Pith. sign in

REVIEW 2 major objections 6 minor 32 references

Safety Invariants for Agents Orchestrating Irreversible State Transitions: A Four-Dimensional Formalism Evaluated on Public Ledgers

T0 review · 2 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Under seven enforced invariants, an agent's realized ledger effect is either nothing or exactly the transition rendered to the user, exactly once—which confines the unsolved intent-understanding question to a single finite check.

desk verdict Useful reduction and clean invariant derivation, but Theorem 1 overreaches: chain-set fees and slippage can break fidelity even when all seven invariants hold. read the letter →

arxiv 2608.00783 v1 pith:4XGC4D2Y submitted 2026-08-01 cs.CR

Zhaoming Yin This is my paper · ORCID
classification cs.CR
keywords agentsafetyexecutionfidelityirreversiblestatetransitionspublicledgersinvariantslargelanguagemodelagentswalletoperationsfault
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks what can be guaranteed when an AI agent is given the power to take irreversible actions on external systems, and it answers for the concrete case of moving value across public ledgers. The answer is a proof of a property the paper calls execution fidelity: under seven enforced invariants and a fault model that admits wrong planning, ambiguous outcomes, retries, at-least-once delivery, and delegated non-human callers, a session's realized effect on the ledger is either nothing at all or exactly the transition that was rendered to the user, exactly once. The proof deliberately does not claim that the agent understood the user's intent, because no runtime layer can decide that; instead it confines that unbounded question to a single finite predicate: does the four-coordinate tuple of wallet, chain, address, and protocol, together with the amount, match what was asked. If the theorem is right, a preview-and-confirm gate becomes a sufficient control for irreversible agent actions, and the paper's own experiments show why evaluation still matters: the stack lifts pass rate by roughly 74 percentage points over a naive baseline on two write-aggressive models but only about 3 points on a write-cautious one.

What carries the argument

The central object is the four-dimensional state space $S = W \times C \times A \times P$: a state is a function assigning a non-negative integer balance to each (wallet, chain, address, protocol) quadruple, and a transition is a partial function on that space which obeys conservation classes and carries a valid signature for every coordinate it decreases. Its role in the argument is decidability rather than descriptive elegance—carrying all four coordinates explicitly makes 'what was promised' and 'what was executed' the same kind of object, so comparing them is a finite check rather than a judgment about language. The argument runs through the fidelity condition $\mathrm{real}(\sigma) \in \{\emptyset, \{\tau_p\}\}$ and a case analysis on its three violation branches: an element other than $\tau_p$, a duplicate copy of $\tau_p$, or a transition derived from $\tau_p$ but not equal to it. Each branch generates the obligations that become the seven invariants—confirm gate, pre-state sufficiency, post-state observability, no phantom success, scoped delegation, plan-level retry safety, and idempotent intent receiver—with enforcement points pinned along a single write path that derives the signing key only after confirmation.

What would settle it

Run one real session with all seven invariants genuinely in force—audited code, no type-coercion bypasses, uncompromised keys, no chain reorganization, honest RPC—and inject each of faults $F_2$ through $F_6$ one at a time; if the ledger ever records a transition that was never rendered, or the rendered transition twice, the three-branch proof is wrong. For the empirical claim, re-running the same 60-prompt suite with a paired per-prompt design across a dozen backing models would settle whether a single-model evaluation of such a stack can stand alone.

