QoS-Aware Token Scheduling and Private Data Valuation for Multi-Modal Agentic Networks

# QoS-Aware Token Scheduling and Private Data Valuation for Multi-Modal Agentic Networks
Source: [https://arxiv.org/html/2606.15573](https://arxiv.org/html/2606.15573)
Yao Du12, Jing Liu1, Pengfei Xu2, Zehua Wang13, Victor C\.M\. Leung146, Cyril Leung1, Victoria Lemieux1 \{yaodu, jingliu, zwang, vleung, cleung\}@ece\.ubc\.ca, nora@lazai\.network, v\.lemieux@ubc\.caThis work was supported in part by Mitacs Project IT47821 under Grant QJLI GR037230, the Natural Sciences and Engineering Research Council \(NSERC\) of Canada under Grants RGPIN\-2019\-06348, RGPIN\-2020\-05410, RGPIN\-2021\-02970, DGECR\-2021\-00187, the Guangdong Pearl River Talents Recruitment Program Grant 2019ZT08X603, the Guangdong Pearl Rivers Talent Plan Grant 2019JC01X235, the Mitacs Project IT44479, and the UBC PMC\-Sierra Professorship in Networking and Communications \(Corresponding authors: Zehua Wang and Jing Liu\)\.

###### Abstract

In agentic systems, human\-generated data records anchor the value of AI services\. Yet cloud compute pipelines centralize processing on remote servers\. Data centralization reduces personal data sovereignty and may potentially degrade the quality of service \(QoS\)\. Meanwhile, user contributions are diverse in quantity and quality: decentralized records can bebiased, noisy, and heterogeneously distributed\. To address the data challenge, we study fair token allocation and private data valuation for decentralized and resource\-constrained agentic systems\. Our approach embeds multi\-modal representations in a shared semantic space and releases differentially private \(DP\) prototypes to preserve utility while reducing semantic leakage\. With the DP guarantee, we design a fair token allocation scheme that rewards effective contributions and remains robust to data heterogeneity and AI resource scarcity\. Extensive simulations demonstrate improved contribution\-based fairness and QoS compared to standard benchmarks\. The improved resistance to image reconstruction attacks indicates enhanced privacy for multi\-modal personal data\.

## IIntroduction

Nowadays, artificial intelligence \(AI\) is increasingly enabling applications at the network edge\[[2](https://arxiv.org/html/2606.15573#bib.bib2)\]\. Agentic applications, powered by multiple AI agents, have become a major research focus\. Traditionally, these systems follow a cloud\-centric pipeline: user data are collected on\-device, transmitted to remote servers, processed by large foundation models in the core network, and then returned as agent actions\. While this architecture accelerated early AI adoption, it also introduces substantial privacy and security risks because sensitive data must leave the device\. For instance, voice assistants may upload continuous audio snippets, and recommendation agents may infer or expose private attributes \(e\.g\., financial records\) without explicit user consent\.

As AI decisions become more autonomous and financially consequential, there is a growing shift toward edge intelligence, where AI agents execute closer to users on personal devices or edge servers\. This shift reduces latency and reliance on centralized infrastructure, and it better supports user data sovereignty\. However, decentralized edge intelligence\[[3](https://arxiv.org/html/2606.15573#bib.bib5)\]introduces new systems challenges: user contributions are heterogeneous, resources such as compute and AI quotas are limited, and an ad hoc scheduler can waste or amplify unfair allocation of scarce edge resources\. The trade\-off between quality of service \(QoS\) and data sovereignty leads to a central question:

How can we quantify data value in a privacy\-preserving way and fairly allocate scarce AI usage quotas?

While the Shapley value is a well\-studied tool for data valuation\[[9](https://arxiv.org/html/2606.15573#bib.bib4)\], Shapley\-based schemes are often impractical in decentralized settings\. Computing data Shapley values typically requires repeated model retraining and external access to raw data\. Moreover, privacy\-preserving cross\-validation\[[3](https://arxiv.org/html/2606.15573#bib.bib5)\]can provide reliable estimates, but it assumes the availability of a local validation set, which adds the deployment complexity of agentic applications\. Furthermore, trusted execution environments\[[6](https://arxiv.org/html/2606.15573#bib.bib14)\]offer efficient integrity and confidentiality for outsourced computation, but depend on hardware trust and can be vulnerable to side channels\. In contrast, zero\-knowledge proofs\[[1](https://arxiv.org/html/2606.15573#bib.bib13)\]can prove correct computation validation without revealing inputs or AI models, but often incur high proof\-generation overhead on resource\-constrained edge devices\.

To address this gap, we study differential privacy \(DP\) for private data valuation and token\-bucket scheduling for fair AI quota allocation\. In decentralized multi\-modal agentic systems, we embed user contributions into a shared semantic representation space and cluster embeddings into individual\-centric decentralized autonomous organizations \(iDAOs\)111https://lazai\.network/learn/idaofor decentralized data valuation\. Building on standard DP guarantees\[[4](https://arxiv.org/html/2606.15573#bib.bib7)\], we release DP\-protected prototypes as iDAO catalog entries to support utility while limiting semantic leakage under reconstruction attacks\. More concretely, our contributions are:

- •We introduce a QoS\-aware incentive framework that treats scarce AI compute resources, rather than static payments, as the dynamic currency for decentralized markets\. By implementing data anchoring tokens \(DAT\)222https://github\.com/0xLazAI/contracts, we settle contribution value into the parameters of a token\-bucket scheduler, ensuring resource access is mathematically proportional to contributed data utility\.
- •We propose a semantic market primitive that solves the “discovery\-privacy” paradox\. By representing raw data as iDAO\-governed, DP\-protected prototypes, we enable agents to semantically search and trade knowledge with a formal DP guarantee, thereby eliminating the need to expose raw data during the valuation phase\.
- •We provide extensive evaluations demonstrating that the token allocation scheme maintains fair allocation even under highly unbalanced contribution distributions\. To validate the system’s utility in adversarial environments, we empirically prove the system’s superior resistance to reconstruction attacks compared to baselines\.

