When Should Agent Trust Be Conditional? Characterizing and Attacking Skill-Conditional Reputation in Agent Swarms

# When Should Agent Trust Be Conditional? Characterizing and Attacking Skill-Conditional Reputation in Agent Swarms
Source: [https://arxiv.org/html/2606.14200](https://arxiv.org/html/2606.14200)
Taotao Wang Shenzhen University, China ttwang@szu\.edu\.cnCorresponding author\.

###### Abstract

Open platforms increasingly route tasks among heterogeneous LLM agents—differing in base model, scaffold, and tool stack—whose competence varies sharply by skill: an agent excellent at one skill may be useless at another\. The standard reputation approach summarizes each agent by a single global trust score, but that scalar is the wrong object here, because routing every task to the globally most\-trusted agent leaves the value of specialization unclaimed\. We study*skill\-conditional trust*R​\(i∣k\)R\(i\\mid k\)—the trust to place in agentiifor a task requiring skillkk, rather than one score per agent—and pose three falsifiable questions:*when*is conditioning worth it,*how much*cross\-skill evidence should be borrowed, and*whether*that borrowing is safe\. A controlled phase\-diagram analysis answers the first two: conditional trust wins only in a specific regime—high agent heterogeneity, sparse per\-skill evidence, and correlated skills—and the coupling strengthβ\\betathat buys this data efficiency is*dual\-use*, because the same cross\-skill borrowing is also a laundering channel\. On a public benchmark of1414genuinely heterogeneous AppWorld agents, real pools land inside the beneficial regime—a small but genuine gain, with the per\-skill best agent genuinely changing across skills\. We then show that an attacker with cheap evidence in one skill and none in a target skill hijacks the conditional router, driving routing regret from0to0\.940\.94on a pool our zero\-cost Conditional Information Value Test \(CIVT\) ratesgreen—while the ungated trust verdict it contaminates reads−0\.06\-0\.06instead of the honest\+0\.19\+0\.19\. A zero\-evidence gate bounds the attack but does not eliminate it; we characterize the residual cost under an explicit budget\. We do*not*claim Sybil\-resistance—we quantify the trade\-off\.

Keywords:multi\-agent systems, LLM agents, trust and reputation, task routing, adversarial robustness, reputation laundering, estimation under sparsity

## 1Introduction

Open platforms are increasingly populated by*heterogeneous LLM agents*offered as services—each a distinct combination of base model, scaffold, and tool stack—and standards for inter\-agent delegation and trust are already being drafted around themHu and Rong\([2025](https://arxiv.org/html/2606.14200#bib.bib7)\);Yu et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib27)\)\. An orchestrator must decide which agent to trust with each incoming task\. The dominant approach to such trust, inherited from reputation systems for online marketplaces and peer\-to\-peer networksKamvar et al\.\([2003](https://arxiv.org/html/2606.14200#bib.bib10)\), summarizes each participant by a*single global score*: how much the system, on aggregate, should trust them\. That scalar is exactly right when a participant’s trustworthiness is one\-dimensional\.

But these agents are not uniformly good, and*which*one is best depends on the task—a regularity that model\- and agent\-routing systems already exploit to trade cost against qualityOng et al\.\([2024](https://arxiv.org/html/2606.14200#bib.bib15)\);Moslem and Kelleher\([2026](https://arxiv.org/html/2606.14200#bib.bib14)\)\. On the public AppWorld benchmarkTrivedi et al\.\([2024](https://arxiv.org/html/2606.14200#bib.bib21)\)we study \(§[5](https://arxiv.org/html/2606.14200#S5)\), the agent that is best at*phone*tasks \(anIPFunCallscaffold on GPT\-4 Turbo\) is not the agent best at*venmo*payments \(aPlanExecscaffold on GPT\-4o\), which is in turn not the best at*spotify*\(FullCodeRefl on GPT\-4o\)\. A single global trust score implicitly assumes an agent is uniformly trustworthy across tasks; for skill\-specialized agents that assumption is simply false, and routing every task to the globally most\-trusted agent forfeits the value of specialization\.

We therefore ask whether the trust*object*itself should be*conditional*: not one score per agent, but one score per agent*per skill*—R​\(i∣k\)R\(i\\mid k\), the trust to place in agentiiwhen the task requires skillkk\. The difficulty is that per\-skill evidence is sparse—an agent may have run only a handful of episodes on any given skill—so a naive per\-skill estimate is too noisy to route on\. The natural remedy is to*borrow*evidence across correlated skills: an agent’s record on related skills is informative about a skill it has rarely attempted—an agent reliable at*venmo*payments is a reasonable prior for the closely related*splitwise*, even with few direct splitwise episodes\. This borrowing of strength across related cells is the classic variance\-reduction logic of empirical\-Bayes shrinkageJames and Stein\([1961](https://arxiv.org/html/2606.14200#bib.bib8)\);Efron and Morris\([1977](https://arxiv.org/html/2606.14200#bib.bib4)\), and the same move classical reputation systems use to cope with sparse direct evidence—structured borrowing along a correlation graph, applied here on the agent–skill axis rather than the peer graph \(§[3\.1](https://arxiv.org/html/2606.14200#S3.SS1)\)\.

#### The question, sharpened\.

It is tempting to stop there and assert that “conditional trust must be better\.” It is not\. Earlier attempts—including our own—to claim blanket superiority of conditional routing do not survive scrutiny: when agents are*not*specialized, or when per\-skill evidence is plentiful, a single global\-best agent is genuinely hard to beat, and cross\-skill borrowing can even inject harmful bias\. We therefore reframe the contribution from*advocacy*to*characterization*, and ask three falsifiable questions:whendoes conditioning on a task’s skill beat a single global\-best agent;how muchcross\-skill evidence should one borrow when per\-skill data is sparse; andwhetherthat borrowing opens an attack surface\. The third question is not an afterthought: the very mechanism that buys data efficiency—cross\-skill evidence borrowing, tuned by a coupling strengthβ\\beta—turns out to be a reputation\-laundering channel, echoing how added inter\-agent trust can enlarge the attack surface rather than only improve collaborationXu et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib23)\);Prakash\([2026](https://arxiv.org/html/2606.14200#bib.bib18)\)\.*How much*to borrow and*whether*it is safe are thus two faces of one knob\. This measurement\-first, mechanism\-then\-attack stance is the honest and, we argue, the more durable contribution\.

#### What we find\.

The three answers turn out sharper than the framing promises\.*When*: conditioning helps only in a specific regime—high heterogeneity, sparse per\-skill evidence, and correlated skills—and a zero\-cost test \(CIVT\) reads off from existing logs, before any model is run, whether a given pool lies inside it; real public pools land just inside, with a small but genuine gain\.*How much*: the borrowing strength has a constrained optimum, since pushing it pastβ≈0\.1\\beta\\\!\\approx\\\!0\.1adds little accuracy while widening the laundering channel\.*Whether it is safe*: here the result is alarming\. On a pool CIVT*certifies*as carrying real conditional value, an attacker with perfect evidence on one cheap skill and*no*evidence on the target skill captures the router for the price of a single fabricated episode, driving routing regret from0to0\.940\.94\(§[6](https://arxiv.org/html/2606.14200#S6)\); the same contamination flips the trust verdict a defender reads from an honest\+0\.19\+0\.19\(“conditioning is clearly worth it”\) to−0\.06\-0\.06\(“conditioning is harmful”\)\. The defense that should work makes it worse: the adaptive coupling that gracefully avoids over\-borrowing on benign pools rides the very correlation the attacker exploits, so robustness at low skill correlation*inverts*into vulnerability at high correlation\. Rate limits and coupling caps are algebraically powerless too; only a structural rule that refuses to borrow for an agent with no direct target evidence bounds the attack, and even that is bypassable at a cost we quantify \(§[6\.2](https://arxiv.org/html/2606.14200#S6.SS2)\)\.

#### Contributions\.

We answer the three questions in four steps—formalizing the object, mapping when and how much to condition, placing real data on that map, and then turning the borrowing mechanism against itself as an attack:

1. 1\.A skill\-conditional trust objectR​\(i∣k\)R\(i\\mid k\), with idealized routers \(π𝗀𝗅𝗈𝖻𝖺𝗅\\pi\_\{\\mathsf\{global\}\},π𝗌𝗄𝗂𝗅𝗅\\pi\_\{\\mathsf\{skill\}\},π𝗈𝗋𝖺𝖼𝗅𝖾\\pi\_\{\\mathsf\{oracle\}\}\) and a zero\-cost de\-risking test \(CIVT\) that decides, from existing logs alone, whether skill conditioning carries value \(§[3](https://arxiv.org/html/2606.14200#S3)\)\.
2. 2\.A phase diagram of when/how\-much/whether\(§[4](https://arxiv.org/html/2606.14200#S4)\): conditioning wins only under high heterogeneityHH\+ sparse evidenceNN\+ correlated skillsCC; the borrowing strengthβ\\betahas a*constrained*optimum because the borrowing channel is dual\-use; and the coupling must be*adaptively estimated*, not assumed\.
3. 3\.Real\-data placement\(§[5](https://arxiv.org/html/2606.14200#S5)\): on 14 heterogeneous public AppWorld agents, real pools land in the beneficial regime \(validated on both continuous and binary outcomes\); across five landing points the conditional gain tracks skill correlationCCas the phase diagram predicts, and CIVT*discriminates*—greenontest\_normal,amberon the hardertest\_challenge—rather than rubber\-stamping\.
4. 4\.Adversarial analysis\(§[6](https://arxiv.org/html/2606.14200#S6)\): cross\-skill laundering hijacks the conditional router at smallβ\\beta; we give a budgeted threat model and defenses that bound—not eliminate—attack benefit\.

