource—one that resists amortization across identities, across time windows, and across whatever operates the channel? This paper answers it in general form, independent of any one downstream use. We introduce the Bounded Participation Channel (BPC), a formal primitive for sustained participation verification that any such downstream mechanism— consensus, governance, reputation, or otherwise—can build on. Rather than verifying participants only at admission time, BPC repeatedly requires each active identity to demonstrate fresh participation through time-local challenges, cryptographically bound to both identity and time window, that must be answered within a strict response deadline. Continuous verification, not accumulated reputation. BPC is continuous in a precise sense: it produces, for every identity v and window d, a verifiable participation bit π(v, d) ∈ {0, 1}, where π(v, d) = 1 iff v performed the qualifying action for window d. Sustained participation over T windows is the sequence π(v, 1), . . . , π(v, T ). Crucially, BPC does not accumulate these bits into a score, reputation, or any other persistent state—each π(v, d) is independently re-established, and nothing about window d affects the cost of window d + 1. BPC exports a sequence of time-indexed participation proofs; it is deliberately silent on what higher-level systems do with them. This separation is what keeps BPC a primitive rather than a policy: gaming platforms may use π(v, ·) for AFK detection, governance systems for voting eligibility, and reputation or consensus systems for scoring participation history—BPC remains agnostic to how any of these interpret its output. The security of BPC rests on four structural properties: identity binding, freshness, real-time response, and bounded per-channel throughput. Together, they rule out every form of amortization—no solution can be shared across identities, replayed across windows, or produced faster than a channel’s physical throughput allows—and induce a provable cost theorem: sT C(s, T ) ≥ , τh where τh denotes the maximum number of valid responses
any single channel can produce per window. The guarantee holds regardless of solver identity: it depends only on the physical fact that no channel can serve unbounded throughput within a deadline, not on humans outperforming machines. To evaluate this claim, we instantiate BPC across four challenge families and experimentally evaluate two of them against three independently developed frontier AI systems: GPT-4o, Gemini 2.5 Flash, and Claude Sonnet 4.5, across 600 trials. Despite near-perfect success rates on perceptual tasks, all models remain throughput-bounded, yielding small single-digit values of τh : solvability does not imply unlimited throughput. Contributions. •
•
•
•
•
A formal primitive, BPC, specified abstractly as an Event/Claim/Proof pattern with two operations, Prove and Verify (Section 3), separating what is guaranteed from how it is realized. A layered security definition that distinguishes objective-level properties (H1–H2, each mapped to a security game), a primitive-level qualitative timing requirement (H3), and a separate channel-capacity assumption (H4) needed only for the multi-identity cost theorem—so that no single proof’s validity depends on an assumption about channel throughput. A cost theorem showing that, under Assumption 1, these properties jointly force C(s, T ) = Ω(sT ), with participation exported as a sequence of time-indexed proofs rather than an accumulated score. A hash-based realization of Prove and Verify via an interactive challenge-response exchange, with a publicly verifiable procedure under standard cryptographic assumptions, and four admissible challenge families with browser-based instantiations. A 600-trial evaluation against three frontier AI systems showing that near-perfect accuracy does not defeat the bound.
2. Related Work Sybil attacks and graph-based defenses. Douceur [13] established the fundamental problem: in open systems without a central authority, identity replication cannot be prevented without binding participation to a scarce resource. Graphbased defenses—SybilGuard [6], SybilLimit [7], SybilInfer [8], SybilRank [14]—exploit social network structure to bound the number of adversarial identities a communitytrust graph can tolerate. Clickstream analysis [9] and network topology [15] provide complementary signals. These mechanisms are valuable but orthogonal to BPC: they constrain how many Sybil identities exist, not how much it costs to sustain each one over time. They provide no per-identity per-window cost bound; an adversary that passes the graph filter at admission can sustain many identities indefinitely at negligible recurring cost. CAPTCHA and one-time verification. CAPTCHAs [3] exploit the human–machine perceptual gap at account creation. reCAPTCHA [16] and hCaptcha [17] add behavioral risk
signals. These defenses share a critical structural weakness: they are one-shot. Once an account is created, sustaining it incurs zero marginal cost; the adversary is never asked to prove renewed participation. This is not an engineering failure—it is a definitional one. CAPTCHA does not attempt to bound C(s, T ); it bounds C(s, 1) at creation time only. Meanwhile, the perceptual gap CAPTCHAs rely on is eroding: deep learning breaks text CAPTCHAs [18], [19] and semantic image challenges [20], [21] at high rates, and solving services commoditize the bypass [22]. Token-binding extensions [23] attempt to tie authentication tokens to specific devices but do not provide fresh, per-window, per-identity challenges and offer no composable cost theorem. Proof-of-Personhood. PoP systems [4], [5] enforce a oneperson–one-identity mapping through ceremonies, biometrics, or social vouching. Deployed systems include Worldcoin [24] (iris scanning), BrightID [25] (social verification), and Gitcoin Passport [26] (credential aggregation). Zk-proof-based approaches [27], [28] provide privacy-preserving personhood attestations without revealing identity. PoP raises the cost of creating a verified identity but does not constrain ongoing participation: once admitted, an adversary sustaining s identities faces no proportional recurring cost. The adversary simply acquires s PoP credentials once—possibly through credential markets [29]—and sustains them indefinitely. PoP achieves C(s, 1) = Ω(s) at creation time; BPC targets C(s, T ) = Ω(sT ) across the full participation lifetime. Continuous and behavioral authentication. Behavioral biometrics use ongoing interaction signals— touchscreen dynamics [10], keystroke timing [11], mouse movement [30]— as persistent authentication signals. Risk-based authentication systems [31] combine behavioral and contextual signals to detect account takeover. These mechanisms come closest to BPC in spirit—continuous rather than one-shot—but they stop short in two ways. They are passive: the system infers presence from behavior rather than issuing identity-specific, time-bound challenges, so a sophisticated adversary can replay or synthesize signals without proportional effort per identity. And they produce no exportable, verifiable record: there is no analogue of BPC’s per-window participation proof π(v, d), only an internal risk score computed and consumed by a single proprietary provider. BPC instead produces a public, cryptographically verifiable proof for every window, usable by any downstream system in an open, adversarial setting. Trusted hardware and rate-bounded attestation. Trusted Execution Environments (TEEs)—Intel SGX [32], ARM TrustZone—bind computation to attested hardware, enabling per-device rate enforcement that is robust against softwarelevel attacks. TPM-based attestation and secure enclaves can enforce (H4) by construction, since scaling to s identities requires s independently attested devices. Privacy Pass [33] uses blind signatures to decouple rate-bounded token issuance from identity, enabling anonymous but rate-limited participation tokens. These approaches are complementary to BPC: trusted hardware is one concrete instantiation of the channel serialization basis for (H4) (Section 3). However, BPC does not require trusted hardware—it is designed to
function with software-only channel enforcement (session serialization, deadline enforcement) when TEEs are unavailable or undesirable. Continuous verification of a single resource. A structurally related line of work formalizes periodic challenge-response verification that binds time to continued possession of a resource. Proofs of Retrievability [34], [35] and Proof of Storage-Time [36] let a server periodically prove to a verifier that it still possesses an outsourced file, without re-transmitting it—structurally the closest primitive-level precedent to BPC’s per-window proof: both are challengeresponse protocols whose output is a fresh, per-interval, publicly checkable claim. The relationship they formalize, however, runs between one prover and one file. There is no notion, built into the primitive itself, of binding many independently claimed identities to a joint per-channel throughput ceiling; deployments that need Sybil-resistance for storage providers add it as a separate economic mechanism (e.g., requiring a distinct replication proof per claimed copy), not as a consequence of the storage-time proof’s own contract. BPC instead makes the per-channel throughput bound part of the primitive’s contract from the start (Property H4, Section 3), so that the cost of sustaining s identities follows directly from Properties (H1)–(H4) rather than from an auxiliary mechanism layered on top. Resource-based anti-Sybil mechanisms. Proof-ofWork [37] and Proof-of-Stake [38] bind influence to computational effort or economic stake. Bonneau et al. [39] survey the design space. These resources are parallelizable: once acquired, hashpower or stake can in principle be subdivided across s identities without a fresh acquisition event per identity. Resource reusability or parallelizability alone does not determine whether sustaining that influence over time incurs sublinear or linear economic cost; the latter depends on a separate, explicit economic assumption about the cost of sustaining the resource, not on reusability alone [12]. Proof-of-Space and storage-based mechanisms [40] offer lower energy cost but retain the same parallelizability structure. Rate-limited token systems such as PoW-based email stamps [41] impose per-request costs but do not bind costs to specific identities across time windows, offering no equivalent of C(s, T ) = Ω(sT ). Solver throughput under real-time constraints. BPC’s security argument is solver-agnostic: it does not depend on humans outperforming AI or on AI being unable to solve individual challenges. The relevant quantity is the rate at which valid responses can be produced per channel under strict deadlines, not per-challenge accuracy. Prior work has documented human and AI performance characteristics on perceptual and reasoning tasks [42]–[46], as well as the increasing capability of frontier VLMs [47]–[49] on unconstrained tasks. These findings are relevant to estimating per-channel τh values for specific challenge families, but they do not bear on whether BPC’s cost guarantee holds: that guarantee rests on channel throughput alone, and our evaluation (Section 9) shows that high per-challenge accuracy does not translate to unbounded throughput under deployment-realistic deadlines for any channel type we evaluated.
Classical primitives, individually. It is natural to ask whether BPC is simply a repackaging of existing primitives. Taken individually, none of the following satisfy (H1)–(H4) jointly. Digital signatures. A signature σ = Sign(skv , m) satisfies (H1)—unforgeability binds σ to v —but says nothing about when σ was produced: v can sign today and reveal σ years later. Composing a signature with a fresh external nonce recovers (H2) but not (H3): as discussed in Section 3, signing is an offline computation with no enforced deadline, so throughput is bounded only by computational speed, not by any channel. Timestamping. Digital timestamping [50] certifies that a document existed before a given time, typically via a hash chain or trusted timestamping authority. This gives an upper bound on when a proof was created, not a lower bound: it does not certify that the identity was online and responsive at any particular moment, only that some artifact predates a point in time. A timestamp can be requested for a precomputed artifact at any later moment, violating the requirement that a proof’s temporal context not be selectable by the identity in advance (H2). Verifiable Random Functions. A VRF [51] produces a pseudorandom value together with a publicly verifiable proof of correctness from a secret key and a seed—structurally the closest single-shot analogue to Prove/Verify (Section 3). But a VRF evaluation is, like a signature, an offline computation: nothing prevents batch-evaluating a VRF over many candidate seeds at once, and a VRF alone carries no channellevel throughput bound across many keys. It is a plausible component to build Prove from—this paper does not—not a substitute for (H4). Remote attestation. TEE-based attestation [32] certifies that specific code ran on specific hardware, which can supply (H1) (device-bound keys) and, with periodic re-attestation, something like (H2)–(H3). It is a legitimate construction for Property (H4)—one of the channel-serialization bases discussed in Section 3—but it is not itself a statement about identity-time cost across many identities: nothing in the TEEattestation literature formalizes a multi-identity throughput ceiling or derives a cost theorem from it. The contribution of BPC is not any one of these primitives but the composition that makes all four properties hold jointly, together with the explicit reduction from that composition to a cost theorem (Sections 6–7). Synthesis: what BPC uniquely provides. Table 1 organizes prior mechanisms along four dimensions critical for sustained Sybil resistance: persistence (is verification repeated over time?), per-identity rate-limiting (does each identity face an independent bound?), solver-agnosticism (does security depend on human superiority over AI?), and joint cost scaling (does the total adversarial cost grow with both s and T ?). No prior mechanism achieves all four simultaneously. Graph-based defenses are not persistent in the cost sense. CAPTCHAs and PoP provide one-time C(s, 1) bounds but not C(s, T ) over time. Behavioral biometrics are not peridentity rate-limited in the cryptographic sense and are not designed for open adversarial settings. Continuous storage
Identity v (H1) binding
Window d Index j
BPC challenge χv,d,j
Response ρ
Verify Alg. 1
(H2) freshness
(H3) deadline
(H4) τh bound
✓/✗
Figure 1. BPC participation flow. Each identity v requests a fresh challenge per window d; the verifier binds it to (v, d, j) via (H1)–(H2). The participant responds within ∆resp (enforcing H3); Algorithm 1 verifies correctness and timeliness. Property (H4) bounds how many challenges any single channel can service per window.