## IISystem Model and Problem Formulation

In this section, we introduce the system model of data valuation in the context of verifiable agentic systems\. We further map the data valuation problem to a token\-bucket scheduling problem to improve the fairness and QoS in decentralized agentic systems\.

### II\-AAgentic Network Model

![Refer to caption](https://arxiv.org/html/2606.15573v1/x1.png)Figure 1:Cloud\-edge\-end collaborative agentic framework\. An example withM=2M=2andN=3N=3\.As shown in Fig\.[1](https://arxiv.org/html/2606.15573#S2.F1), we consider an end–edge–cloud collaboration architecture for the agentic network\. Specifically, AI agentsn∈𝒩=\{1,2,…,N\}n\\in\\mathcal\{N\}=\\\{1,2,\\ldots,N\\\}run at the network edge and interact with end users\. When local resources are insufficient, an agent offloads part of its workload to distributed edge serversm∈ℳ=\{1,2,…,M\}m\\in\\mathcal\{M\}=\\\{1,2,\\ldots,M\\\}that collectively form a decentralized AI compute network\. Beyond providing shared compute, edge servers conduct Layer\-2 coordination, i\.e\., off\-chain validation of submitted data and computation outcomes, generate verifiable proofs, and periodically commit summaries to the on\-chain ledger for reward settlement \(e\.g\., via DAT\)\. We also consider a remote cloud server operated by a large AI provider as a fallback for tasks that cannot be efficiently executed at the edge\.

### II\-BData Valuation Model

We adopt the DAT as an on\-chain abstraction for valuing data and proofs in our agentic system\. A DAT is a semi\-fungible token designed for AI\-native digital assets \(datasets, models, or computation results\); each token jointly encodes an ownership certificate, usage right \(quota\), and value share for future revenue\.

For any agentn∈𝒩n\\in\\mathcal\{N\},un∈ℝ≥0u\_\{n\}\\in\\mathbb\{R\}\_\{\\geq 0\}denotes the allocated utility quota\. LetVVdenote the total utility quota available for allocation\. Then,

∑n=1Nun≤V\.\\sum\_\{n=1\}^\{N\}u\_\{n\}\\leq V\.\(1\)
For any agentn∈𝒩n\\in\\mathcal\{N\}, letvn≥0v\_\{n\}\\geq 0represent the DAT*data value*governing revenue splits\. We define the DAT record as\(addressn,vn,ρn\)\\big\(\{\\text\{address\}\}\_\{n\},v\_\{n\},\\,\\rho\_\{n\}\\big\), whereaddressn\\text\{address\}\_\{n\}denotes the ownership proof linked to an account address andρn\\rho\_\{n\}is a compact metadata pointer \(e\.g\., integrity hash and provenance proof\)\. Let𝐯=\(v1,v2,…,vn\)\\mathbf\{v\}=\(v\_\{1\},v\_\{2\},\\dots,v\_\{n\}\)andvn≤f​\(𝐝n\)v\_\{n\}\\leq f\(\\mathbf\{d\}\_\{n\}\), where𝐝n\\mathbf\{d\}\_\{n\}denotes the data contribution by agentnnandf​\(𝐝n\)f\(\\mathbf\{d\}\_\{n\}\)is the valuation function calculating the data value of𝐝n\\mathbf\{d\}\_\{n\}\. Details of the non\-negative functionf​\(𝐝n\)f\(\\mathbf\{d\}\_\{n\}\)are introduced in Section[IV](https://arxiv.org/html/2606.15573#S4)\. Therefore, we have

0≤vn≤f​\(𝐝n\)\.0\\leq v\_\{n\}\\leq f\(\\mathbf\{d\}\_\{n\}\)\.\(2\)
In Section[III\-C](https://arxiv.org/html/2606.15573#S3.SS3),vnv\_\{n\}is used to parameterize the refill rate of the token\-bucket scheduler\. By using a personalized refill rate, higher\-valued contributors receive proportionally larger and more frequent AI quotas\.

### II\-CThreat Model

We assume a partially trusted agentic network: the ledger and smart contracts execute correctly, but individual DAT contributors may behave strategically\.

We consider that servers, including data validators and edge computing nodes, may be curious about personal information and could mount membership inference attacks\. In Section[III](https://arxiv.org/html/2606.15573#S3), differential privacy noise is applied for privacy protection\. Letℳ\\mathcal\{M\}denote a randomized mechanism that takes a dataset as input and outputs a result\. LetDDandD′D^\{\\prime\}denote two neighbouring datasets that differ in at most one individual’s record\. LetSSdenote an arbitrary measurable subset of the output space ofℳ\\mathcal\{M\}\. Letε≥0\\varepsilon\\geq 0denote the privacy budget \(smallerε\\varepsilonmeans stronger privacy\), and let0≤δ<10\\leq\\delta<1denote the probability of a privacy violation\.