Watch

Extended reading notes

Core claim

The central claim is Theorem 1 (execution fidelity): let $\sigma$ be a session executed under Invariants 1–7, with faults drawn from F1–F6 and the assumptions of §3.1; then the session's realized multiset of ledger effects satisfies $\mathrm{real}(\sigma) \in \{\emptyset, \{\tau_p\}\}$—either nothing happened, or exactly the single transition $\tau_p$ that was rendered to the user happened, exactly once. Corollary 1 states what this buys: under the invariants, the only fault that can produce an unintended irreversible effect is F1, intent mis-mapping, which the paper treats as unbounded because no runtime layer can decide whether a tuple faithfully renders a natural-language request. Every other fault—pre-state drift, outcome ambiguity, re-issue, duplicate delivery, delegated callers—is forced to produce no effect at all, so the residual risk of the whole pipeline collapses onto one bounded predicate over a finite object: four coordinates and an amount. The proof is a three-branch case analysis on the fidelity condition, and the seven invariants are derived from those branches rather than enumerated from experience; the paper stresses that the theorem's useful form is the contrapositive, since each observed failure class is an instance of some invariant not in fact holding in deployed code.

Load-bearing premise

The load-bearing premise is that the executor code truly enforces all seven invariants and cannot be bypassed; the paper's own failure class 3—a string-to-boolean coercion that let an unconfirmed call reach the signer—was exactly such a bypass, and if any invariant's implementation diverges from its policy the fidelity theorem no longer applies.

Editorial extensions

If this is right

  • If fidelity holds, every failure mode other than intent mis-mapping—RPC lies, ambiguous outcomes, planner retries, duplicate webhook delivery, delegated avatar callers—is forced to produce no ledger effect at all, so engineering attention can concentrate on a few executable gates rather than on the model's behavior.
  • A preview-plus-confirm gate becomes a sufficient control for irreversible agent actions: the unbounded question 'did the agent understand me' is replaced by a finite check—does this tuple and amount match what was asked—that a human can answer in under a second, and that a scope check can approximate when no human is present.
  • The guarantee degrades exactly where the paper says it does: in unattended operation fidelity still holds but the check weakens from tuple content to caller authority; beyond the deduplication window $\Delta$ duplicate suppression lapses; and multi-step plans get prefix consistency, not atomicity, so a plan interrupted midway leaves an intermediate state no one asked for.
  • The evaluation finding is that single-model measurements of agent safety stacks are close to unfalsifiable: the same stack lifts pass rate by roughly 74 percentage points over the naive baseline on two write-aggressive models and by about 3 points on a write-cautious one, so the backing model must be reported as a first-class experimental variable.
  • The formalism transfers beyond ledgers: any probabilistic agent acting on irreversible external state—durable writes, hardware actuation—can be held to the same 'nothing or the previewed transition once' standard, with public ledgers as the hardest testbed because every failure is permanently visible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if the theorem holds, the safety-critical component of an agent system shrinks from the language model to the executor, so certification becomes a code-audit question—whether each gate is correctly implemented and unbypassable—rather than a behavior-psychology question, which suggests a different shape for agent-safety standards than current practice.
  • Editorial inference: the four-coordinate reduction generalizes to other irreversible actions such as permanent data deletion, firmware updates, or signing APIs, and a natural test is whether failures there also partition into the same three branches (unrendered, duplicated, derived-but-different) and are caught by the same seven gates.
  • Editorial inference: the reported numbers imply that on write-aggressive models a cautious model with no safety stack can outperform an aggressive model with one, so buyers of agent frameworks should evaluate the model–stack pair rather than the layer in isolation; a direct way to test this is a paired cross-model run of the paper's 60-prompt suite.
  • Editorial inference: the ablation pattern—code-gate invariants collapsing to near zero when disabled while tool-level checks sit below the measurement floor—predicts that a larger paired study would find the stack's measured value concentrated in the gates that decide when a key is derived and who may act, not in the balance checks the model can also perform from its own context.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper formalizes agent-orchestrated value movement across public ledgers as state transitions in a four-dimensional space S = W × C × A × P, defines a session and the property of execution fidelity (real(σ) ∈ {∅, {τp}}), and derives seven invariants by case analysis on the ways fidelity can be violated. Theorem 1 states that, under faults F1–F6 and the assumptions of §3.1, any session executed with Invariants 1–7 satisfies execution fidelity. The paper also reports a deployed system with 108 production write operations and an N = 60 adversarial suite across four backing models, finding a roughly 74-percentage-point lift over a naive-ReAct baseline on two write-aggressive models but only about a 3-point lift on a write-cautious one.

