PREPRINT
1
Bernoulli CUSUM and Bayes-Optimal Detection Ceilings for Trust Fraud in Sparse Rating Networks
arXiv:2606.05090v1 [cs.CR] 3 Jun 2026
Talal Ashraf Butt
Abstract—Sequential trust detection in rating networks relies on continuous observation models that fail on real data. On Bitcoin-OTC, 56% of ratings take a single value under standard mapping, breaking the distributional assumptions that parametric detectors require. This paper makes three contributions. It derives a Bayes-optimal F1 detection ceiling for per-node sequential detectors using empirically measured observation parameters. At Bitcoin-OTC’s median in-degree of 2, this ceiling falls to 0.451 for strategic attacks, explaining why unsupervised methods cluster near F 1 ≈ 0.4. The analysis shows that detector-model matching, not information content, determines performance: binary models retain 86% of mutual information while enabling exact parametric fit. A dual-regime architecture is presented where Bernoulli CUSUM detects behavioral shifts and triggers asymmetric scoring. Ablation reveals a co-design constraint: the modulation mechanism improves AUC by 0.030 on binary observations but degrades it by 0.094 on continuous observations. The combined system achieves AUC 0.749 on Bitcoin-OTC and 0.796 on Bitcoin-Alpha, beating GaaSTrust on all 8 attacks (p < 0.003), with founder-label AUC of 0.999. Index Terms—Trust detection, sequential change-point detection, CUSUM, Bernoulli observation model, Bitcoin-OTC, rating networks, fraud detection.
I. I NTRODUCTION Trust scores in online rating networks serve as the primary defense against adversarial manipulation. When a trader on Bitcoin-OTC receives a sequence of ratings from counterparties, those ratings carry evidence about whether the trader is honest or fraudulent. The natural framework for processing this evidence is sequential change-point detection: monitor the incoming rating stream and flag an alarm when it shifts from the honest baseline. Page’s CUSUM [1] is the canonical tool for this task, and Moustakides [2] proved it minimax optimal under exponential-family observations. Two prior efforts have applied CUSUM to trust systems [3], [4]. Both assumed continuous observations drawn from well-behaved distributions. That assumption has never been tested on real rating data. Bitcoin-OTC is the standard benchmark for trust-based fraud detection, used across graph neural network [5], [6], iterative scoring [7], and structural feature [8] evaluations. The dataset contains 35,592 signed ratings on a scale from −10 to +10. A standard linear mapping normalizes these to [0, 1] for use by continuous detectors. What nobody has reported is what this mapping does to the distribution. Of 35,592 ratings, 56% equal +1, and linear normalization maps these to 0.55 (Figure 3). A single value carries more than half the probability mass. The Manuscript received XXXX; revised XXXX. This work was supported by XXXX. T. A. Butt is with Higher Colleges of Technology, Fujairah (e-mail: [email protected]).
Gaussian assumption that continuous CUSUM requires is not approximately wrong. It is categorically wrong. Continuous CUSUM, calibrated for Gaussian observations, cannot extract usable signal from a distribution that concentrates more than half its mass at a single value. The parametric log-likelihood ratio assumes a smooth density. When the data is effectively discrete, that ratio loses its discriminative power. A simple exponential moving average (GaaSTrust), which makes no distributional assumptions at all, outperforms continuous CUSUM on Bitcoin-OTC across multiple attack types. The problem is not the CUSUM framework. The problem is the observation model fed into it. This paper makes three contributions. C1. Detection ceiling. A Bayes-optimal F1 bound is derived for any per-node unsupervised sequential detector operating on Bernoulli observations. On Bitcoin-OTC, where the median in-degree is 2, this ceiling falls to F 1 ≤ 0.451 for strategic attacks. Using empirically measured observation parameters, which differ from attack specifications because honest evaluators independently detect mediocre adversary output, the ceiling explains a decade of stagnation in unsupervised trust detection performance (Section III). C2. Detector-model matching. This paper documents for the first time that 56% of Bitcoin-OTC ratings collapse to a single mapped value under standard normalization. Continuous models preserve more mutual information (0.038 bits vs 0.033 bits for strategic attacks), but Gaussian CUSUM cannot extract it from bimodal data. Binary models sacrifice 14% of MI but match Bernoulli CUSUM’s parametric assumptions exactly. Detection performance is governed by this match, not by raw information content (Section IV). C3. Dual-regime Bernoulli CUSUM. A dual-regime architecture is presented where Bernoulli CUSUM detects behavioral shifts and triggers asymmetric EMA scoring, codesigned with binary observations. Ablation shows binarization contributes +0.015 AUC and CUSUM-triggered modulation contributes +0.030, with a non-decomposable interaction: the same modulation on continuous data degrades performance by 0.094. On Bitcoin-OTC, BernoulliCUSUM reaches AUC 0.749 across 8 attack types, significantly above GaaSTrust’s 0.704 (p < 0.003). Bitcoin-Alpha yields AUC 0.796, with a founder-label AUC of 0.999 (Section VI). Prior work on trust detection and sequential analysis, along with the Bitcoin-OTC benchmark literature, is reviewed in Section II. Section III derives the detection ceiling theorem. The matching diagnosis (Section IV) explains why continuous CUSUM fails on Bitcoin-OTC and motivates the dual-regime Bernoulli design (Section V). Experiments on both Bitcoin datasets validate the approach, and an ablation isolates the
PREPRINT
2
contribution of binarization from CUSUM-triggered modulation (Section VI). II. R ELATED W ORK Trust fraud detection draws on three bodies of work: trustspecific scoring methods, sequential change-point detection from statistical process control, and the growing literature that uses Bitcoin-OTC as a benchmark. The common thread across all three is a neglected question, whether the observation model actually matches the data. A. Trust Detection in Rating Networks Bayesian trust modeling began with Bernoulli interactions. In the Beta Reputation System [9], each interaction feeds a Beta posterior over honest-behavior probability. Network-wide propagation followed with EigenTrust [10], which runs power iteration on the trust matrix. Both methods are static. They compute a single trust score from aggregate evidence and have no mechanism for detecting when a node’s behavior changes. Liu and Sun [3] were the first to apply CUSUM to peer-topeer trust, running a standard Gaussian change-point detector on continuous reputation scores evaluated on synthetic networks with well-separated honest and adversary distributions. Li and Wang [4] extended this to a multi-agent setting, applying a GLR detector under a discrete rating model on synthetic networks with well-separated honest and adversary distributions. Neither paper evaluated whether their assumed rating distribution matches real-world data. On Bitcoin-OTC, the standard continuous mapping produces a distribution that violates the assumptions of every parametric detector tested. REV2 [7] jointly estimates user fairness, product goodness, and rating reliability through iterative convergence to a static equilibrium. A strategic adversary who maintains 70% honest behavior achieves high fairness because the equilibrium reflects average behavior, not temporal shifts. BIRDNEST [11] scores users by the surprise of their rating behavior relative to a population baseline, detecting anomalous raters rather than anomalous targets and relying on batch surprise instead of sequential detection. FRAUDAR [12] identifies fraud through dense subgraph detection, finding groups of users who collectively rate the same products but offering no mechanism for individual behavioral change. Jeong et al. [13] proposed rater tendency scaling on Bitcoin-OTC, adjusting ratings by perrater bias. Their work documented rating heterogeneity but did not address the distributional collapse that occurs under linear normalization. On the GNN side, TrustGNN [14] uses learnable propagation for trust evaluation, and TrustGuard [15] targets resilient trust evaluation with dynamicity support. Both are supervised methods that predict trust between node pairs, a fundamentally different task requiring labeled training data that is unavailable in most real-world trust networks. Every approach listed here either assumes the observation model matches the data or ignores the observation model entirely. None has examined how the structure of the rating distribution affects detector performance.
