arXiv CSopen access

Distributed General-Purpose Agent Networks: Architecture, Key Mechanisms, and Prototypes

1

Distributed General-Purpose Agent Networks: Architecture, Key Mechanisms, and Prototypes

arXiv:2606.17368v1 [cs.AI] 15 Jun 2026

Shengli Zhang, Deen Ma, Zibin Lin, and Taotao Wang

Abstract—Large language models have accelerated the transition from passive conversational assistants to autonomous agents that can understand goals, plan actions, invoke tools, and execute multi-step tasks. Yet the capability of a single agent remains constrained by its local data, tool permissions, runtime environment, and governance boundary. This paper studies distributed general-purpose agent networks: open peer-to-peer networks in which heterogeneous agents deployed on personal devices, edge nodes, or autonomous computing environments can discover one another, establish trust, negotiate cooperation rules, and execute open-ended tasks. We argue that such networks cannot be obtained by simply combining existing peer-to-peer overlays with conventional multi-agent systems. Unlike file-sharing networks, which mainly locate static objects, and blockchain networks, which maintain structured ledgers, agent networks must propagate semantic declarations about intentions, capabilities, states, and cooperation constraints. We therefore propose a layered architecture centered on a protocol adaptation layer that connects upper-level task semantics with lower-level network operations. The layer transforms user goals and agent states into announcement, retrieval, verification, negotiation, and execution procedures. Based on this architecture, the paper identifies three core mechanism problems: semantic announcement propagation for collaborator discovery, verifiable identity and multi-topic reputation for cooperation governance, and semantic-gradient mechanism design for open task execution. For each problem, we present a technical route, including bodyless gossip with sequential logs, BAID-based identity binding with MG-EigenTrust reputation, and a Stackelbergstyle mechanism-generation loop driven by semantic attribution feedback. We further report prototype overhead results for BAID-style tiered verification and mechanism-level simulations of MG-EigenTrust under cross-topic disguise-collusion attacks. The resulting framework provides a system-level foundation for open, trustworthy, and scalable agent collaboration. Index Terms—distributed agent networks, peer-to-peer systems, protocol adaptation layer, semantic discovery, verifiable identity, reputation, automated mechanism design, LLM agents

I. I NTRODUCTION

conversation-centered assistance to task-centered autonomy [1], [2], [3], [4]. However, the capability of an individual agent is still bounded by local data, available tools, permissions, and execution environment. The history of the Internet suggests that the value of large numbers of personal computers was not released merely by improving the performance of each endpoint, but by connecting them into an open, stable, and scalable cooperation network. Agent systems face a similar transition. Beyond improving the capability of individual models, a key future direction is to enable large numbers of heterogeneous agents to be discovered, understood, trusted, and coordinated in open environments [5], [6], [7]. Only by moving beyond a single-machine closed loop can agents support more complex networked applications, including social matching, task crowdsourcing, information exchange, resource brokerage, and multi-party negotiation. Motivated by this trend, this paper studies distributed general-purpose agent networks: network systems in which many agents with general task-processing capabilities are interconnected through peer-to-peer protocols and continuously cooperate around open tasks. Compared with centralized multi-agent platforms, such networks deploy agents on personal devices, edge nodes, or autonomous control environments. They use distributed discovery, negotiation, and cooperation to reduce dependence on centralized infrastructure, while improving privacy preservation, resilience, and resistance to single points of failure. Policy-level AI initiatives have also begun to frame agentic systems as infrastructure for broader economic and social transformation [8]. In largescale open collaboration, centralized architectures can face data-compliance pressure, platform bottlenecks, and limited governance reach. A distributed agent network offers a possible infrastructure for a more open, robust, and inclusive next generation of agent-based systems.

A. Background Large language models (LLMs) have made rapid progress in natural language understanding, complex reasoning, task planning, and tool use. As a result, agent systems are evolving from passive dialogue assistants into autonomous actors that can perceive context, plan intermediate steps, invoke external tools, and execute tasks on behalf of users. Personal general-purpose agents, such as systems that integrate planning, retrieval, tool calling, and local context management, illustrate this shift from Shengli Zhang, Deen Ma, Zibin Lin, and Taotao Wang are with the College of Electronics and Information Engineering, Shenzhen University, Shenzhen 518060, China. Emails: [email protected]; [email protected]; [email protected]; [email protected].

B. Problem Statement Although distributed networks and multi-agent systems have both been studied for decades, simply combining them does not yield a usable distributed general-purpose agent network. The reason is that the objects, messages, and cooperation modes in such networks differ fundamentally from those in traditional peer-to-peer or blockchain systems. Traditional file-sharing P2P systems mainly support static resource sharing. Their central problems are file lookup, index maintenance, and data transfer. Blockchain peer-to-peer networks mainly maintain structured ledgers, with emphasis

2

on consistency, security, and consensus efficiency. In contrast, a distributed general-purpose agent network supports highly dynamic, open-ended, and semantically driven task collaboration. The network no longer transmits only fixed-format data or ledger records. Instead, it must propagate semantic information about needs, capabilities, states, and cooperation intentions. The nodes are no longer passive storage or forwarding endpoints; they are agents that can understand, reason, and adapt their strategies. The difference can be seen through a simple example. In a conventional file-sharing network, if a user wants a file, the system usually searches for a known hash or explicit file identifier. The network problem is essentially: who has this object? In a distributed general-purpose agent network, a user may instead ask for help with a task such as “analyze a dataset, write a report, and generate figures.” The network must then solve a different problem: potential collaborators need to understand the task semantics, judge whether they are relevant, and establish a trustworthy cooperation relation. In other words, traditional networks focus on locating known objects, whereas distributed agent networks must support discovery and cooperation around open intentions. Existing methods for structured message propagation, static identity registration, or fixed-rule collaboration are therefore difficult to apply directly. A distributed general-purpose agent network must address not only whether a message can be delivered, but also whether its semantics can be understood, whether the identity behind it can be verified, and whether cooperation can remain stable over time. This motivates a systematic redesign of three basic capabilities: propagation protocols, identity governance, and cooperation mechanisms. C. Proposed Approach This paper proposes a basic architecture for distributed general-purpose agent networks composed of three layers: a general-purpose agent layer, a protocol adaptation layer, and a peer-to-peer network stack. Each network node is driven by a general-purpose personal agent. The bottom layer uses overlay protocols such as LibP2P to connect with other nodes. The middle protocol adaptation layer connects upper-level task semantics with lower-level network communication and is the key component that enables intelligent collaboration. Concretely, the protocol adaptation layer interprets user needs, extracts task intent, and decomposes cooperation goals at the upper interface. At the lower interface, it maps semantic tasks into network operations such as broadcasting, connection establishment, synchronization, verification, and negotiation. It is not merely an interface wrapper or protocol adapter in the conventional sense. Rather, it is the core hub that adaptively matches agent task requirements with distributed network protocols. Around the life cycle of open tasks, the collaboration process is abstracted into two consecutive stages. Interest-aware partner discovery. An agent first compresses the user task into a fixed-size semantic digest and broadcasts it in the peer-to-peer network. Other agents receive the digest, use LLM-based semantic understanding to judge its relevance,

and combine this judgment with their own capabilities, interests, and current states. Potentially relevant nodes are then filtered in the large-scale network and send connection requests to the task initiator. The goal of this stage is to disseminate task needs efficiently within the relevant interest domain, while performing semantic filtering as early as possible to avoid unnecessary communication. Direct negotiation and task execution. After multiple agents identify a potential cooperation intention, they establish peerto-peer connections and negotiate around the concrete task. Before cooperation begins, the parties verify identities, evaluate historical reputation, identify risks, and negotiate benefit allocation, responsibility division, and execution procedures. Once an agreement is reached, agents execute the task, for example through social matching, crowdsourced division of labor, information exchange, or transaction negotiation. The goal of this stage is not merely to exchange a message, but to support verifiable, constrained, and sustainable cooperation in an open environment. Based on this architecture and two-stage workflow, the paper focuses on three basic capability modules in the protocol adaptation layer: collaborator discovery, network governance, and task cooperation execution. D. Main Technical Routes and Contributions Under the above architecture, the paper develops three technical routes and reports the corresponding prototype or simulation evidence where it is available. Route 1: Semantic-message propagation in large-scale open networks. Agent collaboration often begins with the broadcast discovery of needs, capabilities, or states. These messages are usually natural-language or semi-structured descriptions with open semantics, short validity windows, and variable payload sizes. Traditional broadcast protocols are mainly designed for structured messages or static objects, and it is difficult for them to simultaneously achieve low redundancy, low latency, and high coverage. We therefore study lightweight propagation, on-demand retrieval, and sequential consistency for semantic messages in large-scale peer-topeer environments, and analyze scalability boundaries among coverage latency, throughput, and consistency. Route 2: Verifiable identity binding and multi-topic reputation governance. In open distributed environments, LLM-driven agents may forge identities, replace code, migrate across domains, or collude to evade responsibility. Static identity registration and conventional reputation management are insufficient. In multi-topic and multi-scenario networks, a node’s behavior may differ substantially across business domains; a flat global reputation score can cause reputation dilution, cross-domain abuse, and malicious identity laundering. We therefore study verifiable binding among the responsible user, agent code, and on-chain accountability identity, as well as reputation updates under cross-domain cooperation, dynamic adversaries, and multi-layer coupled networks. Route 3: Automated cooperation-rule generation for open tasks. Tasks in distributed agent networks are openended and heterogeneous. Many constraints cannot be fully

