Imagine a gym that charges a membership fee but never checks whether you actually show up. You could buy one membership, clone the key card a thousand times, and have a thousand ghost members voting in the gym's elections — all for the price of one. Most Sybil defenses are that gym: they price the door, not the treadmill. This paper argues you need to price the treadmill. The core claim is a formal cost model the authors call "bilinear Sybil cost": maintaining s fake identities active for T time periods must cost at least sT/A honest-user units, where A is the adversary's hardware speed advantage. This is multiplicative in both identities AND time — not additive, not amortizable. The paper identifies exactly four conditions that together guarantee this bilinear cost: identity binding (each challenge is tied to one identity), freshness (the challenge changes every period), a shared deadline (everyone must finish by the same wall-clock moment), and sequential non-batchable work (you can't parallelize the computation across identities). Remove any one, and the guarantee breaks. The authors prove this independence formally. The mechanism they propose is a verifiable delay function (VDF) evaluated on an identity-bound input each period. VDFs are inherently sequential — no amount of parallel hardware lets you compute them faster. You can verify the output quickly, but producing it requires a fixed number of sequential steps. This is fundamentally different from hash puzzles (proof-of-work), where an ASIC with 10^6 cores does the work of 10^6 honest nodes simultaneously. The empirical comparison is stark. Against hash puzzles, the hardware speed advantage A ranges from 10^3 to 10^7 — meaning an attacker with specialized hardware can maintain thousands to millions of fake active identities per honest user's cost. Against VDFs on commodity CPUs, A drops to 2–8. Even a hypothetical custom ASIC only pushes A to about 28. The paper benchmarks one active identity per CPU core per period, compared to roughly 80,000 under a signed-heartbeat baseline. Batching 1,000 identities yielded no speedup — the sequential constraint holds. The integrity of the result rests on a combination of formal proofs (the four-condition sufficiency and their mutual independence) and empirical measurements on actual hardware. The authors tested multiple attack strategies and report all were rejected. The formalization is tight: the bilinear cost bound is a theorem with stated assumptions, not a simulation artifact. The benchmarks, however, are on the authors' own hardware — no independent replication yet, and no community benchmark exists for this specific cost model. The practical significance is clearest in decentralized systems — DAOs, peer-to-peer networks, federated learning, blockchain governance — anywhere ongoing participation confers influence. Current defenses either charge at the gate (stake, registration fees) or use periodic but batchable checks (heartbeats, PoW). This paper shows why those approaches leak: they allow cost amortization across identities or time. VDF-based recurrent checks close that leak, at a cost of one sequential computation per identity per period per core. The open question is scaling to real deployments with millions of identities on heterogeneous hardware. The VDF evaluation time must be calibrated so honest participants on slow hardware can finish before the deadline, which simultaneously sets the ceiling for how many periods an attacker can squeeze. The paper doesn't address what happens when the device landscape spans smartphones to data centers — a gap the authors likely know about but haven't tackled yet.