proofs formalize persistence for a single prover but have no notion of per-identity binding at all. Resource-based mechanisms enforce persistence but not per-identity independence, and whether the resulting joint cost is sublinear or linear is conditional on the economics of sustaining the resource rather than fixed by the mechanism’s rules alone. BPC is the first mechanism to unify all four properties in a formally specified, solver-agnostic primitive—and the only one that exports its verdict as a public, per-window proof π(v, d) rather than an opaque internal score, with a provable C(s, T ) ≥ sT /τh lower bound.
3. BPC Specification Figure 1 summarizes the resulting participation flow, from challenge issuance through verification. Scope of cryptographic enforcement. Properties (H1)–(H3) are enforced by the hash-based construction of Section 4 under standard cryptographic assumptions. Property (H4) is a structural constraint on participation channels—enforced either by cognitive serialization (for human channels) or by engineering mechanisms such as session serialization and device attestation (for automated channels). The security proofs of Sections 6–7 depend on (H4) as an assumption whose empirical basis for representative challenge families is validated in Section 9.
3.1. Primitive Interface Before stating the formal definition, it is useful to separate three things that are easy to conflate: the event the primitive is about, the claim a verifier can check, and the proof that makes the claim checkable without trusting whoever issued the qualifying action or received the identity’s proof of having performed it. Event. Identity v performs an action, during temporal context d (a window), that (i) requires possession of v ’s credential to perform, and (ii) could not have been performed before d began. What the action concretely consists of—a challenge response, a heartbeat, a hardware attestation—is left to the realization (Section 4); only these two structural requirements are part of the primitive. Claim. A verifier who accepts πv,d may conclude: identity v —and no other identity—performed the qualifying action for context d, and did so no earlier than d permits. This is a claim about what the verifier may believe, not merely a description of what occurred.
TABLE 1. C OMPARISON OF IDENTITY VERIFICATION AND ANTI -S YBIL MECHANISMS ALONG FOUR DIMENSIONS FOR SUSTAINED S YBIL RESISTANCE . Persistent: IS VERIFICATION REPEATED AFTER ADMISSION ? Per-identity: DOES EACH IDENTITY FACE AN INDEPENDENT BOUND , NOT SHARED ACROSS A POOL ? Solver-agnostic: DOES SECURITY HOLD WITHOUT ASSUMING HUMAN COGNITIVE SUPERIORITY ? Joint cost: DOES ADVERSARIAL COST SCALE AS Ω(sT ) JOINTLY IN IDENTITIES s AND TIME T ? E NTRIES MARKED Conditional DEPEND ON A SEPARATE , EXPLICIT ECONOMIC ASSUMPTION ABOUT THE COST OF SUSTAINING THE RESOURCE , NOT ON REUSABILITY OR PARALLELIZABILITY ALONE [12].
Mechanism
Representative Systems
Persistent
Per-identity
Solver-Agnostic
Joint Cost
Graph-based defenses One-time CAPTCHA Proof-of-Personhood Behavioral biometrics Trusted hardware (TEE) Continuous storage proofs Resource-based (PoW/PoS) Rate-limited tokens
[6], [7], [14] [3], [16], [17] [4], [24], [27] [10], [11], [31] [32], [33] [34]–[36] [37], [38] [41]
No No No Yes Yes Yes Yes Partial
No No No No Yes N/A No No
Yes No Partial Partial Yes Yes Yes Yes
O(s) only O(s) once O(s) once Unclear Ω(sT ) (hardware-bound) N/A (single-prover) Conditional o(sT )
BPC (this work)
—
Yes
Yes
Yes
Ω(sT )
Proof. A publicly verifiable object πv,d substantiating the claim. Verification requires no long-term storage of participant data and no trust in the issuing party—only the identity’s registered public key and the public transcript of context d.
•
•
Definition 1 (Bounded Participation Channel). The Bounded Participation Channel (BPC) is a formal primitive that realizes the Event/Claim/Proof pattern above through two operations: Prove : (v, d) −→ πv,d ,
Verify : (v, d, πv,d ) −→ {0, 1}.
At this level, Prove and Verify are left abstract: how a proof is produced and what form it takes are construction decisions, not part of the primitive’s contract. A valid proof sets the participation bit π(v, d) = 1 (Section 5); BPC neither stores nor aggregates this bit across windows—each window’s claim must be independently re-established. BPC is solver-agnostic by construction: the definition and security analysis impose no requirement on what performs the qualifying action—a person, a script, or a model—and apply uniformly to any participation channel satisfying (H1)–(H4). Section 4 instantiates Prove and Verify concretely, as an interactive challenge-response exchange; a non-interactive realization (e.g., periodic device attestation) would satisfy the same contract without ever issuing a challenge. Nothing in this section assumes interactivity.
3.2. Security Properties BPC’s contract is that a proof πv,d satisfying Verify substantiates the claim above only if the following hold. Properties (H1)–(H2) are stated as adversarial objectives— each is directly the basis of a security game (Section 5)— rather than as implementation detail; (H3) is a primitive-level qualitative requirement, realized concretely in Section 4; (H4) is a channel-capacity assumption belonging to a different layer entirely, stated formally as Assumption 1 in Section 5 and needed only for the multi-identity cost theorem of Sections 6–7, not for any single πv,d to be meaningful.
•
•
(H1) Identity binding. No adversary, even given valid proofs for identities other than v , can produce a π that Verify accepts for v without controlling v ’s secret key material. (H2) Non-precomputability. No adversary can produce a π that Verify accepts for context d before d’s context is determined, and d’s context is not selectable or predictable in advance by v itself. The first clause alone is not sufficient: an identity that could choose its own context trivially satisfies "not valid before a context it picked," while gaining nothing in security. (H3) Bounded temporal context. Every valid πv,d must correspond to an action that occurred within a bounded interval—the claim is scoped to d, not to "at some point." Together with (H2), boundedness rules out any strategy that separates the qualifying action from proof production across time. The concrete deadline enforcing this bound is a deployment parameter, fixed in Section 4, not part of the primitive’s definition. (H4) Per-channel throughput bound. A structural fact about channels, not a property of any single πv,d : stated formally as Assumption 1 (Section 5) and not enforced by the cryptographic construction of Section 4. It is what makes the multi-identity cost theorem of Sections 6–7 possible. The structural distinction between temporally reusable resources and resources that must be re-acquired in every participation window is developed in [12]; BPC instantiates the latter case through its bounded, perwindow participation-channel model.
Why not signature + nonce + timestamp? A plain signature over a fresh nonce already satisfies (H1) and (H2), but not (H3) with any enforced deadline: signing is an offline computation, so nothing stops an identity from producing it at leisure, long after the nonce is published. Without a real-time deadline, signing throughput is bounded only by computational speed, not by any channel constraint, making (H4) and the joint cost theorem vacuous. Property (H3)
is what converts an offline computation into a channel-bound, real-time act; Section 2 compares this construction in full against signatures, timestamping, and remote attestation. Proposition 1 (Security is solver-agnostic). Properties (H1)– (H2) hold against a PPT adversary Acrypto under the random oracle model and EUF-CMA; (H3) holds unconditionally. Under these and Assumption 1 (H4), sustaining s active identities over T windows requires C(s, T ) ≥
sT δ = sT · rtt τh ∆resp
independent channel-windows, regardless of whether channels are operated by humans, automated agents, or any combination. The cost argument depends only on (H4) and not on computational hardness: the bound holds against any adversary—PPT or unbounded—given Assumption 1. This result is structural: C(s, T ) here counts independent participation channel-windows required to sustain a target participation level, not an economic expenditure. The relationship between a structural requirement of this kind and the separate economic conditions under which it becomes a cost floor in currency is developed in [12]. The formal proofs of Lemmas 1 and 2 and Theorems 1–3 appear in Sections 6–7. Remark 1. Properties (H1)–(H4) jointly constitute a strictly stronger primitive than per-account rate limiting. Rate limiting bounds request frequency but provides no cryptographic identity binding, no freshness guarantee, and no composable cost theorem. BPC provides all four, enabling the C(s, T ) = Ω(sT ) result of Sections 6–7 and composability with higher-level protocols that consume its exported participation proofs.
3.3. On Property (H4) and Solver Identity Property (H4) asserts that a single channel is throughputbounded per window under ∆resp . This is not equivalent to assuming that humans outperform machines on individual challenges, and should not be interpreted as a claim that automated systems cannot solve BPC challenges. The security argument depends only on bounded throughput per participation channel, not on solver identity. Whether channels are operated by humans, AI systems, or hybrid pipelines is orthogonal to the cost theorem. A single automated agent may solve any given challenge instantly; what (H4) asserts is that a single channel cannot handle ω(1) distinct challenge indices per window within ∆resp , due to the irreducible latency of each challenge-response round trip (network delivery, processing, submission, and verification). For human channels, cognitive processing time contributes to this bound; for automated channels, inference and network latency play the same structurally equivalent role. Empirical validation of (H4) for specific challenge families is given in Section 9. Two independent bases for (H4). Property (H4) can be grounded in two structurally distinct mechanisms, and either one is sufficient for the security argument.
Cognitive serialization. Human cognition imposes an irreducible serial bottleneck: a single person cannot attend to, process, and respond to multiple independent challenges simultaneously within a short deadline. This bound derives from cognitive and motor throughput limits, not from any assumption of human superiority over automated solvers. Channel serialization. Engineering constraints can enforce (H4) independently of who or what operates the channel. Concrete mechanisms include: •
•
•
Per-session serialization. The system issues at most one active challenge per session token at any moment; the browser session or WebSocket connection is the channel boundary. A channel serving multiple identities in parallel must hold multiple concurrent sessions, each incurring its own round-trip budget. Device-bound attestation. Challenges are bound to a specific hardware token, secure enclave, or TPM that enforces a per-device rate limit. Scaling to s identities requires s independently attested devices. Stateful interaction locality. Challenges require continuous interaction with a dynamically mutating UI element throughout ∆resp , making parallel execution across identities on a single device structurally difficult.