A randomized mechanismℳ\\mathcal\{M\}is\(ε,δ\)\(\\varepsilon,\\delta\)\-differentiallyprivate\[[4](https://arxiv.org/html/2606.15573#bib.bib7)\]if for all neighbouring datasets𝐝,𝐝′\\mathbf\{d\},\\mathbf\{d\}^\{\\prime\}and all measurable setsSS,

Pr⁡\[ℳ​\(𝐝\)∈S\]≤eε​Pr⁡\[ℳ​\(𝐝′\)∈S\]\+δ,\\Pr\[\\mathcal\{M\}\(\\mathbf\{d\}\)\\in S\]\\leq e^\{\\varepsilon\}\\Pr\[\\mathcal\{M\}\(\\mathbf\{d\}^\{\\prime\}\)\\in S\]\+\\delta,\(3\)and symmetrically,

Pr⁡\[ℳ​\(𝐝′\)∈S\]≤eε​Pr⁡\[ℳ​\(𝐝\)∈S\]\+δ\.\\Pr\[\\mathcal\{M\}\(\\mathbf\{d\}^\{\\prime\}\)\\in S\]\\leq e^\{\\varepsilon\}\\Pr\[\\mathcal\{M\}\(\\mathbf\{d\}\)\\in S\]\+\\delta\.\(4\)

### II\-DFairness Metrics

To quantify the fairness of quota or resource allocation amongNNagents, we employ two classical inequality measures: Jain’s fairness index and the Gini coefficient\.

Let𝐮=\(u1,u2,…,un\)\\mathbf\{u\}=\(u\_\{1\},u\_\{2\},\\dots,u\_\{n\}\)denote the non\-negative utility quota \(i\.e\., effective AI quota\) received by each agent\. Let𝐫=\(r1,r2,…,rn\)\\mathbf\{r\}=\(r\_\{1\},r\_\{2\},\\dots,r\_\{n\}\)denote the reward rate,

rn=\{unvn,vn\>0,0,vn=0\.\\displaystyle r\_\{n\}=\\begin\{cases\}\\frac\{\{u\}\_\{n\}\}\{\{v\}\_\{n\}\},&v\_\{n\}\>0,\\\\ 0,&v\_\{n\}=0\.\\end\{cases\}\(5\)
Our fairness analysis focuses on the distribution of reward rates, i\.e\., reward per contribution\.Agents with similar data contributions should have comparable reward rates\.

Additionally,Jmin∈\(0,1\)\{J\}\_\{\\text\{min\}\}\\in\(0,1\)andGmax∈\(0,1\)\{G\}\_\{\\text\{max\}\}\\in\(0,1\)represent the fairness bounds to mitigate algorithmic bias among agents and centralized dominance over system utility allocation\.

#### II\-D1Jain’s Fairness Index\.

Jain’s indexJ​\(𝐫\)J\(\\mathbf\{r\}\)evaluates how evenly the reward rates are distributed across agents\.

J​\(𝐫\)=\(∑n=1Nrn\)2N​∑n=1Nrn2,J\(\\mathbf\{r\}\)=\\frac\{\\left\(\\sum\_\{n=1\}^\{N\}r\_\{n\}\\right\)^\{2\}\}\{N\\sum\_\{n=1\}^\{N\}r\_\{n\}^\{2\}\},\(6\)where

J​\(𝐫\)≥Jmin,0<Jmin≤1\.\\quad J\(\\mathbf\{r\}\)\\geq\{J\}\_\{\\text\{min\}\},0<\{J\}\_\{\\text\{min\}\}\\leq 1\.\(7\)NoteJ​\(𝐫\)=1J\(\\mathbf\{r\}\)=1if and only if all agents receive the same reward rate\. A smallerJ​\(𝐫\)J\(\\mathbf\{r\}\)reflects increasing disparity in the token allocation\.

#### II\-D2Gini Coefficient\.

In contrast, the Gini coefficientG​\(𝐫\)G\(\\mathbf\{r\}\)captures the pairwise deviations\.

G​\(𝐫\)=∑i=1N∑j=1N\|ri−rj\|2​N​∑n=1Nrn,G\(\\mathbf\{r\}\)=\\frac\{\\displaystyle\\sum\_\{i=1\}^\{N\}\\sum\_\{j=1\}^\{N\}\\left\|r\_\{i\}\-r\_\{j\}\\right\|\}\{2N\\displaystyle\\sum\_\{n=1\}^\{N\}r\_\{n\}\},\(8\)where

G​\(𝐫\)≤Gmax,0≤Gmax<1\.\\quad G\(\\mathbf\{r\}\)\\leq\{G\}\_\{\\text\{max\}\},0\\leq\{G\}\_\{\\text\{max\}\}<1\.\(9\)Note thatG​\(𝐫\)=0G\(\\mathbf\{r\}\)=0corresponds to a perfectly equal reward rate distribution and larger values indicate higher inequality\.

### II\-EJoint Incentivization Problem

We acknowledge that the fairness metrics are rarely considered in speculative token markets\. In contrast, decentralized AI computing infrastructures, such as the LazAI network333https://lazai\.network/, must effectively allocate AI quotas to prevent service outages caused by resource monopolization\.

