Paper deep dive
Trust-Gated Capability Control: Breaking the Trust-Vulnerability Paradox in Multi-Agent LLM Systems
Mehedi Hasan Nipu, Chinmoy Mitra, Tarannum Ahmed Nowshin, Israt Moyeen Noumi
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 10/7/2026, 7:44:06 AM
Summary
The paper introduces Trust-Gated Capability Control (TGCC), a framework for multi-agent LLM systems that resolves the Trust-Vulnerability Paradox. It employs a five-layer trust stack (epistemic, behavioral, role, social, institutional) coupled by a cross-layer synergy operator to propagate deficits. Trust is aggregated via a generalized-mean composite score with adaptive, failure-grounded weights. Capability grants are issued only when composite trust and prerequisite layer thresholds are met, ensuring revocable, least-privilege access and preventing privilege escalation by compromised agents.
Entities (10)
Relation Signals (8)
Trust-Gated Capability Control → resolves → Trust-Vulnerability Paradox
confidence 96% · We prove this mechanism breaks the paradox: a stealthy compromise that inflates behavioral trust while degrading a prerequisite layer cannot escalate privilege...
Cross-layer synergy operator → propagates → prerequisite-layer deficits
confidence 95% · First, a cross-layer synergy operator propagates prerequisite-layer deficits into dependent layers...
Cross-layer synergy operator → feeds → Generalized-mean composite trust
confidence 94% · ...feeding a generalized-mean composite trust that recovers the weakest-link rule as a limiting case...
Trust-Gated Capability Control → issues → capability grants
confidence 94% · Third, Trust-Gated Capability Control issues short-lived, revocable capability grants only when composite trust and the relevant prerequisite layers clear capability-specific thresholds.
No-regret online estimator → determines → per-layer importance weights
confidence 93% · Second, per-layer importance weights are grounded in observed failures via a no-regret online estimator...
Sleeper adversary → triggers → automatic revocation
confidence 92% · A numerical study with a sleeper adversary confirms the predictions... a compromised prerequisite layer triggers automatic revocation within a few interactions.
No-regret online estimator → uses → Hedge algorithm
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Layered trust models for multi-agent LLM systems remain largely conceptual: they name which dimensions of trust matter but not how layers combine, how their importance is set at runtime, or how trust should govern agent actions. This gap matters because higher inter-agent trust raises task success while also enlarging exposure to exploitation, a tension formalized as the Trust-Vulnerability Paradox. We make a five-layer trust stack operational through three contributions. First, a cross-layer synergy operator propagates prerequisite-layer deficits into de- pendent layers, feeding a generalized-mean composite trust that recovers the weakest-link rule as a limiting case, with provable bounds. Second, per-layer importance weights are grounded in observed failures via a no-regret online estimator that tracks which layer is currently most responsible for harm. Third, Trust- Gated Capability Control issues short-lived, revocable capability grants only when composite trust and the relevant prerequisite layers clear capability-specific thresholds. We prove this mechanism breaks the paradox: a stealthy compromise that inflates behavioral trust while degrading a prerequisite layer cannot escalate privilege, and give a closed-form, provably conservative trust fixed point with a bounded-latency revocation guarantee. A numerical study with a sleeper adversary confirms the predictions: composite-trust bounds hold across 20,000 random draws, the analytic fixed point matches simulation within 0.007, and a compromised prerequisite layer triggers automatic revocation within a few interactions.
Tags
Links
- Source: https://arxiv.org/abs/2610.07000v1
- Canonical: https://arxiv.org/abs/2610.07000v1
Trouble viewing inline? Open PDF directly →
Full Text
34,125 characters extracted from source content.
