When Should Agent Trust Be Conditional? Characterizing and Attacking Skill-Conditional Reputation in Agent Swarms

2026-06-12

AI Summary

Traditional global trust mechanisms struggle to capture the heterogeneous capabilities of agents across distinct skills and overlook the value of specialization. This work proposes a skill-conditioned trust mechanism, \( R(i|k) \), and for the first time employs phase diagram analysis to rigorously delineate its regime of validity. The study reveals that while cross-skill evidence borrowing enhances data efficiency, it simultaneously introduces significant safety risks. To address this, we introduce a zero-cost Conditional Information Value Test (CIVT) to evaluate mechanism safety. Experiments on a real-world pool of heterogeneous AppWorld agents demonstrate that, within its valid regime, conditional trust yields modest yet tangible performance gains; however, adversaries can exploit cross-skill borrowing to inflate routing regret from 0 to 0.94, exposing a critical security vulnerability.

Abstract

Open platforms increasingly route tasks among heterogeneous LLM agents--differing in base model, scaffold, and tool stack--whose competence varies sharply by skill: an agent excellent at one skill may be useless at another. The standard reputation approach summarizes each agent by a single global trust score, but that scalar is the wrong object here, because routing every task to the globally most-trusted agent leaves the value of specialization unclaimed. We study skill-conditional trust R(i | k)--the trust to place in agent i for a task requiring skill k, rather than one score per agent--and pose three falsifiable questions: when is conditioning worth it, how much cross-skill evidence should be borrowed, and whether that borrowing is safe. A controlled phase-diagram analysis answers the first two: conditional trust wins only in a specific regime--high agent heterogeneity, sparse per-skill evidence, and correlated skills--and the coupling strength beta that buys this data efficiency is dual-use, because the same cross-skill borrowing is also a laundering channel. On a public benchmark of 14 genuinely heterogeneous AppWorld agents, real pools land inside the beneficial regime--a small but genuine gain, with the per-skill best agent genuinely changing across skills. We then show that an attacker with cheap evidence in one skill and none in a target skill hijacks the conditional router, driving routing regret from 0 to 0.94 on a pool our zero-cost Conditional Information Value Test (CIVT) rates GREEN--while the ungated trust verdict it contaminates reads -0.06 instead of the honest +0.19. A zero-evidence gate bounds the attack but does not eliminate it; we characterize the residual cost under an explicit budget. We do not claim Sybil-resistance--we quantify the trade-off.

Problem

• skill-conditional trust
• agent swarms
• reputation systems
• heterogeneous agents
• trust routing

Innovation

• skill-conditional trust
• agent heterogeneity
• cross-skill evidence borrowing
• trust laundering
• Conditional Information Value Test