Under channel serialization, the bound on τh is a systems constraint rather than a cognitive claim: it follows from the serialization enforced by the channel architecture. The formal security argument of Sections 6–7 holds under either basis for (H4); deployments may select the enforcement mechanism best suited to their trust model and accessibility requirements. Concurrent versus sequential service. Serialization bounds concurrent service only: a channel cannot serve multiple identities at the same instant, but nothing prevents it from serving multiple identities sequentially within one window, one round trip after another, up to the response-time bound. This is exactly what τh = ⌊∆resp /δ rtt ⌋ (Assumption 1) counts: the number of sequential round trips a single channel can complete before the deadline. Lemma 1 and the multiinstance accounting of Section 10 (e.g., 334 solver instances sustaining 1,000 identities at τh = 3) both rely on this sequential-reuse reading, not on a channel serving only one identity per window.
3.4. Channel Semantics and Enforcement Models The word “channel” is deliberately abstract in the definition of BPC (Section 3), but a concrete deployment must commit to what counts as one channel and how (H4) is enforced for it. Table 2 lists the enforcement models introduced above, together with the failure mode each one is vulnerable to and where in the paper each is instantiated. Each row fixes a different value of τh but leaves the cost theorem itself unchanged: Theorem 2 and Corollary 1 are proved for an arbitrary channel satisfying (H4) and do not depend on which enforcement model supplies it. The empirical evaluation of Section 9 instantiates the API solver
TABLE 2. C HANNEL ENFORCEMENT MODELS . Instantiated in POINTS TO WHERE EACH MODEL IS USED AS A CONCRETE EXAMPLE OR EVALUATED EMPIRICALLY; THE FORMAL RESULTS OF S ECTIONS 6–7 ARE STATED ABSTRACTLY OVER (H4) AND HOLD UNDER ANY ROW OF THIS TABLE . Channel model
What counts as one channel
Enforcement mechanism
Main limitation
Instantiated in
Human operator Browser session Device-bound channel API solver channel UI-occupancy channel
One person One active authenticated session/connection One attested device or key One concurrent inference stream (API key/session/quota) One continuously occupied interactive surface
Cognitive/motor serialization (inherent) Server-side session serialization (one open challenge per session) Hardware attestation (TPM, TEE, passkey) API-level rate and concurrency limits Sustained interaction required throughout ∆resp
Outsourcing to paid human labor markets Bot/session farms provisioning many concurrent sessions Device farms; emulator/attestation-spoofing resistance Parallel API keys; bulk/tail-latency exploitation Automation across multiplexed virtual displays
Section 3.3; human ranges in Table 3 Section 3.3 Section 3.3; Table 1 Section 9; 334-instance example (Section 10) Section 3.3
channel row specifically—the measured τh values in Table 3 are not automatically the right calibration for a device-bound or UI-occupancy deployment, which may instead fall under the exclusive-channel regime (τh = 1, Remark 2) enforced by hardware or interaction constraints rather than by response latency.
3.5. Separability and Composability The security guarantees of BPC depend only on (H1)– (H4). Application-level details—user interfaces, challenge formats, delivery channels—do not affect these guarantees. This separability enables BPC to be instantiated across diverse systems and composed with higher-level protocols, which remain free to define their own policies over the exported participation proofs π(v, ·).
3.6. Delegation and Key Sharing BPC’s properties are proofs about a cryptographic key, not about the person or process holding it. Property (H1) ensures that a valid response is bound to identity v ’s registered key pkv and cannot be credited to any other identity; it does not, and cannot, distinguish between v personally producing that response and v having delegated challengesolving or shared signing access to a third party—a family member, a paid worker, or an automated agent acting under skv . BPC’s guarantee is therefore precisely that sustained access to identity v ’s signing capability was exercised in every counted window, not that a specific human being was sustainedly present. This is a deliberate scope choice, consistent with BPC’s solver-agnostic design (Section 3.3): the primitive prices sustained participation at the channelwindow level regardless of what or who operates the channel, and does not itself prevent a participant from delegating that operation. Deployments that require a stronger non-delegation guarantee—binding participation to a specific individual, not merely to possession of a specific key—should compose BPC with an external mechanism that restricts key custody, such as non-exportable hardware-bound keys (secure enclaves, TPMs, passkeys) or server-controlled session flows that never expose skv to the participant directly (the device-bound channel model of Table 2).
4. A Hash-Based Realization Section 3 left Prove and Verify abstract, specifying only the Event/Claim/Proof contract and Properties (H1)– (H4) that any realization must satisfy. This section gives one such realization: a concrete hash-based instantiation
Figure 2. Two-timescale structure. A window of duration ∆h contains multiple challenges χv,d,j , each with a short deadline ∆resp ≪ ∆h . A fresh nonce ηd is drawn at window open, preventing precomputation (H2); the deadline enforces real-time response (H3). Cross-window reuse is ruled out by (H2): solutions computed in window d are invalid in d+1.
satisfying Properties (H1)–(H3) under standard assumptions— the random oracle model [52] for the hash function, and existential unforgeability under chosen-message attack for the signature scheme—via an interactive challenge-response exchange. It is not the only realization the contract admits: Section 3 already noted that periodic device attestation would satisfy the same contract without ever issuing a challenge, and Section 2 discusses why classical primitives alone— signatures, timestamps, VRFs, attestation—do not, individually, suffice. Property (H4) is a channel-level structural constraint that no cryptographic construction enforces; it is analyzed separately in Section 5 and empirically validated in Section 9. The construction presented here is self-contained and requires no trusted hardware. Prove is realized here as an interactive challengeresponse exchange, illustrated in Figure 2: on input a participant identity v , window index d ∈ N, and challenge index j ∈ {1, . . . , k(d)}, the primitive issues a fresh challenge instance χv,d,j with response deadline ∆resp ≪ ∆h . A response ρ to χv,d,j is valid iff: (i) ρ is received within ∆resp of issuance (realizing H3); (ii) ρ is a correct solution to χv,d,j ; (iii) ρ is cryptographically bound to the triple (v, d, j) (realizing H1). A valid response constitutes the proof πv,d .
4.1. Setup Let H : {0, 1}∗ → {0, 1}λ be a collision-resistant hash function modeled as a random oracle [52], with security parameter λ. We instantiate H with SHA-3 [53] in practice. Each identity v holds a long-term key pair (skv , pkv ) with pkv registered with the system. The registration mechanism is external to BPC and may be any identity management system—Proof-of-Personhood protocols [4], institutional enrollment, or payment-gated admission. BPC does not require
registration to be costly: its linear-cost guarantee governs the sustained participation cost regardless of how cheap identity creation is. An adversary registering s identities incurs the deploying system’s per-identity admission cost, which is orthogonal to and additive with the per-window participation cost C(s, T ) enforced by BPC. At the start of each window d, a fresh nonce ηd ∈ {0, 1}λ is drawn from a public randomness beacon [54] and publicly broadcast. The nonce is unpredictable before window d opens and publicly verifiable thereafter.
4.2. Challenge Generation The binding tag alone does not make the content of a challenge fresh: if the task payload ϕv,d,j were drawn from a source independent of ηd —a pre-generated pool, say—an adversary could solve payloads before window d opens even though the tag itself remains unpredictable, defeating the intent of (H2). To rule this out, both the tag and the payload are derived from one shared, window-fresh seed. For identity v , window d, and index j ∈ {1, . . . , k(d)}: seedv,d,j = H(pkv ∥ d ∥ j ∥ ηd ), (ϕv,d,j , auxv,d,j ) ←− GenC (seedv,d,j ),
(1) (2)
where GenC is the (possibly randomized-looking but seeddeterministic) instance generator of challenge family C from Section 8. seedv,d,j is exactly the binding tag recomputed in Algorithm 1—no new value is introduced. Because ϕv,d,j is a deterministic function of that same unpredictable ηd , freshness of the tag under (H2) carries over to freshness of the challenge content—an adversary cannot precompute ϕv,d,j any earlier than it can precompute the tag. auxv,d,j denotes any auxiliary data the generator produces alongside the payload (e.g., which candidate is correct); whether auxv,d,j is exposed to the participant is a property of the family, discussed next. Verification is public, by design. CheckTask in Algorithm 1 takes only the public payload ϕv,d,j and the submitted response rv,d,j —never a secret answer key held only by the verifier. This is a deliberate consequence of BPC’s solver-agnostic scope (Section 3.3): the security argument never rests on a challenge being hard to solve, only on a response being identity-bound, fresh, and rate-limited, so nothing is lost by making correctness fully publicly checkable. This does mean that admissible challenge families (Section 8) must be ones whose correctness predicate is public-computable from (ϕv,d,j , rv,d,j ) alone—a family that instead required a verifier-only secret to check responses would fall outside the scope of this construction and is not considered here.
4.3. Response and Verification A participant submits: ρ =
σv , rv,d,j ,
Algorithm 1 BP C.Verify(v, d, j, ρ, trecv ) Require: Identity v , window d, index j , response ρ = (σv , rv,d,j ), receipt time trecv Ensure: Accept or Reject 1: if trecv > tissue + ∆resp then 2: return Reject {Deadline exceeded — enforces (H3)} 3: end if 4: if ¬ VerifySig pkv , pkv ∥ d ∥ j ∥ rv,d,j , σv then 5: return Reject {Invalid signature — enforces (H1)} 6: end if 7: Recompute binding tag: τ ← H(pkv ∥ d ∥ j ∥ ηd ) 8: if binding tag in χv,d,j ̸= τ then 9: return Reject {Wrong identity/window — enforces (H1)} 10: end if 11: if ¬ CheckTask(rv,d,j , ϕv,d,j ) then 12: return Reject {Incorrect task solution} 13: end if 14: return Accept
where rv,d,j ∈ R is the task solution and σv = Sign(skv , pkv ∥ d ∥ j ∥ rv,d,j ). Algorithm 1 gives the complete verification procedure.
4.4. Security of the Construction We establish each property against the adversary model of Section 5. Properties (H1)–(H2) hold against the PPT adversary Acrypto ; (H3) holds unconditionally; (H4) follows from Assumption 1 against any adversary. Identity binding (H1). Against a PPT adversary Acrypto , the binding tag H(pkv ∥ d ∥ j ∥ ηd ) ties the challenge to (v, d, j). A valid response includes a signature under skv ; producing a valid response for v ′ ̸= v requires either forging a signature under skv —infeasible under EUF-CMA— or finding a hash collision—infeasible in the random oracle model [52]. Freshness (H2). Against a PPT adversary Acrypto , the nonce ηd is revealed only at the start of window d. Because ηd is hidden prior to window d, the binding tag H(pkv ∥ d∥ j∥ ηd ) is computationally indistinguishable from uniform before d opens. No PPT adversary can compute χv,d,j before ηd is known, ruling out precomputation in the random oracle model [52]. Real-time constraint (H3). This property holds unconditionally, independently of adversarial computational power. Line 1 of Algorithm 1 checks the receipt timestamp deterministically and independently of the task solution. Late responses are rejected regardless of the adversary’s computational capabilities. Throughput bound (H4). The cryptographic construction does not enforce (H4); this property is captured by Assumption 1 and arises from the latency structure of the participation channel. Each valid response requires: (i) receiving χv,d,j after its issuance; (ii) computing rv,d,j and σv ; (iii) transmitting
ρ and having it received within ∆resp . A deployment-specific lower bound δ rtt on this round-trip time (Assumption 1) limits any channel to at most τh = ⌊∆resp /δ rtt ⌋ responses per window. For human channels, cognitive processing time contributes to this floor. The security results of Sections 6–7 are stated conditionally on Assumption 1; empirical characterization of τh for representative challenge families is given in Section 9.
