Multi-Agent Architectures

What can a blockchain anchor actually prove about records?

Blockchain anchors provide tamper evidence, but the note explores what properties they cannot guarantee—like whether events occurred in the right order, were captured accurately, or were authorized to be anchored in the first place.

Can brain structure guide how we design intelligent agents?

Does mapping agent capabilities onto human brain functions provide a useful organizing framework for understanding and comparing different agent architectures? This matters because agents need a shared vocabulary to advance beyond one-off designs.

Does chain-level inspection close the cross-skill attack blind spot?

ChainGuard inspects skill chains rather than individual skills, reducing attack success to 22.5%. The question is whether this chain-level approach can fully eliminate the vulnerability window that adversarial composition exploits.

Can multi-agent defenses close attack paths completely?

Research organizes defenses by five contract components and identifies path closure as a key unsolved challenge. The question asks whether current defenses can fully block attack paths or only narrow them.

Can forwarded content trick high-privilege agents into misusing their authority?

When low-privilege agents retrieve and forward information to higher-privilege agents, does the content itself create conditions where the privileged agent's legitimate authority gets misdirected? This matters because role separation in multi-agent systems assumes the hierarchy protects against misuse.

Does a multi-agent setting automatically signal a security effect?

Explores whether observing a failure in multi-agent systems proves the failure is genuinely multi-agent in nature. The distinction matters for correctly interpreting security research and avoiding false attributions.

How much agent behavior actually gets human review?

Agents may execute thousands of actions while humans review only a handful of decisions. This coverage gap raises a critical question: what portion of the behavior that determines safety remains unexamined?

What scope should a validator's statistical guarantee actually state?

When an LLM validator is claimed to catch N percent of problems, that number rests on an unstated scope—pointwise, domain-conditional, average-case, or uniform. Why does this distinction matter for safety claims?

Can we predict how agent communities shift opinions?

Explores whether collective behavior in language-model agent communities follows predictable patterns as agents revise beliefs through interaction, and what mathematical model could capture those patterns.

Can skill scanners miss attacks hidden across multiple skills?

Current security scanners check each skill individually for malicious behavior. This explores whether attackers can split a harmful objective across multiple benign-looking skills that pass inspection separately but form a dangerous chain when composed together.

Can stateless checks ever catch sequence-level constraint violations?

Explores whether per-action guardrails can express constraints that depend on history, and what structural limits prevent stateless checks from reasoning about composed behavior over time.

Can agent protocols be efficient, versatile, and portable simultaneously?

Agent communication protocols seem to force tradeoffs between efficiency, versatility, and portability. What design choices create these constraints, and can they be overcome?

Should coordination protocols wrap existing systems or replace them?

Explores whether new agent coordination standards should integrate with existing protocols through bridging, or establish themselves as replacements. This shapes which standards survive and how quickly ecosystems can adopt them.

Can step-by-step approval miss harmful behavior patterns?

If each action an agent takes passes its individual safety check, can the overall sequence still violate system constraints? This matters because per-action inspection may miss harms that emerge only across time or composition.

Can external anchoring detect tampering in agentic process logs?

Conventional logs record what happened but not whether records changed afterward. This asks whether external anchoring can add tamper evidence to agentic system traces in ways that logging alone cannot.

Why don't AI agents develop social structure at scale?

When millions of LLM agents interact continuously on a social platform, do they form collective norms and influence hierarchies like human societies? This tests whether scale and interaction density alone drive socialization.

Will inference compute soon exceed training compute demand?

As AI agents proliferate and test-time compute becomes mainstream, will inference—not training—become the dominant compute workload? This matters because it would invert how we think about AI system economics and design priorities.

Does anchored evidence actually enable regulatory compliance or just readiness?

The paper proposes blockchain-anchored evidence for five governance uses under three EU regimes, but leaves unclear whether the evidence layer closes the gap between audit readiness and actual compliance. What architectural controls remain unmapped?

Can commitments protect sensitive agent data while enabling verification?

This explores whether cryptographic commitments can separate verifiability from disclosure, keeping sensitive agent traces and reasoning artifacts off-chain while still allowing stakeholders to verify what occurred.