B. Sequential Detection in Statistical Process Control The statistical process control (SPC) community developed Bernoulli CUSUM specifically for monitoring binary outcomes. Optimal threshold selection for detecting shifts in a Bernoulli proportion parameter was derived by Reynolds and Stoumbos [16]. Surgical outcome monitoring provided the first major field application, where Steiner et al. [17] tracked whether a surgeon’s mortality rate had shifted from an acceptable baseline. That application shares structural features with trust detection: sparse binary observations per monitored entity, a known in-control rate, and a need for rapid alarm with controlled false positives. For categorical data, Höhle [18] established that categorical CUSUM outperforms continuous approximations in public health surveillance. Multi-channel settings preserve CUSUM’s optimality guarantees under a union rule [19]. In the trustdetection setting of this paper, each target node instantiates an independent monitoring channel with categorical observations. Further extensions to non-stationary baselines [20] and highdimensional streams [21] lie beyond the scope of the sparse binary setting considered here. Despite this mature theoretical foundation, no prior work has applied Bernoulli CUSUM or categorical CUSUM to trust fraud detection. The SPC and trust detection literatures have developed in parallel without cross-pollination. C. Bitcoin-OTC as Benchmark Bitcoin-OTC and Bitcoin-Alpha are the most widely used benchmarks for trust-aware methods on signed networks, introduced by Kumar et al. [22]. SGCN [5] applies balance theory through signed graph convolution to predict edge signs, extended to directed balance theory in GCNEXT [6]. Skorupka et al. [8] extracted structural node features and fed them to supervised classifiers, reporting AUC above 0.93 with labeled training data. Islam et al. [23] analyzed trust propagation patterns in Bitcoin networks, and Shadrooh and Nørvåg [24] proposed GAN-based data augmentation for node-level trust intensity prediction in incomplete signed networks. These approaches solve a different problem. Sign prediction assumes stable node identities and asks whether the next edge will be positive or negative. Fraud detection must handle nodes that change behavior over time. The evaluation methodology in this paper reflects this distinction: adversarial agents with known attack strategies are injected onto the real Bitcoin network topology, preserving the original graph structure while controlling the ground truth. III. D ETECTION C EILING Any detector’s performance is bounded by the information available in the observation stream. A per-node sequential detector observes binary ratings for each target node and must classify that node as honest or adversarial. The central question is how high the F1 score can reach given n observations per node. Lorden’s minimax formulation [25] fixes a false-alarm constraint and asks which detection procedure keeps worstcase delay smallest. CUSUM attains that bound whenever the
PREPRINT
π · ps1 (1−p1 )n−s . P (H1 | S=s) = π · ps1 (1−p1 )n−s + (1−π) · ps0 (1−p0 )n−s
(1) The MAP classifier declares adversary when P (H1 | S) > 0.5, and the resulting F1 score is the ceiling for any per-node detector whose decision function depends on the Pobservations only through the count sufficient statistic S = i Xi . The ceiling depends on empirical observation parameters, not the attack design specification. Table I distinguishes between two quantities: the specification p1 (what the adversary produces) and the empirical p1 (what the adversary receives, as measured after injection). Honest evaluators independently react to adversary behavior. The divergence between specification and measurement can be large. For bad_mouth (specification p1 = 0.85), evaluators detect mediocre output and downrate adversaries. The empirical received positive rate drops to p1 = 0.503. This community amplification increases the KL divergence from 0.003 nats (specification parameters) to 0.111 nats (empirical), a 37-fold increase in per-observation discriminability. All ceiling computations in this paper use empirical parameters. Figure 1 plots this ceiling as a function of n for five attack types using empirical observation parameters (Table I). The dashed vertical line marks n = 2, the median in-degree of Bitcoin-OTC. At this observation level, the ceiling sits at 0.451 for strategic attacks. For bad_mouth, the empirical parameters (p0 = 0.731, p1 = 0.503) produce a ceiling of 0.414, substantially higher than the specification-based ceiling of 0.333. Community amplification makes bad_mouth more detectable than the attack design suggests. Unsupervised methods on Bitcoin-OTC have clustered at F 1 ≈ 0.3–0.4 for years. The constraint is not algorithmic. At median in-degree 2, the per-node Bayesian error rate dominates detection performance regardless of which method is applied. The situation parallels the sparse mixture detection problem studied by Donoho and Jin [27], where sparse signal and low per-observation discriminability impose hard information-theoretic limits even on optimal detectors.