## 2Related Work

Our work sits at the intersection of four threads: the reputation paradigm we depart from \(and its classical Sybil/whitewashing attacks, which we specialize\); LLM\-agent routing, to which we add an adversarial trust dimension; the emerging agent\-trust\-and\-security literature, which we make*quantitative*; and classical shrinkage estimation, which we re\-read as a security knob\. We position against each in turn\.

#### Spectral reputation aggregation and its classical attacks\.

Power\-iterating a normalized adjacency matrix to its principal eigenvector is the canonical recipe for ranking participants in an open graph:PageRankapplies it to web authorityPage et al\.\([1999](https://arxiv.org/html/2606.14200#bib.bib17)\),EigenTrustto peer\-to\-peer reputationKamvar et al\.\([2003](https://arxiv.org/html/2606.14200#bib.bib10)\), and a long line of work since studies the recipe’s robustness, its pretrust/damping defenses, and personalized or context\-aware variants\. What this family shares is the*object*it produces: a single scalar score per participant \(in personalized variants, per*evaluator*\)\. The classical threat models are the Sybil attackDouceur\([2002](https://arxiv.org/html/2606.14200#bib.bib3)\)—forging many identities to outvote honest participants—and the cheap\-pseudonym or*whitewashing*problemFriedman and Resnick\([2001](https://arxiv.org/html/2606.14200#bib.bib5)\), shedding a bad history by re\-registering\. Both are provably hard to eliminate in open systems:Cheng and Friedman\([2005](https://arxiv.org/html/2606.14200#bib.bib2)\)prove that*no*symmetric reputation function—a class that includesPageRank\-style scores—can be Sybil\-proof, so every such mechanism admits a beneficial Sybil attack\. This impossibility is exactly why classical defenses are*budgeted*—bounding rather than eliminating harm—as in the social\-network admission control ofSybilGuardandSybilLimitYu et al\.\([2006](https://arxiv.org/html/2606.14200#bib.bib25),[2008](https://arxiv.org/html/2606.14200#bib.bib26)\)\. We depart on the conditioning*axis*, not the aggregation rule: we make the trust object depend on the*task’s skill*—which agent to trust depends on what is being asked—recovering the single global score as the no\-conditioning special case \(§[3\.1](https://arxiv.org/html/2606.14200#S3.SS1)\)\. Our attacks \(§[6](https://arxiv.org/html/2606.14200#S6)\) are correspondingly cross\-skill reputation\-laundering variants of Sybil/whitewashing, and we inherit the classical impossibility—our defenses bound the attack benefit under an explicit budget but are not Sybil\-proof\.

#### LLM\-agent routing and model selection\.

A large recent literature routes queries among models or agents to cut cost or raise quality: learned cost\-routers such asRouteLLMOng et al\.\([2024](https://arxiv.org/html/2606.14200#bib.bib15)\), cost\-cutting model cascades such asFrugalGPTChen et al\.\([2023](https://arxiv.org/html/2606.14200#bib.bib1)\), dynamic routing/cascading systems surveyed inMoslem and Kelleher\([2026](https://arxiv.org/html/2606.14200#bib.bib14)\), cost\-aware cross\-attention routersPulishetty et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib19)\), and mixture\-of\-experts architecturesJiang et al\.\([2024](https://arxiv.org/html/2606.14200#bib.bib9)\)that route within a single model\. This line has largely matured from a research question into infrastructure, and it is not our competitor: it routes on*cost*or*claimed capability*, assumes the candidate agents are non\-strategic, and presupposes a trustworthy quality signal\. We study the prior question that this presupposition hides—when, and how safely, a*trust*signal should be conditioned on skill at all\. Without a reliable, attack\-resistant reputation signal, skill\-routing is building on sand; we characterize that signal’s value and its adversarial limits rather than proposing a better router\.

#### Agent trust, reputation, and security\.

As the “agentic web” begins to deploy, trust between agents has become an active concern, and recent work approaches our thesis closely\. Industry\-facing protocol studies catalog inter\-agent trust mechanisms across emerging standards \(A2A, AP2, ERC\-8004\)Hu and Rong\([2025](https://arxiv.org/html/2606.14200#bib.bib7)\), and surveys map the threat landscape of trustworthy LLM agentsYu et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib27)\)and zero\-trust agentic architecturesLiu et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib12)\); these establish that attack\-resistant agent reputation is a real, deployed open problem but remain framework\-level\. Two papers are close enough to require sharp differentiation\.Prakash\([2026](https://arxiv.org/html/2606.14200#bib.bib18)\)identify a*provenance paradox*: self\-claimed quality in multi\-agent LLM delegation collapses routing below random, and their remedy is protocol\-level attestation of identity and delegation contracts\. Our launderer is strictly harder to defend against, because it does not lie: it holds*genuine*observed performance on a farm skill and exploits theβ\\beta\-coupling of Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\) to contaminate the target estimate—the signal is real and attestable, the*pooling structure*is the vulnerability, so attestation does not address it\.Xu et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib23)\)document a*trust paradox*—parameterized inter\-agent trust improves collaboration while enlarging the attack surface—and their trust parameter plays the role of ourβ\\beta; but they treat trust as undifferentiated information exposure, whereas we give a*skill\-conditional*structure and quantify the cost as routing regret, a phase diagram of when conditioning pays, and a bounded\-attack benefit\. Closest in object are concurrent decentralized\-trust proposals\.Qi et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib20)\)equip each agent with a per\-skill*capability vector*beside a scalar reputation and match tasks by capability, andWang et al\.\([2025](https://arxiv.org/html/2606.14200#bib.bib22)\)make a decentralized trust mechanism evolutionarily stable under adversarial mutation\. Both*build a mechanism*; neither asks our question\. A per\-skill capability vector is precisely the object we estimate—but they do not analyze the cross\-skill*borrowing*that sparse per\-skill evidence forces: its dual\-use as a laundering channel, the budget degeneracy that makes the attack one\-episode cheap, or the regime in which conditioning carries value at all\. Our contribution is the conditions under which estimating that vector*conditionally*helps, how much to borrow, and what the borrowing costs under attack\. Across this thread the work either identifies a paradox qualitatively or proposes a trust*mechanism*; our contribution is the quantitative map—*when*conditioning has value,*how much*borrowing is optimal, and the*upper bound*on what an attacker gains—rather than a new framework\.

#### Estimation under sparsity\.

Borrowing strength across related cells to reduce variance at the cost of bias is classical: James–Stein estimationJames and Stein\([1961](https://arxiv.org/html/2606.14200#bib.bib8)\)and empirical\-Bayes shrinkageEfron and Morris\([1977](https://arxiv.org/html/2606.14200#bib.bib4)\)formalize when pooling beats independent per\-cell estimates\. Our coupling\-weighted estimator \(Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\)\) is an instance of this family on the agent–skill matrix, withβ\\betacontrolling the degree of pooling\. The classical analysis treatsβ\\betaas a purely statistical bias–variance knob; our contribution is to give it a*security*reading—the same parameter that optimally trades bias for variance under honest data is the parameter an attacker tunes to launder reputation, so its safe setting is bounded from above by adversarial, not just statistical, considerations\.

## 3Problem Formulation and Method

This section builds the machinery the rest of the paper measures and attacks\. We first explain why the live question is*conditioning*rather than transitive aggregation \(§[3\.1](https://arxiv.org/html/2606.14200#S3.SS1)\)\. We then state the observation model, give a*single*coupling\-weighted estimator whose four special cases are the methods we compare, and define the routing regret that scores them\. Finally we introduce CIVT—a zero\-cost test of whether conditioning carries value on a given log—and the three pool statistics\(H,N,C\)\(H,N,C\)that the mechanism analysis of §[4](https://arxiv.org/html/2606.14200#S4)sweeps\.

### 3\.1Why conditioning, not transitive aggregation

Classical reputation systems confront*sparse pairwise evidence*—a participant has interacted with few others—and the canonical response is*transitive*borrowing across the graph: power\-iterate a normalized trust matrix to a fixed point, the same spectral recipe that ranks web pages \(PageRankPage et al\.\([1999](https://arxiv.org/html/2606.14200#bib.bib17)\)\) and peers \(EigenTrustKamvar et al\.\([2003](https://arxiv.org/html/2606.14200#bib.bib10)\)\)\. Our setting differs in two ways that make*conditioning*, not transitive aggregation, the live question\.

