Sybil-Resistant Personhood: Rooting a Web of Trust in Passports

The problem: proving "one unique human" to a machine

Any service that wants to let every human in, and only humans, and each one only once, is solving what the cryptography literature calls the Sybil problem: a single actor cheaply manufacturing many apparently distinct identities. John Douceur's foundational Sybil Attack paper proved something bleak about it in 2002: without some logically centralized authority, Sybil attacks are always possible except under unrealistic assumptions about every participant having equal resources. Every system discussed below is, in effect, an argument about where to hide that centralized authority so it does the least damage.

The problem has gotten sharper since 2002. A 32-author paper from OpenAI, Microsoft, MIT, Harvard and others, Personhood credentials: Artificial intelligence and the value of privacy-preserving tools to distinguish who is real online, argues that increasingly capable AI makes old defenses like CAPTCHAs unreliable, while full identity verification is too invasive for most everyday use. Their proposed middle path — a credential that proves "a real person is here" without saying which person — is close in spirit to what you're sketching, just without the passport-rooted graph structure.

It's worth being precise about which problem you're solving, because "prove you're human" (bot-resistance) and "prove you're a unique human" (Sybil-resistance) are different and the second is much harder. Your target use case, w3hc/gov, needs the second: it's a minimalist onchain voting system, built on OpenZeppelin Governor contracts, where each non-transferable membership NFT carries exactly one vote. Right now, membership is minted by a designated operator address, and the project's own documentation is candid that this is a real trust assumption: whoever holds that role can mint as many memberships as they like before their permission expires, which is another way of saying they can conjure new votes into existence. Everything in this document is really about what could replace that one address with something trust-minimized.

Bryan Ford, who has spent two decades on this problem at EPFL's DEDIS lab, proposes four criteria to judge any candidate: inclusion (can every real person actually participate?), equality (do they get equal power?), security (can it resist a well-funded attacker?), and privacy (what must someone reveal to take part?). No known system scores well on all four at once, and most of this document is about trade-offs between them.

Two shortcuts fail immediately. "Just require a government ID" sounds simple, but the World Bank's ID4D program puts the number of people worldwide with no official proof of identity at roughly 800 million, and 2.8 billion with no digitally verifiable ID even if they have a paper one — see the 2025 findings summary. It also means trusting whichever of roughly 190 states issued the document, with wildly uneven guarantees. "Just use biometrics" is Worldcoin's answer, and it's worth spelling out why you're right to be skeptical of it before surveying the alternatives.

Why not just biometrics

World ID (the identity layer formerly branded Worldcoin) scans a person's iris with proprietary "Orb" hardware, hashes it into an "IrisCode," and checks that hash against every previous one to enforce uniqueness. It's the largest system of its kind by a wide margin. It has also drawn sustained regulatory pushback: Spain's data protection authority ordered a temporary shutdown in 2024 over the handling of biometric data, and Hong Kong's privacy commissioner separately found the project's iris- and face-scanning violated the territory's data-protection ordinance, with similar scrutiny in Kenya, France and Germany (see TNW's coverage of the Spain order and PYMNTS on the Hong Kong finding). None of that has stopped the project from expanding — it relaunched a stablecoin-based payments product across more than 150 countries in September 2026 — but the regulatory friction is structural, not incidental: a single company holding a global biometric registry is exactly the kind of target that data-protection law exists to scrutinize.

Vitalik Buterin, who first put a "unique identity system" on Ethereum's wishlist back in 2014, has written at length weighing biometric proof-of-personhood against social-graph alternatives and against simply giving up on the property altogether. His conclusion, echoed across the field, is that biometrics buy strong uniqueness at a real, structural privacy cost, and that a social-graph or credential-based approach trades some certainty for a much smaller blast radius if something goes wrong. That trade-off is the whole reason a passport-plus-graph hybrid is worth designing carefully rather than defaulting to an Orb.

The existing landscape

Roughly seven families of approach exist today. None of them is exactly what you're proposing, but each solved a piece of the puzzle worth stealing.

Proof by investment

CAPTCHAs, proof-of-work, and proof-of-stake all make identity cost something — attention, computation, or capital — rather than verifying anything about the person behind it. Ford's DEDIS talk is blunt about why these fail as personhood proofs: they fail the equality test, since anyone with more money or more machines can simply buy more identities, and CAPTCHAs specifically are becoming unreliable as AI gets better at solving them while remaining a real barrier for people with disabilities.