1.0
F1 ceiling (Bayes-optimal)
observation distribution sits in the exponential family [2], the condition this paper establishes for the binary rating model. Multi-stream extensions and finite-sample approximations followed [26]. These results characterize detection delay, not classification accuracy. Fraud detection requires a bound on the achievable F1 given a fixed evidence budget. A Bayes-optimal bound arises under four conditions: (i) observations are i.i.d. Bernoulli with parameter p0 under the honest hypothesis and p1 under the adversary hypothesis, (ii) node labels are independent, (iii) the detector uses only per-node evidence (no graph structure), and (iv) the prechange and post-change parameters are known. Under these conditions, the MAP classifier reaches the F1 ceiling for any per-node detector. Theorem 1 (Bayes-Optimal F1 Ceiling): Given n observations per node, each drawn from Bernoulli(p0 ) under the null hypothesis H0 (honest) or Bernoulli(p1 ) under H1 (adversary), with adversary prior π, the posterior probability of the Pn adversary hypothesis given total count S = t=1 Xt is
3
0.8 0.6 0.4
always lie strategic colluding bad mouth (p0=0.73) on off median in-degree
0.2 0.0 0
10
20
30
Observations per node
40
50
Fig. 1. Bayes-optimal F1 ceiling computed with empirically measured observation parameters (Table I). Bad_mouth uses p0 = 0.731 (honest positive rate reduced by adversary downrating). The dashed vertical line marks n = 2 (median in-degree of Bitcoin-OTC).
Structured observations can improve detection beyond naive per-stream bounds [28]. Table IV stratifies detection efficiency by in-degree. BernoulliCUSUM achieves 95.1% of the Bayes-optimal ceiling for nodes with median in-degree 2. Efficiency decreases for well-observed nodes (76.2% at median in-degree 19), where the ceiling rises faster than detection improves. IV. D ETECTOR -M ODEL M ATCHING The ceiling theorem establishes what is achievable. Existing continuous detectors fall short of that bound because of the observation model, not the detection algorithm. Figure 3(a) shows the raw rating distribution of BitcoinOTC. Of the 35,592 ratings, 56% take the value +1. The remaining mass spreads thinly across the [−10, +10] integer range, with a secondary concentration at −10. Under the standard linear mapping r 7→ (r + 10)/20, the +1 spike lands at 0.55 (Figure 3(b)). One value holds more than half the probability mass. A natural objection is that binarization discards information. Mutual information (2) and KL divergence (3) between honest and adversary observation distributions test this directly. The mutual information between the observation and the hypothesis is I(X; H) = H(X) − H(X | H),
(2)
where H(X | H) = (1 − π) · H(Ber(p0 )) + π · H(Ber(p1 )). The KL divergence between adversary and honest observation distributions is p1 1 − p1 DKL (Ber(p1 )∥Ber(p0 )) = p1 ln + (1 − p1 ) ln . (3) p0 1 − p0 For strategic attacks, the continuous model retains 0.038 bits of mutual information. The binary model retains 0.033 bits, sacrificing 14% of MI. The continuous model carries more raw signal. It should win. It does not. Gaussian CUSUM’s log-likelihood ratio assumes a unimodal density with known mean and variance. When 56% of the data mass concentrates at a single value,
PREPRINT
4
1.50 1.25 1.00 0.75 0.50 0.25 0.00
20000 17500 15000 12500 10000 7500 5000 2500 0
56%
Count
Binary Continuous (strategic) Count
KL divergence (nats)
1.75
10
5
0
5
(a) Raw integer rating
always lie
strategic
colluding
Attack type
bad mouth
on off
Fig. 2. KL divergence between adversary and honest observation distributions under binary and continuous models, across five attack types. Binary KL dominates when p1 is far from p0 (always_lie, colluding). Continuous KL dominates when p1 ≈ p0 (bad_mouth, on_off).
that assumption collapses. Because the Gaussian density assigns vanishing probability to an observed point mass, the LLR cannot accumulate in any consistent direction. Detection delay grows sharply as the assumed distribution diverges from the true data-generating process [21]. On discrete or heavily quantised data, the degradation is more severe. A GLR-based binning statistic that partitions the sample space consistently outperforms Gaussian CUSUM when the postchange distribution is not fully specified [29]. Bernoulli CUSUM faces no such problem. Its LLR takes only two values, one for each outcome Xt ∈ {0, 1}. The Bernoulli family lies in the exponential family, and Moustakides’ optimality guarantee [2] activates in full. The performance gap between continuous and Bernoulli CUSUM on bimodal data is driven by extraction efficiency, not information loss. The binary model retains 86% of mutual information. Bernoulli CUSUM’s parametric assumptions are exactly satisfied. Gaussian CUSUM’s are not even approximately satisfied. Detection performance is governed by the match between the observation model and the detector’s distributional assumptions [30], not by the raw information content of the observations. Figure 2 extends this analysis across five attack types. For always_lie (p1 = 0.10), binary KL divergence reaches 1.75 nats, nearly 10× the continuous value of 0.18 nats. Binarization concentrates the full separation between p0 = 0.90 and p1 = 0.10 into a single binary contrast that Bernoulli CUSUM extracts completely. For colluding (p1 = 0.60), the binary advantage is smaller at 0.31 vs 0.18 nats. A crossover occurs at bad_mouth and on_off, where p1 approaches p0 and the continuous model retains more discriminability. These are exactly the attacks where BernoulliCUSUM’s per-attack advantage shrinks (Table III). The KL structure predicts the empirical performance ordering. V. M ETHOD : D UAL -R EGIME B ERNOULLI CUSUM Each rating is binarised, an honest baseline is calibrated on an initial window, Bernoulli CUSUM runs on the resulting
10
20000 17500 15000 12500 10000 7500 5000 2500 0
binarization threshold
0.00 0.25 0.50 0.75 1.00
(b) Mapped rating [0, 1]
Fig. 3. Bitcoin-OTC rating distribution. (a) Raw integer histogram showing the dominant spike at +1 (56% of all ratings). (b) Standard linear mapping to [0, 1] produces a point mass at 0.55, violating the continuous distributional assumptions of Gaussian CUSUM.
binary stream, and the alarm feeds into a dual-regime EMA trust score. Algorithm 1 and Figure 4 present the procedure. CUSUM flagging drives the regime switch that reweights the EMA update. a) Binarization.: Each incoming rating rt for target node jt collapses to the sign indicator Xt = 1[rt > 0]. A positive rating encodes as 1, and any rating at or below zero encodes as 0. This mapping discards magnitude information but matches the distributional structure of Bitcoin-OTC, where the distinction between positive and negative carries more signal than the distinction between +1 and +5 (Section IV). b) Phase I calibration.: The in-control positive rate p0 is estimated from an initial window of ratings under the assumption that the system starts in a predominantly honest state. On Bitcoin-OTC, the empirical positive rate is p0 = 0.90. The post-change parameter is set to p1 = p0 − 0.20 = 0.70, calibrated against the strategic attack. c) Bernoulli CUSUM monitoring.: For each target node j, the detector maintains a CUSUM statistic Sj . Under Bernoulli observations, each arrival contributes an LLR increment p1 1 − p1 Λt = Xt · ln + (1 − Xt ) · ln . (4) p0 1 − p0 The increments accumulate through Page’s non-negative recursion, St = max(0, St−1 + Λt ),
S0 = 0.