First, the sparse evidence lives on a different axis\. Trust here is*competence*, and what is scarce is episodes in the agent×\\times*skill*matrix \(an agent has few runs on a given skill\)\. We therefore borrow evidence*across correlated skills*, along the structure encoded by the coupling matrix𝑾\\bm\{W\}\(Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\)\), with the no\-conditioning special case \(all\-ones𝑾\\bm\{W\}\) recovering a single global score\. This borrowing channel is*dual\-use*in exactly the way transitive borrowing is in classical systems—the strengthβ\\betathat buys data efficiency is the same knob an attacker tunes to launder reputation across skills \(§[6](https://arxiv.org/html/2606.14200#S6)\)\.

Second, outcomes here are*program\-verifiable*rather than peer\-reported\. In that setting, a relay’s identity matters when the object being relayed is an assessment whose credibility must itself be judged\. Here, the object is an environment\-verified episode record\. Relays may still matter for discovery, synchronization, or selective withholding of records, but once a record is observed, its evidentiary weight does not depend on the peer who forwarded it\. The sparse axis therefore moves from who\-trusts\-whom evidence on a peer graph to per\-cell evidence in the agent×\\times*skill*matrix, where a cell is one agent–skill entry\. Transitive reputation machinery becomes relevant again when the signal includes unverifiable peer assessments, subjective ratings, or cross\-organization reports\. In the verifiable\-outcome slice studied here, the estimation problem is how much evidence to*borrow across skills*\.

### 3\.2Setup and observation model

A pool ofMMagents serves tasks spanningKKskills\. Agentiihas unknown ground\-truth competenceθi,k∈\[0,1\]\\theta\_\{i,k\}\\in\[0,1\]on skillkk\. At the task level, an episode is an attempt by agentiion tasktt, with skill labelk​\(t\)k\(t\)and verifiable outcomeyi,t∈\[0,1\]y\_\{i,t\}\\in\[0,1\]; for estimation we aggregate these task\-level records into agent–skill cells\. Each cell\(i,k\)\(i,k\)is observed throughni,kn\_\{i,k\}episodes with*verifiable*outcomes \(program\-checked pass/fail, or a graded score\), summarized by an observed mean scoreoi,k∈\[0,1\]o\_\{i,k\}\\in\[0,1\]carrying evidence massni,kn\_\{i,k\}\. Verifiability is the feature that distinguishes our setting from classical reputation: an episode’s outcome is checked by the environment, not reported by a peer, so a single observationoi,ko\_\{i,k\}is itself trustworthy and the only scarce resource is the*number*of observationsni,kn\_\{i,k\}\. This is why the live problem is conditioning, not transitive aggregation \(§[3\.1](https://arxiv.org/html/2606.14200#S3.SS1)\)\. Our object of interest is the*skill\-conditional trust*R​\(i∣k\)R\(i\\mid k\): the degree to which the orchestrator should trust agentiion a task of skillkk\. Its ideal value is the \(unobserved\) ground\-truth competenceθi,k\\theta\_\{i,k\}; the estimators of §[3\.3](https://arxiv.org/html/2606.14200#S3.SS3)approximate it from the sparse, verifiable evidence\{oi,k,ni,k\}\\\{o\_\{i,k\},n\_\{i,k\}\\\}, and we writeτ^i,k\\hat\{\\tau\}\_\{i,k\}for such an estimate\. RecoveringR​\(i∣k\)R\(i\\mid k\)well—and, since routing selects the per\-skillarg⁡max\\arg\\max, recovering for each skillkkan across\-agent*ordering*close to that of the trueθ⋅,k\\theta\_\{\\cdot,k\}—is the core problem\. \(One may further condition on rolerrand queryqq; we studykkand leaver,qr,qto future work\.\)

### 3\.3A single coupling\-weighted estimator

All trust estimators we consider are instances of*one*rule—evidence\-mass pooling across skills through a coupling matrix𝑾\\bm\{W\}\(K×KK\{\\times\}K, nonnegative, unit diagonal\):

τ^i,k​\(𝑾\)=∑k′Wk,k′​ni,k′​oi,k′∑k′Wk,k′​ni,k′\.\\hat\{\\tau\}\_\{i,k\}\(\\bm\{W\}\)\\;=\\;\\frac\{\\sum\_\{k^\{\\prime\}\}W\_\{k,k^\{\\prime\}\}\\,n\_\{i,k^\{\\prime\}\}\\,o\_\{i,k^\{\\prime\}\}\}\{\\sum\_\{k^\{\\prime\}\}W\_\{k,k^\{\\prime\}\}\\,n\_\{i,k^\{\\prime\}\}\}\.\(1\)Skillkkborrows skillk′k^\{\\prime\}’s evidence in proportion to the couplingWk,k′W\_\{k,k^\{\\prime\}\}and to its evidence massni,k′n\_\{i,k^\{\\prime\}\}—an empirical\-Bayes–style partial poolingJames and Stein\([1961](https://arxiv.org/html/2606.14200#bib.bib8)\);Efron and Morris\([1977](https://arxiv.org/html/2606.14200#bib.bib4)\)\. The methods differ*only*in𝑾\\bm\{W\}:

- •Independent\(𝑾=𝑰\\bm\{W\}\{=\}\\bm\{I\}\):τ^i,k=oi,k\\hat\{\\tau\}\_\{i,k\}=o\_\{i,k\}\. No borrowing; unbiased but high\-variance whenni,kn\_\{i,k\}is small\.
- •Global\(𝑾=𝟏𝟏⊤\\bm\{W\}\{=\}\\bm\{1\}\\bm\{1\}^\{\\top\}, all ones\): pools every skill into one score per agent, broadcast acrosskk—the single global\-score object\. Low variance, but biased when agents are skill\-specialized\.
- •Conditional\(fixed block coupling\):Wk,k′=βW\_\{k,k^\{\\prime\}\}\{=\}\\betaifk≠k′k\\\!\\neq\\\!k^\{\\prime\}lie in the same correlated skill block, else0, with strengthβ∈\[0,1\]\\beta\\in\[0,1\]\. Independent is the limitβ=0\\beta\{=\}0; the strength interpolates between no pooling and within\-block pooling\.
- •Adaptive: data\-estimated couplingWk,k′=β​max⁡\(Rk,k′,0\)W\_\{k,k^\{\\prime\}\}\{=\}\\beta\\max\(R\_\{k,k^\{\\prime\}\},0\),k≠k′k\\\!\\neq\\\!k^\{\\prime\}, with𝑹\\bm\{R\}the cross\-agent column\-correlation matrix \([2](https://arxiv.org/html/2606.14200#S3.E2)\)\. Borrowing follows*empirically positive*correlation only; when skills are uncorrelated𝑾→𝑰\\bm\{W\}\\\!\\to\\\!\\bm\{I\}and it degrades gracefully to Independent \(no backfire\)\.

Rk,k′=∑io~i,k​o~i,k′∑io~i,k2​∑io~i,k′2,o~i,k=oi,k−o¯⋅,k\.R\_\{k,k^\{\\prime\}\}=\\frac\{\\sum\_\{i\}\\tilde\{o\}\_\{i,k\}\\,\\tilde\{o\}\_\{i,k^\{\\prime\}\}\}\{\\sqrt\{\\textstyle\\sum\_\{i\}\\tilde\{o\}\_\{i,k\}^\{2\}\}\\,\\sqrt\{\\textstyle\\sum\_\{i\}\\tilde\{o\}\_\{i,k^\{\\prime\}\}^\{2\}\}\},\\qquad\\tilde\{o\}\_\{i,k\}=o\_\{i,k\}\-\\bar\{o\}\_\{\\cdot,k\}\.\(2\)Hereo¯⋅,k=1M​∑ioi,k\\bar\{o\}\_\{\\cdot,k\}=\\tfrac\{1\}\{M\}\\sum\_\{i\}o\_\{i,k\}is the mean of skill columnkk, soRk,k′R\_\{k,k^\{\\prime\}\}is the across\-agent Pearson correlation between skill columnskkandk′k^\{\\prime\}\. The coupling strengthβ\\betais thus a single knob trading variance for bias—and, as §[6](https://arxiv.org/html/2606.14200#S6)shows, the same knob an attacker exploits\.

### 3\.4Conditional routing and regret

Given estimatesτ^\\hat\{\\tau\}and a candidate pool𝒫\\mathcal\{P\}, the conditional router sends a skill\-kktask toak⋆=arg⁡maxi∈𝒫⁡τ^i,ka^\{\\star\}\_\{k\}=\\arg\\max\_\{i\\in\\mathcal\{P\}\}\\hat\{\\tau\}\_\{i,k\}\. We score a router by*routing regret*, the normalized shortfall in*true*competence against the per\-skill oracle:

𝖱𝖾𝗀​\(τ^\)=1K​∑k=1K\(maxi∈𝒫⁡θi,k−θak⋆,k\)\.\\mathsf\{Reg\}\(\\hat\{\\tau\}\)=\\frac\{1\}\{K\}\\sum\_\{k=1\}^\{K\}\\Big\(\\max\_\{i\\in\\mathcal\{P\}\}\\theta\_\{i,k\}\-\\theta\_\{a^\{\\star\}\_\{k\},\\,k\}\\Big\)\.\(3\)Thus, estimates determine the routing decision, while regret is evaluated using the true competenceθ\\theta\.