5. System and Adversary Model 5.1. System Model The system consists of a set of identities I interacting with a platform relying on BPC for continuous verification. Time is divided into windows d ∈ N of fixed duration ∆h . For identity v and window d, let π(v, d) ∈ {0, 1} denote the participation bit: π(v, d) = 1 iff v performs at least one valid qualifying action during d, and π(v, d) = 0 otherwise. An identity v is active in window d iff π(v, d) = 1. BPC’s internal state supports only the cryptographic bookkeeping required for freshness—nonces and window indices (H2)— and does not accumulate π(v, ·) into a score, reputation, or any other persistent participation record. BPC exports the sequence π(v, 1), π(v, 2), . . . as its sole output; interpreting or aggregating this sequence for reputation, voting weight, or consensus influence is the responsibility of the higher-level system that consumes it, not of BPC itself. Verification is deterministic, public, and requires no long-term storage of participant data.
5.2. Adversary Model We consider a two-layer adversary model reflecting the two-layer structure of BPC’s security guarantees. Cryptographic layer ((H1)–(H3)). For the purposes of the construction in Section 4, we consider a probabilistic polynomial-time (PPT) adversary Acrypto bounded by the security parameter λ. Properties (H1) and (H2) hold against Acrypto under the random oracle model and existential unforgeability of the signature scheme (EUF-CMA). Property (H3) holds unconditionally: the deadline check in Algorithm 1 is deterministic and requires no computational assumption. Structural layer ((H4)). For the cost analysis of Sections 6– 7, we consider a computationally unbounded adversary A that may: • •
• •
create and coordinate an arbitrary number of identities s; operate up to m independent participation channels (human or automated) within any window, with m adaptively varying across windows; employ outsourcing, relay attacks, AI automation, or any combination; deviate arbitrarily from the protocol, subject to Assumption 1 (H4).
The cost results of Sections 6–7 hold unconditionally given Assumption 1, independently of adversarial computational power.
5.3. Adversarial Cost Function Definition 2 (Adversarial cost). C(s, T ) denotes the minimum number of independent participation channel-windows required to sustain s active identities over T consecutive windows. Assumption 1 (Channel Throughput Bound). Let δ rtt > 0 denote a deployment-specific lower bound on the time required by a single participation channel to complete one valid challenge-response interaction under the deployed channel model—a round trip consisting of challenge delivery, response computation, and receipt acknowledgement—such that no channel admitted by that model can complete a round trip faster than δ rtt . Any single participation channel then produces at most ∆resp τh = δ rtt valid responses per window, independently of the number of identities associated with that channel. This is a structural claim about the channel model, not a statistical one: δ rtt must hold against the fastest channel the deployment’s threat model admits, not merely against a typical one, so it cannot simply be read off as an average of observed latencies. Section 9 estimates δ rtt conservatively from observed latency distributions rather than instantiating it with the sample mean; the gap between the two, and the risk of a real deployment’s fastest achievable channel undercutting whatever value of δ rtt is adopted, is treated explicitly as a deployment consideration in Section 11 rather than as a hidden gap. Remark 2 (Three capacity regimes). The quantity τh in Assumption 1 names one of three structurally distinct capacity regimes; every other occurrence of τh in this paper refers to the first. • Synchronous deadline capacity, τhsync = ⌊∆resp /δ rtt ⌋: the number of sequential challengeresponse round trips a single channel can complete before a shared deadline ∆resp closes. This is the regime instantiated by the browser-session and API solver channel models of Table 2, the one used in Theorem 2 and Corollary 1, and the one measured empirically in Section 9. • Window-service capacity, τhwin = ⌊∆h /δservice ⌋, where ∆h is the full window length rather than a single response deadline and δservice is the time a channel takes to service one identity’s request within it: the regime for a channel that stays continuously open across the whole window rather than answering one burst deadline. τhwin can exceed τhsync when ∆h ≫ ∆resp ; a deployment operating in this regime re-derives Corollary 1 with τhwin in place of τhsync — the algebra is unchanged, only the capacity value differs.
•
Exclusive-channel capacity, τh = 1: the degenerate case in which the enforcement mechanism itself, not response latency, limits a channel to one identity per window regardless of ∆resp or δ rtt . This is the regime instantiated by the device-bound and UI-occupancy channel models of Table 2: a single attested device or a single continuously occupied interactive surface cannot serve a second identity within the same window at all, so the round-trip formula above neither applies nor is needed—τh = 1 holds by construction.
All results in Sections 6–7 are proved for a generic τh and hold under any of the three regimes; only the numeric value, and for the window-service regime the substituted formula, changes. Remark 3 (Bases for Assumption 1). Assumption 1 can be grounded in two structurally distinct mechanisms. (i) Cognitive serialization: for human channels, cognitive and motor processing time sets δ rtt ≥ δcog , where δcog is the irreducible human response latency for the deployed challenge family (empirically characterized in Section 9). (ii) Channel serialization: for automated channels, δ rtt is bounded below by network propagation delay plus inference latency. Measured under standard commercial inference APIs (Section 9), current frontier VLMs incur mean latencies of 2.25–3.57 s on multi-image perceptual tasks and 0.95–1.79 s on text-based reasoning tasks; treating these observed means as an illustrative (not conservative) reference point yields τh ∈ {2, 3} for ∆resp = 8 s on perceptual challenges and τh ∈ {6, 7, 12} for ∆resp = 12 s on reasoning challenges; Section 9.2 discusses conservative calibration of δ rtt itself. Either basis is sufficient for the security argument of Sections 6–7.
6. Sybil Cost Analysis Figure 3 previews where this section’s result (and Section 7’s multi-window extension of it) sits relative to the mechanisms surveyed in Section 2. Lemma 1 (Per-window identity bound). Under Assumption 1, in any window d, an adversary operating m participation channels can produce valid BPC responses for at most ∆resp m · τh = m · δ rtt distinct identities. Proof. By Assumption 1 (H4), each of m channels produces at most τh = ⌊∆resp /δ rtt ⌋ valid responses per window. By (H1), a response for identity v cannot be credited to v ′ ̸= v ; responses are non-sharable across identities. By (H2) and (H3), precomputed or late responses are rejected. The total valid responses attributable to distinct identities is therefore at most m · τh .
adversarial cost C(s, T ) BPC: Ω(s) per window
PoW/PoS: Ω(s) or o(s) (depends on carrying cost) CAPTCHA/PoP: O(1)
identities s (fixed time horizon T )
Figure 3. Schematic adversarial cost C(s, T ) as a function of the number of sustained identities s (at fixed T ). BPC enforces linear scaling Ω(s) per window unconditionally, from a structural channel constraint alone. Resource-based mechanisms such as PoW/PoS occupy the shaded band: their regime is Ω(s) or o(s) depending on a separate, explicit economic assumption about the cost of sustaining the resource, not on reusability or parallelizability alone [12]; one-time mechanisms (CAPTCHA, PoP) incur constant cost after creation regardless of s.
Theorem 1 (Linear Sybil cost). Under (H1)–(H3) and Assumption 1 (H4), sustaining s active identities in any single window requires s δ rtt m ≥ = s· τh ∆resp independent participation channels. Equivalently, C(s, 1) ≥ s/τh = s · δ rtt /∆resp . Proof. From Lemma 1, mτh ≥ s, giving m ≥ s/τh = s · δ rtt /∆resp . Since τh = ⌊∆resp /δ rtt ⌋ is fixed under Assumption 1, this gives m = Ω(s). By Definition 2, C(s, 1) is exactly this minimum channel count m, so C(s, 1) ≥ s/τh . Remark 4 (On the simplicity of this reduction). The proof above is a direct counting argument, not a computational reduction, and this is intentional rather than a gap. Once (H1)– (H4) are granted, linear cost follows by pigeonhole; the same is true of many security reductions once the underlying hardness assumption is granted—IND-CPA security of ElGamal follows quickly from DDH, for instance. The intellectual content of such results lies in identifying a minimal, achievable assumption and showing it implies the target guarantee, not in the length of the derivation. Here, the analogous work is threefold: showing that (H1)–(H4) are sufficient for linear cost, while making explicit the role each property plays in the bound—(H1) rules out crediting one response to multiple identities, (H2)–(H3) rule out precomputed or late responses, and (H4) caps per-channel throughput—and situating this combination against prior mechanisms that achieve at most a subset of it (Section 2); constructing (H1)– (H3) from standard cryptographic primitives (Section 4); and empirically establishing that (H4) actually holds, with small τh , for realistic channels—which was not obvious in advance and is where this paper’s claims could have failed (Section 9). We do not claim (H1)–(H4) are individually necessary for linear cost—a different mechanism might achieve the same
scaling via a different property combination—only that this combination suffices and that no prior mechanism surveyed in Section 2 attains it with fewer properties. The theorem is simple; whether its hypothesis is true of the physical world is not, and that is the question the empirical evaluation is designed to answer. Corollary 1 (No sublinear amortization). No adversary can sustain s identities with o(s) channels per window, regardless of the value of τh . Proof. By Lemma 1, each of m channels produces valid responses for at most τh distinct identities per window (H4). Property (H1) ensures that a response for identity v cannot be credited to v ′ ̸= v ; responses are non-transferable. Therefore m channels cover at most mτh identities, giving m ≥ ⌈s/τh ⌉. Since τh is a fixed positive constant under Assumption 1, ⌈s/τh ⌉ = Ω(s), so no adversary can sustain s identities with o(s) channels per window regardless of the value of τh . Remark 5 (Structural vs. economic amortization). Corollary 1 rules out amortization in a structural sense: no adversary, regardless of scale, can cover more identities per channel as s grows—the channel-to-identity ratio never improves with size. It does not by itself imply that the dollar cost of operating those channels resists amortization: bulk pricing or labor-market economies of scale could still drive down the cost per channel as an adversary scales. That gap is closed only under the separate, explicit Assumption 2 and Corollary 2 below, which convert this structural count into an economic floor.
7. Multi-Window and Long-Term Analysis Let sd and md denote the number of active identities and channels, respectively, in window d. Lemma 2 (Window persistence bound). Under Assumption 1, sd ≤ md · τh = md · ⌊∆resp /δ rtt ⌋ for every window d. Proof. Lemma 1 applied to window d. Since (H2)–(H3) prevent cross-window reuse, effort in window d cannot carry to d + 1. Theorem 2 (Joint linear cost). Under (H1)–(H3) and Assumption 1 (H4), C(s, T ) ≥
sT δ = sT · rtt . τh ∆resp
Proof. By Lemma 2, each window d independently requires at least ⌈s/τh ⌉ channel-windows. Properties (H2)–(H3) ensure that valid responses from window d are rejected in window d + 1: each window requires fresh participation and cannot draw on effort invested in prior windows. The channelwindow counts across PT windows are therefore additive, and the total cost is d=1 ⌈s/τh ⌉ ≥ sT /τh . Theorem 2 bounds C(s, T ), a structural count of channelwindows (Definition 2); it makes no claim about currency. Converting this structural requirement into an economic floor takes one further, separately falsifiable step.