Centralized biometrics

Covered above. World ID is the largest deployment; India's Aadhaar program, covering over a billion people, is the precedent it's often compared to, though Aadhaar was built for government services rather than as a permissionless online credential.

Government ID unlocked with zero-knowledge proofs

This is the fastest-moving family right now, and the one your Layer 1 belongs to. The European Union's EU Digital Identity Wallet, mandated under the eIDAS 2.0 regulation, requires every member state to give citizens a wallet that can prove attributes like age without revealing the underlying document, with the cryptography specified in an evolving SoK of anonymous-credential schemes for digital identity wallets. Microsoft Research's Vega system, published in 2026, shows the cryptography is now fast enough to matter in practice: proofs over a government-issued credential in under 100 milliseconds on an ordinary phone, with no trusted setup ceremony required.

On the permissionless side, ZKPassport, Rarimo, and Self Protocol all read the NFC chip inside an ICAO 9303-compliant e-passport, generate a zero-knowledge proof that a government signed it, and publish a per-document nullifier on-chain so the same passport can't register twice. Anon Aadhaar does the same trick for India's Aadhaar QR codes. The academic version of this idea is zk-creds, which converts any existing signed document — a passport, a driver's licence — into an anonymous credential without needing the issuer to change anything or hold any new secret.

The caveat that matters most for your design: every one of these produces a nullifier tied to a document, not a human. A dual national with two passports gets two nullifiers. A well-maintained tracker of this exact gap describes the whole family bluntly as producing "a per-document nullifier, not a per-human one" — see the ZK-passport-and-eID protocol notes. There's no cryptographic fix for this that doesn't reintroduce cross-checking biometrics across states.

Web of trust

BrightID builds a social graph from cryptographically signed, mutually confirmed connections and asks apps to require a minimum number of diverse connections — not all from one cluster — before trusting a node. Circles UBI does something related for a basic-income currency: everyone mints their own personal token, and trust edges (who accepts whose token at face value) let value flow transitively through the graph via a pathfinding algorithm, without ever needing a global registry.

Douceur's original paper already anticipated the weakness here: a pure web of trust, PGP-style, is vulnerable precisely because nothing stops a well-resourced attacker from building a large, internally consistent fake sub-graph. A more recent essay on the same tension, Bootstrapping the Web of Trust, makes the point directly: in practice, "many attempts end up sneaking in a centralized element to prevent Sybils" — a phone number, an email, or a government ID — at the point of first entry, which is exactly the seam your design proposes to make explicit and load-bearing rather than hiding it.

Physical presence

Bryan Ford and Jacob Strauss's 2008 paper proposed pseudonym parties: periodic, in-person events where attendees are scanned into a lobby by a hard deadline, get one token each, and can't attend two simultaneous events because a body can only be in one place at a time. Encointer is the closest living implementation — local groups hold randomized, concurrent "key-signing" meetups to mint a proof of personhood alongside a local basic-income currency, with no biometric or document requirement at all.

Human-only puzzles

Idena asks every participant in its network to solve a short, AI-resistant visual puzzle called a "flip," at the same global instant, on a tight deadline — a person simply cannot solve two flips in two places at once, so running multiple identities on one laptop doesn't work.

Composite / aggregator scores

Human Passport (formerly Gitcoin Passport) and Proof of Humanity, built by the Kleros arbitration protocol, both take the position that no single signal is trustworthy alone. Proof of Humanity combines video submission with public vouching and an economic challenge game — vouch for a fake and you can be slashed. Human Passport blends dozens of weak Web2 and Web3 signals into one score, on the theory that faking all of them simultaneously is expensive even if faking any one is cheap.

Academic hybrids — the closest prior art

A handful of research systems anticipate almost exactly what you're describing. CanDID (IEEE S&P 2021) issues decentralized credentials by drawing securely on data from existing unmodified web accounts, explicitly to solve what its authors call the credential-issuance bootstrapping problem, while adding Sybil-resistance and a way to blacklist sanctioned users. A very recent (2026) system, De-SyRIS, literally "synergizes facial biometric verification with anti-Sybil social graph analysis," combining zero-knowledge proofs and trusted hardware to get uniqueness without a central credential issuer — the same two-layer instinct as your idea, with a biometric root instead of a passport root. And a 2025 human-computer-interaction study, Personhood Credentials: Human-Centered Design Recommendation, interviewed 23 people in the US and EU about exactly the design choice you're facing — government versus private issuers, biometric versus document-based onboarding — and found people's trust hinges heavily on who issues the credential and whether verification happens once or periodically.

