智能体间信任模型：智能体网络协议设计（A2A、AP2、ERC-8004 及更远）中 Brief、Claim、Proof、Stake、Reputation 与 Constraint 的比较研究
Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design-A2A, AP2, ERC-8004, and Beyond
AI总结：
本文系统比较了智能体间协议中六类信任模型（Brief、Claim、Proof、Stake、Reputation、Constraint），揭示单一机制不足以应对 LLM 特有脆弱性，并提出以 Proof 和 Stake 为核心的混合信任架构及可操作设计指南。
摘要：
随着“智能体网络”逐渐成形——数十亿个 AI 智能体（通常由 LLM 驱动）自主进行交易与协作——信任正从人类监督转向协议设计。2025 年，若干智能体间协议使这一转变具体化，包括 Google 的 Agent-to-Agent (A2A)、Agent Payments Protocol (AP2) 以及 Ethereum 的 ERC-8004 “Trustless Agents”，但它们底层的信任假设仍未得到充分审视。本文对智能体间协议设计中的信任模型进行了比较研究：Brief（自我或第三方可验证声明）、Claim（自我宣称的能力与身份，例如 AgentCard）、Proof（密码学验证，包括零知识证明和可信执行环境 attestation）、Stake（带罚没和保险的抵押担保）、Reputation（群体反馈和基于图的信任信号）以及 Constraint（沙箱化和能力边界限制）。针对每一种模型，我们分析了其假设、攻击面和设计权衡，并特别强调 LLM 特有的脆弱性——提示注入、谄媚/易受诱导、幻觉、欺骗和错位——这些脆弱性使得纯粹依赖声誉或仅依赖声明的方法变得脆弱。我们的研究结果表明，没有任何单一机制是足够的。我们主张采用默认无信任的架构，以 Proof 和 Stake 为锚点来管控高影响行为，并以 Brief 增强身份与发现能力，以 Reputation 叠加层提供灵活性和社会信号。我们在涵盖安全性、隐私、延迟/成本以及社会鲁棒性（抗 Sybil/合谋/洗白）的指标下，对 A2A、AP2、ERC-8004 以及学术研究中相关的历史变体进行了比较评估。最后，我们提出了混合信任模型建议，以缓解声誉博弈和 LLM 的错误信息行为，并提炼出可操作的设计指南，以构建更安全、可互操作且可扩展的智能体经济。
英文摘要：
As the "agentic web" takes shape-billions of AI agents (often LLM-powered) autonomously transacting and collaborating-trust shifts from human oversight to protocol design. In 2025, several inter-agent protocols crystallized this shift, including Google's Agent-to-Agent (A2A), Agent Payments Protocol (AP2), and Ethereum's ERC-8004 "Trustless Agents," yet their underlying trust assumptions remain under-examined. This paper presents a comparative study of trust models in inter-agent protocol design: Brief (self- or third-party verifiable claims), Claim (self-proclaimed capabilities and identity, e.g. AgentCard), Proof (cryptographic verification, including zero-knowledge proofs and trusted execution environment attestations), Stake (bonded collateral with slashing and insurance), Reputation (crowd feedback and graph-based trust signals), and Constraint (sandboxing and capability bounding). For each, we analyze assumptions, attack surfaces, and design trade-offs, with particular emphasis on LLM-specific fragilities-prompt injection, sycophancy/nudge-susceptibility, hallucination, deception, and misalignment-that render purely reputational or claim-only approaches brittle. Our findings indicate no single mechanism suffices. We argue for trustless-by-default architectures anchored in Proof and Stake to gate high-impact actions, augmented by Brief for identity and discovery and Reputation overlays for flexibility and social signals. We comparatively evaluate A2A, AP2, ERC-8004 and related historical variations in academic research under metrics spanning security, privacy, latency/cost, and social robustness (Sybil/collusion/whitewashing resistance). We conclude with hybrid trust model recommendations that mitigate reputation gaming and misinformed LLM behavior, and we distill actionable design guidelines for safer, interoperable, and scalable agent economies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