3

Node A

Node A

User (Owner)

User (Owner)

Task

Result

General-purpose agent (OpenClaw) Reasoning / planning / tools Open task Collaborative Description Task execution LLM-driven protocol adaptation layer Identity & reputation governance BAID identity verification

Task Agents mutually complete task collaboration

Task adaptation module Task decomposition • Partner discovery • Cooperative execution

Step 2: direct collaboration and cooperation-mechanism negotiation

Mechanism self-evolution • Generator agent • Strategy explorer

Announcement Business events view Network broadcast module Layered Gossip protocol reputation Interest partner discovery Sequential business log Effective topology Event-state construction feedback Libp2p network stack Discovery / Connection / Encryption / Transport

Identity & reputation governance BAID identity verification

Step 1: broadcast event announcement and partner discovery

Result

General-purpose agent (OpenClaw) Reasoning / planning / tools Open task Collaborative Description Task execution LLM-driven protocol adaptation layer Task adaptation module Task decomposition • Partner discovery • Cooperative execution Mechanism self-evolution • Generator agent • Strategy explorer

Announcement Business events view Network broadcast module Layered Gossip protocol reputation Interest partner discovery Sequential business log

P2P connection (encrypted transport/session)

Effective topology Event-state construction feedback Libp2p network stack Discovery / Connection / Encryption / Transport

Fig. 1. Reference architecture of a distributed general-purpose agent network. A node contains a general-purpose agent, a protocol adaptation layer, and a peer-to-peer network stack. The protocol adaptation layer translates task semantics into announcement, verification, negotiation, and execution procedures. Multiple nodes with the same structure form a dynamic cooperation system for open tasks.

expressed as explicit numerical utility functions; they appear as natural-language rules, task goals, or semi-structured requirements. At the same time, reasoning-capable agents may actively discover loopholes and evolve new attack strategies. We therefore study how LLM-based semantic understanding and attribution can be combined with game-theoretic mechanism design to generate cooperation mechanisms that approximate incentive compatibility, individual rationality, and robustness under an open strategy space. The main contribution of this paper is a system-level framework that connects these three routes through the protocol adaptation layer. Instead of treating semantic discovery, trust governance, and cooperation-rule generation as isolated modules, we view them as coupled functions of a common control layer that turns task semantics into network behavior and feeds cooperation outcomes back into future discovery, trust, and mechanism decisions. We also provide preliminary evidence through discovery simulations, a BAID verification-overhead prototype, and MG-EigenTrust mechanism-level simulations; the semantic-gradient component is presented as a mechanism design and evaluation protocol for subsequent system studies. Table I clarifies the scope of evidence in the current manuscript. This distinction is important because the paper combines architecture, mechanism design, analytical modeling, and preliminary experiments rather than reporting a single end-to-end deployed system.

II. R ELATED W ORK This section reviews prior work related to the three core problems above: large-scale peer-to-peer communication protocols, distributed identity and reputation management, and automated mechanism design. Existing research has provided important foundations for message propagation, node trust, and rule optimization. However, most of it targets structured data, static node relations, or closed task environments, and therefore does not directly support agent collaboration around open semantic tasks.

A. Large-Scale Peer-to-Peer Communication Protocols Peer-to-peer overlay networks are a natural substrate for distributed agent networks. Classical epidemic and rumorspreading models established the theoretical foundation for efficient and robust randomized dissemination in dynamic networks [9]. Peer-sampling protocols, such as Cyclon-style randomized view exchange, reduce partition risks and maintain robust overlay topologies in dynamic settings [10], [11]. Modern systems such as LibP2P and GossipSub further combine mesh forwarding with gossip-based metadata propagation and peer scoring, and have been widely used in decentralized networks [12], [13]. Agent networks introduce heterogeneous payloads and semantic messages. When message bodies are large, direct broadcast can create bandwidth spikes and long-tail latency.

4

TABLE I P ROTOTYPE AND EVALUATION EVIDENCE FOR THE THREE TECHNICAL ROUTES IN THIS MANUSCRIPT.

Route

Current prototype/evaluation evidence

Next-stage evaluation scope

Semantic discovery Identity and reputation governance

Protocol design, sequential-log model, coverage and throughput bounds, and discovery simulations under churn BAID proof-overhead prototype and MGEigenTrust mechanism-level simulations

Semantic-gradient mechanism design

Game model, Stackelberg loop, semantic attribution formulation, and evaluation protocol

Larger deployment traces, richer semantic task distributions, topic-noise stress tests, and variable payloadsize settings. Full evidence-generation pipelines, on-chain execution costs, punishment-threshold calibration, and larger heterogeneous workloads. Concrete attack traces, rule revisions, and before–after measurements of IC, IR, and robustness.

Two-stage propagation, where lightweight digests are disseminated first and full payloads are retrieved on demand, has been studied in blockchain systems and provides a useful design pattern. Related ideas include compact block relay, bodyless block propagation, set reconciliation, and coded data retrieval [14], [15], [16], [17]. For agent networks, this pattern must be extended from structured block data to natural-language or semi-structured semantic declarations. Distributed consistency is another relevant foundation. Logical clocks define partial ordering among events, and vector clocks distinguish concurrent from causally ordered events [18], [19]. Conflict-free replicated data types provide eventual convergence without central coordination [20]. Stronger consistency can be obtained through Byzantine-fault-tolerant consensus [21], [22], but global consensus is often too costly for open semantic announcement networks. The key challenge is therefore to find a middle ground: preserving the local sequential semantics needed by task declarations while avoiding the cost of a global ledger. Recent agent interoperability protocols focus more on application-layer message formats, capability registration, secure discovery, and agent-to-agent communication [23], [24], [25]. These efforts are important, but they do not yet provide a unified protocol design that connects business intent, semantic propagation, and network-level scalability analysis for generalpurpose agent networks. B. Distributed Identity and Reputation Management In open distributed networks, Sybil attacks are a basic threat: a malicious participant can create many identities to amplify influence or evade punishment [26]. Trust and reputation mechanisms are therefore central to long-term cooperation in open systems [27], [28]. Classical reputation systems such as EigenTrust and PowerTrust aggregate local interaction scores into global trust signals for peer-to-peer environments [29], [30]. These methods are important starting points, but they assume relatively stable node identities and do not directly address code replacement, agent evolution, or cross-topic behavior drift. As agent interoperability protocols emerge, identity and dynamic reputation become key infrastructure for the Internet of agents. An agent identity should be distinguishable, verifiable, and traceable. Naming, registration, and resolution mechanisms can support discovery, but centralized registries

may create bottlenecks and governance boundaries in crossdomain networks. Recent work also explores verifiable metadata, decentralized governance, and on-chain proofs for agent accountability [31], [32], [33], [34], [35]. These approaches help turn trust claims into auditable claims, but a systematic mechanism is still needed to bind a responsible user, executable agent code, and accountability anchor. Dynamic reputation is equally important. In multi-agent systems, self-interested behavior can cause cooperation collapse, and reputation can serve as a lever for repairing cooperation [36], [37]. Gossip-driven indirect reciprocity and dynamic filtering mechanisms show that reputation can stabilize cooperation under incomplete information and noisy feedback [38], [39]. However, existing work mainly studies static identity registration or conventional node reputation. It has not fully addressed verifiable user–code–responsibility binding, nor reputation convergence under grouped broadcasts, multi-domain migration, and adversarial cross-topic behavior. C. Automated Mechanism Design Automated mechanism design formulates rule design as a computational optimization problem [40], [41], [42]. Early work focused on solving incentive compatibility and individual rationality constraints under given preference distributions. Later, deep learning methods represented high-dimensional mechanisms with neural networks. RegretNet-style approaches showed that deep models can be used for multi-item auction design and differentiable mechanism optimization [43], [44], [45]. Other work embeds mechanism design in multi-agent games, where a mechanism designer interacts with strategic participants and searches for robust rules [46], [47], [48]. LLMs introduce a different possibility. Many cooperation rules in agent networks are not fixed numerical functions; they are textual rules, procedural constraints, and semi-structured agreements. Recent work on optimizing generative systems through textual feedback suggests that language-model feedback can play a role similar to gradient information in nondifferentiable semantic spaces [49]. Generative agents and LLM-based game simulations further provide environments in which rule-following, negotiation, and strategic behavior can be studied [50], [48]. Still, existing automated mechanism design mainly assumes explicit utilities, finite action spaces, and relatively static environments. Distributed general-purpose agent networks require mechanisms for open tasks, natural-language constraints,

