Pith. sign in

REVIEW 4 major objections 5 minor 45 references

TrustAgentNet claims a dual-tier blockchain can make agent skillset supply chains zero-trust, catching all tested fake AI models while adding only modest overhead.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 01:16 UTC pith:2KGIT5RN

load-bearing objection A genuinely useful system architecture, but the 'flawless 100% interception' claim is built on a test set that matches exactly what the verifier checks — backdoored models that preserve accuracy would sail through. the 4 major comments →

arxiv 2608.00104 v1 pith:2KGIT5RN submitted 2026-07-31 cs.CR cs.AIcs.NI

Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking

Yayu Gao , Yong Xiao , Hao Hu , Xubo Li , Zhiwei Liu , Yingyu Li , Guangming Shi , Ping Zhang This is my paper
classification cs.CR cs.AIcs.NI
keywords agentic AI networkingzero-trustblockchainskillset lifecycleclaim-to-capability consistencyLLM verificationmulti-agent collaborationtrust score
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper argues that the trust-by-declaration model underlying agentic AI networks is the root vulnerability: agents select third-party skillsets on the basis of unverified natural-language claims. To replace that, it proposes a two-tier blockchain architecture — a global chain that anchors verified skillset metadata and transient task chains that coordinate multi-agent collaboration — with specialized LLM agents doing the semantic verification off-chain. The central claim is that claim-to-capability consistency can be enforced end-to-end: the verifying agent decomposes a skillset into implementation and declaration layers, extracts semantic features, and cross-checks them in a sandbox, recording only hashes and trust scores on-chain. On the paper's tests this caught all 40 honest versus 10 adversarial AI models, reached 83.91% accuracy on 1,478 features of 171 procedural skills, and left blockchain overhead small relative to LLM inference. If true, agent networks could move from trusting advertisements to audited, self-healing skillset supply chains.

Core claim

The paper's core discovery is a verification pipeline. A skillset's declared capabilities are cross-examined against its actual implementation by an LLM 'verifying agent' in three stages: decouple code or weights from documentation, extract semantic feature claims, and run sandboxed consistency analysis. On the AI-model track the pipeline reports 100% interception across 50 models (40 honest, 10 adversarially constructed). On the procedural track it reports 83.91% accuracy and F1 0.848 across 1,478 hand-annotated features, with Behavior the clear weak spot (F1 0.498). The paper also derives a three-way trade-off bound showing that raising security thresholds filters agents, widening the opti

What carries the argument

The load-bearing machinery is the dual-tier ledger: a global Chain of Skillsets storing only cryptographic metadata, hashes, and trust scores, plus transient task-specific Chains of Collaboration. Two LLM agents run on top: a Mapping Agent that translates natural-language task goals into skillset suites, and a Verifying Agent that runs the three-stage claim-to-capability audit. The audit function Ψ assigns each declared feature Match, Miss, or Uncertain, feeding a dual trust-score update and threshold-based admission or revocation. The key move is decoupling on-chain anchoring from off-chain inference: the chain commits only hashes and verification reports, never model weights, so heavy comp

Load-bearing premise

The central claim rests on the assumption that the test distribution — 50 AI models and 171 annotated procedural skills — represents how real adversaries actually construct deceptive skillsets, and that the LLM-based semantic verifier generalizes to deception vectors that were not used in testing.