Assumption 2 (Uniform Per-Channel Operating Cost). There exists a constant cop > 0, independent of s and T , such that provisioning and operating each channel-window required by Theorem 2 incurs an economic cost of at least cop . This is an economic claim, not a structural one: bulk pricing or labor-market economies of scale available only to a large-s adversary would violate it, an empirical question about a given deployment addressed in Section 11, not a consequence of (H1)–(H4). Corollary 2 (Concrete security bound). Let Cecon (s, T ) denote the minimum economic cost, in currency, of sustaining s identities over T windows. Under Assumption 2, Cecon (s, T ) ≥ cop · C(s, T ) = Ω(sT ).
For illustration (using the cross-solver mean latencies of Section 9 only as a convenient reference point; Section 9.2 gives the conservative calibration an actual deployment should use instead), take a perceptual deployment with ∆resp = 8 s and δ rtt ≈ 2.7 s: τh = ⌊8/2.7⌋ = 2, giving C(s, T ) ≥ sT /2 channel-windows and Cecon (s, T ) ≥ cop · sT /2. For a reasoning deployment with ∆resp = 12 s and δ rtt ≈ 1.4 s, giving τh = 8: the bound relaxes to Cecon (s, T ) ≥ cop ·sT /8. In both regimes τh is a small single-digit constant and the Ω(sT ) scaling of C(s, T ) is preserved unconditionally; the scaling of Cecon (s, T ) additionally requires Assumption 2. Reducing ∆resp decreases τh proportionally, tightening the per-channel-window guarantee at the cost of higher interaction burden. Theorem 3 (Steady-state SybilP capacity). Under AssumpT tion 1, let m̄ = lim supT →∞ T1 d=1 md . Then T ∆resp 1X lim sup sd ≤ m̄ · τh = m̄ · . δ rtt T →∞ T d=1
Proof. Sum sd ≤ md τh over T windows, divide by T , take lim sup. The bound is explicit in ∆resp and δ rtt via Assumption 1. Burst attacks. Concentrating effort in short bursts PT does not help: the total identity-window budget BT = d=1 sd satisPT fies BT ≤ τh d=1 md , so burst attacks incur linear cost in total channel-windows regardless of temporal concentration.
8. Challenge Families 8.1. Abstract Admissibility Requirements A challenge family C is admissible for BPC if every instance satisfies (H1)–(H4). Concretely: •
•
instances are unpredictable before issuance (H2), which requires both the binding tag and the task payload ϕv,d,j to be generated from the shared window-fresh seedv,d,j of Equation 1, not from an independent or pre-generated source; correct responses are deterministically and publicly verifiable from (ϕv,d,j , rv,d,j ) alone, with no verifieronly secret required by CheckTask;
• •
responses are cryptographically bound to (v, d, j) (H1) via the construction of Section 4; the interaction model imposes an irreducible perresponse latency that limits channel throughput to τh per window (H4).
The construction of Section 4 satisfies (H1)–(H3) for any task payload; admissibility under (H4) depends on the interaction latency of the specific task family.
8.2. Admissible Families Perceptual visual matching. A distorted or noise-corrupted image is shown with candidate matches; the participant selects the correct correspondence within ∆resp . Admissibility under (H4) does not depend on accuracy differences between humans and automated solvers; both can solve these tasks. What makes the family admissible is that current VLMs incur multi-second inference latencies on multi-image inputs, enforcing a throughput ceiling per channel independently of correctness. Instances are generated by random visual transformations; verification is deterministic. Interactive reasoning tasks. Short dependent reasoning sequences require maintaining intermediate state and submitting a result before a visible countdown expires. Multi-step inference latency limits automated throughput. Correctness is verified deterministically from dynamically generated parameters. Biometric-light response tasks. A fresh, unpredictable prompt requires a synchronized real-time signal (spoken phrase, motion gesture). Real-time synthesis of such signals under strict deadlines incurs additional latency overhead that contributes to throughput bounding under (H4); the admissibility argument does not depend on synthesis being impossible, only on the channel latency floor it imposes. Verification uses transient signal features without long-term biometric enrollment. Attention-based interaction tasks. A dynamic scene requires continuous tracking or selection over several seconds, occupying the full ∆resp interval. This structurally limits any channel to one response per window.
8.3. Deployment Example: Relaxed Window Sizes The formal guarantees of BPC hold across the full parameter space of ∆resp and τh , from sub-second strict deadlines to relaxed daily interaction windows. A concrete example illustrates the range. Daily participation with device-bound login. Consider a system in which each identity must perform one login-style interaction per day: ∆h = 24 h, ∆resp = 24 h, and τh = 1. A single human has 24 hours to respond—there is no cognitive pressure. However, if the login is device-bound (bound to a specific smartphone, secure element, or attested browser session), then sustaining s identities requires s independent attested devices or sessions. An adversary cannot amortize one device across s identities within the same window: each identity requires its own channel-window.
Under this configuration, Theorem 2 gives C(s, T ) = Ω(sT ) channel-windows even with τh = 1. Sybil resistance does not depend on the challenge being cognitively demanding or time-pressured; it depends entirely on channel non-transferability (H1) and window-locality (H4) enforced by the device binding. This example also clarifies the design space: tighter ∆resp values (seconds to minutes) provide stronger near-real-time resistance but impose higher usability cost. Relaxed windows (hours to daily) reduce user burden while preserving the linear cost structure, provided channel binding is enforced engineering-side. The appropriate point in this tradeoff is a deployment-level decision orthogonal to the formal guarantees.
8.4. Rotation and Composability BPC does not depend on any single family. Systems may rotate across admissible families between windows or combine them within a window. Since security depends only on (H1)–(H4), rotation preserves all guarantees of Theorems 2 and 3—this is essential for long-lived deployments where the automation landscape evolves.
9. Empirical Evaluation Evaluation scope. The purpose of this evaluation is not to demonstrate that automated systems fail to solve BPC challenges. Rather, the goal is to characterize the throughput properties of representative participation channels under deployment-realistic deadlines and to measure the resulting values of τh . High per-challenge accuracy and bounded throughput are not contradictory properties; BPC’s formal security requires only the latter. The evaluation is designed accordingly: we treat high solver accuracy as an expected outcome and focus on whether accuracy translates into unbounded servicing capacity within a window. We empirically evaluate Property (H4) along two complementary axes. First, we measure the throughput of three state-of-the-art automated solvers against a deployed instantiation of the perceptual and reasoning challenge families, isolating δrtt and the resulting τh under realistic inference conditions. Second, we contextualize these measurements against established findings on human response time and accuracy on structurally analogous perceptual and reasoning tasks, drawn from the human-performance literature. This design directly targets the empirical content of Assumption 1: that τh is small and bounded for every participation channel, automated or human, under a deployment-realistic ∆resp .
9.1. Methodology Challenge implementation. We implemented the perceptual and reasoning challenge families (Section 8) as a deployed web application, with challenge generation and verification
logic identical to the formal specification of Section 4.1 Each candidate images—one correctly corresponding to the original under random rotation, additive Gaussian noise, and color jitter, three drawn from distinct distractor base images under independent transformations—requiring the solver to identify the matching index within ∆resp = 8 s. Each reasoning instance presents a four-element numeric sequence (arithmetic, geometric, Fibonacci-like, or perfectsquare) and requires the next element within ∆resp = 12 s. Using synthetic geometric shapes for the perceptual family avoids copyright and memorization concerns associated with natural images while preserving the noise-robust matching structure relevant to (H4). Automated solvers. We evaluate three vision-language models representative of current commercial inference APIs: GPT4o [47], Gemini 2.5 Flash [48], and Claude Sonnet 4.5 [49]. For each (solver, family) pair we generate 100 independent trials (600 trials total), drawing fresh challenge instances via the same generator used to serve human participants. Critically, each solver receives only the public challenge fields—images and sequence values—and never the private verification target; this mirrors the information available to a real adversary attempting to defeat BPC and rules out trivial leakage of the correct answer through the prompt construction. For perceptual trials, the original and four option images are transmitted as base64-encoded PNG content blocks via each provider’s standard multi-image chat completion interface, accompanied by a fixed instruction requesting a single-digit index. For reasoning trials, the four-element sequence is transmitted as plain text with an instruction requesting the next integer. We measure wall-clock latency δrtt as the interval between issuing the API request and receiving a parsed response, enforced via a hard per-trial timeout equal to ∆resp . A trial is passed iff the response is both correct and received within ∆resp ; we separately record latency_fail (correct response arriving after the deadline) and correctness_fail (an incorrect response, regardless of timing), consistent with the failure-mode separation introduced in Section 3. Requests are issued sequentially per solver with inter-trial delays respecting each provider’s published rate limits; full results, including per-trial latency, correctness, and raw responses, are released alongside this paper. Mean latency versus the Assumption 1 floor. Table 3 and Figure 4 report τh = ⌊∆resp /δ̄rtt ⌋ using each solver’s mean observed latency δ̄rtt . This is a descriptive statistic about the tested solvers under our trial conditions, not an instantiation of the formal δ rtt of Assumption 1: an adversary operating preferentially at the low-latency tail—for example by issuing multiple concurrent requests and taking the fastest—routinely beats the mean, so a τh computed from the mean is not a valid upper bound on adversarial throughput and should not be read as one. We note that exploiting the tail this way still requires provisioning additional concurrent connections, 1. The deployed web application, source code, and challenge generators are available in an anonymized repository for review and will be publicly released, with a live deployment link, upon publication.
each of which counts as a separate channel-window under Assumption 1, so it does not escape the Ω(sT ) scaling—but it does mean that a deployment’s operative δ rtt must be set conservatively, at or below the fastest round-trip time the threat model plausibly admits, not at the sample mean. We release per-trial latency distributions alongside this paper so that deployments can calibrate δ rtt from a low percentile of observed latency (and size ∆resp accordingly) for their specific threat model, rather than from the mean values reported here for cross-solver comparison. Human performance (literature-calibrated). A full-scale controlled human study with statistically powered recruitment is left as immediate future work (Section 11). In place of a de novo study, we contextualize the automatedsolver measurements against established findings on human performance on structurally comparable tasks under time pressure. For perceptual matching under noise and geometric distortion, human recognition accuracy in the 85–95% range with response times of 3–7 seconds is consistently reported across controlled psychophysics studies of human visual generalization under noise and shape distortion [42] and of human performance on perceptually structured CAPTCHAstyle matching tasks [20]. For short numeric and symbolic sequence-completion tasks under time pressure, human accuracy in the 80–95% range with response times of 2–6 seconds is reported in the interactive human–AI reasoning literature [46]. We use these published ranges, rather than a simulated distribution fit to arbitrary parameters, to anchor the comparison in Section 9.2; we treat this as a conservative contextualization rather than a substitute for first-party human-subject data, and we flag this explicitly as a limitation (Section 11).