In the context of decentralized AI computing networks, we model the social welfare function, denoted byℱ\\mathcal\{F\}, as follows:

ℱ​\(𝐯,𝐮\)=∑n=1Nvn​un≤∑n=1Nf​\(𝐝n\)​un\.\\mathcal\{F\}\(\\mathbf\{v\},\\mathbf\{u\}\)=\\sum\_\{n=1\}^\{N\}v\_\{n\}u\_\{n\}\\leq\\sum\_\{n=1\}^\{N\}f\(\\mathbf\{d\}\_\{n\}\)u\_\{n\}\.\(10\)One observation from the above objective is thatℱ\\mathcal\{F\}encourages valuable data contribution to maximizef​\(𝐝n\)f\(\\mathbf\{d\}\_\{n\}\)\. Forn∈𝒩n\\in\\mathcal\{N\},

maximize𝐯,𝐮\\displaystyle\\mathop\{\\text\{maximize\}\}\_\{\\mathbf\{v\},\\mathbf\{u\}\}ℱ​\(𝐯,𝐮\),\\displaystyle\\quad\\mathcal\{F\}\(\\mathbf\{v\},\\mathbf\{u\}\),\(11\)s\.t\.\([1](https://arxiv.org/html/2606.15573#S2.E1)\),\([2](https://arxiv.org/html/2606.15573#S2.E2)\),\([7](https://arxiv.org/html/2606.15573#S2.E7)\),\([9](https://arxiv.org/html/2606.15573#S2.E9)\)\.\\displaystyle\\quad\(\\ref\{equ:val\_sum\}\),\(\\ref\{cons:share\}\),\(\\ref\{cons:Jain\}\),\(\\ref\{cons:Gini\}\)\.
We note that \([11](https://arxiv.org/html/2606.15573#S2.E11)\) is non\-convex due to the objective function \([10](https://arxiv.org/html/2606.15573#S2.E10)\) and constraints \([7](https://arxiv.org/html/2606.15573#S2.E7)\), \([9](https://arxiv.org/html/2606.15573#S2.E9)\)\. Therefore, it is very challenging to solve \([11](https://arxiv.org/html/2606.15573#S2.E11)\) optimally\. In the following sections, we adopt a two\-stage approach: we first optimize𝐮\\mathbf\{u\}given𝐯\\mathbf\{v\}in Section[III](https://arxiv.org/html/2606.15573#S3); then, we optimize𝐯\\mathbf\{v\}given𝐮\\mathbf\{u\}in Section[IV](https://arxiv.org/html/2606.15573#S4)to obtain an effective solution for decentralized AI compute networks\.

## IIIQoS\-Aware Token Allocation

In this section, we explore a token allocation scheme that balances fairness and performance\. Given𝐯\\mathbf\{v\}, we show that the best strategy for each agent under this scheme is to actively use the remaining quota\. We embed a “spend to earn more” property in our incentive design\. That is, no additional tokens will be allocated to an agent with a full token bucket\.

### III\-AProblem Reformulation

Given𝐯\\mathbf\{v\}, \([11](https://arxiv.org/html/2606.15573#S2.E11)\) is reformulated as

maximize𝐮\\displaystyle\\mathop\{\\text\{maximize\}\}\_\{\\mathbf\{u\}\}∑n=1Nvn​un,\\displaystyle\\quad\\sum\_\{n=1\}^\{N\}v\_\{n\}u\_\{n\},\(12\)s\.t\.\([1](https://arxiv.org/html/2606.15573#S2.E1)\),\([7](https://arxiv.org/html/2606.15573#S2.E7)\),\([9](https://arxiv.org/html/2606.15573#S2.E9)\)\.\\displaystyle\\quad\(\\ref\{equ:val\_sum\}\),\(\\ref\{cons:Jain\}\),\(\\ref\{cons:Gini\}\)\.Note that \([12](https://arxiv.org/html/2606.15573#S3.E12)\) is still non\-convex due to constraints \([7](https://arxiv.org/html/2606.15573#S2.E7)\) and \([9](https://arxiv.org/html/2606.15573#S2.E9)\)\. In low\-latency computing scenarios, non\-convex optimization problems are typically handled by seeking near\-optimal solutions that significantly reduce optimization complexity\. To enable real\-time token allocation in agentic systems, we therefore propose a simple yet effective scheme based on token\-bucket scheduling\.

### III\-BToken\-Bucket for Agents

Token\-bucket scheduling regulates network traffic by accumulating tokens in a limited\-capacity bucket to control data bursts while enforcing a reliable long\-term service\[[10](https://arxiv.org/html/2606.15573#bib.bib3)\]\. In a decentralized AI system deployed at the network edge, computing resources are similarly constrained compared with bandwidth\-limited networks\. Therefore, it is critical to design a mechanism that uses AI quota efficiently while avoiding service outages due to resource limitations\.

![Refer to caption](https://arxiv.org/html/2606.15573v1/x2.png)Figure 2:Token\-bucket scheduling in a three\-agent system\. Utility quotas are represented as tokens capped by per\-agent bucket sizes\. Blockchain servers read the DAT information to distribute tokens\.As illustrated in Fig\.[2](https://arxiv.org/html/2606.15573#S3.F2), we adopt the token buckets for agentic systems by treating*AI quota*as tokens in a virtual bucket for each agent\. By using a virtual “bucket” to store tokens as utility quotas, agents are allowed to have bursts of inference queries up to the bucket’s capacity\. LetBnB\_\{n\}andRnR\_\{n\}respectively denote the bucket size and remaining tokens for agentn∈𝒩n\\in\\mathcal\{N\}\. Typically,BnB\_\{n\}corresponds to service subscription tiers\. Then, we have

0≤un≤Bn−Rn\.\\displaystyle 0\\leq u\_\{n\}\\leq B\_\{n\}\-R\_\{n\}\.\(13\)