What would settle it

Run the Verifying Agent on a held-out set of adversarially constructed skillsets whose deceptions were not among the paper's six vectors (e.g., a skill whose description is semantically consistent but whose behavior diverges only under a rare runtime condition). If any such skill is certified as consistent while its runtime behavior violates the declaration, the 100% interception claim is disproved; a simpler check is to report the interception rate on a dataset where the adversarial models are generated by an adaptive adversary who has access to the verifier's audit function.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • If verified at scale, agent platforms could refuse to load any skillset whose declared capabilities have not passed the consistency audit, cutting off a large class of supply-chain attacks at deployment time.
  • Because the blockchain layer stores only hashes and trust scores, the measured overhead of zero trust is dominated by LLM inference; organizations could add the audit pipeline to existing agent networks at modest latency cost.
  • The transient collaboration chains give a concrete way to run federated learning, mixture-of-experts, and model-partitioning collaboration without exposing raw data, with a formal bound on the accuracy cost of filtering out uncertified agents.
  • The self-healing case study implies that a compromised local skillset can be automatically replaced by re-fetching the verified artifact from decentralized storage, restoring functionality without human intervention.
  • The 83.91% procedural-skill accuracy, together with the low Behavior F1 (0.498), indicates the approach is viable for structured features now but needs dynamic sandbox execution to close the behavioral gap.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The 100% interception figure is measured on a 50-model dataset whose adversarial examples were crafted along the paper's own six deception vectors; a natural next test is whether the pipeline catches an adaptive adversary who optimizes a deception against the verifier itself, something the paper does not claim to have run.
  • The weak Behavior category suggests that static metadata analysis will not be enough for skills whose harm appears only at runtime; one testable extension is feeding the Verifying Agent actual execution traces from a sandbox and re-measuring the Behavior F1.
  • The trade-off theorems imply an operational tuning problem the paper leaves implicit: an operator must choose the endorsement threshold knowing it will exclude honest-but-non-conformist agents; the bounds could be inverted to recommend a threshold given a target performance gap.
  • A held-out comparison against existing behavioral integrity verification methods would clarify whether the blockchain adds security value or just auditability on top of the LLM verifier.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes TrustAgentNet, a dual-tier blockchain zero-trust governance framework for agentic AI skillsets. A global Chain of Skillsets (CoS) stores lightweight metadata and hashes, while specialized LLM agents (M-Agent for acquisition/mapping, V-Agent for submission verification) perform off-chain semantic auditing. Transient Chains of Collaboration (CoC) coordinate privacy-preserving multi-agent training/inference, and a Security-agent (S-Agent) supports runtime self-healing. The authors give convergence bounds for federated and model-partitioning collaboration, build a Hyperledger Fabric/IPFS/5G prototype, and report that zero-trust overhead is dominated by off-chain LLM inference. The headline empirical claims are 100% interception of 10 adversarial among 50 AI-model skillsets, 83.91% accuracy (F1=0.848) on 1478 features from 171 procedural skills, and a self-healing case study.

Significance. If the headline verification result held for realistic adversaries, this would be a meaningful step toward audited skillset supply chains for agentic AI. The paper's concrete strengths are the hardware prototype (Section VII.A), the clean separation of on-chain metadata hashing from off-chain LLM inference, the careful cost breakdowns in Figs. 5-7, and the honest reporting of the Behavior-category bottleneck (Table I) and of the need for dynamic sandbox verification. The current evaluation, however, supports a narrower claim: detection of declaration-versus-benchmark mismatches on a small, author-constructed adversary set, rather than general adversarial intent. With re-scoped claims and additional experiments, the framework is a useful contribution.