(5)
An alarm is raised the first time St crosses the threshold h = 3.0, and the resulting flag never clears. For exponential-family observations, this recursion minimises the essential supremum of detection delay subject to a false-alarm constraint on mean time [2]. The Bernoulli family satisfies the exponential-family condition exactly, so the minimax optimality guarantee holds without approximation. d) Dual-regime EMA scoring.: The CUSUM flag triggers a regime switch in the EMA trust score. In the stable regime (unflagged), the EMA uses a fixed decay λ = 0.10, weighting each new observation at 10% and retaining 90% of history. Once CUSUM detects a regime change (S ≥ h), the EMA switches to asymmetric parameters: negative evidence is weighted 3× more heavily (λneg = 0.30) while positive
PREPRINT
5
Algorithm 1 Dual-Regime Bernoulli CUSUM Trust Detection Require: Rating stream {(it , jt , rt )}Tt=1 ; parameters p0 , p1 , h, λ, λneg , λpos Ensure: Trust scores τ (j) for each target node j 1: Phase I: Estimate p̂0 from initial ratings 2: for each interaction (it , jt , rt ) at time t do 3: Binarize: Xt ← 1[rt > 0] 1−p1 4: Compute LLR: Λt ← Xt ln pp01 + (1−Xt ) ln 1−p 0 5: Update CUSUM: Sjt ← max(0, Sjt + Λt ) 6: if Sjt ≥ h then 7: Flag jt (permanent) 8: end if 9: if jt is flagged then 10: λ∗ ← λneg if Xt = 0, else λpos {Asymmetric} 11: else 12: λ∗ ← λ {Stable regime} 13: end if 14: τ (jt ) ← λ∗ · Xt + (1 − λ∗ ) · τ (jt ) {EMA update} 15: end for 16: Output: τ (j) ← min(τ (j), 0.30) if j flagged, else τ (j)
evidence recovery is halved (λpos = 0.05). A detected adversary should not recover trust quickly from occasional positive interactions. At output, flagged nodes receive a score cap of 0.30. e) Co-design constraint.: The dual-regime mechanism requires binary observations. Applied to continuous [0, 1] observations, the asymmetric lambdas amplify point-mass noise at 0.55 instead of genuine positive/negative signal, degrading AUC from 0.704 to 0.610 (Section VI-E, Table V). Binary observations create clean {0, 1} separation that the dual-regime modulation amplifies. The observation model and detection architecture are not independently substitutable. f) Parameter summary.: Throughout, the parameters are fixed at p0 = 0.90, p1 = 0.70, h = 3.0, λ = 0.10, λneg = 0.30, λpos = 0.05, and a score cap of 0.30, without any per-attack adjustment. g) Complexity.: A single temporal pass over the edge list suffices, with every edge triggering a constant-time update. Time scales as O(|E|) in the number of ratings, and memory is O(|V |) per target node. On Bitcoin-OTC (35,592 edges, 5,881 nodes), a single CPU core finishes in under a second. h) Regime selection.: BernoulliCUSUM is not universally superior. On data with balanced, high-variance, or uniform rating distributions, continuous CUSUM outperforms it (Section VI-D). If more than 50% of observations map to a single value under the standard normalization, deploy Bernoulli CUSUM. Otherwise, deploy continuous CUSUM. VI. E XPERIMENTS BernoulliCUSUM is evaluated on two real-world Bitcoin trust networks against four baselines under eight attack types. The analysis covers distributional regime crossover and decomposes the contribution of each architectural component through ablation.
TABLE I ATTACK STRATEGIES WITH SPECIFICATION AND EMPIRICAL OBSERVATION PARAMETERS . C EILING COMPUTED USING EMPIRICAL VALUES .
Attack always_lie strategic colluding bad_mouth ballot_stuff on_off oscillation sybil
Behavior
Spec p1
Emp. p1
Emp. p0
All adversarial 70% honest 60% adversarial Mediocre; downrates Mediocre; inflates Phase alternation Sinusoidal quality Mediocre; colluding
0.10 0.70 0.60 0.85 0.85 0.80 0.75 0.85
0.000 0.699 0.667 0.503 0.585 0.532 0.498 0.597
0.900 0.900 0.900 0.731† 0.900 0.900 0.900 0.900
Spec p1 : attack design parameter (output). Emp. p1 : measured positive rate received by adversary nodes. † Bad_mouth adversaries reduce honest p from 0.900 to 0.731. 0
A. Experimental Setup a) Datasets.: Bitcoin-OTC contains 5,881 nodes and 35,592 directed, signed, weighted edges representing trader-totrader trust ratings on the [−10, +10] integer scale. The median in-degree is 2 and 90.0% of ratings are positive. Bitcoin-Alpha contains 3,783 nodes and 24,186 edges with 93.6% positive ratings and median in-degree 2. b) Attack injection.: Adversarial agents are injected onto the real network topology, replacing 20% of nodes with adversaries following one of eight attack strategies.1 Table I describes each strategy with both specification and empirical observation parameters. Each configuration is run with 10 random seeds to control adversary placement. c) Baselines.: Five methods are compared. BernoulliCUSUM is the proposed method. GaaSTrust is an exponential moving average baseline with no distributional assumptions. BTGAggDA-Cal is a continuous CUSUM variant calibrated on the same data. SimpleMean computes the arithmetic mean of raw ratings per node. REV2 [7] is the iterative fairnessgoodness-reliability algorithm. d) Metrics.: AUC-ROC is the primary metric. It measures ranking quality across all thresholds and is independent of score scale. F1 at the default threshold is reported alongside the detection ceiling from Section III to contextualize absolute F1 values. Statistical significance is assessed via bootstrap confidence intervals (10,000 resamples) with Holm–Bonferroni correction. Effect sizes are reported as Cliff’s δ. B. Bitcoin-OTC Results Table II reports mean AUC across 8 attacks and 10 seeds. BernoulliCUSUM achieves 0.749, followed by GaaSTrust at 0.704, BTGAggDA-Cal at 0.562, SimpleMean at 0.558, and REV2 at 0.554. Figure 5 breaks this down by attack type. BernoulliCUSUM achieves the highest AUC on all 8 attacks (Holm–Bonferroni corrected; seven at p < 0.0001, strategic at p = 0.003). Against always_lie, the gap is +0.034 over GaaSTrust (0.949 vs 0.915, Cliff’s δ = 1.000). Against strategic, the gap narrows to +0.016 (0.685 vs 0.670, Cliff’s δ = 0.700). Bad_mouth 1 Under static attack injection, sybil and whitewash produce equivalent behavior. This paper reports sybil. Whitewash requires dynamic re-entry simulation beyond this evaluation’s scope.