9.2. Results Figure 4 and Table 3 summarize the results across all six (solver, family) pairs. The bottleneck is family-dependent, not solver-dependent. The dominant failure mode shifts systematically with challenge family and is highly consistent across all three independently developed models—a pattern that would not be expected if the result reflected an idiosyncrasy of a single provider’s infrastructure. On the perceptual family, all three solvers achieve high correctness (97–100%) but incur mean latencies of 2.25–3.57 s; failures here are concentrated in latency_fail and the residual correctness_fail (0–3%), yielding τh ∈ {2, 3} per window. On the reasoning family, all three solvers respond an order of magnitude faster (0.95–1.79 s) but with substantially lower correctness (75– 78%), so that failures are concentrated almost entirely in correctness_fail (22–25%) rather than latency_fail (≈ 0%), yielding a larger τh ∈ {6, 7, 12}. Averaged across the three solvers, τ̄hperceptual ≈ 2.7 and τ̄hreasoning ≈ 8.3. These findings are entirely consistent with the design goals of BPC. The primitive does not require automated solvers to fail; it requires only that no participation channel achieve unbounded servicing capacity within a window. High solvability and bounded throughput are not contradictory:
(b) Latency vs.\ Δresp Perceptual Reasoning 12
Mean latency (s)
Pass rate (%)
100 75 50 25 0
Perceptual Reasoning GPT-4o Gemini 2.5 Claude Flash Sonnet 4.5
(c) Throughput τh Perceptual Reasoning
Δ = 12s
9
Δ = 8s
6
τh (solves / window)
(a) Pass rate [95% CI]
3 0
8
4
0
GPT-4o Gemini 2.5 Claude Flash Sonnet 4.5
12
12
7
3
2
6 3
GPT-4oGemini 2.5Claude Flash Sonnet 4.5
Perceptual: latency-bound (τh ∈ {2, 3}, accuracy 97–100%). Reasoning: correctness-bound (τh ∈ {6, 7, 12}, accuracy 75–78%).
Figure 4. Empirical throughput evaluation across three frontier VLMs (100 trials per solver–family pair; N = 600 total). (a) Pass rates with 95% Wilson CI confirm high accuracy on perceptual tasks (97–100%) and moderate accuracy on reasoning (75–78%). (b) Mean latency against ∆resp (dashed) shows that perceptual inference (2.25–3.57 s) consumes a large fraction of the 8 s deadline; reasoning responses (0.95–1.79 s) are faster but below the 12 s deadline. (c) Resulting mean-latency-based τh = ⌊∆resp /δ̄rtt ⌋ values illustrate that observed throughput is small and bounded for these solvers: τh ∈ {2, 3} (latency-bound) for perceptual, τh ∈ {6, 7, 12} (correctness-bound) for reasoning (illustrative, not a conservative bound; see Section 9.2). Across all three independently developed models the bottleneck type is consistent, ruling out provider-specific artifacts. TABLE 3. AUTOMATED SOLVER PERFORMANCE UNDER STRICT ∆resp ENFORCEMENT (100 TRIALS PER SOLVER – FAMILY PAIR ; 95% W ILSON SCORE CONFIDENCE INTERVALS ON SUCCESS RATE ). τh USES EACH SOLVER ’ S MEASURED MEAN LATENCY AND IS ILLUSTRATIVE , NOT A CONSERVATIVE INSTANTIATION OF A SSUMPTION 1 (S ECTION 9.2). P UBLISHED HUMAN - PERFORMANCE RANGES FOR STRUCTURALLY COMPARABLE TASKS ARE SHOWN FOR CONTEXT [20], [42], [46].
Family
Solver
Success (%) [95% CI]
Mean Latency (s)
Latency Fail (%)
Correctness Fail (%)
τh
Perceptual (∆resp = 8s)
GPT-4o Gemini 2.5 Flash Claude Sonnet 4.5 Human (literature)
99.0 [94.6, 99.8] 97.0 [91.5, 99.0] 100.0 [96.3, 100.0] 85–95
2.53 3.57 2.25 3–7
1.0 0.0 0.0 —
0.0 3.0 0.0 —
3 2 3 1–2
Reasoning (∆resp = 12s)
GPT-4o Gemini 2.5 Flash Claude Sonnet 4.5 Human (literature)
78.0 [68.9, 85.0] 78.0 [68.9, 85.0] 75.0 [65.7, 82.5] 80–95
0.95 1.50 1.79 2–6
0.0 0.0 0.0 —
22.0 22.0 25.0 —
12 7 6 2–6
a solver that answers every perceptual challenge correctly but incurs 2–4 s per call is still throughput-bounded, and a solver that responds in under 2 s but achieves only 75–78% correctness is bounded by its effective pass rate rather than its speed. In both cases the adversarial cost scales linearly with s and T , consistent with Theorem 2. This asymmetry is informative rather than incidental. Property (H4) does not require that every channel fail outright; it requires only that τh remain small and bounded relative to the number of identities an adversary wishes to sustain. The perceptual family demonstrates a latency-bound regime: solvers are accurate but the irreducible round-trip cost of multi-image inference caps throughput at 2–3 solves
per window regardless of provider. The reasoning family demonstrates a correctness-bound regime: solvers respond quickly, but roughly one in four responses is incorrect, so that sustaining a high rate of valid identity updates still requires either accepting a high rejection rate or expending additional channel-windows to compensate—both of which preserve the linear cost structure of Theorem 1 rather than escaping it. We discuss the adversarial implications of this distinction, including channel parallelization across many independent solver instances, in Section 10. High τh and the linearity argument. The larger τh values on reasoning tasks—τh ∈ {6, 7, 12}—do not undermine the Ω(sT ) cost structure. Sustaining s = 1,000 reasoning iden-
TABLE 4. P ERCENTILE - CALIBRATED THROUGHPUT. τhp10 = ⌊∆resp /p10 ⌋ USES EACH SOLVER ’ S 10 TH - PERCENTILE LATENCY p10 eff = p IN PLACE OF THE MEAN ; τh ADDITIONALLY success · τh DISCOUNTS BY SUCCESS RATE . C OMPUTED FROM THE SAME 600- TRIAL DATASET AS TABLE 3. Family
Solver
p10 (s)
τhmean
τhp10
τheff
Perceptual
GPT-4o Gemini 2.5 Flash Claude Sonnet 4.5
1.92 2.71 1.87
3 2 3
4 2 4
3.96 1.94 4.00
Reasoning
GPT-4o Gemini 2.5 Flash Claude Sonnet 4.5
0.54 1.02 1.51
12 7 6
22 11 7
17.16 8.58 5.25
tities under the worst observed case (τh = 12) still requires ⌈1,000/12⌉ = 84 concurrently operating, independent solver instances per window—each issuing its own API request, consuming its own inference quota, and incurring its own round-trip budget. The key invariant is linearity in s: cost scales as Ω(s) per window regardless of whether τh = 2 or τh = 12. The constant factor determines the cost-per-identity, not whether cost is linear. For deployments requiring tighter per-channel bounds, the perceptual family (τh ∈ {2, 3}) provides a stronger guarantee per sustained identity; the reasoning family may be preferred when minimizing perinteraction user friction is the design priority. Percentile-calibrated throughput and effective throughput. The mean-latency τh values above are, as noted in Section 9.1, an illustrative reference point rather than a conservative instantiation of Assumption 1: an adversary racing multiple concurrent requests and keeping the fastest routinely beats the mean. Table 4 recomputes τh from each solver’s 10th-percentile latency (p10 )—a conservative standin for δ rtt under such tail-racing—and reports the resulting effective throughput ∆resp eff τh = psuccess · , p10 which discounts the p10 -based channel capacity by the family’s measured success rate psuccess , accounting for the fact that not every fast response is also a correct one— relevant chiefly for the correctness-bound reasoning family. The p10 calibration raises every reasoning τh relative to the mean-based figures in Table 3 (most sharply for GPT4o, from 12 to 22); τheff then discounts each by psuccess , pulling the reasoning family back down toward, and in one case (GPT-4o) above, its mean-based value, while leaving the perceptual family essentially unchanged (its near-100% success rate makes the correctness discount negligible). The qualitative conclusion is unchanged—τh remains small and bounded under either calibration—but a deployment sizing ∆resp against a tail-racing adversary should use τheff , not the mean-based figure, as its working estimate. Full pertrial latencies are released alongside this paper so that deployments can recompute both quantities at any percentile appropriate to their threat model. Comparison with published human performance. The literature-calibrated human ranges in Table 3 are not directly
commensurable with our automated measurements as a controlled paired comparison— the underlying tasks differ in surface presentation even where structurally analogous— and we do not claim statistical significance for any humanversus-automated gap. We report them only to situate the automated τh values within a plausible deployment range: published human response times on comparable perceptual and reasoning tasks (3–7 s and 2–6 s respectively) are of the same order of magnitude as the automated solver latencies we measure, supporting the modeling choice in Assumption 1 that τh is small (single-digit) for both channel types under deployment-realistic ∆resp values, rather than near-zero for automated channels and large for human channels (Section 3).