major comments (4)
  1. [Section V.B.2 (Stage 3) and Section VII.B.2] The headline claim of a 'flawless 100% inconsistency interception rate' is not supported for claim-consistent adversaries. The formal verification criterion for AI-model skillsets is only Δp = |P_claimed − P_empirical| < ε on the declared test set (Section V.B.2, Stage 3). A backdoored or trigger-conditioned model that preserves test-set accuracy passes this check by construction. The 10 adversarial models were constructed with mismatches in exactly the dimensions the protocol inspects (performance, metadata, architecture, dataset origin, poisoned weights), so the result substantially reflects the test design. Moreover, the formal protocol does not specify how metadata discrepancies, architecture spoofing, dataset-origin falsification, or poisoned weights are verified; Section VII.B.2 describes a broader 'multidimensional behavioral, structural, and architectural auditing' pipeline that
  2. [Section VII.B.3 / Table I] The cross-domain generalization claim is weakened by the paper's own procedural results. The Behavior category, which is the closest analogue to runtime semantic consistency, has F1=0.498 (Table I), and the text concedes that 'dynamic sandbox verification remains crucial to enhance runtime behavioral analysis of procedural skills.' The overall F1=0.848 is driven by Entry (0.982) and Capability (0.923). In addition, the ground-truth labels are 'manually annotated' with no inter-annotator agreement and no independent benchmark. The conclusion that the verification pipeline 'can govern diverse types of skillsets' should be limited to structural features and should not claim behavioral consistency until a dynamic sandbox is implemented or the claim is explicitly narrowed.
  3. [Section VI.B.1, Theorem 1 and Appendix A] The theorem's 'security-performance tradeoff' is substantially true by construction. The bound contains C*_M_i(F_i) (Definition 1), which is by definition the performance gap caused by removing uncertified agents, and B_M_i = ||w*_{M_i} − w*_{R_i}||², the distance between the certified and full-set optima. Stating that raising the security threshold inflates these terms is a restatement of their definitions rather than a derived tradeoff. The convergence part is inherited from the standard FedAvg analysis [45]. In addition, Assumption 2 is misstated: the inequality ||F_i,k(w) − F_i,k(w')|| ≥ µ||w − w'|| is not the strong-convexity condition used in [45], and Appendix A, Eq. (17), contains an algebraic expansion step that appears invalid as written. The authors should correct the assumptions and proof, and should express the cost of security in terms of primitive quantities (endorsement t
  4. [Section VII.C (Empirical Validation)] The experimental validation of the three-way tradeoff does not measure the security axis. The experiment varies the percentage x of peer nodes required for endorsement and assumes 'a linear correlation between the increase in x% and the number of agents failing to meet the security certification requirements.' This assumption is introduced without evidence, and the paper reports only running time, CPU occupancy, and traffic volume (Fig. 9). Thus Fig. 9 demonstrates the costs of stricter endorsement but does not validate the security level or the tradeoff predicted in Theorem 1. The authors should measure security (e.g., actual fraction of rejected adversarial agents, collusion/failure probability) or re-label the experiment as a cost-scaling study.
minor comments (5)
  1. [Throughout] Please correct typographical issues: 'efficient' → 'efficient', 'traffic' → 'traffic', 'traing' → 'training' in Appendix A, and unify the use of 'skillsets' vs. 'skillset' in compound expressions.
  2. [Section V.B.2, Eq. (10)] The relation between the verification tolerance ε in Stage 3 and the skillset trust-score threshold θ_adm is not specified. It should be stated whether a skillset with Δp < ε but T S_s < θ_adm is accepted or rejected.
  3. [Section VII.B.2] The 'flawless 100%' result is reported without uncertainty quantification. For 50 models the exact counts are 40/40 and 10/10; please state these numbers and, ideally, a confidence interval or sensitivity analysis.
  4. [Appendix B, Eq. (22)] The expression 'Lg 2 β2' appears to be a typo for (L/2)β²; please correct the notation.
  5. [References] Several references (e.g., [3], [6], [20]) are 2026-dated preprints. Please ensure they are publicly verifiable or flag their status consistently.

Circularity Check

1 steps flagged

Part of the claimed security-performance tradeoff is definitional: Theorem 1 bounds the error by C*_Mi, which is defined as the performance gap caused by removing uncertified agents; the verification and overhead results remain independently grounded.

specific steps
  1. self definitional [Section VI.B.1, Definition 1 (Eq. 13), Theorem 1, and Remark 2 (also echoed in Theorem 2 / Remark 3)]
    "The impact of removing a subset Qi = Ri \ Mi of agents on skillset si due to their failure to meet security certifications can be defined as the difference between the global optimal performance with all Ri agents and that with only the Mi certified agents. This discrepancy is given by: C ∗ Mi (Fi) = ... [Eq. 13]. Theorem 1: Esi ≤ ... + 6LC ∗ Mi (Fi). Remark 2: '... losing these agents ... is mathematically mapped onto the inflation of the structural bounds BMi and C ∗ Mi.'"

    C*_Mi is defined in Eq. (13) as the very quantity the theorem is said to explain: the performance gap caused by excluding uncertified agents. Theorem 1 then places 6L C*_Mi(Fi) inside the convergence bound, and Remark 2 reads the tradeoff off this term. Thus the 'security level vs. task performance' component of the claimed tradeoff is true by definition rather than by derived content. The convergence-rate prefactor and variance terms come from a standard external FedAvg bound [45], so the circularity is partial and confined to the security-gap term, which also reappears as CMi(Fi) in Theorem 2.

full rationale

The main experimental results are not circular: the blockchain-overhead comparison is measured directly against a no-blockchain baseline, and the 100% interception / 83.91% F1 results are evaluations on explicitly constructed datasets, not quantities fitted from those datasets. Those evaluations do have external-validity limits (the adversarial AI models are built to mismatch exactly the audited dimensions, and Behavior F1 is 0.498), but that is a generalization/correctness concern, not a derivation that reduces to its inputs. The FedAvg convergence bound in Lemma 1 is attributed to external work [45], and self-citations [1],[2],[38] describe prior platforms and the MoPS model without being used to forbid alternatives. The single genuine circular step is the use of C*_Mi: Eq. (13) defines it as the security-induced performance gap, and Theorem 1/2 then 'derive' a tradeoff whose security-performance component is contained in that definition. Hence the score is moderate, not severe.