Significance. If the fidelity theorem were correct under its stated assumptions, the contribution would be genuinely useful: it reduces the unbounded intent-mapping problem to a single finite predicate and forces every other fault to produce no effect at all. The four-axis state space is well motivated by the transition primitives, and the derivation of the invariants from the fidelity condition is a coherent design proof rather than an empirical list. The paper is unusually candid about the conditional nature of the theorem, the single-turn baseline, the in-process ablation drivers, and the non-release of artifacts. The cross-model spread in the evaluation is a legitimate methodological caution about single-model evaluations of agent safety. However, the central theorem currently overclaims for the stated domain because it does not account for nondeterministic on-chain realization of a signed transaction.

major comments (2)
  1. [§4.6, proof step (i); Definitions 2 and 5; §2] Theorem 1's proof step (i) infers that every element of real(σ) equals τp from the fact that the executor signs only a confirmed, rendered tuple. This inference requires the unstated assumption that the signed transaction's on-chain effect is exactly the rendered transition. On public ledgers this is false: gas fees are determined by block state at inclusion time, swap and bridge outputs depend on pool state, and §2 marks MEV as only partly in scope and not handled by any of the seven invariants. A concrete failure: a user confirms 'transfer 1 ETH, fee 0.0001 ETH'; at broadcast the base fee is 0.0002 ETH; the transaction lands, all seven invariants and the §3.1 assumptions hold, no fault from F1–F6 occurs, yet real(σ) contains a transition different from τp because the realized balance changes differ. Since Definition 2 and Invariant 1 treat fees and expected output as part of the rendered tuple, a different realized fee means the realized transition is not τp. The theorem needs either an explicit assumption that the realized ledger effect equals the rendered function, or a reformulation of fidelity as containment in a rendered envelope of acceptable outcomes, and §4.7 should list nondeterministic realization as a fourth place where the guarantee stops.
  2. [§3.1, fault model F3] The assumptions of §3.1 state that 'the RPC is honest,' while fault F3 explicitly admits that an RPC 'may return a hash it later retracts.' These statements are incompatible: a hash that is later retracted is not honest behavior. As written, either F3 lies outside the theorem's assumptions, in which case Theorem 1 does not cover the phantom-success failure that motivates Invariants 3 and 4, or 'honest' needs a precise definition—for example, eventually consistent or non-adversarial but fallible—that makes the assumption and F3 compatible while still supporting the proof. This needs reconciliation because the theorem's fault coverage is a central claim of the paper.
minor comments (6)
  1. [Abstract and §8] The 74-percentage-point and 3-percentage-point figures are presented without the single-turn qualifier; since §5.1 defines the baseline as single-turn and tool-executing is not performed, add 'single-turn stated-intent delta' to the abstract and conclusion.
  2. [§5.1, code-gate ablations] Because the in-process drivers for I1, I3, I5, I6, and I7 were authored alongside the gates, the corresponding figure rows are better described as unit-style checks of the gate logic than as measurements of the deployed executor; the text makes this point, but the figure captions still say 'Invariant ablation' without the caveat.
  3. [§5.1, GPT-5-nano column] The N = 19–22 cells with overlapping intervals should be explicitly marked as a pilot rather than part of the headline comparison; the text calls the column methodology-bounded, but the figure gives these cells the same visual weight as the full-N rows.
  4. [§2 and §4.6] The partly-in-scope MEV statement in §2 should be cross-referenced in §4.6, since the proof of Theorem 1 does not mention MEV; after the theorem is revised to address nondeterministic realization, this cross-reference will be necessary.
  5. [Table 7] The 'All' row appears garbled in the text ('1089' instead of separate columns); ensure the table typesets the success, escalated, error, aborted, and total counts as distinct entries.
  6. [References] Reference [16] lacks a venue; please add one or mark it explicitly as a preprint.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the fidelity theorem is a forward-design conditional proof, and the empirical evaluation is explicitly disclaimed as validation.