### III\-CQoS\-Aware Token Scheduling

As described above, token\-bucket scheduling is a conventional network traffic shaping method\[[10](https://arxiv.org/html/2606.15573#bib.bib3)\], which we utilize to reshape per\-agent AI quota allocation\. Based on the token\-bucket model, we relax \([12](https://arxiv.org/html/2606.15573#S3.E12)\) to a token allocation problem as follows:

maximize𝐮\\displaystyle\\mathop\{\\text\{maximize\}\}\_\{\\mathbf\{u\}\}∑n=1Nvn​un,\\displaystyle\\quad\\sum\_\{n=1\}^\{N\}v\_\{n\}u\_\{n\},\(14\)s\.t\.\([1](https://arxiv.org/html/2606.15573#S2.E1)\),\([13](https://arxiv.org/html/2606.15573#S3.E13)\)\.\\displaystyle\\quad\(\\ref\{equ:val\_sum\}\),\(\\ref\{cons:bucket\_constraint\}\)\.
For any agentn∈𝒩n\\in\\mathcal\{N\}, we can obtain the optimized token allocation as follows:

un=\{min⁡\{vn∑kvk​V,Bn−Rn\},Rn<Bn,0,Rn=Bn\.\\displaystyle u\_\{n\}=\\begin\{cases\}\\min\\bigl\\\{\\frac\{v\_\{n\}\}\{\\sum\_\{k\}v\_\{k\}\}V,\\;B\_\{n\}\-R\_\{n\}\\bigr\\\},&R\_\{n\}<B\_\{n\},\\\\ 0,&R\_\{n\}=B\_\{n\}\.\\end\{cases\}\(15\)
Therefore, the optimal strategy for a rational agent is to actively spend its tokens on useful inference and to keep contributing high\-quality data \(Section[IV](https://arxiv.org/html/2606.15573#S4)\), rather than hoarding tokens or remaining idle\. We further provide simulation results and analysis in Section[V](https://arxiv.org/html/2606.15573#S5)to justify the effectiveness of our proposed schemes\.

## IVDifferential Private Data Valuation

Once we obtain the token allocation strategy𝐮\\mathbf\{u\}, the next stage is to derive an effective data valuation functionf​\(𝐝n\)f\(\\mathbf\{d\}\_\{n\}\)to calculate𝐯\\mathbf\{v\}fairly and authentically\. In decentralized AI systems, a key research and engineering question is: how can data value be evaluated accurately without compromising privacy? In this section, we explore a multi\-modal agentic novelty detection method with differential privacy guarantees to answer the above question\.

### IV\-AProblem Reformulation and Analysis

Given𝐮\\mathbf\{u\}, we relax and reformulate \([11](https://arxiv.org/html/2606.15573#S2.E11)\) as

maximize𝐯\\displaystyle\\mathop\{\\text\{maximize\}\}\_\{\\mathbf\{v\}\}∑n=1Nvn​un,\\displaystyle\\quad\\sum\_\{n=1\}^\{N\}v\_\{n\}u\_\{n\},\(16\)s\.t\.\([2](https://arxiv.org/html/2606.15573#S2.E2)\)\.\\displaystyle\\quad\(\\ref\{cons:share\}\)\.Note \([16](https://arxiv.org/html/2606.15573#S4.E16)\) can be decomposed into and equivalent toNNindependent linear programming problems\.

For anyn∈𝒩n\\in\\mathcal\{N\},

maximizevn\\displaystyle\\mathop\{\\text\{maximize\}\}\_\{v\_\{n\}\}vn​un,\\displaystyle\\quad v\_\{n\}u\_\{n\},\(17\)s\.t\.\([2](https://arxiv.org/html/2606.15573#S2.E2)\)\.\\displaystyle\\quad\(\\ref\{cons:share\}\)\.Then, we can obtain the solution for agentnnas follows:

vn=\{f​\(𝐝n\),un\>0,0,un=0\.\\displaystyle v\_\{n\}=\\begin\{cases\}f\(\\mathbf\{d\}\_\{n\}\),&u\_\{n\}\>0,\\\\ 0,&u\_\{n\}=0\.\\end\{cases\}\(18\)To obtain the best data valuevnv\_\{n\}, each agent must contribute𝐝n\\mathbf\{d\}\_\{n\}to maximizef​\(𝐝n\)f\(\\mathbf\{d\}\_\{n\}\)\. Therefore,

𝐝n⋆=arg⁡max𝐝n∈𝒟n⁡f​\(𝐝n\),\\mathbf\{d\}^\{\\star\}\_\{n\}=\\arg\\max\_\{\\mathbf\{d\}\_\{n\}\\in\\mathcal\{D\}\_\{n\}\}f\(\\mathbf\{d\}\_\{n\}\),\(19\)where𝒟n\\mathcal\{D\}\_\{n\}denote all possible data contributions from agentnn\. Equation \([19](https://arxiv.org/html/2606.15573#S4.E19)\) implies that, under the proposed system, a rational agent will contribute as much as possible to maximize the data value computed byf​\(𝐝n\)f\(\\mathbf\{d\}\_\{n\}\)\.

