OSPEAD-docs

1 Introduction

This docs website provides a high-level explanation of the OSPEAD (Optimal Static Parametric Estimation of Arbitrary Distributions) code that produces a new and improved decoy selection distribution for Monero. Starting with Chapter 4, the purpose and major features of each piece of code is explained.

It is possible to run each piece of code in sequence to produce the new decoy selection distribution. However, the current version of the code requires a machine with RAM in excess of 150GB and a running time of about two weeks. Future improvements to the code could reduce the RAM and run time requirements. Instead of running the whole OSPEAD code, an interested reader could easily run the simulation code in Chapter 3 in a few hours on a consumer-grade desktop or laptop. The simulation code includes the essential components of OSPEAD and demonstrates its validity.

1.1 Procedure to estimate the real spend age distribution

OSPEAD’s objective is to create a new decoy distribution that is very close to the real spend age distribution. The best decoy is a decoy that closely mimics the real spend. From Monero’s blockchain data, the real spend age distribution must be separated from the decoy distribution and measured. The statistical procedure boils down to two steps:

1. Separate the distribution of rings created by the standard wallet2 code from the distributions of rings created by nonstandard wallet code. The Bonhomme-Jochmans-Robin (BJR) estimator is used for this step (Bonhomme, Jochmans, and Robin 2016).

2. Separate the wallet2 decoy distribution from the real spend distribution. The Patra-Sen inversion estimator is used for this step (Patra and Sen 2016).

1.2 Main results

See Chapter 13 for full details. The best-fitting decoy distribution was determined to be the log transformation of the generalized beta distribution of the second kind, with parameters scale = 20.62, shape1 = 4.462, shape2 = 0.5553, and shape3 = 7.957. On average, an adversary using the Maximum A Posteriori (MAP) Decoder Attack against users who use this distribution would have correctly guessed the real spend in 7.6 percent of rings (Aeeneh et al. 2021). This corresponds to an effective ring size of 13.2. Note that the minimum possible guessing probability is $1/16=6.25\%$.

The estimates also reveal how much privacy Monero users lose by using the current wallet2 decoy selection algorithm. The estimated average attack success probability that an adversary can achieve against real Monero users who were using the default decoy selection algorithm since the August 2022 hard fork was 23.5 percent. This corresponds to an effective ring size of 4.2.

1.3 License

All code in this OSPEAD-docs website is released under the GPL-2 open source license, copyright Rucknium 2025.

1.4 Acknowledgements

This research was funded by Monero’s Community Crowdfunding System.

Thanks to isthmus (Mitchell P. Krawiec-Thayer) for discussion of certain methodological issues and for creating a nonstandard transactions list. Thanks to jeffro256 for improving the documentation of Monero’s default decoy selection algorithm. Thanks to plowsof for lending computing resources for collecting txpool data. Thanks to gingeropolous for managing the Monero Research Lab Research Computing Cluster, which was used to perform the computations for the statistical estimates.

The following people gave feedback on the research process and/or contributed in other ways: ACK-J, ArticMine, bob, coinstudent2048, garth, hyc, jberman, kayabaNerve, koe, mj-xmr, monerobull, moneromooo, neptune, SamsungGalaxyPlayer, SerHack, SethForPrivacy, and Syksy.

Aeeneh, Sina, João Otávio Chervinski, Jiangshan Yu, and Nikola Zlatanov. 2021. “New Attacks on the Untraceability of Transactions in CryptoNote-Style Blockchains.” In 2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), 1–5. https://doi.org/10.1109/ICBC51069.2021.9461130.

Bonhomme, Stéphane, Koen Jochmans, and Jean-Marc Robin. 2016. “Non-Parametric Estimation of Finite Mixtures from Repeated Measurements.” Journal of the Royal Statistical Society. Series B (Statistical Methodology) 78 (1): 211–29. http://www.jstor.org/stable/24775334.

Patra, Rohit Kumar, and Bodhisattva Sen. 2016. “Estimation of a Two-Component Mixture Model with Applications to Multiple Testing.” Journal of the Royal Statistical Society. Series B (Statistical Methodology) 78 (4): 869–93. http://www.jstor.org/stable/24775367.