### 3\.5The Conditional Information Value Test \(CIVT\)

Before deploying any estimator, we ask whether conditioning could help*at all*on a given evaluation log of verified episodes over agents and skills\. We answer with the*Conditional Information Value Test*\(CIVT\)—a zero\-cost screen of whether the skill information is worth conditioning on, computed from existing logs with no model run\. Treating the observation matrix𝑶\\bm\{O\}\(entriesoi,ko\_\{i,k\}\) as the trust signal, we compare three idealized routers by their valueV​\(⋅\)V\(\\cdot\)\(mean score of the routed agent\):π𝗀𝗅𝗈𝖻𝖺𝗅\\pi\_\{\\mathsf\{global\}\}\(one fixed agent—the row of largest overall mean, i\.e\. the single global\-score baseline\),π𝗌𝗄𝗂𝗅𝗅\\pi\_\{\\mathsf\{skill\}\}\(the best agent*per skill*\), andπ𝗈𝗋𝖺𝖼𝗅𝖾\\pi\_\{\\mathsf\{oracle\}\}\(the best agent*per task*, an upper bound\)\. The decision gaps are

Δ𝗌𝗄\\displaystyle\\Delta\_\{\\mathsf\{sk\}\}=V​\(π𝗌𝗄𝗂𝗅𝗅\)−V​\(π𝗀𝗅𝗈𝖻𝖺𝗅\)\\displaystyle=V\(\\pi\_\{\\mathsf\{skill\}\}\)\-V\(\\pi\_\{\\mathsf\{global\}\}\)\(value of conditioning\),\\displaystyle\\text\{\(value of conditioning\)\},Δ𝗈𝗋\\displaystyle\\Delta\_\{\\mathsf\{or\}\}=V​\(π𝗈𝗋𝖺𝖼𝗅𝖾\)−V​\(π𝗀𝗅𝗈𝖻𝖺𝗅\)\\displaystyle=V\(\\pi\_\{\\mathsf\{oracle\}\}\)\-V\(\\pi\_\{\\mathsf\{global\}\}\)\(total headroom\)\.\(4\)A pool is labelledgreen\(conditioning carries value\) whenΔ𝗈𝗋≥0\.05\\Delta\_\{\\mathsf\{or\}\}\\\!\\geq\\\!0\.05,Δ𝗌𝗄≥0\.03\\Delta\_\{\\mathsf\{sk\}\}\\\!\\geq\\\!0\.03, and the per\-skill best agent is not unique\. The numerical thresholds are practical\-effect cutoffs on a\[0,1\]\[0,1\]outcome scale, not fitted parameters or statistical significance tests:Δ𝗈𝗋≥0\.05\\Delta\_\{\\mathsf\{or\}\}\\\!\\geq\\\!0\.05requires at least five points of total routing headroom, whileΔ𝗌𝗄≥0\.03\\Delta\_\{\\mathsf\{sk\}\}\\\!\\geq\\\!0\.03requires the deployable skill\-level router to recover at least three points\. We report the raw gaps throughout, so changing these cutoffs changes only thegreen/amberlabel, not the measured effect\. Each condition rules out a distinct failure of conditioning:Δ𝗈𝗋\\Delta\_\{\\mathsf\{or\}\}demands that*some*per\-task headroom exists at all;Δ𝗌𝗄\\Delta\_\{\\mathsf\{sk\}\}demands that a*skill\-level*router \(the deployable object, since per\-task routing requires an oracle\) captures enough of it to be worth the machinery; and the non\-uniqueness condition rules out the degenerate case in which one agent happens to win every skill, where a single global pick is already optimal\. CIVT runs on existing logs at zero model cost—it is the operational form of the*when*question \(Proposition 1, §[4](https://arxiv.org/html/2606.14200#S4)\), a de\-risking step that decides whether the estimators of §[3\.3](https://arxiv.org/html/2606.14200#S3.SS3)are even worth deploying before any model is run\.

### 3\.6Characterizing a pool:HH,NN,CC

Whether conditioning pays off, and whether borrowing is safe, is governed by three measurable properties of the observation matrix𝑶\\bm\{O\}, whose row𝒐i\\bm\{o\}\_\{i\}is agentii’s skill profile:

- •HeterogeneityH=1Kmeani<j∥𝒐i−𝒐j∥2H=\\tfrac\{1\}\{\\sqrt\{K\}\}\\operatorname\{mean\}\_\{i<j\}\\lVert\\bm\{o\}\_\{i\}\-\\bm\{o\}\_\{j\}\\rVert\_\{2\}: how differently agents perform\.
- •EvidenceN=meani,k⁡ni,kN=\\operatorname\{mean\}\_\{i,k\}n\_\{i,k\}: episodes per cell \(sparsity\)\.
- •CorrelationC=meank≠k′⁡Rk,k′C=\\operatorname\{mean\}\_\{k\\neq k^\{\\prime\}\}R\_\{k,k^\{\\prime\}\}: how correlated the skill columns are \(legitimacy of borrowing\)\.

Sections[4](https://arxiv.org/html/2606.14200#S4)–[6](https://arxiv.org/html/2606.14200#S6)show conditioning wins in a specific\(H,N,C\)\(H,N,C\)regime, and thatCCgoverns whether borrowing helps or backfires\.

## 4Mechanism: When, How Much, and Whether to Condition

Real data answers*where*a given pool lands but cannot varyHH,NN, andCCindependently to expose the underlying mechanism\. We therefore isolate the mechanism in a controlled data\-generating process \(DGP\) in which all three are knobs:M=12M\{=\}12agents andK=4K\{=\}4skills arranged in two correlated blocks, so that the within\-block correlation directly setsCC, per\-agent profiles setHH, and the episode count per cell setsNN\. We instantiate the estimator family of Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\)—Global \(𝑾=𝟏𝟏⊤\\bm\{W\}\{=\}\\bm\{1\}\\bm\{1\}^\{\\top\}\), Independent \(𝑾=𝑰\\bm\{W\}\{=\}\\bm\{I\}\), and Conditional \(block couplingβ\\beta\)—sweepHH,NN,CC, andβ\\betaover500500trials per cell, and score each choice of𝑾\\bm\{W\}by routing regret \([3](https://arxiv.org/html/2606.14200#S3.E3)\) against the known ground truth\. The three propositions below answer, in order, the*when*,*how much*, and*whether*of §[1](https://arxiv.org/html/2606.14200#S1)\.

![Refer to caption](https://arxiv.org/html/2606.14200v1/phase_diagram.png)Figure 1:Mechanism \(controlled DGP\)\. \(A\) At fixed heterogeneity, the Conditional estimator attains the lowest routing regret when evidence is sparse, converging to Independent asNNgrows\. \(B\) Phase diagram overH×NH\\times NatC=1C\{=\}1: green = Conditional net\-wins; the tie line marks where it stops beating the best baseline\. Panel C uses a perfectly correlated honest farm–target pair \(C=1C\{=\}1\) with sparse target evidence; the AppWorld star in panel B previews the real\-data placement expanded in Fig\.[4](https://arxiv.org/html/2606.14200#S5.F4)\. \(C\) Attack tension: as couplingβ\\betarises, clean regret falls but laundering capture rises—the dual\-use of the borrowing channel\.![Refer to caption](https://arxiv.org/html/2606.14200v1/phase_diagram_correlation.png)Figure 2:Whether to borrow depends on skill correlationCC\. \(D\) Coupling validity overC×HC\\times H\. \(E\) Fixed\-block coupling*hurts*at lowCC\(injects irrelevant bias\), while adaptive coupling degrades gracefully to Independent and stays non\-negative acrossCC\.#### Proposition 1 \(When\)\.

*Conditional trust wins exactly under highHHand sparseNN\.*The reason is a bias–variance trade\-off read through the two baselines\. Global \(𝑾=𝟏𝟏⊤\\bm\{W\}\{=\}\\bm\{1\}\\bm\{1\}^\{\\top\}\) has low variance but is*biased*whenever agents are specialized—it broadcasts one score across skills the agent is unequal on—so its error grows withHH\. Independent \(𝑾=𝑰\\bm\{W\}\{=\}\\bm\{I\}\) is unbiased but*high\-variance*whenNNis small, because each per\-skill estimate rests on a handful of episodes\. Conditional coupling occupies the gap: it borrows correlated cross\-skill evidence to cut the variance Independent suffers, without inheriting the cross\-skill bias Global suffers\. The win is therefore largest precisely where both baselines are weak—highHH*and*sparseNN\. Scoring the three𝑾\\bm\{W\}choices by regret \([3](https://arxiv.org/html/2606.14200#S3.E3)\) \(Fig\.[1](https://arxiv.org/html/2606.14200#S4.F1)A–B\): atH=0\.6,N=1H\{=\}0\.6,N\{=\}1the Conditional estimator \[Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\) with block\-β\\beta𝑾\\bm\{W\}\] attains regret0\.1070\.107versus Independent’s \[𝑾=𝑰\\bm\{W\}\{=\}\\bm\{I\}\]0\.1760\.176\(−40%\-40\\%\); asNNgrows, the borrowing terms in Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\) add little over the already\-abundant diagonal evidence and the two converge\. At lowHH, Global suffices; at highHHwith denseNN, Independent suffices\. The tie line in Fig\.[1](https://arxiv.org/html/2606.14200#S4.F1)\(B\) is where Conditional’s regret \([3](https://arxiv.org/html/2606.14200#S3.E3)\) stops beating the best baseline—the operational boundary CIVT estimates from logs alone\.