5

evolving strategies, and adversarial rule exploitation. This motivates a semantic-gradient approach that treats mechanism text, attack strategies, and system losses as nodes in a semantic computation graph. III. S YSTEM A RCHITECTURE AND T ECHNICAL ROUTE BASED ON THE P ROTOCOL A DAPTATION L AYER The goal of a distributed general-purpose agent network is not merely to connect several agents to a common peer-to-peer overlay. The goal is to enable agents to complete a sequence of cooperation operations around open tasks, including discovery, verification, negotiation, execution, and feedback. Achieving this goal depends not only on the stability of the bottom-layer peer-to-peer network, nor only on the semantic and planning capability of the upper-layer LLM agents. It also requires a middle layer that unifies task semantics, network behavior, and cooperation control. We therefore place the protocol adaptation layer at the center of the architecture. Unlike middleware for protocol conversion, interface wrapping, or message-format adaptation, the protocol adaptation layer performs a form of networked intelligent control for open task collaboration. It receives task goals, capability states, and cooperation intentions from the general-purpose agent. It drives network operations such as broadcast, connection establishment, synchronization, verification, negotiation, and execution. During this process, it maintains collaboration context so that multiple agents can form a closed loop from discovery to task completion. A. Overall Architecture and Position of the Protocol Adaptation Layer At the system level, the proposed distributed generalpurpose agent network consists of a general-purpose agent layer, a protocol adaptation layer, and a peer-to-peer network stack, as shown in Fig. 1. The three layers form a top-down architecture that is also coupled through a task collaboration loop. From the perspective of a single node, the general-purpose agent layer directly serves the user. It performs naturallanguage understanding, task planning, tool invocation, and result generation, and determines whether external collaborators are needed. The peer-to-peer network stack maintains node connectivity, neighbor sets, message forwarding, topicbased propagation, and direct peer communication, providing an open, decentralized, and scalable network environment. The protocol adaptation layer bridges the two: it turns the needs, capabilities, and states produced by the upper agent into network-level announcements, connections, verifications, negotiations, and execution procedures, while maintaining the context of the collaboration. The protocol adaptation layer is the key for extending individual intelligence into networked collaborative intelligence. Without this layer, an agent may understand a task but cannot efficiently find partners, build trust, or organize collaboration in an open network. Conversely, the underlying network may provide communication capacity but cannot directly support

dynamic cooperation around open tasks. The protocol adaptation layer therefore acts as the cooperation control plane of the distributed agent network. The data flow of the protocol adaptation layer can be summarized as follows. Its inputs include: (i) task inputs from the local agent, such as user goals, task plans, capability gaps, resource needs, and execution constraints; (ii) network inputs from the peer-to-peer layer, such as node announcement events, connection requests, message digests, identity claims, and behavior feedback; and (iii) state inputs from local storage, such as historical reputation records, cooperation outcomes, policy preferences, stake states, and resource usage. Its outputs include: (i) network-facing operations, such as announcement broadcast, connection establishment, payload retrieval, verification requests, and synchronization; (ii) collaborator-facing outputs, such as identity proofs, risk assessments, cooperation proposals, mechanism clauses, and execution assignments; and (iii) local-agent-facing outputs, such as candidate collaborator lists, cooperation risk evaluations, cooperation agreements, and execution-status feedback. In this sense, the protocol adaptation layer is a middle control layer that couples task semantics, network state, and cooperation rules. B. Overall Framework of the Protocol Adaptation Layer The protocol adaptation layer is not a static interface wrapper, but a dynamic control framework organized around the task life cycle. After a task enters the network, it passes through candidate discovery, trust filtering, rule generation, and task execution. Execution outcomes feed back into later reputation judgments and partner-selection strategies. Thus, the protocol adaptation layer connects task semantics with network behavior while also maintaining the state of the cooperation process. Based on this logic, the protocol adaptation layer is divided into three core modules: collaborator discovery, cooperationnetwork governance, and task cooperation execution. As shown in Fig. 2, the three modules form a continuous cooperation chain around a task. First, the collaborator discovery module abstracts a local task into an announcement event, propagates it within an interest domain, and produces a candidate collaborator set. Second, the governance module verifies identities, evaluates reputation, and filters risks to select trustworthy collaborators. Third, the task execution module generates cooperation rules over the trusted collaborators, performs task decomposition, schedules execution, and tracks outcomes. The modules are not simply connected in a one-way pipeline. Execution feedback, including fulfillment records, violation reports, cooperation quality, and resource consumption, flows back to the governance module to update reputation and risk judgments. These updates further influence the propagation scope, subscription strategy, and candidate filtering criteria in the discovery module. The protocol adaptation layer is therefore an iterative cooperation system rather than a oneshot workflow. Functionally, the three modules answer three questions: whom to find, whom to trust, and how to cooperate. Through

6

Core objective: open-space strategies and cooperation mechanisms for general tasks

Automated Cooperation-Mechanism Design Mechanism-generation agent (MG) Slow variable

Strategy-exploration agent (SE) Fast variable

Multi-agent simulation environment Simulate - evaluate - feedback

Stackelberg-game-based incentive compatibility (IC) and individual rationality (IR) for open tasks Secondary stake, reputation score

Verifiable Identity and Reputation

Core objective: reliable identity and reputation for distributed cross-domain nodes MG-EigenTrust multi-layer reputation algorithm

BAID identity protocol (zkKYC + zkVM) User subject Code logic On-chain rights

Cross-domain reputation penalty and dynamic pretrust AgentID = H(CP | H(Config) | UserID | Salt)

PoS-staked nodes, sequential log

Semantic Propagation and Collaborative Discovery Two-stage Bodyless Gossip protocol Digest flooding Payload pulling

Core objective: scalable dissemination of heterogeneous semantic events Causal consistency of sequential data

E-list CausalIndex SemanticIndex

E-list CausalIndex SemanticIndex

E-list CausalIndex SemanticIndex

E = [ID, Seq, Topic, Payload, TTL, Sig]

Fig. 2. Main modules of the protocol adaptation layer. The layer links collaborator discovery, cooperation governance, and task execution into a feedback loop.

feedback, each collaboration leaves evidence that becomes prior information for future cooperation. C. Key Technical Routes The three modules of the protocol adaptation layer correspond to three technical routes and to the three mechanism designs in Section IV. Table II summarizes the mapping. In the collaborator discovery module, the central problem is lightweight propagation and on-demand retrieval of open task announcements. Because semantic payloads have variable size and direct broadcast is expensive, we use a digestcommitment-based two-stage bodyless gossip protocol. This protocol separates semantic digest dissemination from full payload transmission and uses sequential logs to maintain weakly consistent ordering of announcement events within an interest domain. In the governance module, the central problem is identity attribution and cross-domain reputation convergence. To address identity forgery and responsibility escape in open environments, we design a Binding Agent ID (BAID) mechanism that links the responsible user, agent code, and on-chain accountability identity. We then construct MG-EigenTrust to support dynamic reputation updates in multi-topic and multiscenario coupled networks. In the task execution module, the central problem is automatic generation and optimization of cooperation rules under open task conditions. Since task goals, benefit constraints, and behavioral rules often appear as natural language or semistructured requirements, it is difficult to build a complete

numerical utility model. We therefore use a Stackelberg-style two-level game in which mechanism-generation agents and strategy-exploration agents iteratively improve cooperation agreements through semantic attribution feedback. IV. K EY M ECHANISMS AND P ERFORMANCE A NALYSIS OF THE P ROTOCOL A DAPTATION L AYER Section 3 positioned the protocol adaptation layer at the system level and mapped its three modules to three technical routes. This section develops these routes into concrete mechanism designs and analysis frameworks. Section 4.1 studies semantic announcement propagation for collaborator discovery. Section 4.2 studies verifiable identity and dynamic reputation for cooperation governance. Section 4.3 studies automatic cooperation-rule generation for task execution. A. Sequential Business Events and Propagation Mechanisms in Distributed Agent Networks In a large-scale agent network, agents publish announcement events to describe their capabilities, cooperation intentions, and state changes. These announcements support collaborator discovery. They are semantic, time-sensitive, and often sequentially dependent. The core objective is to build a weakly consistent sequential log system within each interest domain, design a propagation protocol based on digest dissemination and log confirmation, and analyze the coverage-latency and throughput boundaries that allow reliable collaboration in a fully distributed environment.

7

TABLE II M APPING FROM PROTOCOL ADAPTATION MODULES TO TECHNICAL ROUTES .

Module

Core function

Technical route

Section

Collaborator discovery

Large semantic payloads, high propagation redundancy, and sequential dependencies among announcement events Identity forgery, cross-domain misbehavior, and reputation contamination

Digest-commitment-based two-stage bodyless gossip with sequential logs

4.1

BAID verifiable identity binding and MGEigenTrust over multi-layer coupled networks Stackelberg-style automated mechanism design based on semantic-gradient propagation

4.2

Cooperation-network governance Task cooperation execution

Open task constraints, hard-to-model rules, and vulnerability to strategic attacks

4.3

Control plane (lightweight sequential consensus) Publisher Agent

Weak Local View 1. Collect declarations by topic window

Declaration without payload Creates Task Event

Declaration:

2. Order log entries seq / receive time

Batch header

Topic-scoped State

Validators Split

Declaration stream

BAID i, seq l, topic g, op, ttl, sig Payload: text, image, code, ...

3. Publish batch header signed declaration list

Validators process declarations only

ACTIVE

COMPLETE

Data plane (high-throughput semantic dissemination)

Payload Object

WITHDRAW

Publisher Interested peer Relay peer Declaration gossip Payload pull

Pull Declaration gossip topic mesh

Coarse match

Payload pull

Verified match EXPIRED Full match

Payload pulled only by interested peers

Fig. 3. Bodyless-gossip-based semantic announcement propagation and performance-analysis framework. The protocol separates lightweight semantic-digest propagation from on-demand payload retrieval and uses topic-level sequential logs to preserve local ordering semantics.