Axiom & Free-Parameter Ledger

5 free parameters · 7 axioms · 3 invented entities

The central verification claim rests on hand-designed adversarial data and manual annotations plus an LLM whose behavior is not specified; the theoretical part rests on standard optimization assumptions plus an unproved imported lemma. No physical entities are introduced, but the CoS/CoC/agent-trust machinery is the framework itself, so it is not 'independent evidence'.

free parameters (5)
  • γ (trust-score decay)
    Hand-set tuning parameter in TS_s = exp(-γΔp); no value, range, or sensitivity analysis given. Eq. (10).
  • ρ (credit inertia)
    Exponential moving-average factor in agent trust score Eq. (11); value unspecified.
  • θ_adm (skillset admission threshold)
    Skillsets with TS_s < θ_adm are rejected; threshold not specified or justified. Section V.B.3.
  • θ_rev (agent revocation threshold)
    Agents with TS_a < θ_rev are blacklisted/slashed; threshold not specified. Section V.B.3.
  • ε (performance tolerance)
    AI-model consistency requires |P_claimed − P_empirical| < ε; ε is not defined in the paper. Section V.B.2 Stage 3.
axioms (7)
  • standard math Lemma 1 from [45] (FedAvg convergence bound) holds and applies to the Mi certified agents
    Used without proof in the proof of Theorem 1 (Appendix A); the entire bound inherits this external result.
  • standard math Assumptions 1-4 (L-smoothness, µ-convexity, gradient bound, variance bound)
    Standard stochastic-optimization assumptions required by Theorem 1; stated in Section VI.B.1.
  • standard math Assumption 5: initialization gap CI is bounded
    Required for the O(1/√T) bound in Theorem 2; stated in Section VI.B.2.
  • domain assumption Security level is a decaying function of cluster size via collusion tail probability (Eq. 4)
    Postulated model of security vs. cluster size; no derivation or empirical calibration for P_collusion.
  • domain assumption Adversarial claim-to-capability gaps are detectable from artifacts plus sandboxed LLM analysis
    The 100% claim relies on the premise that fabricated accuracy, metadata mismatches, architecture spoofing, poisoned weights, etc. produce signatures the V-Agent can catch; not proven for unseen deceptions.
  • domain assumption Manual annotations for 1478 ClawHub features are correct
    Ground truth for Table I is author-annotated; no inter-annotator agreement or external audit reported.
  • ad hoc to paper Number of agents failing certification increases linearly with endorsement threshold x%
    Assumed in Section VII.C to generate Fig. 9; it forces the monotone cost increase that is then presented as experimental validation of the trade-off.
invented entities (3)
  • Chain of Skillsets (CoS) no independent evidence
    purpose: Global immutable consortium ledger anchoring skillset identity, metadata, hashes, and verification reports.
    Architectural construct; no external falsifiable prediction separate from system operation.
  • Chain of Collaboration (CoC) no independent evidence
    purpose: Transient per-task ledger for multi-agent coordination and aggregation.
    System component whose benefits are only evaluated within the paper's prototype.
  • M-Agent / V-Agent / S-Agent no independent evidence
    purpose: LLM-based agents for semantic mapping, claim-to-capability consistency verification, and runtime attack-agnostic monitoring/recovery respectively.
    Software-embodied protocol roles; no independent evidence outside the paper's prototype.

pith-pipeline@v1.3.0-alltime-deepseek · 24389 in / 14952 out tokens · 155441 ms · 2026-08-04T01:16:21.314920+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking." pith.science (2026). https://pith.science/paper/2KGIT5RN