#### Proposition 2 \(How much\)\.

*The borrowing strengthβ\\betahas a constrained optimum because the evidence\-borrowing channel is also the reputation\-laundering channel\.*Hereβ\\betais the off\-diagonal scale of𝑾\\bm\{W\}in Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\): raising it pulls each skill’s estimate toward its block\-mates\. In Fig\.[1](https://arxiv.org/html/2606.14200#S4.F1)\(C\), clean regret \([3](https://arxiv.org/html/2606.14200#S3.E3)\) falls from0\.1600\.160to0\.1090\.109forβ≥0\.1\\beta\\\!\\geq\\\!0\.1; but the*same*off\-diagonal coupling lets an attacker’s farm\-skill evidence flow into a target skill through Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\), and laundering capture rises from0to0\.340\.34withβ\\beta\(§[6](https://arxiv.org/html/2606.14200#S6)\)\. The two curves move in opposite directions in the same parameter, soβ\\betacannot be set by data efficiency alone: there is a smallest value,β≈0\.1\\beta\\\!\\approx\\\!0\.1, that secures essentially all of the regret reduction while sitting at the low end of the laundering\-capture ramp\. We adoptβ=0\.1\\beta\{=\}0\.1as the deployed coupling throughout, and §[6](https://arxiv.org/html/2606.14200#S6)shows even this conservative setting is enough for an attacker to capture agreenpool\.*This dual\-use of one knob is the hinge to §[6](https://arxiv.org/html/2606.14200#S6)\.*

#### Proposition 3 \(Whether\)\.

*Whether to borrow depends onCC, and the coupling must be estimated, not assumed\.*Contrast two ways of setting𝑾\\bm\{W\}in Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\): fixed block coupling, which*assumes*the block structure, versus adaptive couplingWk,k′=β​max⁡\(Rk,k′,0\)W\_\{k,k^\{\\prime\}\}\{=\}\\beta\\max\(R\_\{k,k^\{\\prime\}\},0\)built from the estimated correlation𝑹\\bm\{R\}\([2](https://arxiv.org/html/2606.14200#S3.E2)\)\. In Fig\.[2](https://arxiv.org/html/2606.14200#S4.F2), fixed coupling*hurts*whenCCis low \(advantage−0\.018\-0\.018atC=0C\{=\}0\), because it injects evidence from uncorrelated skills—borrowing where there is nothing legitimate to borrow\. The adaptive𝑾\\bm\{W\}instead stays≥0\\geq 0across allCC, collapsing to𝑰\\bm\{I\}when𝑹≈𝟎\\bm\{R\}\\\!\\approx\\\!\\bm\{0\}, so it never backfires: borrowing is safe only along empirically estimated correlation\. This makes adaptive coupling the natural*safe default*—but the safety is conditional onCCbeing low where it matters\. We flag now, and demonstrate in §[6\.2](https://arxiv.org/html/2606.14200#S6.SS2), that the guarantee inverts under attack: on a genuinely*high*\-CCpool the adaptive estimator borrows along exactly the channel the attacker rides, so graceful degradation at lowCCdoes not imply robustness at highCC\.

## 5Real\-Data Placement

The mechanism analysis tells us*where*conditioning wins; it cannot tell us whether real agent pools fall there\. The phase diagram is only useful if real pools occupy its interesting regions rather than collapsing into a corner\. We therefore take a pool we did not design—a public leaderboard—measure its\(H,N,C\)\(H,N,C\), and ask CIVT whether conditioning carries value\.

#### Data\.

Among the many benchmarks now used to evaluate LLM agentsLiu et al\.\([2024](https://arxiv.org/html/2606.14200#bib.bib11)\), we use public AppWorldTrivedi et al\.\([2024](https://arxiv.org/html/2606.14200#bib.bib21)\)because it pairs genuinely different scaffold×\\timesmodel agents with program\-verifiable, per\-app outcomes—exactly the heterogeneous, verifiable evidence our setting needs\. We take its leaderboard bundles:14 genuinely heterogeneous agents—the cross product of scaffolds \{ReActYao et al\.\([2023](https://arxiv.org/html/2606.14200#bib.bib24)\), PlanExec, FullCodeRefl, IPFunCall\} and base models \{GPT\-4o, GPT\-4 TurboOpenAI\([2023](https://arxiv.org/html/2606.14200#bib.bib16)\), DeepSeekCoderGuo et al\.\([2024](https://arxiv.org/html/2606.14200#bib.bib6)\), LLaMA3\-70BLlama Team, AI @ Meta\([2024](https://arxiv.org/html/2606.14200#bib.bib13)\)\}—evaluated on the same168168test\_normaltasks \(23522352episodes\)\. The skill axis is the primary app of each task \(file\_system, phone, simple\_note, splitwise, spotify, todoist, venmo\)\. No model is executed: we download, parse, and analyze published trajectories, so the pool is one we did not construct and cannot tune in our favor—a deliberately adversarial\-to\-ourselves test of whether real public pools contain skill\-conditional value\. The heterogeneity is real by construction: the scaffold×\\timesbase\-model cross product mixes planning styles and underlying models, the two axes most likely to produce skill specialization\.

![Refer to caption](https://arxiv.org/html/2606.14200v1/layer2_fig1_heatmap.png)Figure 3:Agent×\\timesskill success matrix on AppWorld \(14 agents×\\times7 app\-skills\)\. Orange boxes mark the best agent per skill: the winner*changes across skills*, the basic precondition for skill conditioning to carry value\.
#### Result:green\.

Over the 14\-agent pool \(Table[1](https://arxiv.org/html/2606.14200#S5.T1)\), skill conditioning beats the global\-best agent byΔsk=\+0\.041\\Delta\_\{\\mathrm\{sk\}\}=\+0\.041\(score\) /\+0\.054\+0\.054\(success\), against a total per\-task headroom ofΔor=0\.190/0\.310\\Delta\_\{\\mathrm\{or\}\}=0\.190/0\.310\. Two facts make this a genuine—if modest—win\. First, the gain is positive on*both*a continuous score and a binary success metric, so it is not an artifact of one scoring choice\. Second, the best agent genuinely differs across skills: the best on*phone*is IPFunCall/GPT\-4T, on*venmo*PlanExec/GPT\-4o, and on*spotify*FullCodeRefl/GPT\-4o \(Fig\.[3](https://arxiv.org/html/2606.14200#S5.F3)\), so the non\-uniqueness condition of CIVT holds and no single global pick is optimal\. Both gaps clear thegreenthresholds \(Δ𝗌𝗄≥0\.03\\Delta\_\{\\mathsf\{sk\}\}\\\!\\geq\\\!0\.03,Δ𝗈𝗋≥0\.05\\Delta\_\{\\mathsf\{or\}\}\\\!\\geq\\\!0\.05\); the verdict isgreenon both metrics\.

Table 1:Idealized router values on AppWorld \(14\-agent pool\)\.
#### Landing point\.

The empirical\(H,N,C\)=\(0\.217,24,0\.795\)\(H,N,C\)=\(0\.217,\\,24,\\,0\.795\), previewed by the AppWorld star in Fig\.[1](https://arxiv.org/html/2606.14200#S4.F1)B and expanded with additional real landings in Fig\.[4](https://arxiv.org/html/2606.14200#S5.F4), projects into the shallow green part of the referenceH×NH\\times Nslice; its full\(H,N,C\)\(H,N,C\)coordinates explain the modest effect size exactly as Proposition 1 predicts\.H=0\.22H\{=\}0\.22is only moderate: frontier models on a shared benchmark are more alike than not, limiting the Global baseline’s bias\.N=24N\{=\}24is not sparse: with two dozen episodes per cell, Independent is already a decent estimator, so there is little variance for borrowing to cut\.C=0\.79C\{=\}0\.79is high: the skills are strongly correlated, so we cannot attribute the gain to fully orthogonal competence\.*Honest reading:*real public pools do contain skill\-conditional value, and the sign and significance survive scrutiny, but the magnitude is small because AppWorld sits near—not deep inside—the beneficial regime\. We read the small magnitude not as a weak effect but as a*measured location*on the phase diagram, which converts into a falsifiable prediction: the gain is small*because*today’s public pools are built from a few frontier models that are mutually similar \(moderateHH, highCC\) and densely evaluated \(largeNN\); as open marketplaces fill with more specialized, unevenly evidenced agents—lowerCC, higherHH, sparserNN—a pool’s coordinates move along the diagram toward the deep\-green region, and the conditional gain grows with them\. The mechanism is the same; only the substrate’s coordinates change\. This is the result \(the mechanism is real on real data\) and its caveat \(the public landscape is shallow\) at once, stated as a curve the ecosystem will climb rather than a constant\. The highCCalso foreshadows the adversarial result: it is precisely the correlation that makes borrowing legitimate here that an attacker will later exploit \(§[6](https://arxiv.org/html/2606.14200#S6)\)\.