full rationale

The paper's central claim is conditional and does not assume its own conclusion. Definition 5 states the target condition real(σ)∈{∅,{τp}}; Invariants 1–7 are operational mechanisms; Theorem 1 then proves that, under the stated fault model and the explicitly listed assumptions of §3.1 (correct executor code, uncompromised keys, no reorg, honest RPC), the mechanisms imply the target. The invariants are not defined in terms of fidelity; they are sufficient conditions derived by a case analysis on the ways a multiset can violate Definition 5. That is a legitimate forward-design proof, and the paper is candid that the derivation and theorem are 'the same argument stated at different levels of rigour.' The failure taxonomy is presented chronologically after the invariants and explicitly framed as a check on the derivation, not as its source, and the deployment record is disclaimed as not an experiment. There are no fitted parameters renamed as predictions, no load-bearing self-citations (the single-author paper cites only external work), and no uniqueness theorem imported from prior work by the author. The gas-fee and slippage objection is a soundness gap about unmodeled environmental nondeterminism, not a circularity: the theorem does not derive deterministic ledger effects from its assumptions; it simply does not model them. The paper also states the places the guarantee stops, including the unattended case, the Δ-bounded deduplication window, and prefix-consistency for plans, which further confirms that the proof is not vacuously or tautologically closed.

Assumptions & free parameters 2 free parameters · 6 assumptions · 0 invented entities

The central theorem rests on several stated trust assumptions and design choices; no fitted parameters enter the proof, and no new physical entities are postulated. The invariants themselves are operational rules, not free parameters.

free parameters (2)
  • Poll window = 12 s
    Post-broadcast verification window in Invariant 3; chosen by hand, bounds when an outcome is reported as uncertain rather than confirmed. Not fitted to data.
  • Deduplication window Δ = 30 s
    Idempotent-receiver window in Invariant 7; chosen by hand, bounds duplicate suppression. The paper notes Δ is a safety parameter, not just a cache-tuning decision.
assumptions (6)
  • domain assumption Executor code is correct and its checks are not bypassable
    Assumed in §3.1; failure class 3 shows it can fail in practice. The theorem is conditional on this.
  • domain assumption Signing keys are uncompromised and the chain does not reorganize
    Stated in §3.1 as out-of-scope assumptions of the analysis.
  • domain assumption The L1 RPC is honest for balance and lookup reads
    Invariant 2 inherits this trust assumption (§4.7); light-client verification is flagged as future work.
  • domain assumption Fault model F1-F6 is complete for non-adversarial fallibility
    The theorem only covers the listed faults; unlisted bugs (e.g., executor signing the wrong tuple) are outside the guarantee.
  • domain assumption A session renders exactly one transition tuple τp
    Definition 4 fixes one preview per session; if multiple tuples were rendered, the set {τp} is not well-defined.
  • standard math Standard set theory and multiset reasoning
    The proof uses basic properties of multisets and partial functions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Safety Invariants for Agents Orchestrating Irreversible State Transitions: A Four-Dimensional Formalism Evaluated on Public Ledgers." pith.science (2026). https://pith.science/paper/4XGC4D2Y

@misc{pith2026260800783,
  author       = {Pith},
  title        = {Pith review of: Safety Invariants for Agents Orchestrating Irreversible State Transitions: A Four-Dimensional Formalism Evaluated on Public Ledgers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4XGC4D2Y}},
  note         = {Machine review of arXiv:2608.00783}
}
read the original abstract