@misc{pith2026260800104,
  author       = {Pith},
  title        = {Pith review of: Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2KGIT5RN}},
  note         = {Machine review of arXiv:2608.00104}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Agentic AI networking (AgentNet) systems rely heavily on third-party skillset implementations and distributed multi-agent collaboration, yet they face major claim-to-capability inconsistencies and security vulnerabilities under trust-by-declaration assumptions. To bridge this gap, this paper proposes TrustAgentNet, a dual-tier blockchain-secured zero-trust framework. Specifically, a global Chain of Skillsets (CoS) governs the lifecycle of skillset metadata with protocols empowered by specialized agents to enforce off-chain auditing while maintaining lightweight on-chain cryptographic consensus. Furthermore, transient, task-oriented Chains of Collaboration (CoC) are dynamically established to enable trustless distributed multi-agent collaboration. Theoretical analysis of the three-way trade-off among security level, task performance, and resource overhead is provided and empirically validated. Experimental results on a hardware prototype demonstrate that compared with no-blockchain trust-by-default baselines, the zero-trust overhead of TrustAgentNet is dominated by off-chain inference, while the blockchain layer incurs minor ledger costs via the ledger-IPFS storage and on/off-chain integration design. Crucially, the proposed verification pipeline achieves a flawless 100% accuracy across 50 AI models, correctly validating 40 honest skillsets and intercepting 10 adversarial ones, and generalizes to non-AI domains with an 83.91% accuracy and a 0.85 F1-score across 1478 features from 171 ClawHub skills. Adversarial experiments further show that TrustAgentNet enables autonomous skillset self-recovery against various malicious attacks.

Figures

Figures reproduced from arXiv: 2608.00104 by Guangming Shi, Hao Hu, Ping Zhang, Xubo Li, Yayu Gao, Yingyu Li, Yong Xiao, Zhiwei Liu.

Figure 1
Figure 1. Figure 1: An architectural framework of TrustAgentNet. [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Graphic illustration of the V-Agent consistency verification protocol for different types of skillset submissions. subsequently advertised to agent controller or adjacent peer agents for further task orchestration. B. Zero-Trust Skillset Submission and Verification Proto￾col To prevent malicious, compromised, or sub-optimal agents from contaminating the decentralized registry with false capability advertis… view at source ↗
Figure 3
Figure 3. Figure 3: On-chain multi-agent collaborative training/inference procedures of (a) federated global model training and (b) [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: TrustAgentNet prototype. A. Prototype and Experimental Setup We develop a TrustAgentNet prototype based on an open-source Radio Access Network (RAN) and soft￾wareized 5G core network, as shown in [PITH_FULL_IMAGE:figures/full_fig_p012_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Comparison in (a) latency, (b) CPU utilization time and (c) traffic volume between the proposed CoS and the baseline (w/o CoS) during the skillset acquisition process across varying scales of skillsets in the system. Note that to eliminate visual masking effects caused by multi-magnitude scaling disparities, the dominant P2 (M-Agent inference) phase is placed at the top of the stacking hierarchy to preserv… view at source ↗
Figure 6
Figure 6. Figure 6 [PITH_FULL_IMAGE:figures/full_fig_p015_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: illustrates the latency performance of the ver￾ification protocol by analyzing the execution breakdown of 10 representative procedural skillsets across the three phases. The empirical results indicate that the latency associated with the initial artifact decoupling phase is practically negligible (as depicted in the inset diagram). The overall latency is heavily dominated by the LLM￾driven inference during… view at source ↗
Figure 9
Figure 9. Figure 9: Running time, real-measured CPU occupancy time, [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

45 extracted references · 7 linked inside Pith

  1. [1]

    Skillsets on the Chain: A Blockchain-based Trustworthy Agentic AI Networking Framework,

    Y. Gao, Y. Xiao, B. Liu, X. Li, A. Hu, W. Li, Y. Li, G. Shi, and P. Zhang, “Skillsets on the Chain: A Blockchain-based Trustworthy Agentic AI Networking Framework,” in Proc. of IEEE GLOBECOM, Taipei, Taiwan, Dec. 2025

    2025

  2. [2]

    Towards agentic AI networking in 6G: A generative foundation model-as-agent approach,

    Y. Xiao, G. Shi, and P. Zhang, “Towards agentic AI networking in 6G: A generative foundation model-as-agent approach,” IEEE Communications Magazine, vol. 63, no. 9, Sep. 2025

    2025

  3. [3]

    When AI Agents Go Wrong: Clawdbots’ Security Failures, Active Campaigns, and Defense Playbook,

    Guardz Cyber Intelligence Research, “When AI Agents Go Wrong: Clawdbots’ Security Failures, Active Campaigns, and Defense Playbook,” Feb. 2026

    2026

  4. [4]

    Agent-to-Agent (A2A) Protocol Specification,

    Google and Industry Partners, “Agent-to-Agent (A2A) Protocol Specification,” Apr. 2025

    2025

  5. [5]

    Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale,

    Y. Liu, W. Wang, R. Feng et al., “Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale,” arXiv preprint arXiv:2601.10338, 2026