Does agent capability matter more than coordination infrastructure?

As AI agents take on economic and social roles, what actually limits their effectiveness: the raw reasoning power of the model itself, or the systems that let them coordinate, stay accountable, and leave evidence of their actions?

What must auditors reconstruct to verify agentic workflows?

Traditional audits ask what humans decided or systems logged. But agentic workflows involve multiple agents, tools, and approval chains. What evidence do auditors actually need to collect and cross-check to verify these complex interactions?

Can true reports together mislead a group?

The SoK claims truthful reports can steer groups toward false beliefs, but provides no mechanism or citation. This explores whether honest inputs combined honestly can produce collective error, and what processes might explain it.

Can semantic capability vectors replace manual agent routing?

Explores whether embedding agent capabilities in high-dimensional space and matching them semantically can eliminate brittle, manually-maintained topic-based routing in multi-agent systems.

Does model efficiency matter more than peak capability for real work?

When AI agents handle multi-step tasks that invoke the model dozens of times, do small per-call cost and latency differences compound enough to reshape which models deliver practical value?

Can validator consensus guarantee both agreement and semantic correctness?

Explores whether agreement reached by protocol-compliant validators also ensures the agreed outcome is semantically valid, and what assumptions would be needed to make that guarantee hold.

Can digital contexts persist as identity after someone dies?

Explores whether the traces people leave in digital systems—conversations, decisions, interactions—can form a lasting identity that persists and continues to interact with the world through AI, even after the person departs.

Can agents adapt without pausing service to users?

Can deployed LLM agents continuously improve their capabilities while serving users without interruption? This explores whether fast behavioral updates and slow policy learning can coexist across different timescales.

Can a quorum of validators really provide independent judgment?

If multiple validators share training data, prompts, evidence sources, or infrastructure, their agreement may reflect shared causes rather than independent confirmation. This could make quorum-based systems less reliable than they appear.

Can inspecting generated workflows catch planning-time attacks?

Does examining a workflow after it's created catch attacks that corrupt the planning signals upstream? This matters because if contamination enters earlier, downstream inspection might miss malicious intent laundered into legitimate-looking structure.

Why do multi-agent systems fail to coordinate at scale?

Explores how LLM agents struggle to synchronize strategy timing and validate information when coordinating across larger networks, revealing fundamental limits in distributed reasoning.

How does SafeFlow track sensitivity through agent rewrites?

SafeFlow labels sensitive requests and propagates them through agent collaboration graphs, but the excerpt leaves unclear whether the taint tracks at the request level (coarse, survives rewrites) or content level (fine-grained, vulnerable to paraphrase). This distinction determines how well the system catches exfiltration without false alarms.

Can a black box see communication through unauthorized channels?

The black box architecture records sanctioned agent communications, but the paper doesn't specify where capture occurs or whether it detects traffic outside authorized channels. This matters for evaluating whether the system would have recorded the incident that motivated it.

Does ChainGuard's defense hold against adaptive attacks?

ChainGuard reduced attack success to 22.5%, but the paper doesn't report whether the attacker refined its strategy specifically against ChainGuard's feedback, as it did against other scanners. Testing against an unadapted attacker gives defenders an unfair advantage.

Does model diversity actually reduce validator agreement failures?

Using different AI model families is the cheapest way to reduce correlated errors among validators. But shared prompts, evidence sources, and infrastructure may keep their mistakes aligned regardless of model choice.

Can individual components pass safety checks if the system still fails?

Explores whether local validation at each step—alignment checks, protocol compliance, plausibility tests—can guarantee safety when components are composed into larger workflows. Why the gap between component-level assurance and system-level outcomes matters for AI safety.

Who actually bears the risk when multi-agent workflows fail?

When AI agents delegate tasks across organizations, the people harmed by failures may never see the workflow or author the prompts. This explores whether current oversight designs protect the right parties.

Can multi-agent RL handle cooperation without observable signals?

This research explores whether standard MARL algorithms can solve tasks where agents must cooperate through acts that leave no trace—like leaving a key for others without knowing if they'll use it. The question matters because real cooperation often happens invisibly.