1) System Model: The network contains N agent nodes. Following the LibP2P design intuition, the baseline overlay is modeled as a random regular graph. For a given interest domain or topic g, the corresponding propagation subgraph is denoted by Gg . An announcement event in an interest domain contains the publisher identity, logical sequence number, topic label, semantic payload, time-to-live, and digital signature:   (ℓ) (ℓ) (ℓ) ai = BAIDi , ℓ, g, xi , ttl, σi . (1) Here the publisher identity is globally unique, bound to the user’s identity, and publicly verifiable; the logical sequence number defines a total order within the publisher’s event stream; the topic label restricts the propagation range; the semantic payload is a natural-language or semi-structured description interpreted by receiving agents; the time-to-live supports automatic expiration; and the signature prevents tampering. Instead of using a global ledger, the system maintains topicbased distributed sequential logs. For each topic, subscribed nodes maintain local event views. The consistency goal is causal consistency: a1 → a2 , a2 ∈ Viewj,g =⇒ a1 ∈ Viewj,g .

(2)

For example, an update event from the same agent must be processed after the corresponding publish event, and revo-

cation events receive the highest propagation priority. This causal-consistency target lowers synchronization cost while preserving the semantic correctness needed by collaboration. 2) Digest-Commitment-Based Propagation and Log Confirmation: If each consensus or propagation message contains all semantic payloads, scalability quickly degrades. Large unstructured payloads also waste bandwidth when many receivers are not semantically interested in the task. We therefore use a two-stage bodyless gossip protocol that decouples discovery from content retrieval. In the push stage, the source node disseminates a fixedlength message digest through a GossipSub-style mesh: (ℓ)

(ℓ)

d(ai ) = BAIDi , ℓ, g, H(xi ), (ℓ)

(ℓ)

Q(Enc(xi )), ttl, σi

(3) .

The digest contains a cryptographic commitment to the payload and a compact semantic representation generated by an encoding model. The hash preserves integrity, while the embedding enables coarse semantic filtering by receivers. In the pull stage, a receiver that is missing the payload and whose local policy judges the digest to be relevant sends a peer-to-peer retrieval request. After receiving the payload, it checks the hash commitment before performing fine-grained semantic interpretation and later negotiation. Large payloads

8

are therefore transmitted only among interested nodes, making the digest-stage bandwidth independent of payload size. Digest propagation alone is insufficient because announcement events may have publish–update–revoke dependencies. The network must also preserve local ordering semantics. Instead of requiring global strong consistency, the proposed design uses topic-level sequential logs and causal consistency. A set of staked validators is periodically selected in each interest domain. Validators collect message digests during a time window, sort them by logical sequence and receive time, and publish a sequential batch header. Ordinary nodes compare the header with their local logs. Missing messages or ordering conflicts trigger targeted synchronization. Since validators process only digests and broadcast fixed-size headers, the control plane is separated from the data plane. 3) Propagation Mechanism and Scalability Analysis: The analysis considers both time dimension, represented by coverage delay, and space dimension, represented by aggregate throughput. Nodes are independently online with probability p. The effective topology at time t contains an edge only when both endpoints are online, and therefore random churn reduces expansion roughly by a factor related to p2 . Let the conductance of the baseline graph be Φ0 . The effective dynamic topology retains sufficient conductance with high probability under suitable online-rate conditions: Φ(Gg (t)) ≥ c p2 Φ0

with high probability,

(4)

where c is a constant determined by the degree distribution and churn model. Digest dissemination can be modeled as a discrete-time susceptible–infected process. Starting from the source node, each infected online node pushes the digest to its online neighbors. The number of rounds needed to reach a target coverage ratio scales logarithmically in the network size under random-regular expansion:   log N + log(1/(1 − ρ)) . (5) Tcover (ρ) = O p2 Φ0 This result formalizes the intuition that gossip spreads information exponentially fast when the effective topology remains sufficiently connected. Throughput can be analyzed by decomposing communication into data and control planes. In the data plane, each event incurs digest-gossip cost and on-demand payloadretrieval cost. In the control plane, validators run a linearcommunication consensus or agreement protocol over digests and fixed-size batch headers. The intended design goal is that consensus overhead depends on the size of the validator set and digest size, rather than on the total payload volume or global network size: Bdata , adig Sdig + ρpull Spay Bcontrol Λcontrol ≤ , κ|Qg |Sdig Λ ≤ min{Λdata , Λcontrol }. Λdata ≤

(6) (7) (8)

Here Bdata and Bcontrol denote data-plane and control-plane bandwidth budgets, Sdig is digest size, Spay is payload size,

adig is the average number of digest transmissions per event, ρpull is the fraction of receivers that retrieve the full payload, Qg is the validator set of topic g, and κ summarizes the communication factor of the chosen digest-level agreement protocol. These formulas are intended as design bounds; measured throughput should be reported after implementationspecific constants are fixed. 4) Simulation Setup and Results: To evaluate the proposed topic-narrowed two-stage discovery mechanism, we construct a simulation following the LibP2P and GossipSub design intuition and compare four discovery paths. Topic/OpenAgent first maps a request declaration into a semantic topic, propagates the declaration inside that topic, and retrieves the full payload on demand after coarse matching. Public broadcast uses the same declaration/payload separation but sends the declaration through a public broadcast path without topic narrowing. Centralized registry maintains provider capabilities in a central directory. Kademlia DHT stores provider records in a distributed hash table and uses lookup to retrieve candidates. The simulation uses 100-node and 200-node settings. Each configuration runs 10 random seeds, and each seed contains 100 requests. The task world is capability-only, the payload size is fixed at 1024 bytes, and the provider limit is set to one. The disturbance conditions include a steady-state setting without churn and two node-churn settings, node_churn_10 and node_churn_20. Under the node-churn protocol, only the requester is protected from churn; the remaining nodes may be randomly set offline. Success is measured under a strict stale-success rule: a request that hits a stale candidate is not counted as successful. Figure 4 summarizes the main trends. In the no-churn setting, all four mechanisms reach a final success rate of 1.000 with stale rate 0. In this stable regime, centralized registry and Kademlia DHT have clear efficiency advantages, confirming that directory or index paths remain fast and cheap when state is fresh. Topic/OpenAgent is not intended to dominate these directory-style methods in steady state. Its value is to reduce the redundant cost of open broadcast while retaining open discovery semantics. In both the 100-node and 200-node settings, the bytes per successful request of Topic/OpenAgent are about one third of public broadcast. The dynamic-churn settings separate the methods more clearly. Under node_churn_10 and node_churn_20, Topic/OpenAgent and public broadcast both maintain final success rate 1.000 and stale rate 0, but public broadcast continues to incur much higher communication cost. Centralized registry and Kademlia DHT begin to degrade because their index or provider records become stale. In the 200-node node_churn_20 case, centralized registry success falls to 0.875, while Kademlia DHT reaches stale rate 0.110. The latency results show the same tradeoff: registry and DHT are faster in a steady state, but churn enlarges their tail latency, with Kademlia DHT approaching a 5 s total p95 latency under the strongest churn setting. Topic/OpenAgent latency increases with scale but remains comparatively stable under churn and stays below public broadcast. These results support a balanced interpretation. There is no single best discovery path across all operating regimes.

9

C. Tail latency under churn

B. Redundant traffic

A. Success under churn

Bytes / success (MB)

Final success

Total p95 latency (ms) 10k

1 10 0.9

1

1k

0.1

0.8

100

0.01 0.7

None

Churn 10%

Churn 20%

Topic / OpenAgent

ic Top

P

ic ubl

y ia istr eml Reg Kad

Public Broadcast

Centralized Registry

None

Churn 10%

Churn 20%

Kademlia DHT

Fig. 4. Discovery simulation trends under churn. Topic/OpenAgent maintains high success while reducing redundant traffic relative to public broadcast; registry and DHT-style paths are efficient in steady state but degrade more strongly under stale state and churn.

Directory-style paths are fast and economical when state is stable; public broadcast is the most open but the most redundant; Topic/OpenAgent occupies the middle ground by preserving open semantic discovery while reducing broadcast redundancy and improving robustness when provider state changes. B. Cooperation-Network Governance: Verifiable Identity and Multi-Layer Dynamic Reputation Unlike passive peer-to-peer nodes, agents in distributed general-purpose agent networks are intelligent and can dynamically modify their behavioral strategies. This creates governance risks including identity forgery, code replacement, crossdomain misbehavior, and responsibility evasion. We propose a two-layer trust system composed of verifiable identity binding and dynamic reputation evolution. The first layer constructs Binding Agent ID (BAID) using cryptographic commitments and zero-knowledge proofs. The second layer models the large-scale network as a multi-layer coupled network and uses MG-EigenTrust to support cross-domain dynamic reputation updates. 1) Verifiable User–Code–Responsibility Binding: The first problem is to make an agent identity more than a public key. In an open agent network, a public key alone proves control of a key pair, but it does not prove which user is responsible for the agent, which code or model configuration was running, or whether the current behavior is generated by the registered agent instance. BAID addresses this problem by binding three elements: the responsible user or organization, the executable agent logic, and the accountability anchor used for later verification. For agent i, we define a binding identity as BAIDi = H(CPi ∥ H(Configi ) ∥ UserIDi ∥ si ) ,

(9)

where CPi is a cryptographic commitment to the agent program, Configi is a configuration digest that may include the model-weight hash, prompt template hash, tool-permission policy, and local safety policy, UserIDi is a user or institutional identity bound through a privacy-preserving KYC

procedure, and si is a random salt. The construction does not reveal private user features or the full agent code. Instead, it creates a public commitment that can be checked later when an agent needs to prove that a task was executed under a registered configuration. Because agent weights, tools, and prompts may change over time, BAID also needs versioned evolution rather than a one(v) time registration. Let Ci denote the commitment of version v. A simple chained update rule is   (v+1) (v) (v+1) (v+1) Ci = H Ci ∥ ∆i ∥ σi , (10) (v+1)