    Pith/arXiv arXiv 2026

  6. [6]

    Behavioral Integrity Verification for AI Agent Skills,

    Y. Wu, T.-L. Li, and H. Liu, “Behavioral Integrity Verification for AI Agent Skills,” arXiv preprint arXiv:2605.11770, 2026

    Pith/arXiv arXiv 2026

  7. [7]

    Enabling 6G Security: The Synergy of Zero Trust Architecture and Artificial Intelli- gence,

    H. Sedjelmaci, K. Tourki, and N. Ansari, “Enabling 6G Security: The Synergy of Zero Trust Architecture and Artificial Intelli- gence,” IEEE Network, vol. 38, no. 3, pp. 171–177, 2024

    2024

  8. [8]

    Zero Trust Architec- ture for 6G Security,

    X. Chen, W. Feng, N. Ge, and Y. Zhang, “Zero Trust Architec- ture for 6G Security,” IEEE Network, vol. 38, no. 4, pp. 224–232, 2024

    2024

  9. [9]

    Agent AI: Surveying the Horizons of Multi- modal Interaction,

    Z. Durante et al., “Agent AI: Surveying the Horizons of Multi- modal Interaction,” arXiv preprint arXiv:2401.03568, Jan. 2024

    Pith/arXiv arXiv 2024

  10. [10]

    Agentic AI: Au- tonomous Intelligence for Complex Goals—A Comprehensive Survey,

    D. B. Acharya, K. Kuppan, and B. Divya, “Agentic AI: Au- tonomous Intelligence for Complex Goals—A Comprehensive Survey,” IEEE Access, vol. 13, Jan. 2025

    2025

  11. [11]

    AI Agent Gover- nance: A Field Guide,

    J. Kraprayoon, Z. Williams, and R. Fayyaz, “AI Agent Gover- nance: A Field Guide,” arXiv preprint arXiv:2505.21808, 2025

    Pith/arXiv arXiv 2025

  12. [12]

    PROMPTGUARD: Zero Trust Prompting for Securing LLM-Driven O-RAN Control,

    Y. Wang, X. Wu, J. Farooq et al., “PROMPTGUARD: Zero Trust Prompting for Securing LLM-Driven O-RAN Control,” in Proc. NDSS, 2026

    2026

  13. [13]

    Zero-Trust Architecture for MCP-Based AI Agents: A Unified CLI Approach,

    Y. Ando, “Zero-Trust Architecture for MCP-Based AI Agents: A Unified CLI Approach,” TechRxiv, vol. 2026, no. 0220, 2026

    2026

  14. [14]

    Zero Trust for AI Systems: A Reference Archi- tecture and Assurance Framework,

    R. Campbell, “Zero Trust for AI Systems: A Reference Archi- tecture and Assurance Framework,” Preprints, Feb. 2026

    2026

  15. [15]

    ”Do Anything Now

    X. Shen, Z. Chen, M. Backes, Y. Shen, and Y. Zhang, “”Do Anything Now”: Characterizing and Evaluating In-the-Wild Jailbreak Prompts on Large Language Models,” in Proc. ACM CCS, 2024, pp. 1671–1685

    2024

  16. [16]

    AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents,

    M. Andriushchenko, A. Souly, M. Dziemian et al., “AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents,” in Proc. ICLR, 2025

    2025

  17. [17]

    Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM- Based Agents,

    H. Zhang, J. Huang, K. Mei et al., “Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM- Based Agents,” in Proc. ICLR, 2025

    2025

  18. [18]

    AgentAuditor: Human-Level Safety and Security Evaluation for LLM Agents,

    H. Luo, S. Dai, C. Ni et al., “AgentAuditor: Human-Level Safety and Security Evaluation for LLM Agents,” in Proc. NeurIPS, 2025

    2025

  19. [19]

    Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw,

    Z. Ying, X. Yang, S. Wu et al., “Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw,” arXiv preprint arXiv:2603.12644, 2026

    arXiv 2026

  20. [20]

    Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis,

    Z. Li, J. Wu, X. Ling et al., “Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis,” arXiv preprint arXiv:2604.02837, 2026

    Pith/arXiv arXiv 2026

  21. [21]

    “Do Not Mention This to the User

    Y. Liu, Z. Chen, Y. Zhang et al., ““Do Not Mention This to the User”: Detecting and Understanding Malicious Agent Skills,” arXiv preprint arXiv:2602.06547, 2026

