What Is a Decoy Selection Algorithm and Why It Matters for Ring Signatures?

21 October 2026

A decoy selection algorithm is the method a privacy coin uses to choose which old, genuine transactions to mix with your real transaction inside a ring signature. How well the algorithm picks those decoys determines whether the ring signature actually hides you or leaves a statistical fingerprint that can be traced. A bad decoy selection algorithm makes ring signatures useless. A good one makes them hard to break even with blockchain analysis.

How ring signatures depend on decoys

A ring signature works by grouping your real transaction output with several other outputs from the past. An observer sees the whole group - the ring - but cannot tell which output you are actually spending. The decoys are the outputs you did not create. They are the cover.

If the decoys are chosen poorly, an attacker can narrow down which output in the ring is real. For example, if all decoys come from transactions made in 2020 and your real output was created yesterday, the newest output in the ring is almost certainly yours. The ring signature still exists, but the privacy collapses.

The decoy selection algorithm is what prevents that collapse. It decides which outputs to pull from the blockchain, when they were created, and how many to include.

What a Decoy Selection Algorithm Tries to Solve

The core problem is that not all transaction outputs on a blockchain are equally likely to be spendable at any given moment. An output created ten years ago might have been spent years ago, or it might belong to a lost key. An output created five minutes ago is almost certainly still unspent and likely belongs to the person who just received it.

If the algorithm picks outputs without considering these probabilities, the real output stands out. The attacker can model the probability that each output in the ring is the real one, based on age, value, and how often outputs of that type appear.

A good decoy selection algorithm tries to make the real output look like just another member of the ring. It does this by selecting decoys that match the statistical profile of typical spends.

How monero's decoy selection works

Monero uses a decoy selection algorithm that has gone through several versions. The current approach, as of the most recent network upgrade, selects decoys from the blockchain using a two-part distribution:

1. Recent decoys: A portion of the decoys are chosen from outputs created in the last few days or weeks. This covers the case where your real output is fresh. If you spend an output you just received, the ring includes other recently created outputs so your output does not look abnormally new.

2. Older decoys: The rest of the decoys are chosen from the entire history of the blockchain, but weighted by a gamma distribution. This distribution approximates how long people typically hold Monero before spending it. Most outputs are spent within a few months. A smaller number are held for years. The algorithm mirrors that pattern so your decoys look like natural spending behavior.

The algorithm also ensures that no output appears as a decoy more than once in the same ring, and that decoys are not reused too often across different rings, which can also create tracing opportunities.

Why It Matters

The decoy selection algorithm is the difference between a ring signature that provides theoretical privacy and one that provides practical privacy. Here is what happens when the algorithm is weak:

• Age clustering: If decoys are only picked from old outputs, any ring containing a recent output immediately flags that output as real. Researchers have demonstrated this attack against older versions of Monero's decoy selection.

• Self-spending detection: If the algorithm does not check whether a decoy output belongs to the same person who created the ring, an attacker who controls many outputs can spot rings where only one output in the ring is not theirs.

• Chain analysis: If the distribution of decoy ages does not match the real spending distribution, analysts can build a statistical model that assigns a probability score to each output in a ring. Over many transactions, the real outputs consistently score higher.

A strong decoy selection algorithm forces an attacker to guess. Even with unlimited computing power and the full blockchain, they cannot tell which output in the ring is real unless the algorithm has been deliberately broken.

Where decoy selection gets restricted

Some jurisdictions and exchanges have attempted to restrict privacy coins that use ring signatures. The restriction is not usually about the algorithm itself. It is about the outcome. A well-tuned decoy selection algorithm makes it impractical for exchanges to comply with anti-money laundering rules that require them to trace the source of funds.

When an exchange delists Monero, the decoy selection algorithm is one reason. The exchange cannot reliably determine whether a particular Monero output came from a legitimate source or from a mixer, a darknet market, or a previous theft. The algorithm is doing exactly what it was designed to do - destroy the linkability that the exchange needs.

The Bottom Line

A decoy selection algorithm is not a minor technical detail. It is the mechanism that makes ring signatures actually work in practice. Without it, ring signatures are a mathematical trick that leaves you exposed to statistical analysis. With it, the privacy coin becomes resistant to the kind of blockchain surveillance that exchanges and regulators rely on. That is why the algorithm matters, and why changes to it are treated as major events in the development of any privacy coin that uses ring signatures.

Back to privacy coins