# Compression-Based Behavioral Similarity for Open-World Sybil Discovery on Ethereum

arXiv: https://arxiv.org/abs/2607.27370 · HTML: https://mlsanity.com/paper/2607.27370/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 13 of its 27 references that are in the map.
- First posted on arXiv 29 Jul 2026.

## Builds on (most cited first, 13 of 13)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Shortcut Learning in Deep Neural Networks](https://mlsanity.com/paper/2004.07780/) (2020)
- [Tabular Data: Deep Learning is Not All You Need](https://mlsanity.com/paper/2106.03253/) (2021)
- [TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Time](https://mlsanity.com/paper/1807.07838/) (2018)
- [SoK: Decentralized Finance (DeFi) Attacks](https://mlsanity.com/paper/2208.13035/) (2022)
- [Detecting Financial Bots on the Ethereum Blockchain](https://mlsanity.com/paper/2403.19530/) (2024)
- [Detecting Sybil Addresses in Blockchain Airdrops: A Subgraph-based Feature Propagation and Fusion Approach](https://mlsanity.com/paper/2505.09313/) (2025)
- [Hidformer: Transformer-Style Neural Network in Stock Price Forecasting](https://mlsanity.com/paper/2412.19932/) (2024)
- [On Evaluating Loss Functions for Stock Ranking: An Empirical Analysis With Transformer Model](https://mlsanity.com/paper/2510.14156/) (2025)
- [Partial multivariate transformer as a tool for cryptocurrencies time series prediction](https://mlsanity.com/paper/2512.04099/) (2025)
- [Detecting Malware with Information Complexity](https://mlsanity.com/paper/1502.07661/) (2015)
- [Airdrops: Giving Money Away Is Harder Than It Seems](https://mlsanity.com/paper/2312.02752/) (2023)
- [Maximal Extractable Value Mitigation Approaches in Ethereum and Layer-2 Chains: A Comprehensive Survey](https://mlsanity.com/paper/2407.19572/) (2024)

## Abstract (arXiv)

Sybil attackers are Blockchain actors that adopt the characteristics of regular users to exploit airdrops or influence governance. Current methods of Sybil actor detection include constructing graphs, which requires token transfers between examined wallets. Machine learning algorithms have been employed as well, but they treat the task as a closed-set classification problem, making them vulnerable to frequent changes in attack strategies or evasion tactics. We address the following questions: can compression-based similarity differentiate Sybil bots, organic users, and arbitrage bot wallets without direct financial links? What is the effect of high-signal contracts on the discovery of Sybils, and how robust are behavioral graphs under temporal drift and adversarial perturbations? Our approach synthesizes a symbolic Transaction Grammar from EVM (Ethereum Virtual Machine) traces, capturing separately transaction rhythm, execution structure, and functional intent. The high-signal contracts are filtered with our own protocol, called the Blind-Spot Protocol. Gzip-based NCD is used to construct a behavioral graph for Sybil discovery. We validate this framework against supervised machine learning baselines, a temporal split, and synthetic camouflage stress tests. Ultimately, we contribute a leakage-aware behavioral framework for Sybil candidate discovery. Its core NCD primitive requires no supervised training and can expand suspicious seed wallets without explicit funding links. We position the method as a training-free local discovery primitive for open-world blockchain audits, rather than as a formal open-set recognition system.