    Pith/arXiv arXiv 2026

  22. [22]

    ToolSafety: A Compre- hensive Dataset for Enhancing Safety in LLM-Based Agent Tool Invocations,

    Y. Xie, Y. S. Yuan, W. Wang et al., “ToolSafety: A Compre- hensive Dataset for Enhancing Safety in LLM-Based Agent Tool Invocations,” in Proc. EMNLP, Suzhou, China, Nov. 2025, pp. 14135–14156

    2025

  23. [23]

    SkillAttack: Automated Red Teaming of Agent Skills Through Attack Path Refinement,

    Z. Duan, Y. Tian, Z. Yin et al., “SkillAttack: Automated Red Teaming of Agent Skills Through Attack Path Refinement,” arXiv preprint arXiv:2604.04989, 2026

    Pith/arXiv arXiv 2026

  24. [24]

    Blockchain-Aided Decentral- ized Trust Management of Edge Computing: Toward Reliable Off-Chain and On-Chain Trust,

    L. Shi, T. Wang, Z. Xiong et al., “Blockchain-Aided Decentral- ized Trust Management of Edge Computing: Toward Reliable Off-Chain and On-Chain Trust,” IEEE Network, vol. 38, no. 5, pp. 182–188, Sep. 2024

    2024

  25. [25]

    Blockchain-Enabled Federated Learning: A Survey,

    Y. Qu, M. P. Uddin, C. Gan et al., “Blockchain-Enabled Federated Learning: A Survey,” ACM Comput. Surv., vol. 55, no. 4, Nov. 2022

    2022

  26. [26]

    When Federated Learning Meets Blockchain: A New Distributed Learning Paradigm,

    C. Ma, J. Li, L. Shi et al., “When Federated Learning Meets Blockchain: A New Distributed Learning Paradigm,” IEEE Computational Intelligence Magazine, vol. 17, no. 3, pp. 26–33, Jul. 2022

    2022

  27. [27]

    Federated Learning for Healthcare: Systematic Review and Architecture Proposal,

    R. S. Antunes, C. André da Costa et al., “Federated Learning for Healthcare: Systematic Review and Architecture Proposal,” ACM Trans. Intell. Syst. Technol., vol. 13, no. 4, May 2022

    2022

  28. [28]

    SPDL: A Blockchain-Enabled Secure and Privacy-Preserving Decentralized Learning System,

    M. Xu, Z. Zou, Y. Cheng et al., “SPDL: A Blockchain-Enabled Secure and Privacy-Preserving Decentralized Learning System,” IEEE Trans. Comput., vol. 72, no. 2, pp. 548–558, Apr. 2023

    2023

  29. [29]

    Blockchain and Federated Learning for Privacy-Preserved Data Sharing in Industrial IoT,

    Y. Lu, X. Huang et al., “Blockchain and Federated Learning for Privacy-Preserved Data Sharing in Industrial IoT,” IEEE Trans. Ind. Inform., vol. 16, no. 6, pp. 4177–4186, Sep. 2020

    2020

  30. [30]

    Incentive-Aware Blockchain- Assisted Intelligent Edge Caching and Computation Offloading for IoT,

    Q. Wang, S. Chen, and M. Wu, “Incentive-Aware Blockchain- Assisted Intelligent Edge Caching and Computation Offloading for IoT,” Engineering, vol. 31, pp. 127–138, Dec. 2023

    2023

  31. [31]

    When MoE Meets Blockchain: A Trustworthy Distributed Framework of Large Models,

    W. Zhu, L. Shi, K. Wei, Z. Mei, Z. Wang, J. Wang, and J. Li, “When MoE Meets Blockchain: A Trustworthy Distributed Framework of Large Models,” arXiv preprint arXiv:2509.12141, Sep. 2025

    arXiv 2025

  32. [32]

    Blockchain Meets Edge Computing: A Distributed and Trusted Authentication System,

    S. Guo, X. A. Hu, S. Guo et al., “Blockchain Meets Edge Computing: A Distributed and Trusted Authentication System,” IEEE Trans. Ind. Inform., vol. 16, no. 3, pp. 1972–1983, Aug. 2020

    1972

  33. [33]

    A Novel Secured Multi-Access Edge Computing Based VANET with Neuro Fuzzy Systems Based Blockchain Framework,