PREPRINT
6
O B S E R VA T I O N
DETECTION
rt
Binarize
Xt
Bernoulli LLR
CUSUM St
St ≥ h
Flag ℱ
[−10, +10]
Xt = 𝟙[rt > 0]
{0, 1}
Λt = Xt ln(p₁/p₀) + ...
max(0, S + Λt)
threshold
permanent
S C O R I N G — Dual-Regime EMA
ℱ unflagged
τ(j)
λ = 0.10
EMA update
fixed decay
τ(j) ← 0.10·Xt + 0.90·τ(j)
Xt
S TA B L E
T(j) A L E RT
flagged
trust score
Xt=0: λ = 0.30 3× faster response to bad evidence
EMA update
Xt=1: λ = 0.05 2× slower recovery from good evidence
min(τ, 0.30)
τ(j) ← λ*·Xt + (1−λ*)·τ(j)
Stable regime: λ=0.10 - equal weight on positive and negative evidence (10% new, 90% history)
Alert, positive: λ=0.05 - skeptical recovery (5% weight on good evidence)
Alert, negative: λ=0.30 - fast trust erosion (30% weight on bad evidence)
Fig. 4. Dual-regime BernoulliCUSUM pipeline. Raw ratings are binarised into {0, 1} by the Observation layer. The Detection layer runs Bernoulli CUSUM and permanently flags suspect nodes when St ≥ h. Unflagged nodes receive a stable EMA update at λ = 0.10. Flagged nodes switch to asymmetric decay (λneg = 0.30, λpos = 0.05) with output capped at 0.30.
TABLE II D ETECTION PERFORMANCE ON B ITCOIN TRUST NETWORKS ( MEAN AUC-ROC, 10 SEEDS ).
BernoulliCUSUM GaaSTrust BTGAggDA-Cal SimpleMean REV2
Bitcoin-OTC
Bitcoin-Alpha
Founder AUC
0.749 0.704 0.562 0.558 0.554
0.796 0.748 0.612 — —
0.999 0.998 1.000 1.000 0.633
produces the largest single-attack margin at +0.134 (0.683 vs 0.549), where the adversary’s negative ratings toward honest nodes create a clear binary signature. Under attack injection, REV2’s iterative convergence assigns high fairness to adversaries who maintain a majority of honest interactions, yielding only AUC 0.554. BTGAggDACal also underperforms at 0.562, confirming that the distributional mismatch diagnosed in Section IV translates directly to detection failure. Table III provides the full per-attack comparison between BernoulliCUSUM and GaaSTrust. All eight attacks show statistically significant improvements with large effect sizes (Cliff’s δ ≥ 0.620). The tightest margin is strategic (+0.016), where the adversary’s 70% honest behavior makes the binary signal weakest. The widest margin is bad_mouth (+0.134), where adverse ratings toward honest nodes produce a measurable drop in the positive rate. On the founder-label evaluation (organic labels from the Bitcoin-OTC dataset, without synthetic attack injection), BernoulliCUSUM achieves AUC 0.999. These labels reflect community consensus about early platform participants. The near-perfect score indicates that the EMA scoring recovers the organic reputation structure of the network.
