Anduin proposes payment-based reputation for AI-agent marketplaces

Making fake popularity cost more

A provider can appear popular without attracting independent customers: an attacker creates wallets, sends payments between them and collects the money back. This is a Sybil attack, in which one operator uses multiple identities to manufacture influence.

Anduin proposes a different basis for reputation in marketplaces where software agents buy services. Rather than counting customers or payments alone, it follows payment relationships connected to providers a buyer already uses. The intended constraint is economic: an attacker must send money outside its own wallets to build useful reputation.

Reza Ramji, Preston Vander Vos, Ziming Zeng and Duc V. Le describe the system in an arXiv preprint posted November 3, 2026. The paper lists Circle Research affiliations and notes that Ramji's work was done while at Circle. Its findings should be treated as preprint research, not established deployment evidence or peer-reviewed validation.

A recommendation network built from payments

The authors report collecting 66.1 million x402 stablecoin payments worth $6.1 million across 16 blockchains over 157 days. Their dataset covers March 23 through August 26, 2026, with a median payment of one cent.

Anduin represents buyers and providers as two separate sets of nodes, linked by payments. For a particular buyer, it identifies known providers, other buyers who paid those same providers, and unfamiliar providers those other buyers have used.

The recommendation therefore follows a short chain: your payment to a known provider, another customer's payment to that provider, and that customer's payment to a new candidate. Payment amounts determine how much evidence can pass through these connections.

The paper presents three scoring methods. Maximum flow limits the total evidence to the buyer's historical spending capacity. Summation flow gives each overlapping customer a separate allowance. Amplified flow pools expanded capacity across customers connected to a candidate. These relaxations aim to distinguish providers that would otherwise receive tied scores.

What the evaluation actually measures

The main experiment uses a 90-day payment history ending June 21, 2026, then checks which unfamiliar provider each buyer first pays during the following 30 days. The evaluation includes 813 buyers who subsequently adopt a previously unused provider with at least two buyers.

That is a selected subset: the historical snapshot contains 136,646 buyers, but only 3,656 transact again during the following month. Results should not be read as performance across the entire population.

Using payment values plus settlement fees, amplified flow ranks the actual next provider first for 22.8% of evaluated buyers. The co-user-count baseline reaches 23.2%, while the usage-ranking baseline reaches 3.7%. Amplified flow reaches 23.6% with logarithmically damped payment values, but that is a different weighting configuration.

Crucially, the target is a purchasing decision—not independently assessed service quality. Predicting whom a buyer pays does not establish that the service was reliable, useful or honestly delivered.

The 23-fold claim has a specific scope

For simulated attacks, the researchers calculate expenditure needed to place an injected provider first for all 813 buyers. With fee-inclusive dollar weights and an assumed average settlement fee of $0.017, amplified flow requires $8,259, versus $358 for the co-user-count baseline: roughly 23 times as much.

The $8,259 equals about 20% of the cohort's combined historical spend of $41,331. It is not a universal minimum attack cost or a percentage required for every buyer. Targeting only the highest-spending buyer costs $291 under amplified flow; reaching the top 25 across the cohort costs $554.

Where the protection stops

The formal guarantees assume attackers control none of the buyer's known providers. Payments to those providers are treated as money permanently leaving the attacker. The budget-bound proof also treats the injected malicious provider as having no genuine payments from honest co-users. These are conditional guarantees, not protection against every form of collusion or compromise.

Coverage also limits recommendations. Buyers without payment histories cannot receive graph-based ratings, and disconnected new providers remain invisible. Shared wallets can conflate unrelated agents. Collection rules miss some transactions involving both unknown facilitators and unregistered sellers.

Anduin's contribution is therefore narrower than verifying trustworthiness: it offers a payment-based recommendation design with explicit, model-dependent manipulation costs, supported by a retrospective evaluation and simulated adversaries.