Autonomous agents are increasingly asked to produce irreversible effects on external systems - transferring funds, writing to durable storage, actuating hardware. Existing agent frameworks (ReAct, Reflexion, MCP) optimize task success on benchmarks and give little attention to the safety of irreversible side-effects. We formalize one such setting, movement of value across public ledgers, as state transitions in a four-dimensional space indexed by (wallet, chain, address, protocol), and use that formalism to state and prove a guarantee we call execution fidelity: under a fault model admitting planner mis-mapping, ambiguous outcomes, retries, at-least-once delivery, and delegated non-human callers, a session's realized effect on the ledger is either nothing at all or exactly the transition that was rendered to the user, exactly once. The theorem deliberately does not claim that the rendered transition matches the user's intent - no runtime layer can decide that - but it confines that unbounded question to a single predicate over a finite object, which is what makes a preview a sufficient control rather than a formality. Seven safety invariants, derived from the fidelity condition rather than enumerated from experience, discharge the guarantee. Empirically, on a controlled N=60 adversarial suite the stack lifts pass rate by ~74 percentage points over a naive-ReAct baseline on two write-aggressive backing models, but by only ~3 points on a write-cautious one - evidence that single-model evaluations of agent safety stacks are close to unfalsifiable. The system is deployed; 108 production write operations across 8 chains back the failure taxonomy. Although the evaluation setting is public ledgers, the formalism and invariants apply to any probabilistic agent acting on irreversible external state.

Figures

Figures reproduced from arXiv: 2608.00783 by the authors.

Figure 1
Figure 1. A transition as a coordinate readout: “deposit all my USDC to Hyperliquid” resolved [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Orchestration pipeline in cryptitalk-wallet. A natural-language request flows top to bottom: the agent resolves it to a single transition tuple, the write tool renders that tuple and holds it until confirmation (I1) and a ground-truth balance check (I2) both pass, and only then is a key derived. The dashed return path is the post-broadcast verify poll, which supplies I3 and I4 before the tool reports any outcome bac… view at source ↗
Figure 3
Figure 3. The executor-local write path. Every early return is a refusal that leaves [PITH_FULL_IMAGE:figures/full_fig_p012_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: State-machine view of a single transition. Solid arrows are the happy path. Dashed arrows [PITH_FULL_IMAGE:figures/full_fig_p014_4.png]
Figure 5
Figure 5. Figure 5: Experimental results with backing model Claude. Each row’s whisker is a 95% bootstrap [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]
Figure 6
Figure 6. Figure 6: Experimental results with backing model MiniMax-M2.7-highspeed. Each row’s whisker is [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]
Figure 7
Figure 7. Figure 7: Experimental results with backing model Gemini-2.5-flash-lite. Each row’s whisker is a [PITH_FULL_IMAGE:figures/full_fig_p021_7.png]
Figure 8
Figure 8. Figure 8: Experimental results with backing model GPT-5-nano. Each row’s whisker is a 95% [PITH_FULL_IMAGE:figures/full_fig_p022_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

32 extracted references · 19 canonical work pages

  1. [1]

    Autonomous agents on blockchains: Standards, execution models, and trust boundaries

    Saad Alqithami. Autonomous agents on blockchains: Standards, execution models, and trust boundaries. arXiv:2601.04583, 2026

    arXiv 2026

  2. [2]

    Model context protocol specification

    Anthropic. Model context protocol specification. https://modelcontextprotocol.io/ specification, 2024. Accessed 2026-04-19

    work page 2024

  3. [3]

    Session keys in Argent: scope-bounded delegated signers

    Argent Labs. Session keys in Argent: scope-bounded delegated signers. Technical blog, 2023

    work page 2023

  4. [4]

    ERC-4337: Account abstraction using alt mempool

    Vitalik Buterin, Yoav Weiss, Dror Tirosh, Shahaf Nacson, Alex Forshtat, Kristof Gazso, and Tjaden Hess. ERC-4337: Account abstraction using alt mempool. Ethereum Improvement Proposal, 2021

    work page 2021

  5. [5]

    The price of in- teroperability: Exploring cross-chain bridges and their economic consequences