C. Bitcoin-Alpha Results Bitcoin-Alpha confirms generalization. BernoulliCUSUM achieves AUC 0.796 versus GaaSTrust at 0.748 (Table II), with consistent improvement across all 8 attack types. Bad_mouth shows the largest margin and always_lie the smallest, mirroring the Bitcoin-OTC ordering. Strategic and on_off yield the tightest margins, consistent with the pattern on OTC where these attacks produce the weakest binary signal. BitcoinAlpha’s higher positive rate (93.6% vs 90.0%) concentrates the honest baseline further, which amplifies the binary contrast when an adversary’s positive rate drops. D. Regime Crossover Analysis BernoulliCUSUM is not the right tool for every distribution. Figure 6 tests all three detectors across six distributional profiles: Balanced, Bimodal 70/30, Bimodal 80/20, Bimodal 90/10, High-variance, and Uniform. Each profile is evaluated on four attack types. On Balanced, High-variance, and Uniform profiles, BTGAggDA-Cal (continuous CUSUM) dominates. These distributions have sufficient spread for Gaussian assumptions to hold. On Bimodal 80/20, BernoulliCUSUM wins across all four attacks, matching the regime of Bitcoin-OTC. Intermediate regimes are messier: on Bimodal 70/30, GaaSTrust is competitive with both CUSUM variants. E. Ablation and Co-Design Analysis Table V decomposes the AUC improvement over GaaSTrust. Binarization alone (binary EMA, no CUSUM) provides +0.015 AUC. Dual-regime modulation on binary data adds +0.030 over the binary EMA baseline, for a combined +0.045. The raw CUSUM statistic as a stand-alone score achieves 0.720, comparable to binary EMA (0.719), confirming that
PREPRINT
7
TABLE III P ER - ATTACK AUC: B ERNOULLI CUSUM VS G AA ST RUST (B ITCOIN -OTC, 10 SEEDS ). A LL COMPARISONS SIGNIFICANT AFTER H OLM –B ONFERRONI CORRECTION ; SEVEN AT p < 0.0001, STRATEGIC AT p = 0.003. Attack
BernoulliCUSUM
GaaSTrust
∆AUC
95% CI
p-value
Cliff’s δ
0.949 0.685 0.704 0.683 0.755 0.720 0.750 0.745
0.915 0.670 0.685 0.549 0.704 0.698 0.716 0.696
+0.034 +0.016 +0.019 +0.134 +0.052 +0.021 +0.034 +0.049
[+0.030, +0.038] [+0.005, +0.026] [+0.008, +0.032] [+0.125, +0.143] [+0.044, +0.060] [+0.019, +0.026] [+0.029, +0.038] [+0.038, +0.059]
<0.0001 0.003 <0.0001 <0.0001 <0.0001 <0.0001 <0.0001 <0.0001
+1.000 +0.700 +0.620 +1.000 +1.000 +0.980 +1.000 +1.000
always_lie strategic colluding bad_mouth ballot_stuff on_off oscillation sybil
BernoulliCUSUM GaasTrust BTGAggDA-Cal
1.0
AUC-ROC
0.9 0.8 0.7 0.6 0.5 0.4
strategic colluding
always lie
bad mouth
ballot stuff
on off
Attack type
oscillation
sybil
Fig. 5. Per-attack AUC on Bitcoin-OTC for BernoulliCUSUM, GaaSTrust, and BTGAggDA-Cal. Error bars show 95% bootstrap confidence intervals over 10 seeds. BernoulliCUSUM achieves the highest AUC on all 8 attacks (p < 0.003, Holm–Bonferroni corrected).
strategic
bad mouth
colluding
r -va
ifo rm Un
gh Hi
90 /10 Bim
70 /30
d ce
80 /20 Bim
Bim
Ba lan
r
ifo rm Un
-va gh Hi
80 /20
70 /30
d ce
90 /10 Bim
Bim
Bim
Ba lan
r -va
ifo rm Un
gh Hi
90 /10 Bim
80 /20 Bim
d ce
70 /30 Bim
Ba lan
r
ifo rm Un
-va
90 /10
80 /20
gh Hi
Bim
Bim
Bim
ce Ba lan
70 /30
BTGAggDA-Cal BernoulliCUSUM GaasTrust
d
AUC-ROC
always lie 1.0 0.9 0.8 0.7 0.6 0.5 0.4 0.3
Fig. 6. Regime crossover across six distributional profiles and four attack types. BernoulliCUSUM dominates on bimodal data with ≥80% concentration at a single value. Continuous CUSUM (BTGAggDA-Cal) outperforms on balanced and uniform profiles. GaaSTrust remains competitive on intermediate regimes.
both mechanisms extract similar information from the binary stream. The critical finding is the co-design constraint (Figure 7). The same lambda modulation applied to continuous [0, 1]
observations degrades AUC by 0.094, from 0.704 (GaaSTrust baseline) to 0.610. The interaction effect (+0.124 AUC swing between the continuous and binary modulation deltas in Ta-
PREPRINT
8
TABLE IV D ETECTION EFFICIENCY BY IN - DEGREE BIN ( MEAN ACROSS 8 ATTACKS , EMPIRICAL OBSERVATION PARAMETERS , BIN - SPECIFIC THRESHOLDS ).
n=1 n=2 n=3–5 n=6–10 n>10
Med. n
Ceiling
Achieved F1
Efficiency
1 2 4 7 19
0.487 0.573 0.640 0.723 0.883
0.494 0.545 0.576 0.589 0.672
101.6% 95.1% 90.0% 81.4% 76.2%
TABLE V A BLATION DECOMPOSITION : CONTRIBUTION OF BINARIZATION AND DUAL - REGIME MODULATION TO AUC IMPROVEMENT (B ITCOIN -OTC, MEAN ACROSS 8 ATTACKS , 10 SEEDS ). Variant
AUC
∆ vs GaaSTrust
GaaSTrust (continuous EMA) Binary EMA only CUSUM score only Continuous EMA + modulation BernoulliCUSUM (combined)
0.704 0.719 0.720 0.610 0.749
— +0.015 +0.016 −0.094 +0.045
ble V) exceeds either component’s individual contribution. The observation model and detection architecture are not independently substitutable. Beyond ranking quality, CUSUM provides something the EMA cannot: a formal detection delay guarantee. Among adversary nodes that accumulate enough observations for the statistic to reach threshold, CUSUM flags them in a median of 3 observations (on_off) to 18 observations (bad_mouth). On_off adversaries trigger fastest because their adversarial phases produce concentrated bursts of negative ratings. At Bitcoin-OTC’s sparse in-degree distribution, 19–59% of adversary nodes receive enough ratings for CUSUM to fire, depending on attack type. For the remaining sparse nodes, the EMA’s base scoring provides ranking quality without CUSUM intervention. The dual-regime architecture thus splits the detection task: CUSUM handles well-observed nodes with formal optimality, and the EMA handles sparse nodes with best-effort ranking. F. Rater-Relative Deviation An alternative to global binarization is rater-relative deviation: compute each rater’s personal mean, then binarize based on whether a given rating deviates from that personal baseline. The intuition is that a consistently positive rater who gives a negative rating carries more signal than one whose ratings already vary. On Bitcoin-OTC, this approach fails. Of 4,814 unique raters, only 45.7% have three or more ratings. Per-rater baselines are unreliable at this sparsity. The standard deviation of rater means is 2.140 on the raw [−10, +10] scale (0.117 on the mapped [0, 1] scale). Raters are homogeneous. Most rate positively and most rate similarly. Deviation-based binarization adds estimation noise without adding discriminative power, and the resulting detector achieves AUC 0.596, well below BernoulliCUSUM’s 0.749. A separate per-evaluator monitoring stream (Stream B) that runs Bernoulli CUSUM on each rater’s outgoing ratings
=+0.029
0.75
AUC-ROC
In-degree bin
0.80
0.70
=-0.094
0.65 0.60 0.55
Binary observations Continuous observations
No modulation
Dual-regime modulation
Fig. 7. Co-design interaction between observation model and dual-regime modulation. Binary observations benefit from modulation (∆ = +0.030). Continuous observations are degraded (∆ = −0.094). The crossing pattern indicates a non-decomposable interaction.