(v+1)

where ∆i is the update digest and σi is the user or operator signature. The chain records the evolution path of the agent without requiring every historical version to be stored on chain. The latest commitment and a compact version root can be publicly anchored, while historical artifacts are retained in distributed storage and retrieved only when an audit or dispute requires them. The identity-binding workflow uses three levels of verification. First, at startup, the agent proves that the loaded code and configuration are consistent with the registered commitment. Second, during normal operation, the agent maintains an append-only behavior log and periodically generates audit evidence that its outputs were produced under a registered configuration. This level can be batched and executed asynchronously so that real-time interaction is not blocked. Third, in dispute or arbitration scenarios, a stronger proof may be required for a specific interaction trace. This tiered design is important because full zero-knowledge proof of every LLM reasoning step is currently too expensive for routine operation; the mechanism therefore uses cryptographic evidence as an accountability substrate, not as a requirement that all reasoning must be proven online. We implemented a prototype overhead test to examine whether such tiered verification is plausible for agent frameworks. The experiment instantiates the proof workflow for three representative agent styles, AutoGPT, ReAct, and SmolAgents, and varies two stress factors: recursive proof depth and terminal payload size. Each configuration is repeated 30

10

Blockchain Commitment and Registry (Trust Root) CP (Code Commitment)

AgentID = agentid : H(CP | H(Config) | UserID | Salt) zkKYC

Step 2: Layered zkVM-based Identity Verification

Step 1: User Binding Registration

Code (CP)

Step 3: Public Verification

Verifier zkVM

Verified web data

User authorization

TLSNotary

IF Verify(Proof) == TRUE User

Fuzzy feature extractor

Recursive proof

Accountability Established

Proof

Fig. 5. BAID identity binding workflow. The mechanism binds local agent code, user responsibility, and on-chain accountability records, and supports proof generation and verification through a zero-knowledge virtual machine.

times, and the figures report the mean with one standard deviation. As shown in Fig. 6, when the recursion depth increases from 1 to 32, terminal proof generation remains roughly in the 39–48 s range rather than increasing monotonically with depth, while verification remains stable at about 67–75 ms. This supports the intended design point of recursive composition: the verifier checks a compressed terminal proof instead of replaying the entire execution history. The payload stress test in Fig. 7 shows a different pattern. When the payload in the last recursive step increases from 1 KB to 16 KB, proof generation grows from about 45–52 s to about 180–190 s, whereas verification remains around 67–69 ms. The result indicates that proof generation is dominated by the amount of data being proved, but external verification remains low-latency for the tested range. In the proposed BAID design, this asymmetry is useful: expensive proof generation can be local, batched, or dispute-triggered, while third-party auditing and accountability checks can stay on the millisecondlevel verification path. 2) MG-EigenTrust over Coupled Topic Layers: After identity binding, the second problem is long-term trust accumulation. A flat reputation score is inadequate because the same node may participate in several topics, and its behavior can differ across domains. A node may be reliable in a lowrisk information-exchange topic but unreliable in a high-value transaction topic. Conversely, a malicious node may accumulate reputation in easy topics and then exploit that reputation in another domain. We therefore model the agent network as a multi-layer topic-coupled graph and define MG-EigenTrust as a dynamic reputation mechanism over this graph. Let V be the set of nodes and G the set of topic groups. The membership of node i is represented by a binary vector mi , where mi,g = 1 means that node i participates in topic g. The node set of topic g is Vg = {i ∈ V : mi,g = 1}. A node that belongs to two or more groups acts as a bridge node and can carry limited reputation feedback between groups. Within each topic g, local interaction outcomes define a normalized trust

(g)

matrix C (g) , where Cij denotes the normalized satisfaction score assigned by node i to node j in topic g. The within-topic reputation iteration follows the EigenTrust form with dynamic pretrust:  ⊤ (r) t(r+1) = (1 − α) C (g) t(r) (11) g g + αpg , (r)

where tg is the reputation vector of topic g at iteration r, α ∈ (r) (0, 1) is the restart probability, and pg is a dynamic pretrust vector. Unlike classical EigenTrust, which usually uses a fixed pretrusted set or a uniform prior, MG-EigenTrust constructs (r) pg from accountability and cross-layer evidence: (r)

p̃i,g = η stakei + (1 − η)

X

(r)

ωgh bi,h ti,h

h̸=g



(r)

× exp −β Vari



,

(12)

(r)

p(r) g =

p̃g

(r)

∥p̃g ∥1

.

Here stakei is the accountability stake or governance weight associated with node i, bi,h indicates whether node i is a valid bridge from topic h, ωgh measures the similarity between (r) topics g and h, and Vari measures cross-topic reputation variance. The exponential penalty discourages “two-faced” behavior in which a node behaves well in some topics but poorly in others. The similarity weight prevents unrelated domains from contaminating one another: when two topics have weak historical correlation, their cross-layer influence is automatically reduced. Reputation updates are divided into epochs. At each epoch, bridge nodes publish compact reputation summaries rather than raw interaction histories. The sequential-log mechanism from Section 4.1 is used to disseminate these summaries with version numbers. A node accepts only summaries whose epoch number is no smaller than its local version and resolves

11

Fig. 6. Effect of recursive proof depth on BAID proof generation and verification overhead. The prototype compares AutoGPT, ReAct, and SmolAgents; error bars show one standard deviation over 30 runs.

Fig. 7. Effect of terminal payload size on BAID proof generation and verification overhead. Larger payloads increase proof generation time, while verification remains nearly stable in the tested range.

conflicts using vector-style version metadata. This allows topic-level reputation to converge toward a consistent snapshot without requiring full-network reputation broadcasting. The governance layer can also be connected to secondary staking and slashing. Nodes that participate in reputation evaluation do not necessarily need a separate asset pool; they may reuse an existing accountability stake. Slashing can be triggered by objective evidence such as double signing, confirmed fraudulent interaction, or repeated cross-layer reputation inconsistency above a threshold. This design raises the cost of attacks from cheap key generation to accountable participation under a user–code–stake binding.

3) Convergence and Complexity: For a fixed pretrust vector pg , the within-topic iteration in Eq. (11) has the same contraction structure as EigenTrust. If C (g) is normalized and α > 0, then the iteration converges to a unique fixed point t⋆g . In the ℓ1 norm, the error satisfies ⋆ r (0) ⋆ ∥t(r) g − tg ∥1 ≤ (1 − α) ∥tg − tg ∥1 .

(13)

Thus the number of iterations required to reach error ϵ is logarithmic in 1/ϵ and controlled mainly by the restart probability α. The graph topology affects the quality of the fixed point, namely how well reputation reflects actual trustworthiness, but the restart term ensures convergence of the iteration itself.

12

When the pretrust vector changes through cross-topic feedback, the global system becomes a coupled nonlinear dynamical system. Let T = (tg )g∈G be the concatenated reputation state. If the dynamic pretrust map P (T ) is Lipschitz continuous with constant LP < 1, then the global update map is a contraction with coefficient at most ρ ≤ (1 − α) + αLP < 1.

(14)

This condition has a direct governance interpretation: the total strength of cross-layer feedback must not exceed the selfstabilizing capacity of each topic layer. In practice, the condition can be encouraged by reducing inter-topic weights ωgh for weakly related domains, increasing the stake component in pg , lowering the sensitivity of the variance penalty, or aggregating too many fine-grained topics into a hierarchy. The communication cost per epoch is dominated by withintopic reputation exchange and bridge-node summaries:   X X O |Eg | + |Bg |dB  , (15) g∈G

g∈G

where Eg is the set of interaction edges inside topic g, Bg is the bridge-node set of topic g, and dB is the average number of bridge links. When each topic has bounded local degree and each node belongs to a small number of topics, this cost scales nearly linearly in the number of active topic memberships and is substantially lower than full-network reputation synchronization. 4) Simulation Setup and Results: We evaluate MGEigenTrust with a query-cycle discrete-event simulation. The experiment is not a Docker deployment, an on-chain contract benchmark, or an end-to-end zkVM system test. Its purpose is to isolate the reputation propagation, cross-topic migration control, and punishment response of the proposed mechanism under a fixed verifiable-evidence interface. Four methods are compared in the main cross-topic experiment. random_no_trust does not maintain a reputation vector and randomly selects a provider from the candidate set. public_eigentrust_pretrusted flattens all topics into a single global EigenTrust matrix with five static honest pretrusted peers. independent_topic_eigentrust_pretrusted runs EigenTrust independently within each topic, again with static honest pretrusted peers, but does not share reputation or punishment evidence across topics. mg_eigentrust_semantic is the proposed method; it uses no static pretrusted peers, constructs dynamic pretrust from floor mass, stake, bridge feedback, topic similarity, and consistency gating, and triggers stake burn/freeze when the verified-evidence interface produces a FRAUD_PROOF. Table III summarizes the comparison. The main configuration contains 100 nodes, 5 topics, 30 random seeds, and 50 epochs. Each topic generates 50 query cycles per epoch, and each query samples 8 candidate providers from the active nodes in the current topic. The five topics are code_generation, code_review_security, devops_tool_execution, data_analysis, and