### 5\.1Robustness: the phase diagram holds in both directions

A single landing point cannot show that the phase diagram*governs*real pools rather than merely admitting one\. We add four more landing points from the same public source, at zero model cost: three difficulty strata oftest\_normal\(slicing the 14\-agent pool by AppWorld task difficulty\), and the independent, hardertest\_challengesplit \(380380tasks across the same1414agents, recovered by decrypting the public leaderboard bundles; same app\-primary skill axis\)\. Table[2](https://arxiv.org/html/2606.14200#S5.T2)reports the full coordinates; Fig\.[4](https://arxiv.org/html/2606.14200#S5.F4)visualizes them by projectingH,NH,Nonto the reference phase slice and plottingCCdirectly against the observed conditional gain\. Slicing out difficulty lowers the skill correlationCCfrom0\.790\.79to0\.560\.56–0\.680\.68and the conditional gain*rises*to\+0\.06\+0\.06–\+0\.09\+0\.09: pooling difficulties had averaged specialization away, so the headline\+0\.04\+0\.04*understates*the per\-stratum value\. The hardertest\_challengesplit moves the other way—CCrises to0\.820\.82as multi\-app tasks and floored\-out weak agents inflate cross\-skill correlation—and conditioning value collapses to\+0\.01\+0\.01, anamberverdict: ample total headroom \(oracle−\-global=0\.25=0\.25\) that the primary\-app axis fails to capture\. The governing variable is the correlationCC\(and the coarseness of the skill axis\), not task difficulty\. Crucially, CIVT*discriminates*: it certifiestest\_normalgreenand flagstest\_challengeamberfrom logs alone, returning a negative exactly where conditioning stops paying\. The de\-risking test is therefore not a rubber stamp—which is what makes itsgreenontest\_normal, and the attack we now mount on that pool, meaningful\.

Table 2:Five real AppWorld landing points \(no model execution\)\. The table reports the full\(H,N,C\)\(H,N,C\)coordinates behind Fig\.[4](https://arxiv.org/html/2606.14200#S5.F4); CIVT returnsgreenoramberaccordingly\.Δsk\\Delta\_\{\\mathrm\{sk\}\}is skill\-vs\-global on the continuous score\.![Refer to caption](https://arxiv.org/html/2606.14200v1/phase_diagram_appworld_overlay.png)Figure 4:Five real AppWorld landing points\. \(A\) Projection onto a referenceH×NH\\times Nphase slice atC=1C\{=\}1; marker color shows the CIVT verdict, marker size tracksΔsk\\Delta\_\{\\mathrm\{sk\}\}, and labels report each pool’s empiricalCC\. SinceCCis not an axis in this panel, \(B\) plots empirical skill correlationCCdirectly against conditional gainΔsk\\Delta\_\{\\mathrm\{sk\}\}; the dashed line marks the CIVT skill\-value cutoffΔsk=0\.03\\Delta\_\{\\mathrm\{sk\}\}\{=\}0\.03\.

## 6Adversarial Analysis

Proposition 2 warned, in the controlled DGP, that the borrowing channel is dual\-use; §[5](https://arxiv.org/html/2606.14200#S5)then found a real pool whose conditional value rests on high skill correlation\. We now collide the two: we run the laundering attack on exactly that real, CIVT\-certifiedgreenpool, and ask how cheap the attack is, which defenses bound it, and at what residual cost\.

#### Threat model\.

In an open pool an attacker registers one or more agents and seeks to be routed skill\-ktk\_\{t\}tasks despite having no genuine competence on the*target*skillktk\_\{t\}\. Its lever is a cheap*farm*skillkfk\_\{f\}on which honest evidence is easy to produce, and the borrowing channel of Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\), which lets farm evidence inflate the target estimate wheneverWkt,kf\>0W\_\{k\_\{t\},k\_\{f\}\}\{\>\}0\. We hold the attacker to an explicitbudgetBB—the number of farm episodes it can fabricate, or the number of Sybil identities it can register—and the defender routes with the conditional estimator at the deployed couplingβ=0\.1\\beta\{=\}0\.1fixed in §[4](https://arxiv.org/html/2606.14200#S4)\. We distinguish four attacker profiles by how they spend the budget: a*launderer*\(one agent, perfect farm evidence, zero target evidence\); a*whitewasher*\(a fresh identity that sheds a bad history and re\-enters with farm evidence only\); a*Sybil*\(the same farm budget split acrosskkidentities\); and a*sleeper*\(farm build\-up plus partial, genuine target evidence\)\. A fifth profile, the*learner*, plants failing target episodes to defeat the defense of §[6\.2](https://arxiv.org/html/2606.14200#S6.SS2)and is analyzed there\. We measure attack benefit by the same full\-pool routing regret \([3](https://arxiv.org/html/2606.14200#S3.E3)\) used for the honest analysis: the attack succeeds to the extent it makes the router send target tasks to an incompetent agent\.

#### Attack surface\.

The choice of farm–target pair matters for the strength of the claim\. We first examined simple\_note→\\rightarrowvenmo, but its honest gap is sub\-green\(Δ𝗌𝗄=0\.02\\Delta\_\{\\mathsf\{sk\}\}\{=\}0\.02\): CIVT would not recommend conditioning on that pair in the first place, so capturing it invites the reply “you attacked a pool the system would avoid\.” To close that gap we attack a pair CIVT itself*endorses*: farm = simple\_note, target = phone\. This pair is highly correlated \(R=0\.861R\{=\}0\.861\)—so the honest borrowing the attacker abuses is exactly the borrowing Proposition 3 sanctions—andgreenunder the honest gated verdict,Δ𝗌𝗄=Δ𝗈𝗋=0\.1922\\Delta\_\{\\mathsf\{sk\}\}\{=\}\\Delta\_\{\\mathsf\{or\}\}\{=\}0\.1922, well above the0\.03/0\.050\.03/0\.05thresholds\. The attack is therefore not an edge case on a pair the system would avoid; it captures a skill\-conditioned pool with real, CIVT\-certified routing value\. This is the strongest form of the threat: the defense cannot escape it by simply refusing to condition, because refusing to condition here forfeits a genuine\+0\.19\+0\.19gain\.

Sweepingβ\\beta\(Fig\.[5](https://arxiv.org/html/2606.14200#S6.F5), Table[3](https://arxiv.org/html/2606.14200#S6.T3)\), azero\-target attacker—either a launderer with perfect farm evidence or a whitewasher with a fresh identity—is captured atβ≥0\.05\\beta\\\!\\geq\\\!0\.05and drives full\-pool routing regret \([3](https://arxiv.org/html/2606.14200#S3.E3)\) from0to0\.93570\.9357: above the threshold coupling the inflated target estimate exceeds every honest incumbent’s, so the router hands phone tasks to an agent with no phone competence\. The same attack contaminates the trust signal itself\. On the clean pool the gated CIVT verdict is\+0\.1922\+0\.1922\(stronglygreen\); but the launderer’s perfect farm score also lifts its*global*mean, so if it is admitted into the global baseline—as a naive verdict does—the apparent value of conditioning collapses to−0\.0643\-0\.0643\. The same pool thus reads “conditioning is harmful” to a defender who does not gate, and “conditioning is worth\+0\.19\+0\.19” to one who does: the gap between−0\.06\-0\.06and\+0\.19\+0\.19is entirely an artifact of whether zero\-target evidence is allowed to vote, which is exactly what the defense of §[6\.2](https://arxiv.org/html/2606.14200#S6.SS2)controls\. The remaining profiles confirm the pattern: aSybilsplitting2424farm episodes acrosskkidentities is captured for allk≥1k\\\!\\geq\\\!1\(splitting the budget does not weaken it, since each identity still carries zero target evidence\), while asleeperthat mixes in partial genuine target evidence is*not*captured atβ=0\.1\\beta\{=\}0\.1—its real target failures dilute the laundering signal below the capture threshold\. This realizes Proposition 2’s warning on a realgreenpool, at the conservative couplingβ=0\.1\\beta\{=\}0\.1we adopted there\.

![Refer to caption](https://arxiv.org/html/2606.14200v1/attack_combined.png)Figure 5:Cross\-skill laundering on agreenAppWorld pair \(simple\_note→\\rightarrowphone\)\. Asβ\\betacrosses0\.050\.05, the zero\-target attack captures the target skill and regret jumps to0\.93570\.9357\. The gated verdict remains stronglygreen\(\+0\.1922\+0\.1922\), while the naive global baseline is contaminated \(−0\.0643\-0\.0643\)\.Table 3:Capture at theβ=0\.1\\beta\{=\}0\.1sweet spot on the simple\_note→\\rightarrowphonegreenpair\.
### 6\.1The attack is one\-episode cheap

A natural first instinct is to defend by rate\-limiting: cap how much farm evidenceBBan agent may accumulate, on the theory that laundering needs a large farm balance to outweigh honest competence\. We measure attack benefit as full\-pool routing regret \([3](https://arxiv.org/html/2606.14200#S3.E3)\) againstBBand find this instinct is*mathematically void*for pure laundering\.