The landscape at a glance

The proposed design: a passport-rooted web of trust

Your idea sits deliberately between two of these families: use Layer 1 (government-ID-derived zero-knowledge proofs) only to seed Layer 2 (a web of trust), so the graph inherits strong uniqueness at the root while extending, through ordinary human vouching, to the roughly 2.8 billion people a passport-only system would exclude. The update in this revision — that Layer 1 should be capable of being removed later, leaving a self-sustaining graph — changes the design from a permanent two-tier system into a bootstrapping phase with an explicit exit.

flowchart TB
    subgraph L1["Layer 1 — Genesis Set (temporary)"]
        P1["Passport A"] -->|ZK nullifier| G1(("Root node"))
        P2["Passport B"] -->|ZK nullifier| G2(("Root node"))
    end
    subgraph L2["Layer 2 — Trust Graph"]
        G1 -->|vouch| M1(("Member"))
        G2 -->|vouch| M2(("Member"))
        M1 -->|vouch| M3(("Member, no passport"))
        M2 -->|vouch| M3
    end
    subgraph L3["Layer 3 — Gate"]
        M3 -->|"trust score ≥ threshold"| Gate["PersonhoodGate.sol"]
        Gate --> NFT["gov membership NFT"]
    end

Layer 1 — the Genesis Set

Use ZKPassport or Rarimo's registry as-is: each passport produces one on-chain nullifier via a zero-knowledge proof over the ICAO 9303 chip signature, revealing nothing but "a government signed this, and it hasn't registered before." Accept the dual-citizenship leakage as a bounded, known error rate rather than trying to eliminate it — chasing perfect per-human uniqueness at the root reintroduces exactly the cross-state biometric matching that makes World ID controversial.

Layer 2 — the Trust Graph

A root node can vouch for a newcomer by issuing a signed, one-time, rate-limited invitation — capped per epoch, so a single passport can't quietly mint an army of accounts. Trust should decay with distance from the nearest root and require diversity of incoming edges, following BrightID's rule that connections shouldn't all trace back to one cluster. The actual scoring can reuse two decades of graph-based Sybil-detection research rather than inventing new math: EigenTrust, which computes a global trust value for every node in a peer-to-peer network via distributed power iteration, and SybilRank, which ranks nodes by short random walks from a trusted seed set and bounds the number of fake accounts that can outrank real ones to roughly O(log n) per compromised edge into the trusted region — a concrete, checkable target for how much damage one bribed voucher can do.

Borrow Proof of Humanity's accountability model directly: if someone you vouched for is later proven to be a duplicate, your own vouching rights should be suspended or slashed. A vouch that costs nothing to give is a vouch that can be sold, which is precisely the failure mode that let people in several countries sell their iris scans for a few dollars.

Layer 3 — the Gate

A PersonhoodGate.sol contract, not a human operator, becomes the address authorized to mint gov membership NFTs. It accepts either a fresh Layer 1 nullifier or a proof of Layer 2 graph membership above a trust threshold. For the second path, Semaphore is close to a perfect fit: it's a zero-knowledge protocol, already used inside World ID itself for anonymous signaling, that lets someone prove membership in a group and cast one signal per epoch — enforced by an on-chain nullifier — without revealing which member of the group they are. A member could prove "I am a node in the Trust Graph above the threshold" without exposing their position in the graph at all, which is exactly the anonymity property vouching-based systems otherwise leak.

Two problems worth separating clearly: personhood-gating (who gets a vote) and vote-buying resistance (whether that vote can be coerced or sold once cast) are different problems. Once gov has a working Gate, MACI — Minimal Anti-Collusion Infrastructure, originally proposed by Buterin — is the natural next layer: it encrypts ballots so a voter can't prove to a briber how they voted, closing the loop that a purely public Governor contract leaves open.