Who decides which agent communications get anchored?

The paper commits to anchoring 'selected' communications but never specifies who makes that selection, by what criteria, or how missed selections would be detected. This matters because the selector controls what evidence can ever exist.

Where do user values break down in agent supervision?

When people use AI agents, their values tend to align with delivered outputs but conflict during oversight. What explains this gap, and what does it reveal about delegation design?

Can a poisoned validator still approve unsafe actions?

When a review agent reads from the same compromised memory as the retrieval agent, does it retain the authority to block unsafe actions? This tests whether a single approval point can serve as a meaningful safeguard.

Can agents learn cooperation by adapting to diverse partners?

Explores whether sequence model agents can develop mutual cooperation strategies through in-context learning when trained against varied co-players, without explicit cooperation mechanisms or hardcoded assumptions.

What makes delegation work beyond just splitting tasks?

Delegation is more than task decomposition. What dimensions of a task—like verifiability, reversibility, and subjectivity—determine whether an agent can safely and effectively handle it?

Can agents share thoughts without converting them to text?

Can multi-agent systems exchange information through continuous hidden representations instead of language? This matters because text serialization loses information and slows inference.

Can LLM agent groups reliably reach consensus together?

Tests whether multi-agent LLM systems can achieve valid agreement in Byzantine consensus games, even under benign conditions with no conflicting preferences over outcomes.

Why do single-message classifiers miss cross-agent harms?

Can prompt classifiers detect malicious intent when harm emerges only across multiple agent interactions? The question reframes security from checking individual messages to tracking how content flows and transforms through a multi-agent system.

Does MCP handle multi-turn agent coordination without application code?

MCP is lightweight for inter-agent coordination, but whether it avoids pushing state management into application code remains unclear. This matters because where coordination logic lives affects implementation burden and system complexity.

How do failures cross boundaries between multiple agents?

Explores four distinct mechanisms—messages, shared state, aggregation, and delegation—that allow a failure or attack originating in one principal to propagate through multi-agent systems. Understanding these pathways is essential for designing agent interactions that contain rather than amplify risk.

Does confidence drive influence in multi-agent deliberation systems?

When multiple AI agents deliberate together, does the agent who sounds most confident gain the most influence over the group's final answer? Understanding this matters because it determines whether consensus reflects actual competence or just persuasive miscalibration.

Can prompts alone reshape multi-agent workflows without system access?

Explores whether attackers can compromise planner-executor multi-agent systems by manipulating the planning prompt itself, without touching agents, tools, or infrastructure. Matters because it identifies a previously overlooked attack surface that existing defenses don't address.

Does token spending drive multi-agent research performance?

Multi-agent systems outperform single agents substantially, but what actually accounts for that improvement? Is it intelligent coordination or simply spending more tokens on the same task?

When does adding more agents actually help systems?

Multi-agent systems often fail in practice, but the reasons remain unclear. This research investigates whether coordination overhead, task properties, or system architecture determine when agents improve or degrade performance.

What blocks rigorous security evaluation of multi-agent systems?

Multi-agent security evaluation faces four major gaps: isolating interaction effects from architecture, designing metrics that diagnose root causes rather than just outcomes, reusing evaluation methods across different system designs, and testing open-system operation. Understanding these gaps is essential for building trustworthy multi-agent systems.

Why do multi-agent LLM systems fail more than expected?

This research asks what specific failure modes cause multi-agent systems to underperform despite their promise. Understanding these failure patterns is essential for building more reliable collaborative AI systems.

Can transcript alone tell whether a reflection helps?

Explores whether memory-admission gates that only read generated text can reliably improve team performance across different external situations. Matters because most reflection systems lack grounding in actual outcomes.

Why do protocol-based tool integrations fail in production workflows?

Explores whether standardized tool protocols like MCP introduce non-determinism that undermines agent reliability, and what causes ambiguous tool selection in production systems.

Can AI agents cooperate without explicit incentives or enforcement?

