decoy output

A decoy output is a real, pre-existing output on the blockchain that a ring-signature transaction references as a fake possible source, purely to hide the one output actually being spent. When you spend in Monero, your wallet does not just sign with your real output; it pulls in a handful of other people's old outputs from the chain, includes them all in the ring, and signs in a way that makes any of them look equally likely to be the true input. The decoys are the crowd your real spend disappears into, and the size of that crowd is your anonymity set.

Decoys are unwitting and free to use because the system only needs the decoys' public information, not consent or private keys — any output ever created is fair game to reference. The ring signature mathematically guarantees the verifier learns only 'one of these N outputs was spent', and the linkable key image ensures the real one cannot be double-spent, but neither reveals which output was real. Monero currently mandates a fixed ring size of 16, so each spend references 15 decoys plus the genuine output, and every transaction uses the same size to avoid fingerprinting by ring size.

The subtle and crucial part is how decoys are chosen, because a naive selection can betray the real spend. If decoys were picked uniformly at random across the chain's whole history, the real input would stand out, since people overwhelmingly spend recently-received coins rather than ancient ones. Monero therefore selects decoys from a gamma distribution over output age that mimics the empirical distribution of real spends, so the true output blends into a statistically plausible crowd. Poor decoy-selection algorithms in Monero's past, plus optional and small rings in its early years, left many transactions effectively traceable.

Decoys have intrinsic limits that motivate newer designs. The anonymity set is only as large as the ring (16 is modest), and decoys can be eroded by chain-reaction analysis: if an output used as a decoy in your ring is later proven to be the true spend in some other transaction, an analyst can eliminate it as a possibility in yours, gradually narrowing the real input. This fragility is why Monero is moving toward Full-Chain Membership Proofs, which replace a small ring of hand-picked decoys with a zero-knowledge proof of membership in the entire set of outputs — an anonymity set of tens of millions instead of sixteen.