What stops a malicious actor from taking over a shard?

Question

As I understand it validators are randomly assigned to committees. That's all good and well but what stops a malicious validator who owns, say, 10% of the total network to keep applying for committees until all his validator nodes are put in the same committee?

For example, say he chooses shard one. He splits up his stake of the Network into indistinguishable validators of 32 ETH size. With these validators he applies to committees. If put in committee 1, he leaves the validator there, if put in a committee for a different shard, he waits until he can leave the committee and tries again. Eventually he will have assembled all his validators on shard 1.

One solution I suppose is to churn the committees regularly, but this introduces another trade-off: the more the shard committees are churned, the more the validators have to keep processing the state of all the shards, defeating the scalability purpose. Or am I seeing this wrong?

Answer 1

From the Ethereum Wiki sharding FAQs:

How can we solve the single-shard takeover attack in an uncoordinated majority model? In short, random sampling. Each shard is assigned a certain number of notaries (e.g. 150), and the notaries that approve collations on each shard are taken from the sample for that shard. Samples can be reshuffled either semi-frequently (e.g. once every 12 hours) or maximally frequently (i.e. there is no real independent sampling process, notaries are randomly selected for each shard from a global pool every block).

Since there is also a waiting period until a validator is activated, it seems impossible to try and recreate a validator when it got placed on a non-desired shard.