#### Budget degeneracy\.

Consider a zero\-target launderer on target skillktk\_\{t\}with farm skillkfk\_\{f\}: it holds no genuine target evidence \(ni,kt=0n\_\{i,k\_\{t\}\}\{=\}0\) and farm evidence equal to its budget \(ni,kf=Bn\_\{i,k\_\{f\}\}\{=\}B\)\. Every honest target term then drops out of Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\), and the target estimate collapses:

τ^i,kt=β​B​oi,kf\+ni,kt​oi,kt⏞=0β​B\+ni,kt⏟=0=β​B​oi,kfβ​B=oi,kf,\\hat\{\\tau\}\_\{i,k\_\{t\}\}=\\frac\{\\beta\\,B\\,o\_\{i,k\_\{f\}\}\+\\overbrace\{n\_\{i,k\_\{t\}\}\\,o\_\{i,k\_\{t\}\}\}^\{=\\,0\}\}\{\\beta\\,B\+\\underbrace\{n\_\{i,k\_\{t\}\}\}\_\{=\\,0\}\}=\\frac\{\\beta\\,B\\,o\_\{i,k\_\{f\}\}\}\{\\beta\\,B\}=o\_\{i,k\_\{f\}\},identically for*every*B≥1B\\\!\\geq\\\!1and*every*β\>0\\beta\\\!\>\\\!0: the budgetBBand the couplingβ\\betacancel algebraically\. The estimate is pinned at the farm score the instant a single farm episode exists, so one fabricated episode already drives regret to its capped value0\.93570\.9357and a full agent’s2424episodes buy nothing more \(Fig\.[6](https://arxiv.org/html/2606.14200#S6.F6)\)\. The flat budget curve is not a plotting artifact—it is this cancellation\. Two consequences follow\.*\(i\)*The attack is not merely possible but*one\-episode cheap*: there is no budget threshold to raise, because the threshold is one\.*\(ii\)*The defense cannot be a rate limit onBBor a clip onβ\\beta, both of which the cancellation neutralizes; it must instead be*structural*, keying on the qualitative fact that genuine target evidence is absent\. That is precisely the gate of §[6\.2](https://arxiv.org/html/2606.14200#S6.SS2)\.

![Refer to caption](https://arxiv.org/html/2606.14200v1/budget_curves.png)Figure 6:Attack benefit vs\. budgetBBon thegreenpair\. For zero\-target launderer/whitewasher attacks,BBandβ\\betacancel in Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\): anyB≥1B\\\!\\geq\\\!1andβ\>0\\beta\\\!\>\\\!0yields the same capped regret \(0\.93570\.9357\)\. The sleeper does not capture atβ=0\.1\\beta\{=\}0\.1\.

### 6\.2Only an evidence gate bounds it

Budget degeneracy already rules out rate\-limiting, but three other defensive instincts remain: make the*estimator*robust \(adaptive coupling\),*cap*the borrowed contribution, or*detect*and flag the attacker\. We evaluate all four against each attack profile at the deployedβ=0\.1\\beta\{=\}0\.1\(Fig\.[7](https://arxiv.org/html/2606.14200#S6.F7)\), and the picture is sharply asymmetric—only the one structural defense works:

- •Zero\-evidence gate—suppress cross\-skill borrowing for any agent withni,k<1n\_\{i,k\}\{<\}1direct episodes on the target skill—is the*only*effective defense, cutting launderer and whitewasher benefit from0\.93570\.9357to0\.00000\.0000while leaving the honestgreenverdict intact\.
- •Adaptive coupling—the hero of Proposition 3—*fails*here\. Because the farm and target skills are genuinely correlated in the honest pool \(R=0\.861R\{=\}0\.861\), the adaptive estimator \([2](https://arxiv.org/html/2606.14200#S3.E2)\) borrows along exactly the channel the attacker rides, and cannot separate laundering from honest correlated competence\. Graceful degradation at*low*CC\(§[4](https://arxiv.org/html/2606.14200#S4)\) does not imply robustness at*high*CC\.
- •Capped borrowing\(clip the off\-diagonal contribution\) is ineffective at thisβ\\beta: the coupling structure of Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\) still admits full inflation\.
- •Detection signature\(flag agents with perfect farm and zero target evidence\) attains precision and recall1\.01\.0at capture, but flagging is not mitigation: benefit is unchanged unless the flag triggers an action such as the gate\.

![Refer to caption](https://arxiv.org/html/2606.14200v1/defense_matrix.png)Figure 7:Defense benefit matrix atβ=0\.1\\beta\{=\}0\.1\(lower is better\)\. Of four defenses, only the zero\-evidence gate reduces launderer and whitewasher regret to0; adaptive coupling, capping, and detection leave the0\.93570\.9357benefit intact\. Zero\-height bars are marked explicitly at the baseline\. The sleeper is harmless throughout\.#### Bounded claim, and where it breaks\.

We therefore state a deliberately bounded result:*atβ=0\.1\\beta\{=\}0\.1, the zero\-evidence gate reduces zero\-target laundering benefit from0\.93570\.9357to0on agreenpair, while leaving the honest\+0\.1922\+0\.1922verdict intact\.*The gate works because it keys on the one thing budget degeneracy could not fake: the*qualitative*presence of genuine target evidence\. A pure launderer hasni,target=0n\_\{i,\\mathrm\{target\}\}\{=\}0by definition, so suppressing cross\-skill borrowing exactly forni,k<1n\_\{i,k\}\{<\}1removes its inflation without touching any agent that has actually attempted the target skill\. But this is a bounded result, not Sybil\-resistance, and we are explicit about where it breaks\. The predicateni,k<1n\_\{i,k\}\{<\}1is a cliff at zero, so an attacker who plants even a single failing target episode—posing as a “learner” acquiring the skill rather than a pure launderer—steps over the cliff and re\-enters the borrowing channel\. The question is what that costs\.

![Refer to caption](https://arxiv.org/html/2606.14200v1/learner_cost.png)Figure 8:Residual learner cost under the zero\-evidence gate\. Once the attacker plants target\-skill evidence, the budget axis becomes non\-degenerate: on thegreenpair, one planted failing target episode requires6464farm episodes to recover capture, while two or more planted episodes are not captured up to6464farm episodes\.Figure[8](https://arxiv.org/html/2606.14200#S6.F8)quantifies this residual channel, and the cost is high\. The budget axis, degenerate for pure laundering, comes back to life once a planted episode appears in the denominator of Eq\. \([1](https://arxiv.org/html/2606.14200#S3.E1)\): the attacker must now out\-mass its own planted failures with farm evidence\. With one planted target\-zero episode, regaining capture takes6464farm episodes; with two, four, or eight planted episodes, capture does not occur at all up to6464farm episodes\. The gate is therefore not a cure, but it converts a free, one\-episode attack into an explicit and steep target\-evidence\-versus\-farm\-budget tradeoff\. Crucially, the bypass is*costlier on greener pools*: a high\-Δ𝗌𝗄\\Delta\_\{\\mathsf\{sk\}\}pool has strong honest incumbents, so each planted failure drags the attacker’s pooled estimate below their bar faster than farm evidence can lift it back—the gate is most effective exactly where conditioning is most valuable, and weakest on the marginal pools where there was little to protect\. This is the shape of the bounded\-defense claim we make: rather than assert Sybil\-resistance, we map which attacks each defense blocks, at what cost, and where the classical Sybil\-proofness impossibilityCheng and Friedman\([2005](https://arxiv.org/html/2606.14200#bib.bib2)\);Friedman and Resnick\([2001](https://arxiv.org/html/2606.14200#bib.bib5)\)remains open—a trade\-off quantified, not a guarantee overclaimed\.

## 7Limitations and Future Work

We state the boundaries of the claims plainly\.

- •Verifiable\-outcome scope\.We study skills whose outcome a program can check—tool use, code, payments, data tasks \(the makeup of AppWorld\)\. For*quality*services such as summarization, writing, or translation there is no environment judge, and the only available signal is a consumer’s*subjective*rating; such skills fall outside our setting\. When unverifiable peer ratings enter the signal, transitive cross\-agent propagation \(and the Sybil/collusion surface it must then defend\) becomes a live problem again; we leave that regime to future work\. We view restricting to the verifiable slice as deliberate, not a simplification: when a checkable signal exists, routing on it strictly dominates routing on a gameable rating, and the slice already covers a large class of real agent tasks\.
- •Skill definition\.The skill axis is the single primary app of each task; multi\-app tasks are projected onto their primary app, and task*difficulty*is not modeled as a separate skill\. A finer skill taxonomy could raise bothHHand the conditional gain\.
- •Shallow real landing\.AppWorld lands inside the beneficial regime but shallowly \(highC=0\.79C\{=\}0\.79, modest gain\+0\.04\{\+\}0\.04\)\. We validate the mechanism on real data but cannot, on this benchmark, exhibit a*large*real\-world effect; the difficulty strata of §[5\.1](https://arxiv.org/html/2606.14200#S5.SS1)already show the gain rising asCCfalls, but reaching the deep\-green regime would require pools with higher heterogeneity and sparser, less\-correlated evidence than current public benchmarks supply\.
- •Bounded adversarial claim\.The gate’s guarantee is bounded, not absolute: it defeats zero\-target laundering but is bypassable by a learner at a quantified cost \(§[6\.2](https://arxiv.org/html/2606.14200#S6.SS2)\), and we explicitly do not claim Sybil\-resistance\.
- •Conditioning axis\.We condition on skillkkonly; conditioning on rolerrand queryqq, and the interaction among them, is future work\.