10. Security Analysis We analyze BPC against the principal adversarial strategies. All arguments are grounded in (H1)–(H4) and the construction of Section 4. Automated solving. An adversary deploying AI solvers to fill participation channels does not circumvent the linear cost bound. By (H4), each automated channel is throughputbounded at τh responses per window under ∆resp . Scaling to s identities requires Ω(s) independent channels. Automation shifts the cost from human labor to API credits or hardware, but preserves linear scaling in s. The empirical measurements of Section 9.2 make this concrete. A single GPT-4o instance sustains τh ≈ 3 perceptual identities or τh ≈ 12 reasoning identities per window (Table 3). An adversary aiming to sustain s = 1000 perceptual identities therefore requires m ≥ ⌈1000/3⌉ = 334 independent solver instances—each issuing its own API request, incurring its own latency, and paying its own marginal inference cost—running concurrently within the same window. This is precisely the channel scaling permitted by the adversary model of Section 5: BPC does not claim that an adversary cannot acquire 334 channels, only that doing so costs Ω(s) in provisioned, concurrently operating channels— in contrast to a reusable resource such as hashpower or stake, which may or may not be subdivided across s identities at lower marginal cost depending on the economics of sustaining it [12]. A single inference endpoint cannot itself serve 1000 identities within one window: each concurrent request still incurs the same δrtt , so throughput scales with the number of provisioned endpoints, not with the capability of any one model. Unlike a reusable resource, BPC requires fresh participation within each bounded response window; this is the structural distinction between resource-parallelism, whose cost regime depends on a separate economic assumption, and channel-parallelism, which BPC explicitly permits but prices linearly in s by construction of the channel model established above (Section 6). BPC should therefore not be interpreted as an anti-AI mechanism. Its objective is to continuously price independently sustained participation, not to defeat any particular solver technology. Automation changes the implementation of participation channels and their operational costs—from human labor to API credits and infrastructure—but does not
invalidate the linear identity-time cost theorem. The theorem holds equally whether channels are operated by humans, AI systems, or any combination thereof. Economic cost of channel provisioning. The linear scaling imposes concrete operational constraints beyond per-call inference cost alone. Sustaining s = 1,000 perceptual identities per window requires ⌈1,000/3⌉ = 334 simultaneously active, independent solver instances—each maintaining its own session token, its own API quota, and its own connection to the challenge server. This provisioning cost recurs across every window: over T windows the adversary must provision 334 · T instance-windows in total. Under Assumption 2, this structural requirement becomes an economic one: Cecon (s, T ) ≥ cop · C(s, T ) = Ω(sT ) (Corollary 2). Crucially, cop is not amortizable beyond τh : a single API key or worker cannot have one response credited to multiple identities (H1), though it may serve multiple identities sequentially within a window, up to the channel-throughput bound τh —which is exactly why sustaining s = 1,000 identities above requires ⌈1,000/τh ⌉ = 334 instances rather than 1,000, not zero amortization within a window. Whether cop itself can be driven down across identities by bulk API pricing or labor-market economies of scale as s grows is the separate empirical question Assumption 2 makes explicit (Section 11). Deployments may calibrate cop and τh jointly—through challenge selection, ∆resp tuning, and per-challenge computational cost—to ensure that large-scale Sybil maintenance is economically prohibitive for the target threat model. Human outsourcing and labor markets. An adversary may hire human workers or use CAPTCHA-solving services [22] to solve challenges. This attack is captured in the adversary model: the adversary operates m human channels. Sustaining s identities requires m = Ω(s) workers (Theorem 1). Outsourcing converts the cost from direct labor to wages, but the linear scaling is preserved. Relay and real-time forwarding attacks. Relaying challenges to external solvers adds network round-trip time, which tightens rather than relaxes (H4). By (H1) and (H2)– (H3), relayed responses are identity-bound and non-reusable; relaying does not reduce the total independent channelwindows required. Replay and solution reuse attacks. By (H1), response ρv,d,j is bound to (v, d, j) via the signature σv and the binding tag. Submitting the same response for (v ′ , d′ , j ′ ) ̸= (v, d, j) fails the binding-tag check in Algorithm 1 (lines 3–5). By (H2), the nonce ηd ensures responses prepared before window d are invalid. Precomputation and batch-solving. By (H2), χv,d,j cannot be computed before ηd is revealed. Batch-solving within a window is bounded by (H4): processing k > τh challenges requires more than τh round-trip latency budgets, which is infeasible under ∆resp . Synthetic media and deepfake attacks. For biometric-light families, an adversary may attempt real-time synthesis of a biometric response. Mitigations include: (i) challenge freshness (H2) prevents off-line synthesis; (ii) liveness detection flags synthesized signals; (iii) challenge rotation to fami-
lies resistant to synthesis (e.g., attention-based interaction) eliminates reliance on vulnerable modalities. Side-channel and man-in-the-browser attacks. A malicious browser extension may observe and forward challenges to an external solver. This constitutes a relay attack and is bounded as above. Deployment-level countermeasures— content-security-policy headers, subresource integrity, and challenge obfuscation—reduce exfiltration feasibility but are orthogonal to the core security model. Privacy and data minimization. Verification requires only ρ = (σv , rv,d,j ) and χv,d,j ; no raw biometric data or behavioral record is stored. pkv may be pseudonymous. Privacy-preserving challenge delivery ensuring unlinkability across windows while preserving identity binding is an important direction for future work.
11. Limitations Scope of the cryptographic guarantees. The two-layer split of Section 5 has two concrete consequences for what can weaken BPC’s guarantees. First, Property (H4)—formalized as Assumption 1—is not a cryptographic guarantee like (H1)– (H3); it is a structural property of the channel parameterized by τh = ⌊∆resp /δ rtt ⌋, and all cost results are explicitly conditional on it. Its degradation is quantified, not catastrophic: Corollary 2 shows a tenfold increase in τh weakens the channel-window lower bound by a factor of ten without invalidating the linear scaling in s and T . Second, because (H3) and all cost results hold unconditionally given Assumption 1—independently of computational power— advances in raw compute alone do not weaken the linearcost guarantee; only reductions in δ rtt itself (faster hardware, lower-latency inference, co-located solvers) affect the bound, and these are addressed by adjusting ∆resp accordingly. Dependence on Assumption 1 (H4). The linear cost guarantee rests on Assumption 1, and can be weakened along two distinct routes. First, a faster channel: an adversary with ultralow-latency inference infrastructure—co-located on-premise hardware, specialized accelerators, or a distilled model running at sub-100 ms latency—could achieve δrtt ≪ ∆resp , undercutting whatever δ rtt the deployment adopted and driving τh up. Second, more channels: adversaries may scale channel capacity through infrastructure—VM farms, cloud phone emulators, browser-bot fleets, distributed worker pools—rather than beating any single channel’s latency. Neither route invalidates (H4) or breaks the Ω(sT ) scaling in s and T ; both convert the guarantee from an impossibility into a cost multiplier that a deployment must actively manage: a faster channel weakens the per-channel-window bound by a constant factor, and each additional farmed channel still requires its own provisioning cost, so total adversarial cost remains Ω(sT ) either way. This places (H4) in a different category from the cryptographic assumptions underlying (H1)–(H2): DDH or EUFCMA are treated as asymptotically stable, and their failure is catastrophic and binary. Assumption 1 is instead a physicallygrounded, empirically measured, and recalibratable quantity, degrading gracefully rather than catastrophically—the same
category of assumption underlying Proof-of-Work mining difficulty, which Bitcoin does not treat as disqualifying but retargets periodically against measured hash rate [37], or an honest-majority assumption in Byzantine fault-tolerant protocols, which likewise carries a concrete, quantifiable cost to violate rather than an absolute guarantee. BPC requires the analogous operational discipline: long-lived deployments must periodically reassess the prevailing δ rtt floor for the deployed challenge family and size ∆resp and per-channel costs so that beating it—by speed or by scale— stays economically prohibitive for the target threat model. This is an operational responsibility, not a cryptographic guarantee; BPC bounds adversarial cost rather than adversarial capability, and disclosing that structure is a design choice rather than a deficiency. Uniformity of per-channel operating cost. Corollary 2’s economic bound rests on Assumption 2 not being automatic: bulk-rate API pricing above a volume threshold, or labormarket economies of scale in sourcing human operators at large s, could in principle drive an adversary’s effective cop downward with scale. Should this occur, the structural bound C(s, T ) = Ω(sT ) (Theorem 2) is unaffected, but the economic floor Cecon (s, T ) could grow more slowly. Like Assumption 1, this is an empirical and economic question the paper does not resolve on a given deployment’s behalf. Scope of the empirical evaluation. Our automated-solver measurements (Section 9) are first-party and empirical: 100 trials per solver–family pair across three independently developed vision-language models [47]–[49], with Wilson score confidence intervals reported in Table 3. The human side of the comparison, by contrast, is literature-calibrated rather than a first-party controlled study: we anchor expected human performance to published ranges [20], [42], [46] rather than to a study conducted on our own challenge implementation with a controlled recruitment platform [55], [56]. This is a deliberate scoping choice—the central claim of (H4) is solver-agnostic (Proposition 1) and does not require a paired human-versus-automated comparison to establish that τh is small and bounded for automated channels—but it does mean the human-performance figures in Table 3 should be read as contextual rather than as a controlled baseline. A first-party human-subject study on the deployed challenge implementation (N ≥ 100 via Prolific, pre-registered analysis, direct statistical comparison against the automated results reported here) is the immediate next step and is planned as near-term future work. A related open question is more theoretical than empirical: this evaluation measures human and automated solve rates post hoc for a fixed challenge instantiation, but a deployment may instead want to design challenge difficulty to hit a target human solve rate directly— a calibration problem we leave for future work (Section 12). The automated evaluation also does not cover task-specific fine-tuned models, custom inference hardware, or organized human–AI hybrid pipelines that combine automated prefiltering with human fallback; characterizing τh under such hybrid adversary strategies is left for future work. Accessibility and inclusivity. Challenge families requiring visual, auditory, or motor interaction may exclude participants
with relevant impairments. Deployments must provide alternative modalities and accessibility-aware selection policies. Parameter sensitivity. ∆resp and k(d) jointly determine the security-usability tradeoff. The formal guarantees hold for any ∆resp > 0, but concrete parameterization requires empirical measurement of τh and honest participant success rates in the target deployment environment. Theoretical scope. The cost results assume (H1)–(H3) hold and Assumption 1 (H4) is satisfied throughout execution. Partial failures of (H4)— arising when the actual roundtrip latency δrtt falls below the modeled floor δ rtt — yield intermediate scaling regimes in which C(s, T ) = Ω(sT /τh ) with larger τh . The broader characterization of when resource structure translates into an economic cost floor—as opposed to a merely structural requirement—is developed in [12]; the results here use only the structural component of that framework, instantiated through BPC’s bounded participationchannel model.
12. Conclusion We introduced the Bounded Participation Channel (BPC), a formal primitive for continuous, identity-bound, rate-limited participation verification, combining a cryptographic layer enforcing (H1)–(H3) with a structural channel constraint enforcing (H4). Under Properties (H1)–(H4), BPC enforces C(s, T ) = Ω(sT ): sustaining s identities over T windows requires Ω(sT ) independent channel-windows, regardless of whether channels are operated by humans, automated agents, or any combination thereof. No assumption about human cognitive superiority is required. Rather than accumulating participation into a score or reputation, BPC exports a sequence of independently verifiable, time-indexed participation proofs π(v, d); higher-level systems remain free to interpret this sequence according to their own policies. We presented a hash-based construction satisfying (H1)– (H3) under standard cryptographic assumptions, with Algorithm 1 as the formal verification procedure. We identified four admissible challenge families, described browserbased instantiations, and conducted an empirical evaluation across three independently developed VLMs (GPT-4o, Gemini 2.5 Flash, Claude Sonnet 4.5) confirming that all three impose a natural throughput ceiling under strict response deadlines—bound by latency on perceptual tasks and by correctness on reasoning tasks—validating the empirical basis of (H4) and demonstrating that the bottleneck is consistent across providers rather than an artifact of any single model. BPC answers the question this paper set out to answer: sustained, per-identity participation can be engineered into a security resource, by verifying it window by window so that no adversary can amortize it. BPC does not rely on a claim that a particular resource class is intrinsically expensive to sustain—reusability and parallelizability alone do not settle that question [12]. Instead, its structural properties (identity binding, freshness, real-time response, and bounded perchannel throughput) make fresh, per-window verification of participation unavoidable, independent of any economic
assumption about a particular resource class. BPC is deliberately kept general and minimal: it verifies each window’s participation bit but does not itself accumulate those bits into a score, reputation, or any other policy, leaving that decision— and the domain it is applied in—to the systems that consume it. Different domains—consensus, governance, reputation, or any open system that can pose its own qualifying action— may aggregate the same per-window bits differently, or not at all. The most immediate priorities for future work are a large-scale empirical study (N ≥ 100, controlled recruitment via a platform such as Prolific, direct statistical comparison against the automated results reported here); a theoretical treatment of difficulty-calibrated challenge design for human channels— parameterizing challenge families so that human solve rate can be tuned continuously by design rather than only measured post hoc, analogous to a difficulty parameter in other proof-of-work-style primitives; privacy-preserving challenge delivery with cross-window unlinkability; formal composability analysis in the UC framework; and adaptive challenge rotation mechanisms that preserve (H1)–(H4) under evolving automation capabilities.
