Measure real-world hijacking rates under trip-cap defenses

Determine the rate at which an adversary can hijack legitimate principals while exploiting trip-cap defenses, because the effectiveness and safety of trip caps depend on the adversarial hijacking fraction.

Background

Trip caps can restore a stronger containment bound when principals are scarce and cannot be freely replaced, but they create a serious failure mode when an adversary operates through legitimate principals: the legitimate host may be permanently blocked.

The paper models this behavior using a parameter h representing the fraction of adversarial crossings performed inside legitimate principals. The simulation demonstrates severe harm at high h, but the empirical value of h in real deployments is unknown and directly determines whether the proposed mitigation is acceptable.