    M. Poongodi, S. Bourouis, A. N. Ahmed et al., “A Novel Secured Multi-Access Edge Computing Based VANET with Neuro Fuzzy Systems Based Blockchain Framework,” Comput. Commun., vol. 192, pp. 48–56, Aug. 2022

    2022

  34. [34]

    Blockchain-Enabled Resource Management and Sharing for 6G Communications,

    H. Xu, P. V. Klaine, O. Onireti et al., “Blockchain-Enabled Resource Management and Sharing for 6G Communications,” Digital Communications and Networks, vol. 6, no. 3, pp. 261– 269, Aug. 2020

    2020

  35. [35]

    Blockchain and Deep Reinforcement Learning Empowered Intelligent 5G Beyond,

    Y. Dai, D. Xu, S. Maharjan et al., “Blockchain and Deep Reinforcement Learning Empowered Intelligent 5G Beyond,” IEEE Network, vol. 33, no. 3, pp. 10–17, May 2019

    2019

  36. [36]

    Toward Scalable Generative AI via Mixture of Experts in Mobile Edge Networks,

    J. Wang, H. Du, D. Niyato et al., “Toward Scalable Generative AI via Mixture of Experts in Mobile Edge Networks,” IEEE Wireless Commun., vol. 32, no. 1, pp. 142–149, Oct. 2025

    2025

  37. [37]

    Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layer,

    N. Shazeer, A. Mirhoseini, K. Maziarz, A. Davis, Q. V. Le, G. E. Hinton, and J. Dean, “Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layer,” in Proc. ICLR, Toulon, France, Apr. 2017

    2017

  38. [38]

    SANet: A Semantic-aware Agentic AI Networking Framework for Cross-layer Optimization in 6G,

    Y. Xiao, X. Li, H. Zhou, Y. Li, Y. Gao, G. Shi, P. Zhang, and M. Krunz, “SANet: A Semantic-aware Agentic AI Networking Framework for Cross-layer Optimization in 6G,” IEEE Trans. Mobile Comput., pp. 1–18, 2026

    2026

  39. [39]

    On the Convergence of Zeroth- Order Federated Tuning for Large Language Models,

    Z. Ling, D. Chen, L. Yao et al., “On the Convergence of Zeroth- Order Federated Tuning for Large Language Models,” in Proc. ACM SIGKDD, 2024, pp. 1827–1838

    2024

  40. [40]

    Federated Multi- AgentDeepReinforcementLearning(Fed-MADRL)forDynamic Spectrum Access,

    H.-H. Chang, Y. Song, T. T. Doan et al., “Federated Multi- AgentDeepReinforcementLearning(Fed-MADRL)forDynamic Spectrum Access,” IEEE Trans. Wireless Commun., vol. 22, no. 8, pp. 5337–5348, 2023

    2023

  41. [41]

    Robust Multi-Agent Rein- forcement Learning via Adversarial Regularization: Theoretical Foundation and Stable Algorithms,

    A. Bukharin, Y. Li, Y. Yu et al., “Robust Multi-Agent Rein- forcement Learning via Adversarial Regularization: Theoretical Foundation and Stable Algorithms,” in Proc. NeurIPS, vol. 36, 2023, pp. 68121–68133. 18

    2023

  42. [42]

    Why Gradient Clipping Accel- erates Training: A Theoretical Justification for Adaptivity,

    J. Zhang, T. He, S. Sra et al., “Why Gradient Clipping Accel- erates Training: A Theoretical Justification for Adaptivity,” in Proc. ICLR, 2019

    2019

  43. [43]

    Your Own Mobile Network,

    srsRAN, “Your Own Mobile Network,” Online available at srsRAN website, 2019

    2019

  44. [44]

    Hyperledger Fabric: A Distributed Oper- ating System for Permissioned Blockchains,

    E. Androulaki et al., “Hyperledger Fabric: A Distributed Oper- ating System for Permissioned Blockchains,” in ACM EuroSys, Porto, Portugal, Apr. 2018, pp. 1–15

    2018

  45. [45]

    On the Convergence of FedAvg on Non-IID Data,

    X. Li, K. Huang, W. Yang et al., “On the Convergence of FedAvg on Non-IID Data,” in Proc. ICLR, Addis Ababa, Ethiopia, Apr. 2020. Yayu Gao (Member, IEEE) is an Associate Professor in the School of Electronic Infor- mation and Communications at the Huazhong University of Science and Technology (HUST), Wuhan, China. Her research interests include next-gener...

    2020