Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design-A2A, AP2, ERC-8004, and Beyond
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
As the "agentic web" takes shape-billions of AI agents (often LLM-powered) autonomously transacting and collaborating-trust shifts from human oversight to protocol design. In 2025, several inter-agent protocols crystallized this shift, including Google's Agent-to-Agent (A2A), Agent Payments Protocol (AP2), and Ethereum's ERC-8004 "Trustless Agents," yet their underlying trust assumptions remain under-examined. This paper presents a comparative study of trust models in inter-agent protocol design: Brief (self- or third-party verifiable claims), Claim (self-proclaimed capabilities and identity, e.g. AgentCard), Proof (cryptographic verification, including zero-knowledge proofs and trusted execution environment attestations), Stake (bonded collateral with slashing and insurance), Reputation (crowd feedback and graph-based trust signals), and Constraint (sandboxing and capability bounding). For each, we analyze assumptions, attack surfaces, and design trade-offs, with particular emphasis on LLM-specific fragilities-prompt injection, sycophancy/nudge-susceptibility, hallucination, deception, and misalignment-that render purely reputational or claim-only approaches brittle. Our findings indicate no single mechanism suffices. We argue for trustless-by-default architectures anchored in Proof and Stake to gate high-impact actions, augmented by Brief for identity and discovery and Reputation overlays for flexibility and social signals. We comparatively evaluate A2A, AP2, ERC-8004 and related historical variations in academic research under metrics spanning security, privacy, latency/cost, and social robustness (Sybil/collusion/whitewashing resistance). We conclude with hybrid trust model recommendations that mitigate reputation gaming and misinformed LLM behavior, and we distill actionable design guidelines for safer, interoperable, and scalable agent economies.
Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 4 of its 18 references that are in the map. First posted on arXiv 5 Nov 2025.
Builds on
4 of 18 references.
References · 4
- 2023Towards Understanding Sycophancy in Language Modelscited by 988
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
- 2023Large Language Model Alignment: A Surveycited by 241
- 2025Beyond DNS: Unlocking the Internet of AI Agents via the NANDA Index and Verified AgentFactscited by 20
Built on by
Citing papers per year: 2026: 8.
8 papers.
- 2026SoK: Security of Autonomous LLM Agents in Agentic Commercecited by 8
- 2026RAILS: Verification-Native Clearing For Agentic Commercecited by 2
- 2026Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystemcited by 2
- 2026Trust Without Trusting: A Recomputable Trust Protocol for Autonomous Agentscited by 1
- 2026Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directionscited by 1
- 2026When Should Agent Trust Be Conditional? Characterizing and Attacking Skill-Conditional Reputation in Agent Swarmscited by 0
- 2026The Civilization Framework: Sovereign-Anchored Communication Between Personal Multi-Agent Systemscited by 0
- 2026SoK: Decentralized Agent Economic Infrastructurecited by 0
- 2026SoK: Decentralized Agent Economic Infrastructure1 Oct 2026
- 2026The Civilization Framework: Sovereign-Anchored Communication Between Personal Multi-Agent Systems3 Sep 2026
- 2026Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions5 Aug 2026
- 2026Can Trustless Agents Be Trusted? An Empirical Study of the ERC-8004 Decentralized AI Agent Ecosystem24 Jun 2026
- 2026When Should Agent Trust Be Conditional? Characterizing and Attacking Skill-Conditional Reputation in Agent Swarms12 Jun 2026
- 2026RAILS: Verification-Native Clearing For Agentic Commerce7 Jun 2026
- 2026Trust Without Trusting: A Recomputable Trust Protocol for Autonomous Agents7 May 2026
- 2026SoK: Security of Autonomous LLM Agents in Agentic Commerce15 Apr 2026
Similar, not cited
Close in wording, no citation either way
- 2025Insured Agents: A Decentralized Trust Insurance Mechanism for Agentic Economy
- 2025BlockA2A: Towards Secure and Verifiable Agent-to-Agent Interoperability
- 2025The Trust Fabric: Decentralized Interoperability and Economic Coordination for the Agentic Web
- 2026InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents
- 2025From Cloud-Native to Trust-Native: A Protocol for Verifiable Multi-Agent Systems
- 2026Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking
- 2026Trustworthy Agent Network: Trust in Agent Networks Must Be Baked In, Not Bolted On
- 2026Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundaries