search

WalletWasabi / WalletWasabi

Open-source, non-custodial, privacy preserving Bitcoin wallet for Windows, Linux, and Mac.
https://wasabiwallet.io
MIT License
2.15k stars 501 forks source link

Counterintuitivity of anonymity computation #8051

Open onvej-sl opened 2 years ago

onvej-sl commented 2 years ago

Please, see this test, that demonstrate counterintuitivity of anonymity computation after https://github.com/zkSNACKs/WalletWasabi/pull/8025 was merged.

nopara73 commented 2 years ago

This issue could be considered being the continuation of the Anonymity Calculation VS Coin Selection dilemma after in https://github.com/zkSNACKs/WalletWasabi/pull/8025 the opposite compromise was made.

The purpose of the anonymity score calculation is to help the wallet answer the question "when is it time to stop the mixing process?" Unfortunately, the previous, "intuitive" anonymity score calculation did a poor job at that: it only worked for 1.0, but not for 2.0 coinjoins. In 2.0 it seemed to somewhat work, but even that was just an illusion because we had to ruin the coin selection algorithm to satisfy it: the previous anonscore calculation forced us to tailormade the coin selection algorithm to select coins with similar anonymity scores, which prevented any other factor like amounts, randomness and tx graph interconnectedness to matter, thus the selections were low-quality, resulting in subpar coinjoins those did not only had significantly worse privacy, but as well in various - non-edge case - configurations of the software it made coinjoins completely unusable.

See Goodhart's Law: When a measure becomes a target, it ceases to be a good measure.

How to resolve the issue the example demonstrates? I think you're thinking too small. Pun intended :) Literally, the transaction is too small. That's why we can assume common ownership heuristic there. The larger the transaction is the less we can assume common input ownership heuristic, thus the less counterintuitive the weighted averaging is, and that's the default case for WW2 coinjoins on mainnet, so that's how it's becoming intuitive to default to. And in fact, I think we could even resolve all the conflicts if we'd start out with exponential punishment for small coinjoins and as the coinjoins become larger and larger we could slog our way back to weighted averaging?

onvej-sl commented 2 years ago

Literally, the transaction is too small. That's why we can assume common ownership heuristic there.

I understand your reasons why you decided to use weighted average. I'm only saying the assumption that coinjoin sudoku is a hard problem is not valid for this particular transaction. At the very least, you should refuse to compute anonymity for transactions that are too small.

See Goodhart's Law: When a measure becomes a target, it ceases to be a good measure.

This is a nice slogan which was said in some context that probably doesn't apply here. If this law was universally true, some scientific fields of study such as mathematical optimization wouldn't exist.

nopara73 commented 2 years ago

I'm only saying the assumption that coinjoin sudoku is a hard problem is not valid for this particular transaction.

Yes, I acknowledged this. Did you succeed to parse the last part of my comment? More precisely, what do you think of the suggestion to resolve the issue?

And in fact, I think we could even resolve all the conflicts if we'd start out with exponential punishment for small coinjoins and as the coinjoins become larger and larger, we could slog our way back to weighted averaging?

onvej-sl commented 2 years ago

Please reopen this issue, https://github.com/zkSNACKs/WalletWasabi/pull/8933 certainly doesn't fix it.