Retiring Layer 1: a stages framework

Here's a genuinely useful borrowed idea: this is structurally the same problem Ethereum itself solved for rollups. In 2022, Buterin proposed milestones for rollups taking off training wheels — a staged path from a multisig with override power (Stage 0) to a system where no human group can override the code at all (Stage 2), with objective, checkable criteria for graduating between stages rather than a vague promise to decentralize eventually. Nothing in the proof-of-personhood literature applies this framing directly, but the shape of the problem — a necessary, centralizing bootstrap mechanism that should shrink in influence as the system matures — is identical. Below is a first attempt at translating it.

• Stage 0 — full root dependency. Every accepted member needs a fresh Layer 1 nullifier. This is the bootstrap phase: small, fast to secure, but as exclusionary as passport-only systems.
• Stage 1 — supervised graph growth. Vouching from root-adjacent members is allowed; SybilRank-style scoring and slashing are active; but the trust-score algorithm still uses the passport-rooted set as its required seed, the way a rollup's security council can still intervene on a detected bug.
• Stage 2 — root-optional. New members are accepted purely on graph-internal metrics — accumulated, slashing-tested trust edges — with no path back to a passport holder required at all. Passport verification becomes one optional input among several rather than the mandatory genesis.

Concrete, on-chain-checkable exit criteria for Stage 1 → Stage 2, mirroring how L2BEAT's rollup-stages framework turned Buterin's proposal into measurable checkboxes rather than a vibe:

1. Concentration bound. No single root node, root-adjacent cluster, or passport-issuing state should ever account for more than some fixed share (say 5%) of total trust mass in the graph — a Gini- or HHI-style cap that keeps one compromised state from being systemically critical.
2. Adversarial resilience. The DAO's own security researchers periodically inject simulated Sybil clusters and require the scoring algorithm to rank them near zero, matching or beating SybilRank's O(log n)-per-attack-edge bound, before trusting the graph without root fallback.
3. Structural age and density. A minimum count of independent, multi-hop trust components that have survived a set number of epochs without collapsing.
4. A governance vote. Since gov is already an OpenZeppelin Governor DAO, the "root-weight" parameter that controls how much Layer 2 scoring depends on Layer 1 proximity should itself be governed on-chain — existing members vote to lower it, the same way Ethereum's own rollups gradually cede power away from their security councils rather than having it revoked unilaterally.

Open problems and honest limitations

• Per-document, not per-human, uniqueness. Dual citizens get two Layer 1 nullifiers. There is no purely cryptographic fix short of cross-state biometric matching.
• Cold start for the undocumented. The whole point of Layer 2 is reaching the ~800 million people with no ID, but a community with zero existing links into the graph still needs one real-world bootstrapping event — a BrightID-style connection party or an Idena-style ceremony — to get its first edge in.
• Vouch markets. Anywhere a credential has value, someone will pay for it. Rate limits and slashing raise the price; they don't make it zero, especially for people vouching under financial pressure.
• Graph privacy. Even without names attached, a visible trust graph leaks social structure. Semaphore hides which member is proving membership, but the underlying graph topology used to compute trust scores is still more exposed than a fully rigorous design would want — this remains closer to an open research problem than a solved one, which is part of why standardization efforts like the anonymous-credentials SoK are still active in 2026.
• Liveness and churn. Passports expire and get revoked; people die. Both layers need re-attestation or decay logic, or the system accumulates "zombie" voting power.
• Root capture. If a passport-issuing state is compromised or starts mass-issuing fraudulent documents while Layer 1 is still load-bearing, the damage propagates into every Layer 2 node that traces back to it — the concentration bound in the stages framework above exists specifically to cap this risk before Layer 1 can be safely dropped.
• Personhood is not collusion-resistance. Solving "one human, one vote" doesn't stop that human from selling their vote or being coerced. That's MACI's job, not this design's.

Further reading

• Douceur, "The Sybil Attack" (2002)
• Siddarth, Ivliev, Siri & Berman, "Who Watches the Watchmen? A Review of Subjective Approaches for Sybil-Resistance in Proof of Personhood Protocols" (2020)
• Ford, "Identity and Personhood in Digital Democracy" (2020)
• Borge et al., "Proof-of-Personhood: Redemocratizing Permissionless Cryptocurrencies" (2017)
• W3C Decentralized Identifiers (DIDs) v1.0
• W3C Verifiable Credentials Data Model
• ICAO Doc 9303 — Machine Readable Travel Documents
• 10 World ID alternatives compared (2026)