### IV\-BPrivate Data Valuation

Let\|⋅\|\|\\cdot\|denote the set cardinality\. Then, the data quantity of𝐝n\\mathbf\{d\}\_\{n\}can be represented as\|𝐝n\|\|\\mathbf\{d\}\_\{n\}\|\. We further define a novelty score function, denoted byϕ​\(𝐝n\)∈\[0,1\]\\phi\(\\mathbf\{d\}\_\{n\}\)\\in\[0,1\], to quantify the average data novelty over𝐝n\\mathbf\{d\}\_\{n\}\. We propose

f​\(𝐝n\)=ϕ​\(𝐝n\)​ln⁡\(1\+\|𝐝n\|\)\.\\displaystyle f\(\\mathbf\{d\}\_\{n\}\)=\\phi\(\\mathbf\{d\}\_\{n\}\)\\ln\(1\+\|\\mathbf\{d\}\_\{n\}\|\)\.\(20\)
We consider a dynamic data valuation function that depends on both data quality and data quantity\. The main indicator of data quality,ϕ​\(𝐝n\)\\phi\(\\mathbf\{d\}\_\{n\}\), measures how the contributed data𝐝n\\mathbf\{d\}\_\{n\}enriches the discovered knowledge of the decentralized agentic system\. By definition, noisy contributions yieldϕ​\(𝐝n\)=0\\phi\(\\mathbf\{d\}\_\{n\}\)=0\. In contrast, the natural logarithm is used to capture the diminishing marginal utility of increasing data quantity\[[3](https://arxiv.org/html/2606.15573#bib.bib5)\]\. In this paper, we propose a data novelty\-based valuation method to approximate the true data value with reduced computational complexity\.

![Refer to caption](https://arxiv.org/html/2606.15573v1/x3.png)Figure 3:DP noise is added to high\-dimensional private data before data valuation\. Each semantic cluster forms an iDAO to govern data valuation and reward settlement\.As shown in Fig\.[3](https://arxiv.org/html/2606.15573#S4.F3), raw data \(e\.g\., texts or images\) are first encoded into numerical vectors in a semantic embedding space\. As users continue to contribute new data, data embeddings form clusters in the semantic space\. Data embeddings from the same cluster are averaged into a prototype\. For privacy protection, DP noise is added to the prototype embedding vector before it is transmitted to the edge server\.

To incentivize high\-quality contributions, we introduce a thresholdΓ\\Gammato distinguish novel from normal data\. Our intuition is that novelty is tied to timestamped data freshness: the firstΓ\\Gammasamples that populate a newly discovered cluster are treated as novel data, i\.e\.,ϕ​\(𝐝n\)=1\\phi\(\\mathbf\{d\}\_\{n\}\)=1, while subsequent samples falling into the same cluster are considered normal contributions, i\.e\.,ϕ​\(𝐝n\)=0\.5\\phi\(\\mathbf\{d\}\_\{n\}\)=0\.5\. In contrast, noisy or low\-quality data, which cannot be confidently assigned to any cluster, is regarded as semantically noisy and does not receive novelty credit, i\.e\.,ϕ​\(𝐝n\)=0\\phi\(\\mathbf\{d\}\_\{n\}\)=0\.

Letqqdenote the perturbation coefficient for the noise andssdenote a scale parameter for the Gaussian distribution\. LetΔ2\\Delta\_\{2\}denoteℓ2\\ell\_\{2\}\-sensitivity of the mean embedding\. According to the Gaussian Mechanism\[[4](https://arxiv.org/html/2606.15573#bib.bib7)\], we require

q2​s2≥\(Δ2​2​ln⁡\(1\.25/δ\)ε\)2,\\displaystyle q^\{2\}s^\{2\}\\;\\geq\\;\\left\(\\frac\{\\Delta\_\{2\}\\sqrt\{2\\ln\(1\.25/\\delta\)\}\}\{\\varepsilon\}\\right\)^\{2\},\(21\)which guarantees the DP prototype obtained is\(ε,δ\)\(\\varepsilon,\\delta\)\-differentially private\. Detailed derivations are included in the supplementary materials\.

## VResults and Analysis

In this section, we evaluate our proposed schemes by computer simulations\. In a decentralized edge environment, heterogeneous private data leads to diverse data contributions\. We first use Jain’s fairness index and Gini coefficient to test the fairness of AI quota allocation\. Then, we evaluate our decentralized data valuation method in different blockchain environments\. Finally, the proposed novelty detection with DP noise is evaluated for privacy protection\.

### V\-AExperimental Setup

We respectively set up three experiments for token allocation, data valuation, and privacy protection\. The well\-known COCO dataset\[[7](https://arxiv.org/html/2606.15573#bib.bib8)\]is used as a multi\-modal database in our simulations\. The following benchmarks are used:

- •Random allocation\[[13](https://arxiv.org/html/2606.15573#bib.bib9)\]: DistributesVVtokens randomly acrossNNagents according to a uniform multinomial distribution\. Every token is independently assigned to one agent with equal probability, without bucket limitations\.
- •Round\-Robin allocation\[[13](https://arxiv.org/html/2606.15573#bib.bib9)\]: Cycles throughNNagents in a fixed order\. Each agent is given one token at a time, capped by the bucket size and the available tokens\.
- •Max–Min allocation\[[11](https://arxiv.org/html/2606.15573#bib.bib10)\]: Greedily gives the next token to the agent who currently holds the fewest tokens, capped by the bucket size and the available tokens\.
- •Image\-DP444[https://anonymous\.4open\.science/r/DomainFL/](https://anonymous.4open.science/r/DomainFL/)\[[12](https://arxiv.org/html/2606.15573#bib.bib6)\]: Adds DP noise only to the image embeddings or prototypes\. It protects visual features alone while leaving text embeddings unchanged\. We follow\[[12](https://arxiv.org/html/2606.15573#bib.bib6)\]and setq=0\.2q=0\.2,s=0\.05s=0\.05\.
- •Reconstruction Attack555[https://github\.com/stanislavfort/Direct\_Ascent\_Synthesis/](https://github.com/stanislavfort/Direct_Ascent_Synthesis/)\[[5](https://arxiv.org/html/2606.15573#bib.bib11)\]: An adversary can reconstruct an image by optimizing a dummy input so its encoded embedding matches the shared prototype\. We setϵ\\epsilon= 1 and run 100 optimization steps with a learning rate of 0\.2\[[5](https://arxiv.org/html/2606.15573#bib.bib11)\]\.

