Avalanche looks interesting, but there doesn't seem to be anything in the white paper to suggest how they plan to deal with Sybil attacks. Their safety guarante

Avalanche looks interesting, but there doesn't seem to be anything in the white paper to suggest how they plan to deal with Sybil attacks. Their safety guarantees are dependent on the number of Byzantine nodes in the network, but what prevents a single attacker from simulating a large number of independent nodes (e.g. with VMs, or a botnet) and exceeding that limit? Can a minority of correct nodes continue to function safely despite a hostile Byzantine majority?