    Yiyue Cao, Mingzhe Zheng, Lin William Cong, Siguang Li, and Xuechao Wang. The price of in- teroperability: Exploring cross-chain bridges and their economic consequences. arXiv:2604.03083, 2026

    arXiv 2026

  6. [6]

    Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability

    Philip Daian, Steven Goldfeder, Tyler Kell, Yunqi Li, Xueyuan Zhao, Iddo Bentov, Lorenz Breidenbach, and Ari Juels. Flash boys 2.0: Frontrunning in decentralized exchanges, miner extractable value, and consensus instability. InIEEE Symposium on Security and Privacy (S&P), 2020

    work page 2020

  7. [7]

    Systematization of knowledge: Security and safety in the Model Context Protocol ecosystem

    Shiva Gaire, Srijan Gyawali, Saroj Mishra, Suman Niroula, Dilip Thakur, and Umesh Yadav. Systematization of knowledge: Security and safety in the Model Context Protocol ecosystem. arXiv:2512.08290, 2025

    arXiv 2025

  8. [8]

    Morgan Kaufmann, 1993

    Jim Gray and Andreas Reuter.Transaction Processing: Concepts and Techniques. Morgan Kaufmann, 1993

    work page 1993

Show all 32 references
  1. [9]

    Herlihy and Jeannette M

    Maurice P. Herlihy and Jeannette M. Wing. Linearizability: A correctness condition for concurrent objects.ACM Transactions on Programming Languages and Systems, 12(3), 1990

    1990

  2. [10]

    MetaGPT: Meta programming for a multi-agent collaborative framework

    Sirui Hong, Mingchen Zhuge, Jiaqi Chen, Xiawu Zheng, Yuheng Cheng, Ceyao Zhang, Jinlin Wang, Zili Wang, Steven Ka Shing Yau, Zijuan Lin, Liyang Zhou, Chenyu Ran, Lingfeng Xiao, Chenglin Wu, and Jürgen Schmidhuber. MetaGPT: Meta programming for a multi-agent collaborative frame...

    2023 arXiv

  3. [11]

    A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions

    Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng, Haotian Chen, Qianglong Chen, Weihua Peng, Xiaocheng Feng, Bing Qin, and Ting Liu. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. arXiv:2311.05232, 2023

    2023 arXiv

  4. [12]

    Survey of hallucination in natural language generation

    Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. Survey of hallucination in natural language generation. ACM Computing Surveys, 55(12), 2023

    2023

  5. [13]

    DeCoAgent: Large language model empowered decentralized autonomous collaboration agents based on smart contracts.IEEE Access, 12:155234–155245, 2024

    Anan Jin, Yuhang Ye, Brian Lee, and Yuansong Qiao. DeCoAgent: Large language model empowered decentralized autonomous collaboration agents based on smart contracts.IEEE Access, 12:155234–155245, 2024

    2024

  6. [14]

    Llms get lost in multi-turn conversation

    Philippe Laban, Hiroaki Hayashi, Yingbo Zhou, and Jennifer Neville. Llms get lost in multi-turn conversation. arXiv:2505.06120, 2025. 27

    2025 arXiv

  7. [15]

    Levy.Capability-Based Computer Systems

    Henry M. Levy.Capability-Based Computer Systems. Digital Press, 1984

    1984

  8. [16]

    Lost at the beginning of reasoning

    Baohao Liao, Xinyi Chen, Sara Rajaee, Yuhui Xu, Christian Herold, Anders Søgaard, Maarten de Rijke, and Christof Monz. Lost at the beginning of reasoning. 2025

    2025

  9. [17]

    Intent mismatch causes LLMs to get lost in multi-turn conversation

    Geng Liu, Fei Zhu, Rong Feng, Changyi Ma, Shiqi Wang, and Gaofeng Meng. Intent mismatch causes LLMs to get lost in multi-turn conversation. arXiv:2602.07338, 2026

    2026

  10. [18]

    Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang

    Nelson F. Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. Lost in the middle: How language models use long contexts. InTransactions of the Association for Computational Linguistics (TACL), 2024