Unless otherwise indicated, we setN=500N=500,V=1000V=1000, andB=4B=4\. We use the Dirichlet distribution with concentration parameterα=0\.5\\alpha=0\.5to simulate the heterogeneous distribution of data contributions\. Our method \(i\.e\., Proposed\) is based on Equation \([15](https://arxiv.org/html/2606.15573#S3.E15)\)\. Each data point in the token allocation experiment is averaged across 1000 simulation rounds\. Data embeddings are visualized and produced by using randomly selected images from the COCO validation set666[https://cocodataset\.org/\#download](https://cocodataset.org/#download)\. For decentralized data valuation, we setϕ​\(𝐝n\)\\phi\(\\mathbf\{d\}\_\{n\}\)as described in Section[IV](https://arxiv.org/html/2606.15573#S4)\. For multi\-modal DP setting \(i\.e\., Image\-Ours and Text\-Ours\), we setϵ=1\\epsilon=1andδ=10−5\\delta=10^\{\-5\}\. For each newly discovered cluster, we useΓ=50\\Gamma=50as the threshold for the novel data quantity\. The CLIP ViT/32 model\[[8](https://arxiv.org/html/2606.15573#bib.bib12)\]is used across all experiments\. Sensitivity analyses forα\\alphaandΓ\\Gammaare respectively provided in Fig\.[4](https://arxiv.org/html/2606.15573#S5.F4)and Fig\.[6](https://arxiv.org/html/2606.15573#S5.F6)\. Further data visualizations are included in the supplementary materials\.

### V\-BEffectiveness of Token Allocation

A key challenge of token allocation is to balance the fairness of the reward rate𝐫\\mathbf\{r\}in the resource\-limited network edge\.

![Refer to caption](https://arxiv.org/html/2606.15573v1/x4.png)

\(a\)Jain Index
![Refer to caption](https://arxiv.org/html/2606.15573v1/x5.png)

\(b\)Gini Coefficent

Figure 4:Fairness metrics under differentα\\alpha\. Our proposed token allocation improves fairness across diverse contribution distributions\.In Fig\.[4](https://arxiv.org/html/2606.15573#S5.F4), the distributional heterogeneity of𝐯\\mathbf\{v\}increases whenα\\alphadecreases\. A higher Jain index and lower Gini coefficient lead to better fairness of AI quota allocation\. A key observation is that our proposed token allocation scheme outperforms benchmarks across diverse data contribution scenarios\. Our design achieves a “contribute more to earn more” incentive mechanism\.

![Refer to caption](https://arxiv.org/html/2606.15573v1/x6.png)

\(a\)Jain Index
![Refer to caption](https://arxiv.org/html/2606.15573v1/x7.png)

\(b\)Gini Coefficent

Figure 5:Fairness metrics with differentNN\. Our method supports real\-world deployment under constrained AI quota and compute budgets\.Fig\.[5](https://arxiv.org/html/2606.15573#S5.F5)further illustrates the effectiveness of token allocation under varying numbers of agentsNN\. With sufficient AI quota, all agents can be refilled to full capacity\. However, in practical deployments where AI quota and computational resources are limited, our method significantly outperforms the benchmarks\. The results indicate that our token allocation scheme is well\-suited for large\-scale distributed environments with constrained resources\.

### V\-CDecentralized Data Valuation

To show how novelty\-based detection works, we use diverseΓ\\Gammato set the novelty threshold\. The COCO dataset is used in the prototype discovery process with DP noise added\.

![Refer to caption](https://arxiv.org/html/2606.15573v1/x8.png)

\(a\)Data Value
![Refer to caption](https://arxiv.org/html/2606.15573v1/x9.png)

\(b\)Prototype Discovery

Figure 6:Data valuation in novel discovery\. Our proposed scheme incentivizes early contributions while preserving privacy by applying DP before prototypes are shared\.As shown in Fig\.[6](https://arxiv.org/html/2606.15573#S5.F6)\(a\), data valuation is governed by both quantity and novelty thresholds\. The diminishing marginal utility incentivizes early contributions of novel data\. In Fig\.[6](https://arxiv.org/html/2606.15573#S5.F6)\(b\), a largerΓ\\Gammaadmits more novel samples per cluster but delays cluster confirmation\. Since DP noise is added only after a cluster is confirmed, increasingΓ\\Gammaalso postpones when DP can be applied\. A trade\-off between privacy and latency exists\.

### V\-DMulti\-Modal Differential Privacy

To evaluate privacy protection, we conduct a reconstruction attack\. The adversary uses the same CLIP encoder to optimize a dummy image so that its CLIP embedding maximizes similarity to the shared prototype\.

![Refer to caption](https://arxiv.org/html/2606.15573v1/x10.png)

\(a\)Reconstructed Images
![Refer to caption](https://arxiv.org/html/2606.15573v1/x11.png)

\(b\)Attack Score

Figure 7:Attacks on shared DP prototypes\. Our method improves privacy level on multi\-modal data\.As illustrated in Fig\.[7](https://arxiv.org/html/2606.15573#S5.F7), the Image\-DP baseline leaks substantial semantic information\. An example original sample is shown in Fig\.[3](https://arxiv.org/html/2606.15573#S4.F3)\. In contrast, sensitive information, such as facial characteristics, is well\-protected by our DP schemes\. Our method achieves consistently lower attack scores than Image\-DP\. We observe that it is very challenging to reproduce the semantic information from our shared cross\-modal prototypes\. The results suggest that the DP guarantee in Equation \([21](https://arxiv.org/html/2606.15573#S4.E21)\) strengthens privacy protection for multi\-modal personal data\.

