AI summaryⓘ
The authors address how multiple independent operators can verify who created certain data and whether the connections between their outputs were properly authorized, without needing a shared authority or public record. They propose a two-layer method where each operator signs their output and records proof that connections (edges) between outputs were approved. They compare different ways to organize this evidence, favoring a co-signed directed acyclic graph (DAG) approach that better prevents unauthorized links after key compromise. Their experiments on hardware and cloud systems show the method is efficient and reliable. This work helps ensure trust and accountability in complex multi-operator workflows.
multi-agent systemsattestationdynamic delegationtrusted deployer runtimeMerkle chainco-signed DAGkey compromiseauthorizationworkflow verificationlatent language model (LLM)
Abstract
Multi-agent applications delegate work across independently operated deployers. After an incident, a verifier must answer two questions: which deployer released the reported bytes, and whether each cross-deployer edge was authorized. Credentials establish who may act, but need not bind them to later output bytes or prove both deployers authorized a dynamically created edge. We present a two-layer attestation design for dynamic delegation without a shared authority, public log, or precommitted workflow. A trusted deployer runtime signs a hash of each released output; this records released bytes but does not prevent prompt injection. Ancestry evidence records edge authorization. Under a unified threat model, we compare a signed linked list, a Merkle-chain variant, and a co-signed DAG. The primitives are standard; the contribution is deployer-side binding and the evidence needed for the two questions. After child-key compromise, the single-signer designs permit an unauthorized parent binding, whereas the co-signed DAG rejects it because the parent must authorize the edge. Fixed adversary matrices and regression tests validate the composed verifier. On an Apple M1 Pro, ancestry-only checks take 24.3-499.2us per hop. In a live local multi-service workflow, a parent discovers the child's A2A Agent Card; the child calls an MCP tool and releases local-LLM output: all 30 signed-DAG tasks passed complete verification, while a controlled child-key-only claim was rejected; its mean end-to-end latency was 813.1ms versus 770.8ms without evidence. In a complementary three-availability-zone AWS deployment, all 1,000 valid co-signed-DAG paths verified; issuance averaged 3.651ms and complete verification 5.015ms. The cloud result excludes TLS/mTLS, KMS, and model-serving latency.