was also tested. Stream B improves bad_mouth detection marginally but reduces founder-label AUC from 0.999 to 0.971. The trade-off between evaluator filtering and organic label recovery favors the simpler single-stream design. The critical design choice is the distributional form of the observation model (continuous vs binary), not the reference point used for binarization (global threshold vs personal baseline). On data where raters are homogeneous, personalization adds noise without adding signal. VII. D ISCUSSION Three questions emerge from the experimental results: why AUC is the primary metric instead of F1, where BernoulliCUSUM fails, and what directions follow. A. Why AUC, Not F1 SimpleMean achieves F1 = 0.400 at the default threshold on Bitcoin-OTC, higher than BernoulliCUSUM’s F1 = 0.309. At its own optimal threshold, GaaSTrust reaches 0.524, above BernoulliCUSUM’s 0.496. Both comparisons mislead for the same structural reason. SimpleMean operates on raw integer ratings. Its trust scores spread across a wide range. BernoulliCUSUM’s EMA scoring compresses scores into a narrow band near the positive rate. The wider spread gives SimpleMean a favorable thresholddependent F1 despite far worse ranking quality: its AUC is 0.558, nearly 0.2 below BernoulliCUSUM’s 0.749. The F1 advantage reflects score spread, not detection quality. A trust system in deployment ranks nodes and presents the ranking to a human operator or downstream process. It does not make binary accept/reject decisions at a fixed threshold. AUC measures exactly this ranking quality, independent of score scale and threshold choice. The detection ceiling from Section III further contextualizes F1: at median in-degree 2, the Bayes-optimal ceiling stays near or below 0.45 for most
PREPRINT
9
attacks. Comparing methods on F1 without ceiling context attributes informational limits to algorithmic failure. B. Limitations On balanced continuous distributions where no single value dominates, BernoulliCUSUM underperforms continuous CUSUM by a wide margin. The regime crossover analysis (Figure 6) shows this directly: on the Balanced profile, BernoulliCUSUM drops to near-chance on strategic attacks while continuous CUSUM achieves AUC above 0.90. Binarization discards the distributional structure that continuous detectors exploit. The co-design constraint means that deploying the dualregime architecture on continuous data without binarization degrades performance below the non-modulated baseline. The evaluation uses static attack injection, where every injected agent follows a fixed strategy from start to end. An adaptive adversary that monitors its own trust score and throttles behavior to stay below detection thresholds would pose a harder problem. Regime crossover boundaries between Bimodal 70/30 and 80/20 are not crisp. In this intermediate zone, no single detector dominates, and GaaSTrust’s non-parametric approach often matches or exceeds both CUSUM variants. An online regime classifier for real-time deployment has not been built.
The gap between continuous and binary observation models is not about information content. The binary model retains 86% of mutual information. Extraction efficiency accounts for the difference: the match between the detector’s parametric assumptions and the data’s distributional structure. On BitcoinOTC, 56% of ratings collapse to a single mapped value, violating the Gaussian assumptions that continuous CUSUM requires. Bernoulli CUSUM’s assumptions are satisfied exactly, activating Moustakides’ minimax optimality guarantee in full. A dual-regime Bernoulli CUSUM architecture achieves AUC 0.749 on Bitcoin-OTC and 0.796 on Bitcoin-Alpha, with all 8 pairwise comparisons significant at p < 0.003 and Cliff’s δ ≥ 0.620. The method runs in O(|E|) time with O(|V |) space, requires no labeled training data, and approaches the Bayes-optimal ceiling at 95% efficiency for sparse nodes. Ablation reveals a co-design constraint: the dual-regime modulation requires binary observations, with an interaction effect (+0.124 AUC) exceeding either component’s individual contribution. For sequential detection on discrete data more broadly, these results suggest that the choice of observation model and its match to the detector’s assumptions deserves at least as much attention as the choice of detection algorithm. ACKNOWLEDGMENTS The author acknowledge the support of the Higher Colleges of Technology, United Arab Emirates.
C. Future Work For well-observed nodes where BernoulliCUSUM’s efficiency drops to 76% of ceiling, a Bayesian posterior update that weights all observations uniformly instead of exponentially discounting early evidence should approach the bound more tightly. The community amplification effect, where honest evaluators naturally downrate adversary output, raises the empirical KL divergence by up to 37× over specification parameters. Rating interface design could further amplify this signal. Platforms that encourage evaluators to express strong negative opinions when warranted would widen the gap between p0 and p1 , directly lifting the ceiling. Whether the co-design constraint between observation model and detection architecture holds in other sequential monitoring domains remains open. The finding that adaptation mechanisms can help on one observation model and harm on another suggests that observation model selection should precede and constrain detector design. VIII. C ONCLUSION This paper presented three contributions to sequential trust detection in rating networks. A Bayes-optimal F1 ceiling was derived using empirically measured observation parameters. On Bitcoin-OTC, where the median in-degree is 2, strategic attacks hit a ceiling near 0.45 and bad_mouth near 0.41. For a decade, unsupervised methods on this dataset have clustered at F 1 ≈ 0.4. The ceiling pins down why: at median in-degree 2, the per-node Bayesian error rate leaves no headroom for an algorithmic fix.
R EFERENCES [1] E. S. Page, “Continuous inspection schemes,” Biometrika, vol. 41, no. 1–2, pp. 100–115, 1954. [2] G. V. Moustakides, “Optimal stopping times for detecting changes in distributions,” The Annals of Statistics, vol. 14, no. 4, pp. 1379–1387, 1986. [3] Y. Liu and Y. Sun, “Anomaly detection in feedback-based reputation systems through temporal and correlation analysis,” in Proceedings of the 2nd IEEE International Conference on Social Computing (SocialCom), 2010. [4] S. Li and X. Wang, “Quickest attack detection in multi-agent reputation systems,” IEEE Journal of Selected Topics in Signal Processing, vol. 8, no. 4, pp. 653–666, 2014. [5] T. Derr, Y. Ma, and J. Tang, “Signed graph convolutional networks,” in Proceedings of the IEEE International Conference on Data Mining (ICDM), 2018, pp. 929–934. [6] W. Kudo, M. Nishiguchi, and F. Toriumi, “GCNEXT: Graph convolutional network with expanded balance theory for fraudulent user detection,” Social Network Analysis and Mining, vol. 10, no. 1, pp. 1– 12, 2020. [7] S. Kumar, B. Hooi, D. Makhija, M. Kumar, C. Faloutsos, and V. S. Subrahmanian, “REV2: Fraudulent user prediction in rating platforms,” in Proceedings of the 11th ACM International Conference on Web Search and Data Mining (WSDM), 2018, pp. 333–341. [8] A. Skorupka, “Detecting anomalies in graph networks on digital markets,” PLOS ONE, vol. 19, no. 12, p. e0315849, 2024. [9] R. Ismail and A. Josang, “The Beta reputation system,” in Proceedings of the 15th Bled Electronic Commerce Conference, 2002, pp. 41–55. [Online]. Available: https://aisel.aisnet.org/bled2002/41 [10] S. D. Kamvar, M. T. Schlosser, and H. Garcia-Molina, “The EigenTrust algorithm for reputation management in P2P networks,” in Proceedings of the 12th International Conference on World Wide Web (WWW), 2003, pp. 640–651. [11] B. Hooi, N. Shah, A. Beutel, S. Günnemann, L. Akoglu, M. Kumar, D. Makhija, and C. Faloutsos, “BIRDNEST: Bayesian inference for ratings-fraud detection,” in Proceedings of the SIAM International Conference on Data Mining (SDM), 2016, pp. 495–503.
PREPRINT
[12] B. Hooi, H. A. Song, A. Beutel, N. Shah, K. Shin, and C. Faloutsos, “FRAUDAR: Bounding graph fraud in the face of camouflage,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2016, pp. 895–904. [13] S. Jeong, J. Kim, B. S. Lee, and S. Lim, “User tendency-based rating scaling in online trading networks,” PLOS ONE, vol. 19, no. 4, p. e0297903, 2024. [14] C. Huo, D. He, C. Liang, D. Jin, T. Qiu, and L. Wu, “TrustGNN: Graph neural network based trust evaluation via learnable propagative and composable nature,” IEEE Transactions on Neural Networks and Learning Systems, vol. 35, no. 10, pp. 14 205–14 217, 2024. [15] J. Wang, Z. Yan, J. Lan, E. Bertino, and W. Pedrycz, “TrustGuard: GNNbased robust and explainable trust evaluation with dynamicity support,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 5, pp. 4433–4450, 2024. [16] M. R. Reynolds, Jr. and Z. G. Stoumbos, “A CUSUM chart for monitoring a proportion when inspecting continuously,” Journal of Quality Technology, vol. 31, no. 1, pp. 87–108, 1999. [17] S. H. Steiner, R. J. Cook, V. T. Farewell, and T. Treasure, “Monitoring surgical performance using risk-adjusted cumulative sum charts,” Biostatistics, vol. 1, no. 4, pp. 441–452, 2000. [18] M. Höhle, “Online change-point detection in categorical time series,” in Statistical Modelling and Regression Structures: Festschrift in Honour of Ludwig Fahrmeir, T. Kneib and G. Tutz, Eds. Heidelberg: Physica-Verlag HD, 2010, pp. 377–397. [Online]. Available: https://doi.org/10.1007/978-3-7908-2413-1_20 [19] Y. Mei, “Efficient scalable schemes for monitoring a large number of data streams,” Biometrika, vol. 97, no. 2, pp. 419–433, 2010. [20] G. Romano, I. A. Eckley, P. Fearnhead, and G. Rigaill, “Fast online changepoint detection via functional pruning CUSUM statistics,” Journal of Machine Learning Research, vol. 24, no. 81, pp. 1–36, 2023. [Online]. Available: http://jmlr.org/papers/v24/21-1230.html
10
[21] T. Gong, J. Lee, X. Cheng, and Y. Xie, “Neural network-based CUSUM for online change-point detection,” arXiv preprint arXiv:2210.17312, 2022. [Online]. Available: https://arxiv.org/abs/2210.17312 [22] S. Kumar, F. Spezzano, V. S. Subrahmanian, and C. Faloutsos, “Edge weight prediction in weighted signed networks,” in Proceedings of the IEEE International Conference on Data Mining (ICDM), 2016, pp. 221– 230. [23] M. J. Islam, M. R. Islam, and M. A. Basar, “iTrustBD: Study and analysis of Bitcoin networks to identify the influence of trust behavior dynamics,” SN Computer Science, vol. 5, p. 476, 2024. [24] S. Shadrooh and K. Nørvåg, “DATIS: Data augmentation for trust intensity prediction in incomplete signed networks,” Social Network Analysis and Mining, vol. 14, p. 243, 2025. [25] G. Lorden, “Procedures for reacting to a change in distribution,” The Annals of Mathematical Statistics, vol. 42, no. 6, pp. 1897–1908, 1971. [26] A. G. Tartakovsky, I. V. Nikiforov, and M. Basseville, Sequential Analysis: Hypothesis Testing and Changepoint Detection, ser. Monographs on Statistics and Applied Probability. Chapman and Hall/CRC, 2014. [27] D. Donoho and J. Jin, “Higher criticism for detecting sparse heterogeneous mixtures,” The Annals of Statistics, vol. 32, no. 3, pp. 962–994, 2004. [28] L. Xie, S. Zou, Y. Xie, and V. V. Veeravalli, “Sequential (quickest) change detection: Classical results and new directions,” IEEE Journal on Selected Areas in Information Theory, vol. 2, no. 2, pp. 494–514, 2021. [29] T. S. Lau, W. P. Tay, and V. V. Veeravalli, “A semi-parametric binning approach to quickest change detection,” IEEE Transactions on Signal Processing, vol. 67, no. 3, pp. 609–621, 2019, arXiv:1801.04756. [Online]. Available: https://arxiv.org/abs/1801.04756 [30] T. M. Cover and J. A. Thomas, Elements of Information Theory, 2nd ed. Wiley-Interscience, 2006.