creative_writing. All methods share the same request sequence, candidate sets, and latent service outcomes; they differ only in provider selection and reputation update. During the attack phase, malicious nodes first build reputation in code_generation through good service and collusive feedback, then migrate to code_review_security and return bad service. Spy/bridge nodes help reputation migrate across topics, Sybil/whitewashing nodes enter the target topic during the attack phase, and cold-start honest nodes are included to evaluate the initial reputation assigned to new honest identities. We first check that the public EigenTrust baseline is not artificially weak. In a classic single-topic maliciouscollective setting without cross-topic migration, spy/bridge nodes, Sybil whitewashing, semantic coupling, cold start, or slashing, public_eigentrust_pretrusted reaches a warmup attack success rate of 0.0391, lower than random_no_trust at 0.1407 and public_eigentrust_uniform at 0.2303. Therefore, the later failure of the public EigenTrust baseline should be interpreted as a cross-topic reputation-contamination effect rather than a weak baseline implementation. The main cross-topic results are summarized in Table IV. Under the disguise-collusion attack, the attack success rate is 0.2176 for random selection, 0.3759 for public EigenTrust, 0.2160 for independent topic EigenTrust, and 0.0291 for MG-EigenTrust. The corresponding burn-only attacker ROI is 3.3523, 6.5174, 3.3209, and -0.8022. If frozen stake is also counted as opportunity cost, the MG-EigenTrust ROI becomes -0.9186. These results indicate that a single global reputation layer can incorrectly carry source-topic reputation into a target topic, even when fixed pretrusted peers exist. Independent topic EigenTrust avoids part of this global contamination, but it lacks the evidence-to-punishment feedback loop. MG-EigenTrust reduces exposure by combining topic-aware migration control with verified-evidence-triggered economic punishment. The detection diagnostics reveal both the strength and the current limitation of the design. MG-EigenTrust detects attackers at rate 0.9509 and has a miss rate of 0.0491 once verified evidence is available, but its false-positive rate is 0.5488 under the current conservative threshold. This should not be read as a deployment-ready calibration result. It shows that the protocol loop can convert verifiable bad-behavior evidence into reputation downgrading and economic penalty, but production use would require threshold tuning, appeal mechanisms, and human or institutional oversight for high-stakes punishment. The control-plane state estimate is also protocol-level rather than a measurement of bandwidth, gas, or end-to-end latency. Public EigenTrust and independent topic EigenTrust synchronize 285 reputation-state entries per epoch in this setting, while MG-EigenTrust exchanges 45 entries per epoch, an 84.21% reduction. This follows from the multi-layer design: the system does not propagate a full flattened reputation vector, but instead exchanges compact bridge summaries and cross-layer weights. The cold-start result is likewise a priorquality result rather than a convergence-speed claim. MGEigenTrust assigns cold-start honest nodes an initial reputation

13

TABLE III M ETHODS FOR EVALUATING VERIFIABLE IDENTITY AND DYNAMIC REPUTATION .

Method

Identity capability

Reputation model

Main limitation

Random/no trust

Static node identity

No reputation; random provider choice

Public EigenTrust

Static node identity

Single global EigenTrust layer with fixed pretrusted peers

Independent topic EigenTrust

Static node identity

Separate EigenTrust instance per topic

MG-EigenTrust

BAID-style accountable identity

Coupled topic-layer reputation with dynamic pretrust and slashing

Cannot accumulate trust from past behavior Vulnerable to cross-topic reputation contamination Limited cold-start support and no evidence-triggered punishment loop Higher implementation and governance cost

0.218

Attack success rate

6.52

0.4 0.3

C. Targeted ablation

B. Attack economics

0.376

0.216

0.2 0.1

0.029

0 m lic ndep. do I Pub Ran

Attacker ROI

Attack success rate

A. Cross-topic attack exposure

MG

6 4

3.35

3.32

2 0 −1 . c dom Publi Indep Ran

-0.80

MG

0.333

0.3 0.2 0.1

Rate

Rate

1

detected

FP

0.5

effective evidence

0.5 attack success

0

te sh G tic l M /o sla /o ga seman w Ful w o w/

Entries per epoch

1 FN

0

0.25

0.50

0.75

1.00

0.029

0.029

0 G te sh tic l M /o sla /o ga seman l u w F w o w/

D. Detection diagnostics E. Evidence coverage response Detected

0.029

F. State and cold start

300

285

285

200 100 0 lic Pub

cold start final rep.45 MG: 0.0156

p.

e Ind

MG

Verified evidence coverage

Fig. 8. Compact MG-EigenTrust simulation results redrawn in vector form. The panels summarize cross-topic attack exposure, burn-only attack ROI, targeted ablations, detection diagnostics, evidence-coverage response, and control-plane state with cold-start reputation. TABLE IV M AIN CROSS - TOPIC DISGUISE - COLLUSION SIMULATION RESULTS .

Method Random/no trust Public EigenTrust Independent topic EigenTrust MG-EigenTrust

of 0.0146, compared with 0.0019 under independent topic EigenTrust, because verified cross-topic evidence can be used as a Bayesian-style prior when an honest node enters a new topic. Panels C–E of Fig. 8 and Table V further separate the con-

Attack success

Burn-only ROI

Control entries/epoch

0.2176 0.3759 0.2160 0.0291

3.3523 6.5174 3.3209 -0.8022

0 285 285 45

tribution of the main design components. Removing slashing increases attack success from 0.0291 to 0.3332 and raises burn-only ROI from -0.8022 to 5.6637. The attacker detection rate also drops from 0.9509 to 0.0916. In contrast, removing the consistency gate or the semantic topic-similarity weight

14

has little effect in this particular attack path: without the gate, attack success is 0.0290 and ROI is -0.7931; without semantic weighting, attack success is 0.0285 and ROI is -0.7948. This does not imply that the gate or semantic weight are unnecessary. The tested migration path from code generation to code review and security is semantically close, and the dominant effect is produced by verified evidence and slashing. A lower-related migration, such as creative writing to code review and security, would better isolate the value of semantic weighting; a setting with inconsistent cross-domain behavior but low immediate evidence coverage would better test the gate. The evidence-coverage sweep varies only the probability that a bad service in the target topic produces a verified FRAUD_PROOF; the query sequence, candidate sets, and service outcomes are held fixed. At coverage 0.25, full MGEigenTrust still lowers attack success to 0.0874, well below the no-slashing variant at 0.3332, but the burn-only ROI remains slightly positive at 0.0946. When coverage rises to 0.50, burnonly ROI falls to -0.5219; at coverage 1.00 it falls further to -0.8022. Thus, exposure suppression does not require perfect evidence coverage, while economic suppression strengthens as evidence coverage improves. Overall, the simulation supports four conclusions. First, public EigenTrust remains effective in the classic singlelayer malicious-collective setting, and its weakness in the main experiment comes from cross-topic reputation arbitrage. Second, MG-EigenTrust substantially reduces attack success under cross-topic disguise-collusion and makes burn-only ROI negative once evidence coverage reaches 0.50. Third, the largest gain in the current setting comes from the verifiedevidence-triggered slashing loop; the gate and semantic weight are structural safeguards whose value should be stressed under lower-related or lower-evidence migration settings. Fourth, the results are mechanism-level simulations. Real evidence generation, on-chain execution, zkVM proof production under full workloads, and deployment-level network cost remain separate system experiments. C. Task Cooperation Execution: Automated Mechanism Design Based on Semantic Gradients This section addresses cooperation-rule generation for open tasks. Unlike conventional automated mechanism design, which usually assumes finite action spaces and explicit utility functions, tasks in distributed agent networks often come with natural-language or semi-structured constraints. Agents may also actively discover loopholes and generate new attack strategies. Mechanism design must therefore operate over both an open semantic rule space and an evolving strategy space. 1) Reputation–Stake-Coupled Game Model: Consider a network with n agent nodes. The state of node i is described by a reputation score ri , obtained from the dynamic reputation mechanism in Section 4.2, and a stake value qi , representing the amount of accountability collateral locked for the current task. To couple reputation and responsibility, the mechanism requires dqmin (r) ≤ 0. (16) qi ≥ qmin (ri ), dr

Thus high-reputation nodes may receive lower stake requirements, while low-reputation or new nodes must provide stronger collateral. To prevent an attacker from accumulating reputation in advance and then attacking with low stake, the minimum stake is also constrained by the maximum gain from a single attack: λslash qmin (ri ) ≥ Gmax ,

(17)

where Gmax is an upper bound on one-shot attack gain and λslash is the effective slashing ratio. This condition ensures that the expected punishment can cover the maximum immediate benefit of deviation. In an infinitely repeated cooperation process, node i adopts strategy πi under mechanism M . Its expected utility is "∞ # X t t Ui (πi , π−i ; M ) = E δ ui , (18) t=0

where δ ∈ (0, 1) is a discount factor. A single-period payoff may include task reward, opportunity cost of stake, reputation gain or loss, and slashing under confirmed misbehavior:
uti = Rit (at ; M ) − cq qit + vr rit+1 − rit (19) − Itbad Si (qit , rit ; M ). The mechanism M is not only a numerical parameter vector. It is a structured rule text that may contain admission conditions, stake requirements, reward allocation, responsibility division, violation penalties, appeal procedures, execution ordering, and task-specific constraints. The design goal is to find a mechanism M that satisfies three requirements. First, incentive compatibility (IC) means that honest participation is a Bayesian-Nash-equilibrium-like response under the modeled information structure. Second, individual rationality (IR) means that honest participation yields expected utility no lower than the reservation utility of not participating. Third, robustness means that system loss remains small when the adversary chooses a strong deviation strategy. 2) Two-Timescale Stackelberg Design: The proposed design system contains four components. The mechanismgeneration agent (MG) produces a structured mechanism text M (k) at slow iteration k. The strategy-exploration agent (SE) observes the current mechanism and searches for loopholes by chain-of-thought reasoning, attack simulation, and adversarial strategy refinement. The multi-agent simulation environment executes candidate strategies and reports system loss, IC violation, and IR violation. Finally, the optimizer agent reads the simulation traces and produces semantic attribution feedback for revising the mechanism. This forms a two-timescale Stackelberg loop. At the lower level, SE approximates the strongest attack against the current mechanism: ϕ⋆ (M ) ∈ arg max L(M, ϕ), ϕ∈Φ

(20)

where ϕ denotes an attack or deviation strategy and L(M, ϕ) is the system loss induced by that strategy. SE is not restricted

15

TABLE V TARGETED ABLATION AND EVIDENCE - COVERAGE SENSITIVITY.

