SoK: The Ghost Trilemma
Sulagna Mukherjee, Srivatsan Ravi, Paul Schmitt, Barath Raghavan
TL;DR
The Ghost Trilemma posits that three core properties of online identity—sentience ($S$), location ($L$), and uniqueness ($U$)—cannot be simultaneously verified in a fully decentralized system. The paper surveys the design space, threat models, and prior work across misinformation, trolling, and decentralized verification, then formalizes the intuition and sketches a proof sketch to justify the inherent tradeoffs. It proposes a prototype POS-based framework that anchors verification to trusted, distributed premises (e.g., POS devices and physical addresses) to achieve acceptable tradeoffs between centralization and decentralization while protecting privacy. The analysis discusses the robustness and cost implications of such schemes under adversarial pressure, offering pathways for incremental deployment and highlighting the persistent tension between verifiability, privacy, and inclusivity in open systems. Overall, the work provides a structured SoK for understanding why fully decentralized verification of sentience, location, and uniqueness remains elusive and how hybrid designs can deliver practical, privacy-preserving trust signals in real-world platforms.
Abstract
Trolls, bots, and sybils distort online discourse and compromise the security of networked platforms. User identity is central to the vectors of attack and manipulation employed in these contexts. However it has long seemed that, try as it might, the security community has been unable to stem the rising tide of such problems. We posit the Ghost Trilemma, that there are three key properties of identity -- sentience, location, and uniqueness -- that cannot be simultaneously verified in a fully-decentralized setting. Many fully-decentralized systems -- whether for communication or social coordination -- grapple with this trilemma in some way, perhaps unknowingly. In this Systematization of Knowledge (SoK) paper, we examine the design space, use cases, problems with prior approaches, and possible paths forward. We sketch a proof of this trilemma and outline options for practical, incrementally deployable schemes to achieve an acceptable tradeoff of trust in centralized trust anchors, decentralized operation, and an ability to withstand a range of attacks, while protecting user privacy.