Multi agent federations get improved identity and governance tools
PRIMUS: Identity, Governance, and Verification for Multi-Agent Federations
Artificial Intelligence
Summary
Multi-agent federations are groups where many independent agents work together but might not always be honest. The paper presents PRIMUS, a new system that makes it easier to know who participated, ensure they follow rules, and determine who has authority, even when some agents act maliciously or communication is noisy. It also studies if the system's checks can guide the group to better decisions and finds some limits on what can be fixed. The authors measure how well this approach works with both simulated and real data.
What this means in practice
- •For distributed system engineers: Implement governance controls with prime-power identities and secure consensus tokens to manage participation and enforcement under adversarial conditions.
- •For security architects: Use verified safe-kill thresholds and VRF succession strategies to prevent false positives and maintain safety in partially synchronous multi-agent networks.
Authors
Sasank Annapureddy, Anjaneya Prasad Thamatani
Abstract
Multi-agent federations need governance that answers three questions under adversarial conditions: who participated (identity), did they conform (enforcement), and who decides (authority). A separate question is whether the verification machinery that polices a federation's outputs can also steer a generate-and-test loop toward better answers. Part I. PRIMA introduced prime-power agent identity and a consensus token whose factorization indexes participation, but assumed honest agents. We present PRIMUS, which couples prime-power identity with BLS aggregate signatures (PIAC), derives a safe-kill threshold that reduces false-positive agent termination from 80% to 0.00% under 10% channel noise, gives the closed-form economic boundary where singleton governance outperforms Byzantine quorum ($γ^* \approx 9f$, verified flat across n = 50 to 10,000), and specifies VRF succession with lease and fencing that makes safety unconditional under partial synchrony. Five problems are identified as provably unfixable within the model and stated as scope boundaries. Part II. A verifier is not a solver. We ask whether PRIMA's binary artifact-fidelity verdict can be converted into a graded fitness signal, and measure the conversion on binary covering codes. Calibration against injected fault burden is strong ($ρ$ = 0.676 deterministic, 0.819 full); against real LLM-generated candidates the same scores fall to 0.158 and 0.406, roughly a quarter of the calibration value (the same-designer confound, measured). As a pre-filter it beats a random-score control convincingly and a binary gate narrowly. Under 400 iterations of explicit optimization it was not gamed, but only because the objective saturated after one honest answer. A cross-family judge preserves the burden-ordering signal while destroying individual judgments. No covering-code record resulted. Measured program cost: USD 164.78.