Variant Full MG-EigenTrust Without slashing Without consistency gate Without semantic weight Evidence coverage 0.25 Evidence coverage 0.50 Evidence coverage 1.00

Input Xk = task + Nt + public profiles

Attack success

Burn-only ROI

Attacker detection

0.0291 0.3332 0.0290 0.0285 0.0874 – 0.0291

-0.8022 5.6637 -0.7931 -0.7948 0.0946 -0.5219 -0.8022

0.9509 0.0916 – – – – 0.9509

slow timescale (k): mechanism update

fast timescale (j): best response search

Mechanism-generation agent (MG)

Strategy-exploration agent (SE)

Xk

Mk

Mk = MG ( Xk , Ak , θk )

φ{k,j} → φ{k,j+1} → ... → φ{k,*} under fixed Mk

Repair context: g(Mk) A{k+}

，

Candidate attack φ{k,j}

Mk

Simulation results τ{k,j}, ℓ{k,j}

Best response φ{k,*}

Multi-agent simulation environment Sim ( Mk , φ {k,*} ; Ak ) loss vector ℓk

Successful φ{k,*}

IC/IR violation

，τk, ℓk

Ak

trace τk

Successful φ{k,*}

Semantic attribution optimizer: repair brief generation

，τk, ℓk

Attack strategy archive Ak successful attack traces

mechanism repair brief g(Mk) rule defects + parameter directions → structure repair — text edits

attack-path attribution g(φk)

→ parameter repair — zeroth-order tuning

why φ{k,*} succeeded

regression test suite historical losses

A{k+} = Ak

∪ (φ{k,*}, τk, ℓk)

Historical attacks A{k+}

Repair brief g(Mk)

Fig. 9. Automated mechanism design for open agent collaboration. Mechanism-generation agents and strategy-exploration agents interact in a Stackelberg-style loop, while semantic attribution feedback guides rule revision.

to a fixed attack template. It searches the rule text for ambiguity, boundary cases, execution loopholes, and inconsistent constraints. At the upper level, MG revises the mechanism after SE has sufficiently explored the current rule space: min L(M, ϕ⋆ (M )) + λIC VIC (M ) + λIR VIR (M ), M

(21)

where VIC and VIR measure IC and IR violations, and λIC and λIR are penalty coefficients. Time-scale separation matters: the upper-level update should be based on an approximate best response from the lower level rather than on a weak or accidental attack sample. 3) Semantic Attribution as a Gradient Analogue: The term semantic gradient is used here as a functional analogy, not as a claim that natural-language rules are differentiable in the classical sense. In differentiable optimization, gradients are obtained by back-propagating loss through a computation graph. In open semantic mechanism design, the system instead builds a semantic computation graph whose nodes include the mechanism text, attack strategy, execution trace, violation

evidence, and system loss. The forward pass is simulation and evaluation; the backward pass is semantic attribution. Let A denote the attack-strategy archive and τ denote simulation traces. The optimizer first generates strategy-level attribution: gϕ = LLM Optϕ (L, ϕ⋆ , τ, A) ,

(22)

which explains why a strategy succeeded, what rule ambiguity it exploited, and which conditions made the attack feasible. It then propagates this attribution to the mechanism level: gM = LLM OptM (gϕ , M, τ, A) ,

(23)

which identifies concrete rule defects and proposes executable edits. The next mechanism is obtained by a text-editing operator:   M (k+1) = Edit M (k) , gM . (24) If the mechanism also contains numerical parameters such as slashing ratio, cooling period, or reward coefficient, those parameters can be optimized separately by zeroth-order or finitedifference methods. This hybrid structure–parameter strategy

16

uses LLMs for non-structured rule logic and conventional numerical optimization for continuous parameters. To avoid cyclic repair, the system maintains an attackstrategy archive. When a new mechanism is proposed, it must pass regression tests against historical successful attacks: L(M (k+1) , ϕ) ≤ L(M (k) , ϕ) + ϵ,

∀ϕ ∈ A.

(25)

This acceptance condition does not prove global optimality. It provides a practical monotonicity check over the observed attack set, reducing the risk that repairing one loophole reopens a previous one. 4) Evaluation Protocol: Representative evaluation scenarios include distributed crowdsourcing, collaborative reasoning, and resource-exchange negotiation. In distributed crowdsourcing, multiple agents divide subtasks, submit results, and receive rewards according to the mechanism. In collaborative reasoning, agents share intermediate retrieval, analysis, and verification results. In resource exchange, nodes negotiate resources, prices, and delivery responsibilities. The baselines include manually designed static rules, singlelevel reinforcement-learning-based rule tuning, and the proposed semantic-attribution Stackelberg loop. Table VI summarizes the comparison. The evaluation should therefore be interpreted as a protocol for future empirical study rather than as a completed benchmark. The relevant metrics include IC violation, IR violation, system loss under adversarial strategies, convergence iterations, attack-regression pass rate, and interpretability of generated rule revisions. A complete empirical study would report the initial mechanism, discovered attack traces, semantic feedback from the optimizer, and before–after changes in IC, IR, and robustness. V. C ONCLUSION This paper studies distributed general-purpose agent networks as an infrastructure problem: how to connect autonomous agents so that they can discover collaborators, establish accountable trust, and execute open tasks without relying on a single centralized platform. The central argument is that such networks require more than a peer-to-peer transport layer and more than an application-level agent protocol. They require a protocol adaptation layer that translates task semantics into network actions and feeds collaboration outcomes back into later discovery, trust, and mechanism decisions. Based on this view, the paper proposes a three-part architecture and develops three mechanism routes. For collaborator discovery, semantic announcements are represented as digestcommitment events and propagated through two-stage bodyless gossip with topic-level sequential logs. For cooperation governance, BAID binds user responsibility, agent code, and accountability anchors, while MG-EigenTrust models reputation over coupled topic layers to mitigate cross-domain abuse and cold-start problems. For task execution, a semanticgradient Stackelberg loop uses mechanism-generation agents, strategy-exploration agents, simulation traces, and semantic attribution feedback to revise cooperation rules in open rule spaces.

The present manuscript should be read as a system and mechanism-design study with preliminary prototype and simulation evidence, rather than as a full deployment report. The next stage of system evaluation should extend the current evidence to large-scale trace validation, variable-payload and topic-noise behavior, verifiable-evidence generation cost, punishment-threshold calibration, and the empirical quality of semantic attribution in mechanism repair. Together, the architecture, mechanisms, prototype measurements, and simulations provide a coherent technical route for turning isolated general-purpose agents into an open, verifiable, and scalable cooperation network. R EFERENCES [1] T. Guo et al., “Large language model based multi-agents: A survey of progress and challenges,” arXiv preprint arXiv:2402.01680, 2024. [2] T. R. Sumers, S. Yao, K. Narasimhan, and T. L. Griffiths, “Cognitive architectures for language agents,” arXiv preprint arXiv:2309.02427, 2023. [3] ARK Investment Management LLC, “Big ideas 2026,” ARK Invest, 2026. [Online]. Available: https://ark-invest.com/big-ideas-2026 [4] M. Basu, “Openclaw ai chatbots are running amok – these scientists are listening in,” Nature, vol. 650, pp. 533–534, 2026. [5] W. Chen, Z. You, R. Li et al., “Internet of agents: Weaving a web of heterogeneous agents for collaborative intelligence,” International Conference on Learning Representations, 2025. [6] Y. Wang, S. Guo, Y. Pan et al., “Internet of agents: Fundamentals, applications, and challenges,” IEEE Transactions on Cognitive Communications and Networking, 2025. [7] Y. Yang, H. Chai, S. Shao et al., “Agentnet: Decentralized evolutionary coordination for llm-based multi-agent systems,” in Advances in Neural Information Processing Systems, 2025. [8] State Council of the People’s Republic of China, “Guiding opinions on deeply implementing the “artificial intelligence plus” action,” Guo Fa [2025] No. 11, Beijing, China, 2025. [9] R. Karp, C. Schindelhauer, S. Shenker, and B. Vocking, “Randomized rumor spreading,” in Proceedings of the IEEE Symposium on Foundations of Computer Science, 2000, pp. 565–574. [10] S. Voulgaris, D. Gavidia, and M. van Steen, “Cyclon: Inexpensive membership management for unstructured p2p overlays,” Journal of Network and Systems Management, vol. 13, no. 2, pp. 197–217, 2005. [11] M. Jelasity, S. Voulgaris, R. Guerraoui, A.-M. Kermarrec, and M. van Steen, “Gossip-based peer sampling,” ACM Transactions on Computer Systems, vol. 25, no. 3, 2007. [12] D. Vyzovitis, Y. Napora, D. McCormick et al., “Gossipsub: Attack-resilient message propagation in the filecoin and eth2.0 networks,” arXiv preprint arXiv:2007.02754, 2020. [Online]. Available: https://arxiv.org/abs/2007.02754 [13] M. U. Farooq and D. Kaiser, “Preamble and imreceiving for improved large message handling in libp2p gossipsub,” arXiv preprint arXiv:2505.17337, 2025. [Online]. Available: https://arxiv.org/abs/2505. 17337 [14] M. Corallo, “Bip152: Compact block relay,” Bitcoin Improvement Proposal, 2016. [Online]. Available: https://bips.dev/152 [15] C. Zhao, S. Zhang, T. Wang et al., “Bodyless block propagation: Tps fully scalable blockchain with pre-validation,” Future Generation Computer Systems, vol. 163, p. 107516, 2025. [16] T. Keniagin, E. Yaakobi, and O. Rottenstreich, “Certainsync: Rateless set reconciliation with certainty,” Proceedings of the ACM on Measurement and Analysis of Computing Systems, vol. 9, no. 2, pp. 1–33, 2025. [17] C. Yang, K. W. Chin, J. Wang et al., “Scaling blockchains with error correction codes: A survey on coded blockchains,” ACM Computing Surveys, vol. 56, no. 6, pp. 1–33, 2024. [18] L. Lamport, “Time, clocks, and the ordering of events in a distributed system,” Communications of the ACM, vol. 21, no. 7, pp. 558–565, 1978. [19] C. J. Fidge, “Timestamps in message-passing systems that preserve the partial ordering,” in Proceedings of the 11th Australian Computer Science Conference, 1988, pp. 56–66. [20] M. Shapiro, N. Preguica, C. Baquero, and M. Zawirski, “Conflict-free replicated data types,” Stabilization, Safety, and Security of Distributed Systems, pp. 386–400, 2011.

17

TABLE VI BASELINES FOR EVALUATING AUTOMATED COOPERATION - MECHANISM DESIGN .

Method

Rule source

Optimization mode

Main limitation

Manual mechanism

Human-written rules

Static design

Single-level RL mechanism

Strategy training

Numerical optimization

Proposed semantic-gradient loop

LLM generation and editing

Semantic attribution + Stackelberg search

Difficult to adapt to new attacks Weak interpretability and limited handling of textual rules Depends on simulation fidelity and attribution quality

[21] M. Castro and B. Liskov, “Practical byzantine fault tolerance,” in Proceedings of the Symposium on Operating Systems Design and Implementation, 1999, pp. 173–186. [22] M. Yin, D. Malkhi, M. K. Reiter et al., “Hotstuff: Bft consensus with linearity and responsiveness,” in Proceedings of the ACM Symposium on Principles of Distributed Computing, 2019, pp. 347–356. [23] Google Developers Blog, “Announcing the agent2agent protocol (a2a),” 2025. [Online]. Available: https://developers.googleblog.com/en/ a2a-a-new-era-of-agent-interoperability [24] K. Huang and V. S. Narajala, “Agent name service (ans): A universal directory for secure ai agent discovery and interoperability,” arXiv preprint arXiv:2505.10609, 2025. [Online]. Available: https: //arxiv.org/abs/2505.10609 [25] R. J. Georgio, C. Forder, S. Deb et al., “The coral protocol: Open infrastructure connecting the internet of agents,” arXiv preprint arXiv:2505.00749, 2025. [Online]. Available: https://arxiv.org/abs/2505. 00749 [26] J. R. Douceur, “The sybil attack,” in Proceedings of the International Workshop on Peer-to-Peer Systems, 2002, pp. 251–260. [27] A. Jøsang, R. Ismail, and C. Boyd, “A survey of trust and reputation systems for online service provision,” Decision Support Systems, vol. 43, no. 2, pp. 618–644, 2007. [28] J. Sabater and C. Sierra, “Review on computational trust and reputation models,” Artificial Intelligence Review, vol. 24, no. 1, pp. 33–60, 2005. [29] S. D. Kamvar, M. T. Schlosser, and H. Garcia-Molina, “The eigentrust algorithm for reputation management in p2p networks,” in Proceedings of the International Conference on World Wide Web, 2003, pp. 640–651. [30] R. Zhou and K. Hwang, “Powertrust: A robust and scalable reputation system for trusted peer-to-peer computing,” IEEE Transactions on Parallel and Distributed Systems, vol. 18, no. 4, pp. 460–473, 2007. [31] T. South, S. Nagabhushanaradhya, A. Dissanayaka et al., “Identity management for agentic ai: The new frontier of authorization, authentication, and security for an ai agent world,” arXiv preprint arXiv:2510.25819, 2025. [Online]. Available: https://arxiv.org/abs/2510. 25819 [32] A. Chan, N. Kolt, P. Wills et al., “Ids for ai systems,” arXiv preprint arXiv:2406.12137, 2024. [Online]. Available: https://arxiv.org/abs/2406. 12137 [33] R. Raskar, P. Chari, J. Zinky et al., “Beyond dns: Unlocking the internet of ai agents via the nanda index and verified agentfacts,” arXiv preprint arXiv:2507.14263, 2025. [Online]. Available: https://arxiv.org/abs/2507.14263 [34] R. Ranjan, S. Gupta, and S. N. Singh, “Loka protocol: A decentralized framework for trustworthy and ethical ai agent ecosystems,” arXiv preprint arXiv:2504.10915, 2025. [Online]. Available: https://arxiv.org/ abs/2504.10915 [35] M. De Rossi, D. Crapis, J. Ellis et al., “Erc-8004: Trustless agents,” Ethereum Improvement Proposal, 2025. [Online]. Available: https://eips.ethereum.org/EIPS/eip-8004 [36] S. Ren, W. Fu, X. Zou et al., “Reputation as a solution to cooperation collapse in llm-based mass,” arXiv preprint arXiv:2505.05029, 2025. [Online]. Available: https://arxiv.org/abs/2505.05029 [37] T. Ren, X. Yao, Y. Li et al., “Bottom-up reputation promotes cooperation with multi-agent reinforcement learning,” in Proceedings of the International Conference on Autonomous Agents and Multiagent Systems, 2025, pp. 1745–1753. [38] S. Zhu, Y. Lin, S. Kaistha et al., “Talk, judge, cooperate: Gossip-driven indirect reciprocity in self-interested llm agents,” arXiv preprint arXiv:2602.07777, 2026. [Online]. Available: https: //arxiv.org/abs/2602.07777

[39] Y. Lou, H. Hu, S. Ma et al., “Drf: Llm-agent dynamic reputation filtering framework,” in Proceedings of the International Conference on Neural Information Processing, 2025, pp. 127–141. [40] V. Conitzer and T. Sandholm, “Complexity of mechanism design,” Proceedings of the Conference on Uncertainty in Artificial Intelligence, pp. 103–110, 2002. [41] T. Sandholm, “Automated mechanism design: A new application area for search algorithms,” in Proceedings of the International Joint Conference on Artificial Intelligence, 2003, pp. 90–97. [42] M. J. Curry, Z. Fan, Y. Jiang et al., “Automated mechanism design: A survey,” ACM SIGecom Exchanges, vol. 22, no. 2, pp. 102–120, 2025. [43] P. Duetting, Z. Feng, H. Narasimhan, D. C. Parkes, and S. S. Ravindranath, “Optimal auctions through deep learning,” in Proceedings of the International Conference on Machine Learning, 2019, pp. 1706–1715. [44] X. Li, Z. Wang, B. Zhu et al., “Deep automated mechanism design for integrating ad auction and allocation in feed,” in Proceedings of the International ACM SIGIR Conference on Research and Development in Information Retrieval, 2024, pp. 1211–1220. [45] X. Cao, Y. Yang, J. Li et al., “Edge-awarenet: A graph neural approach for efficient multi-item auction mechanism design,” Knowledge-Based Systems, vol. 313, p. 115097, 2025. [46] J. Hao, K. Shao, K. Li et al., “Research and applications of game intelligence,” Scientia Sinica Informationis, vol. 53, no. 10, pp. 1892– 1923, 2023, in Chinese. [47] P. Huang, M. Xu, F. Fang et al., “Robust reinforcement learning as a stackelberg game via adaptively-regularized adversarial training,” in Proceedings of the International Joint Conference on Artificial Intelligence, 2022, pp. 3099–3106. [48] H. Sun, Y. Wu, Y. Cheng et al., “Game theory meets large language models: A systematic survey,” in Proceedings of the International Joint Conference on Artificial Intelligence, 2025, pp. 10 669–10 677. [49] M. Yuksekgonul, F. Bianchi, J. Boen et al., “Optimizing generative ai by backpropagating language model feedback,” Nature, vol. 639, pp. 609–616, 2025. [50] J. S. Park, J. O’Brien, C. J. Cai, M. R. Morris, P. Liang, and M. S. Bernstein, “Generative agents: Interactive simulacra of human behavior,” in Proceedings of the ACM Symposium on User Interface Software and Technology, 2023, pp. 1–22.