Do foundation model agents that model themselves as part of their environment cooperate in social dilemmas where classical game theory predicts defection? This tests whether self-awareness changes rational strategic behavior.

Can a separate trained curator improve skill libraries better than frozen agents?

Explores whether decoupling skill curation from agent execution enables better long-term learning of what skills to keep, delete, or refine. Matters because manual curation doesn't scale and heuristic approaches lack feedback.

Can individually safe agents fail when working together?

When multiple AI agents interact—sharing information, state, and authority—do failures emerge that local safety checks alone cannot catch? This matters because system-level safety depends on understanding how principals interact.

Can attackers evade skill scanners by refining individual skills?

Explores whether feedback from per-skill scanners can be weaponized to make malicious multi-skill chains undetectable. Matters because it tests a core assumption of skill-level defense mechanisms.

How do agent security layers connect across the stack?

Agent security is often treated as separate challenges at each layer—inputs, delegation, routing, containment. But do defenses at one layer fail if others aren't secured? This explores whether securing agents requires end-to-end integration.

Can small language models handle most agent tasks?

Explores whether smaller, cheaper models are actually sufficient for the repetitive, scoped work that dominates deployed agent systems, rather than relying on large models by default.

Can semantic labels on requests prevent malicious propagation through agent networks?

SafeFlow explores whether attaching structured intent labels to root requests and propagating them through multi-agent collaboration graphs can block malicious information flow by restoring context that task fragmentation strips away.

Can language models discover new expertise through collaborative weight search?

Can model experts be composed through particle swarm optimization in weight space without training? This explores whether collaborative search can discover capabilities that no individual expert possesses.

Can task decomposition hide harmful intent across agents?

Explores whether splitting a harmful objective into specialized subtasks allows malicious intent to evade detection at each individual step, since no single agent sees the full malicious picture.

Can adversary position unify fragmented multi-agent attack models?

The A-I-R framework organizes attacks by where the adversary sits relative to the system, which interface they use, and what system risk results. Does this coordinate system actually help compare defense results across different attack scenarios?

Can a quorum of honest validators certify an invalid transition?

When validators follow the protocol perfectly but lack semantic understanding, can they collectively approve a state change that violates application invariants? This matters because it reveals a gap between protocol correctness and execution safety.

Can action-level metrics alone expose contained attacks?

When a defense stops unsafe actions from executing, does measuring only the final action reveal whether the attack was blocked or never penetrated? This matters because different defense layers need different metrics to show what actually happened.

Can attackers manipulate which model handles a request?

Explores whether the routing layer that directs requests to specific models represents a security vulnerability separate from model-level defenses, and whether deployed systems can verify which model actually responded.

Does bundling code with skills create hidden security risks?

Agent skills combine instructions with executable code and system access. This packaging enables reuse but may also enable attacks—especially when skills are composed together or shared across platforms without adequate inspection.

Are multi-agent systems actually intelligent coordination or just token spending?

Does multi-agent performance come from better coordination strategies, or primarily from distributing tokens across parallel contexts? Understanding this distinction matters for deciding when to build multi-agent systems versus scaling single agents.

How does the authorization layer stay outside the poisoned path?

The containment result depends on task-bound tokens and a policy oracle remaining unreachable by memory poisoning attacks. The excerpt names these defenses but provides no design details about token issuance, binding scope, verification procedure, or whether tested attacks actually targeted them.

Which authorization component achieves the zero percent unsafe rate?

The paper reports that two authorization checks together prevent unsafe actions, but doesn't isolate which one—the token verification or the policy oracle—actually carries the result. This matters for understanding whether both are necessary or one is redundant.

What recovery mechanisms do vault defense notes actually specify?

The vault's multi-agent defense notes are checked against a five-part contract template. A keyword search finds recovery—the fifth part—mentioned in only one of six notes, raising questions about what recovery mechanisms, if any, the defenses specify.

Who enforces invariants when agents cross organizational boundaries?

Multi-agent trajectories span multiple organizations with different policy owners, but no party may see the entire path or agree on which constraints should apply. Understanding whose responsibility it is to state and verify sequence-level guarantees is critical for safe delegation.