## 8Conclusion

As open systems fill with heterogeneous LLM agents, a single global trust score becomes the wrong object, and the natural fix—conditioning trust on the task’s skill—is neither universally better nor a free lunch\. Our characterization makes three things precise\.*When*: conditioning pays off only under high heterogeneity and sparse, correlated evidence, a regime CIVT detects from logs at zero cost\.*How much*: the borrowing strengthβ\\betahas a constrained optimum because the same channel that buys data efficiency launders reputation\.*Whether it is safe*: cross\-skill laundering captures even a CIVT\-certifiedgreenpool at one\-episode cost, and only a structural zero\-evidence gate bounds it—bounds, not eliminates, with a residual learner cost we quantify\. We give the map, place real public data on it, and chart its adversarial limits, trading the comfortable claim that conditional trust is simply better for the more durable one that says exactly when, how much, and at what risk\.

## References

- Chen et al\. \[2023\]L\. Chen, M\. Zaharia, and J\. Zou\.FrugalGPT: How to use large language models while reducing cost and improving performance, 2023\.
- Cheng and Friedman \[2005\]A\. Cheng and E\. Friedman\.Sybilproof reputation mechanisms\.In*Proceedings of the 2005 ACM SIGCOMM Workshop on Economics of Peer\-to\-Peer Systems \(P2PECON\)*, pages 128–132\. Association for Computing Machinery, 2005\.doi:10\.1145/1080192\.1080202\.
- Douceur \[2002\]J\. R\. Douceur\.The Sybil attack\.In*International Workshop on Peer\-to\-Peer Systems \(IPTPS\)*, pages 251–260, 2002\.
- Efron and Morris \[1977\]B\. Efron and C\. Morris\.Stein’s paradox in statistics\.*Scientific American*, 236\(5\):119–127, 1977\.
- Friedman and Resnick \[2001\]E\. J\. Friedman and P\. Resnick\.The social cost of cheap pseudonyms\.In*Journal of Economics & Management Strategy*, 2001\.whitewashing / cheap\-pseudonym reputation problem\.
- Guo et al\. \[2024\]D\. Guo, Q\. Zhu, D\. Yang, Z\. Xie, K\. Dong, W\. Zhang, G\. Chen, X\. Bi, Y\. Wu, Y\. K\. Li, F\. Luo, Y\. Xiong, and W\. Liang\.DeepSeek\-Coder: When the large language model meets programming—the rise of code intelligence, 2024\.
- Hu and Rong \[2025\]B\. Hu and H\. Rong\.Inter\-agent trust models: A comparative study of brief, claim, proof, stake, reputation and constraint in agentic web protocol design \(A2A, AP2, ERC\-8004\), 2025\.AAAI 2026 Workshop on Trust and Control in Agentic AI \(TrustAgent\)\.
- James and Stein \[1961\]W\. James and C\. Stein\.Estimation with quadratic loss\.In*Proceedings of the Fourth Berkeley Symposium on Mathematical Statistics and Probability*, volume 1, pages 361–379, 1961\.
- Jiang et al\. \[2024\]A\. Q\. Jiang, A\. Sablayrolles, A\. Roux, A\. Mensch, B\. Savary, C\. Bamford, D\. S\. Chaplot, D\. de las Casas, E\. B\. Hanna, F\. Bressand, G\. Lengyel, G\. Bour, G\. Lample, L\. R\. Lavaud, L\. Saulnier, M\.\-A\. Lachaux, P\. Stock, S\. Subramanian, S\. Yang, S\. Antoniak, T\. Le Scao, T\. Gervet, T\. Lavril, T\. Wang, T\. Lacroix, and W\. El Sayed\.Mixtral of experts, 2024\.
- Kamvar et al\. \[2003\]S\. D\. Kamvar, M\. T\. Schlosser, and H\. Garcia\-Molina\.The EigenTrust algorithm for reputation management in P2P networks\.In*Proceedings of the 12th International Conference on World Wide Web \(WWW\)*, pages 640–651, 2003\.
- Liu et al\. \[2024\]X\. Liu, H\. Yu, H\. Zhang, Y\. Xu, X\. Lei, H\. Lai, Y\. Gu, H\. Ding, K\. Men, K\. Yang, S\. Zhang, X\. Deng, A\. Zeng, Z\. Du, C\. Zhang, S\. Shen, T\. Zhang, Y\. Su, H\. Sun, M\. Huang, Y\. Dong, and J\. Tang\.AgentBench: Evaluating LLMs as agents\.In*International Conference on Learning Representations \(ICLR\)*, 2024\.
- Liu et al\. \[2025\]Y\. Liu, R\. Zhang, H\. Luo, Y\. Lin, G\. Sun, D\. Niyato, H\. Du, Z\. Xiong, Y\. Wen, A\. Jamalipour, D\. I\. Kim, and P\. Zhang\.Secure multi\-LLM agentic AI and agentification for edge general intelligence by zero\-trust, 2025\.
- Llama Team, AI @ Meta \[2024\]Llama Team, AI @ Meta\.The Llama 3 herd of models, 2024\.
- Moslem and Kelleher \[2026\]Y\. Moslem and J\. D\. Kelleher\.Dynamic model routing and cascading for efficient LLM inference: A survey, 2026\.
- Ong et al\. \[2024\]I\. Ong, A\. Almahairi, V\. Wu, W\.\-L\. Chiang, T\. Wu, J\. E\. Gonzalez, M\. W\. Kadous, and I\. Stoica\.RouteLLM: Learning to route LLMs with preference data, 2024\.ICLR 2025\.
- OpenAI \[2023\]OpenAI\.GPT\-4 technical report, 2023\.
- Page et al\. \[1999\]L\. Page, S\. Brin, R\. Motwani, and T\. Winograd\.The PageRank citation ranking: Bringing order to the web\.Technical Report 1999\-66, Stanford InfoLab, 1999\.
- Prakash \[2026\]S\. Prakash\.The provenance paradox in multi\-agent LLM routing: Delegation contracts and attested identity in LDP, 2026\.
- Pulishetty et al\. \[2025\]R\. Pulishetty, M\. K\. Ghantasala, K\. K\. Dasoju, N\. Mangwani, V\. Garimella, A\. Mate, S\. Chatterjee, Y\. Kang, E\. Nosakhare, S\. Hasan, and S\. Srinivasan\.One head, many models: Cross\-attention routing for cost\-aware LLM selection, 2025\.
- Qi et al\. \[2025\]M\. Qi, T\. Zhu, L\. Zhang, N\. Li, and W\. Zhou\.Towards transparent and incentive\-compatible collaboration in decentralized LLM multi\-agent systems: A blockchain\-driven approach, 2025\.
- Trivedi et al\. \[2024\]H\. Trivedi, T\. Khot, M\. Hartmann, R\. Manku, V\. Dong, E\. Li, S\. Gupta, A\. Sabharwal, and N\. Balasubramanian\.AppWorld: A controllable world of apps and people for benchmarking interactive coding agents\.In*Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(ACL\)*, 2024\.Best Resource Paper\.
- Wang et al\. \[2025\]J\. Wang, S\. Yang, T\. Qiao, J\. Qin, J\. Li, Y\. Wang, and Y\. Zhao\.Ev\-Trust: An evolutionarily stable trust mechanism for decentralized LLM\-based multi\-agent service economies, 2025\.
- Xu et al\. \[2025\]Z\. Xu, M\. Qi, S\. Wu, L\. Zhang, Q\. Wei, H\. He, and N\. Li\.The trust paradox in LLM\-based multi\-agent systems: When collaboration becomes a security vulnerability, 2025\.
- Yao et al\. \[2023\]S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao\.ReAct: Synergizing reasoning and acting in language models\.In*International Conference on Learning Representations \(ICLR\)*, 2023\.
- Yu et al\. \[2006\]H\. Yu, M\. Kaminsky, P\. B\. Gibbons, and A\. Flaxman\.SybilGuard: Defending against sybil attacks via social networks\.In*Proceedings of the ACM SIGCOMM Conference*, pages 267–278, 2006\.
- Yu et al\. \[2008\]H\. Yu, P\. B\. Gibbons, M\. Kaminsky, and F\. Xiao\.SybilLimit: A near\-optimal social network defense against Sybil attacks\.*IEEE/ACM Transactions on Networking*, 2008\.
- Yu et al\. \[2025\]M\. Yu, F\. Meng, X\. Zhou, S\. Wang, J\. Mao, L\. Pan, T\. Chen, K\. Wang, X\. Li, Y\. Zhang, B\. An, and Q\. Wen\.A survey on trustworthy LLM agents: Threats and countermeasures\.In*Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining*, KDD ’25, pages 6216–6226, New York, NY, USA, 2025\. Association for Computing Machinery\.doi:10\.1145/3711896\.3736561\.