[3]
L. von Ahn, M. Blum, N. J. Hopper, and J. Langford, “CAPTCHA: Using hard AI problems for security,” in Advances in Cryptology – EUROCRYPT, 2003, pp. 294–311.
[4]
M. Borge, E. Kokoris-Kogias, P. Jovanovic, L. Gasser, N. Gailly, and B. Ford, “Proof-of-personhood: Redemocratizing permissionless cryptocurrencies,” in IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2017, pp. 23–28.
[5]
B. Ford, “Pseudonym parties: An offline foundation for online accountability,” in IEEE Security & Privacy Workshops, 2020.
[6]
H. Yu, P. B. Gibbons, M. Kaminsky, and F. Xiao, “SybilGuard: Defending against Sybil attacks via social networks,” in ACM SIGCOMM, 2006, pp. 267–278.
[7]
H. Yu, M. Kaminsky, P. B. Gibbons, and A. D. Flaxman, “SybilLimit: A near-optimal social network defense against Sybil attacks,” in IEEE Symposium on Security and Privacy (S&P), 2008, pp. 3–17.
[8]
G. Danezis and P. Mittal, “SybilInfer: Detecting Sybil nodes using social networks,” in Network and Distributed System Security Symposium (NDSS), 2009.
[9]
G. Wang, T. Konolige, C. Wilson, X. Wang, H. Zheng, and B. Y. Zhao, “You are how you click: Clickstream analysis for Sybil detection,” in USENIX Security Symposium, 2013, pp. 241–256.
Ethics Considerations
[11] A. Serwadda and V. V. Phoha, “When kids’ games expose grown-up flaws: An analysis of keystroke dynamics classifiers under skilled impersonation attack,” in ACM Conference on Computer and Communications Security (CCS), 2013, pp. 1189–1200.
This paper does not involve human subjects research, personal data collection, or vulnerability disclosure. The empirical evaluation in Section 9 uses automated API calls to three commercial vision-language models (GPT-4o, Gemini 2.5 Flash, Claude Sonnet 4.5) on synthetically generated challenges; no human participants were involved in the automated-solver evaluation, and no personally identifiable information was collected or processed. The deployed web application described in Section 9.1 (link withheld for anonymous review; see the anonymized repository) is intended for future human-subject evaluation under appropriate institutional oversight.
Generative AI Usage Considerations
[10] M. Frank, R. Biedert, E. Ma, I. Martinovic, and D. Song, “Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication,” IEEE Transactions on Information Forensics and Security, vol. 8, no. 1, pp. 136–148, 2013.
[12] H. Maleki, N. Sainz, J. Legarda, and I. Santos-Grueiro, “Scarcity is not enough: Structural limits of linear Sybil cost under parallelizable resources,” 2026, https://arxiv.org/abs/2605.29651. [13] J. R. Douceur, “The Sybil attack,” in International Workshop on Peer-to-Peer Systems (IPTPS), 2002, pp. 251–260. [14] Q. Cao, M. Sirivianos, X. Yang, and T. Pregueiro, “Aiding the detection of fake accounts in large scale social online services,” in USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2012, pp. 197–210. [15] B. Viswanath, A. Post, K. P. Gummadi, and A. Mislove, “An analysis of social network-based Sybil defenses,” in ACM SIGCOMM, 2010, pp. 363–374. [16] Google, “reCAPTCHA v3,” 2019, https://www.google.com/recaptcha. [17] hCaptcha Team, “hCaptcha,” 2020, https://www.hcaptcha.com.
Generative AI was used for editorial purposes in preparing this manuscript, including assistance with phrasing, consistency checking, and structural revision of draft sections. All technical content, formal definitions, proofs, experimental design, and empirical results were developed, executed, and verified by the authors. All outputs were inspected by the authors to ensure accuracy and originality. No AI-generated ideas or results appear in this paper without independent development and validation by the authors.
References [1]
[2]
H. Maleki, N. Sainz, and J. Legarda, “Human challenge oracle: Designing ai-resistant, identity-bound, time-limited tasks for sybilresistant consensus,” 2026, https://arxiv.org/abs/2601.03923. Thales, “2026 bad bot report: Bad bots in the agentic age,” 2026, 13th annual report, Thales (Imperva) Threat Research and Security Analyst Services, https://www.imperva.com/resources/resource-library/reports/ 2026-bad-bot-report/.
[18] E. Bursztein, M. Martin, and J. C. Mitchell, “Text-based CAPTCHA strengths and weaknesses,” in ACM Conference on Computer and Communications Security (CCS), 2011, pp. 125–138. [19] G. Ye, Z. Tang, D. Fang, Z. Zhu, Y. Feng, P. Xu, X. Chen, and Z. Wang, “Yet another text CAPTCHA solver: A generative adversarial network based approach,” in ACM SIGSAC Conference on Computer and Communications Security (CCS), 2018, pp. 332–348. [20] S. Sivakorn, I. Polakis, and A. D. Keromytis, “I am robot: (deep) learning to break semantic image CAPTCHAs,” in IEEE European Symposium on Security and Privacy (EuroS&P), 2016, pp. 388–403. [21] I. J. Goodfellow, Y. Bulatov, J. Ibarz, S. Arnoud, and V. Shet, “Multi-digit number recognition from street view imagery using deep convolutional neural networks,” in International Conference on Learning Representations (ICLR), 2014. [22] M. Motoyama, K. Levchenko, C. Kanich, D. McCoy, G. M. Voelker, and S. Savage, “Re: CAPTCHAs—understanding CAPTCHA-solving services in an economic context,” in USENIX Security Symposium, 2010, pp. 435–452. [23] S. Popov, “Token binding and its applications,” in IEEE Security & Privacy, 2019, pp. 44–50.
[24] Worldcoin Foundation, “Worldcoin: Proof of personhood at scale,” 2023, https://worldcoin.org. [25] BrightID, “BrightID: Decentralized identity,” 2022, https://www. brightid.org.
[47] OpenAI, “GPT-4 technical report,” 2023, arXiv:2303.08774. [48] Gemini Team, Google, “Gemini: A family of highly capable multimodal models,” 2023, arXiv:2312.11805.
[26] Gitcoin, “Gitcoin passport,” 2023, https://passport.gitcoin.co.
[49] Anthropic, “The Claude model family,” 2024, model card, https:// www.anthropic.com.
[27] Semaphore, “Semaphore: Zero-knowledge proof-of-personhood,” 2023, https://semaphore.appliedzkp.org.
[50] S. Haber and W. S. Stornetta, “How to time-stamp a digital document,” Journal of Cryptology, vol. 3, no. 2, pp. 99–111, 1991.
[28] UniRep, “UniRep: A decentralized anonymous reputation system,” 2023, https://developer.unirep.io.
[51] S. Micali, M. Rabin, and S. Vadhan, “Verifiable random functions,” in IEEE Symposium on Foundations of Computer Science (FOCS), 1999, pp. 120–130.
[29] P. Golle and I. Mironov, “Uncheatable distributed computations,” in CT-RSA, 2001, pp. 425–440. [30] C. Shen, T. Yu, S. Yuan, Y. Li, and X. Guan, “Performance analysis of multi-motion sensor behavior for active smartphone authentication,” vol. 12, no. 1, 2017, pp. 48–62. [31] D. M. Freeman, “Using machine learning to detect account compromise on a large-scale platform,” in IEEE Symposium on Security and Privacy (S&P), Workshop, 2016. [32] V. Costan and S. Devadas, “Intel SGX explained,” 2016, iACR Cryptology ePrint Archive, Report 2016/086. [33] A. Davidson, I. Goldberg, N. Sullivan, G. Tankersley, and F. Valsorda, “Privacy pass: Bypassing internet challenges anonymously,” in Proceedings on Privacy Enhancing Technologies (PoPETs), vol. 2018, no. 3, 2018, pp. 164–180. [34] A. Juels and B. S. Kaliski, Jr., “PORs: Proofs of retrievability for large files,” in ACM Conference on Computer and Communications Security (CCS), 2007, pp. 584–597. [35] H. Shacham and B. Waters, “Compact proofs of retrievability,” in Advances in Cryptology – ASIACRYPT, 2008, pp. 90–107. [36] G. Ateniese, L. Chen, M. Etemad, and Q. Tang, “Proof of storagetime: Efficiently checking continuous data availability,” in Network and Distributed System Security Symposium (NDSS), 2020. [37] S. Nakamoto, “Bitcoin: A peer-to-peer electronic cash system,” 2008, white paper. [38] A. Kiayias, A. Russell, B. David, and R. Oliynykov, “Ouroboros: A provably secure proof-of-stake blockchain protocol,” in Advances in Cryptology – CRYPTO, 2017, pp. 357–388. [39] J. Bonneau, A. Miller, J. Clark, A. Narayanan, J. A. Kroll, and E. W. Felten, “SoK: Research perspectives and challenges for Bitcoin and cryptocurrencies,” in IEEE Symposium on Security and Privacy (S&P), 2015. [40] S. Dziembowski, S. Faust, V. Kolmogorov, and K. Pietrzak, “SpaceMint: A cryptocurrency based on proofs of space,” in Financial Cryptography and Data Security (FC), 2018, pp. 480–499. [41] C. Dwork and M. Naor, “Pricing via processing or combatting junk mail,” in Advances in Cryptology – CRYPTO, 1993, pp. 139–147. [42] R. Geirhos, C. R. M. Temme, J. Rauber, H. H. Schütt, M. Bethge, and F. A. Wichmann, “Generalisation in humans and deep neural networks,” Advances in Neural Information Processing Systems (NeurIPS), pp. 7538–7550, 2018. [43] R. Geirhos, P. Rubisch, C. Michaelis, M. Bethge, F. A. Wichmann, and W. Brendel, “ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness,” in International Conference on Learning Representations (ICLR), 2019. [44] R. Geirhos, J.-H. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, and F. A. Wichmann, “Shortcut learning in deep neural networks,” Nature Machine Intelligence, vol. 2, pp. 665–673, 2020. [45] B. M. Lake, T. D. Ullman, J. B. Tenenbaum, and S. J. Gershman, “Building machines that learn and think like people,” Behavioral and Brain Sciences, vol. 40, p. e253, 2017. [46] H. H. Schütt, R. Geirhos, and F. A. Wichmann, “Human vs AI in interactive reasoning tasks,” in NeurIPS Workshop on Human-AI Interaction, 2023.
[52] M. Bellare and P. Rogaway, “Random oracles are practical: A paradigm for designing efficient protocols,” in ACM Conference on Computer and Communications Security (CCS), 1993, pp. 62–73. [53] NIST, “SHA-3 standard: Permutation-based hash and extendableoutput functions,” 2015, fIPS Publication 202. [54] E. Syta, P. Jovanovic, E. Kokoris-Kogias, N. Gailly, L. Gasser, I. Khoffi, M. J. Fischer, and B. Ford, “Scalable bias-resistant distributed randomness,” in IEEE Symposium on Security and Privacy (S&P), 2017, pp. 444–460. [55] Prolific Academic Ltd., “Prolific: Quickly find research participants,” 2014, https://www.prolific.com. [56] E. Peer, D. Rothschild, A. Gordon, Z. Evernden, and E. Damer, “Data quality of platforms and panels for online behavioral research,” Behavior Research Methods, vol. 54, pp. 1643–1662, 2022.