    2024

  11. [19]

    Miller.Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control

    Mark S. Miller.Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control. PhD thesis, Johns Hopkins University, 2006

    2006

  12. [20]

    Miller, Ka-Ping Yee, and Jonathan Shapiro

    Mark S. Miller, Ka-Ping Yee, and Jonathan Shapiro. Capability myths demolished. Technical Report SRL2003-02, Systems Research Laboratory, Johns Hopkins University, 2003

    2003

  13. [21]

    Cambridge University Press, 1999

    Robin Milner.Communicating and Mobile Systems: The π-calculus. Cambridge University Press, 1999

    1999

  14. [22]

    PhD thesis, Technische Universität Darm- stadt, 1962

    Carl Adam Petri.Kommunikation mit Automaten. PhD thesis, Technische Universität Darm- stadt, 1962

    1962

  15. [23]

    A look around the corner: Theπ-calculus

    Frank Puhlmann and Mathias Weske. A look around the corner: Theπ-calculus. InTransactions on Petri Nets and Other Models of Concurrency II. Springer, 2009

    2009

  16. [24]

    Quantifying blockchain extractable value: How dark is the forest? InIEEE Symposium on Security and Privacy (S&P), pages 198–214, 2022

    Kaihua Qin, Liyi Zhou, and Arthur Gervais. Quantifying blockchain extractable value: How dark is the forest? InIEEE Symposium on Security and Privacy (S&P), pages 198–214, 2022

    2022

  17. [25]

    Safe smart account modules and session keys

    Safe Ecosystem Foundation. Safe smart account modules and session keys. Technical documen- tation, 2024

    2024

  18. [26]

    J. H. Saltzer, D. P. Reed, and D. D. Clark. End-to-end arguments in system design.ACM Transactions on Computer Systems, 2(4), 1984

    1984

  19. [27]

    Towards post-quantum Bitcoin blockchain using Dilithium signature.IACR Communications in Cryptology (CIC), 2(3), 2025

    Iyane Seck and Adeline Roux-Langlois. Towards post-quantum Bitcoin blockchain using Dilithium signature.IACR Communications in Cryptology (CIC), 2(3), 2025

    2025

  20. [28]

    Reflexion: Language agents with verbal reinforcement learning

    Noah Shinn, Federico Cassano, Edward Berman, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. Reflexion: Language agents with verbal reinforcement learning. InAdvances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  21. [29]

    White, Doug Burger, and Chi Wang

    Qingyun Wu, Gagan Bansal, Jieyu Zhang, Yiran Wu, Beibin Li, Erkang Zhu, Li Jiang, Xiaoyun Zhang, Shaokun Zhang, Jiale Liu, Ahmed Hassan Awadallah, Ryen W. White, Doug Burger, and Chi Wang. AutoGen: Enabling next-gen LLM applications via multi-agent conversation. arXiv:2308.08155, 2023

    2023 arXiv

  22. [30]

    React: Synergizing reasoning and acting in language models

    Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. React: Synergizing reasoning and acting in language models. InInternational Conference on Learning Representations (ICLR), 2023

    2023

  23. [31]

    SoK: Security of cross-chain bridges: Attack surfaces, defenses, and open problems

    Mengya Zhang, Xiaokuan Zhang, Josh Barbee, Yinqian Zhang, and Zhiqiang Lin. SoK: Security of cross-chain bridges: Attack surfaces, defenses, and open problems. arXiv:2312.12573, 2023. 28

    2023 arXiv

  24. [32]

    SoK: Decentralized finance (defi) attacks

    Liyi Zhou, Xihan Xiong, Jens Ernstberger, Stefanos Chaliasos, Zhipeng Wang, Ye Wang, Kaihua Qin, Roger Wattenhofer, Dawn Song, and Arthur Gervais. SoK: Decentralized finance (defi) attacks. InIEEE Symposium on Security and Privacy (S&P), 2023. 29

    2023

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.