## VIConclusions

In this paper, we studied privacy\-preserving data valuation for fair AI resource allocation in decentralized agentic systems\. Our goal is to support data sovereignty by protecting multi\-modal personal data with DP and enabling contribution\-aware trading in decentralized data markets\. We allocate limited AI quotas as tokens via a token\-bucket allocator to achieve fair resource distribution under heterogeneous contributions\. We further represent contributions using DP\-protected prototypes, which form a semantic iDAO*data catalog*\(i\.e\., a marketplace directory\) anchored in a shared embedding space\. Despite the above advantages, the privacy–utility trade\-off in releasing DP prototypes remains an open direction for future research\.

## References

- \[1\]\(2024\)ZKML: an optimizing system for ML inference in zero\-knowledge proofs\.InEuropean Conference on Computer Systems,pp\. 560–574\.Cited by:[§I](https://arxiv.org/html/2606.15573#S1.p4.1)\.
- \[2\]Z\. Chen, Q\. Sun, N\. Li,et al\.\(2024\)Enabling mobile AI agent in 6G era: architecture and key technologies\.IEEE Network38\(5\),pp\. 66–75\.External Links:[Document](https://dx.doi.org/10.1109/MNET.2024.3422309)Cited by:[§I](https://arxiv.org/html/2606.15573#S1.p1.1)\.
- \[3\]Y\. Du, Z\. Wang, C\. Leung, and V\. C\. Leung\(2024\)Towards collaborative edge intelligence: blockchain\-based data valuation and scheduling for improved quality of service\.Future Internet16\(8\),pp\. 267\.Cited by:[§I](https://arxiv.org/html/2606.15573#S1.p2.1),[§I](https://arxiv.org/html/2606.15573#S1.p4.1),[§IV\-B](https://arxiv.org/html/2606.15573#S4.SS2.p2.3)\.
- \[4\]C\. Dwork, A\. Roth,et al\.\(2014\)The algorithmic foundations of differential privacy\.Foundations and Trends in Theoretical Computer Science9\(3–4\),pp\. 211–407\.Cited by:[§I](https://arxiv.org/html/2606.15573#S1.p5.1),[§II\-C](https://arxiv.org/html/2606.15573#S2.SS3.p3.4.1),[§IV\-B](https://arxiv.org/html/2606.15573#S4.SS2.p5.4)\.
- \[5\]S\. Fort and J\. Whitaker\(2025\)Direct ascent synthesis: revealing hidden generative capabilities in discriminative models\.arXiv preprint arXiv:2502\.07753\.Cited by:[5th item](https://arxiv.org/html/2606.15573#S5.I1.i5.p1.1)\.
- \[6\]F\. Kato, Y\. Cao, and M\. Yoshikawa\(2023\)Olive: oblivious federated learning on trusted execution environment against the risk of sparsification\.Proceedings of the VLDB Endowment16\(10\),pp\. 2404–2417\.Cited by:[§I](https://arxiv.org/html/2606.15573#S1.p4.1)\.
- \[7\]T\. Lin, M\. Maire, S\. Belongie,et al\.\(2014\)Microsoft COCO: common objects in context\.InEuropean Conference on Computer Vision,pp\. 740–755\.Cited by:[§V\-A](https://arxiv.org/html/2606.15573#S5.SS1.p1.11)\.
- \[8\]A\. Radford, J\. W\. Kim, C\. Hallacy,et al\.\(2021\)Learning transferable visual models from natural language supervision\.InInternational Conference on Machine Learning,pp\. 8748–8763\.Cited by:[§V\-A](https://arxiv.org/html/2606.15573#S5.SS1.p1.10)\.
- \[9\]B\. Rozemberczki, L\. Watson, P\. Bayer,et al\.\(2022\)The shapley value in machine learning\.InInternational Joint Conference on Artificial Intelligence and European Conference on Artificial Intelligence,pp\. 5572–5579\.Cited by:[§I](https://arxiv.org/html/2606.15573#S1.p4.1)\.
- \[10\]D\. Shan, P\. Zhang, W\. Jiang,et al\.\(2021\)Towards the fairness of traffic policer\.InIEEE Conference on Computer Communications,pp\. 1–10\.Cited by:[§III\-B](https://arxiv.org/html/2606.15573#S3.SS2.p1.1),[§III\-C](https://arxiv.org/html/2606.15573#S3.SS3.p1.1)\.
- \[11\]Y\. Sheng, S\. Cao, D\. Li,et al\.\(2024\)Fairness in serving large language models\.InUSENIX Symposium on Operating Systems Design and Implementation,pp\. 965–988\.Cited by:[3rd item](https://arxiv.org/html/2606.15573#S5.I1.i3.p1.1)\.
- \[12\]J\. Zhang, Y\. Duan, S\. Niu,et al\.\(2025\)Enhancing federated domain adaptation with multi\-domain prototype\-based federated fine\-tuning\.InInternational Conference on Learning Representations,pp\. 1–23\.Cited by:[4th item](https://arxiv.org/html/2606.15573#S5.I1.i4.p1.2)\.
- \[13\]K\. Zhang, Y\. Sun, and B\. Ji\(2025\)Multimodal remote inference\.arXiv preprint arXiv:2508\.07555\.Cited by:[1st item](https://arxiv.org/html/2606.15573#S5.I1.i1.p1.2),[2nd item](https://arxiv.org/html/2606.15573#S5.I1.i2.p1.1)\.