Expand or collapse full text
Trust-Gated Capability Control: Breaking the Trust–Vulnerability Paradox in Multi-Agent LLM Systems Md Mehedi Hasan Nipu1, Chinmoy Mitra2, Tarannum Ahmed Nowshin3 Israt Moyeen Noumi4 Affiliation: 1Department of Electrical and Computer Engineering, North South University, Dhaka, Bangladesh 2Department of Computer Science & Engineering Rajshahi University of Engineering & Technology Rajshahi, Bangladesh 3Department of Computer Science and Engineering BRAC University,Dhaka, Bangladesh 4Dept of Computer Science and Engineering, Ahsanullah University of Science and Technology, Bangladesh mehedi.nipu@northsouth.edu, rudrochinmoy@gmail.com, taranowshin@gmail.com, isratmoyeen.23@gmail.com Abstract Layered trust models for multi-agent LLM systems remain largely conceptual: they name which dimensions of trust matter but not how layers combine, how their importance is set at runtime, or how trust should govern agent actions. This gap matters because higher inter-agent trust raises task success while also enlarging exposure to exploitation, a tension formalized as the Trust-Vulnerability Paradox. We make a five-layer trust stack operational through three contributions. First, a cross-layer synergy operator propagates prerequisite-layer deficits into dependent layers, feeding a generalized-mean composite trust that recovers the weakest-link rule as a limiting case, with provable bounds. Second, per-layer importance weights are grounded in observed failures via a no-regret online estimator that tracks which layer is currently most responsible for harm. Third, Trust-Gated Capability Control issues short-lived, revocable capability grants only when composite trust and the relevant prerequisite layers clear capability-specific thresholds. We prove this mechanism breaks the paradox: a stealthy compromise that inflates behavioral trust while degrading a prerequisite layer cannot escalate privilege, and give a closed-form, provably conservative trust fixed point with a bounded-latency revocation guarantee. A numerical study with a sleeper adversary confirms the predictions: composite-trust bounds hold across 20,000 random draws, the analytic fixed point matches simulation within 0.007, and a compromised prerequisite layer triggers automatic revocation within a few interactions. Index Terms: multi-agent systems, large language models, trust, zero-trust, capability control, agent safety, alignment I Introduction Large language model (LLM) agents are increasingly deployed as collaborating collectives that plan, negotiate, and act through shared tools and messages [1, 2, 3, 4]. Collaboration improves capability but makes trust between agents a first-class operational variable rather than a background assumption: a compromised or hallucinating agent whose output is consumed without scrutiny can propagate errors system-wide, and structured attacks on inter-agent trust raise harmful-response rates well above single-agent baselines [25]. Recent work formalizes this as a Trust-Vulnerability Paradox (TVP): higher inter-agent trust improves task success yet monotonically increases over-exposure and authorization drift [5], so trust is better treated as a revocable, continuously verified security variable governed by least-privilege principles [6, 7, 8]. Layered trust models are an appealing response, decomposing trustworthiness into dimensions such as epistemic reliability, behavioral alignment, role awareness, social accountability, and institutional governance. Yet existing accounts are largely descriptive, leaving three questions open: (i) Composition – how do layer-wise trust values combine into one actionable score when layers are not independent? (i) Weighting – how is each layer’s relative importance set, and can it adapt to which layer is failing? (i) Actuation – how should the resulting trust govern what an agent is permitted to do? Without answers, a layered model cannot be deployed at runtime. This paper closes these gaps. We treat the layered stack as a dynamical object and make it operational. Contributions: • A cross-layer synergy operator (Sec. I) propagating prerequisite-layer deficits into dependent layers, feeding a generalized-mean composite trust Φp _p whose limit p→−∞p\!→\!-∞ recovers the weakest-link rule (Theorem 1, Proposition 2), plus a closed-form conservative trust fixed point (Proposition 1). • Failure-grounded adaptive weights (Sec. IV): layer importances αℓ(t) _ (t) learned online from layer-attributed failures with a no-regret guarantee (Lemma 2). • Trust-Gated Capability Control (Sec. V): a runtime algorithm mapping composite trust to revocable capability grants, provably breaking the TVP (Theorem 2) with bounded revocation latency (Corollary 1). • A numerical study (Sec. VI) confirming the bounds, fixed point, and self-revocation under a sleeper adversary. We also map the framework onto deployed agent protocols (MCP, A2A) and sketch cross-modal and economic-incentive extensions (Sec. VII). I Related Work Trust as a security variable. Qi et al. [5] formalize the Trust–Vulnerability Paradox around three facets of inter-agent trust – strength (how readily claims are accepted), scope (what is thereby authorized), and revocability (how fast permissions can be withdrawn) – and show empirically that raising a scalar trust level τ monotonically increases over-exposure and authorization drift across several agent frameworks. Their defenses (sensitive-information repartitioning, a guardian agent policing disclosures) reduce exposure but operate around the trust signal rather than reshaping how it is computed. Zero-trust treatments for agentic AI [6, 8] recast trust as never-implicit and continuously re-verified, with verifiable identity, least-privilege scopes, and per-call revocation; TRiSM [7] organizes the broader landscape. These works establish that trust must be revocable, but leave open how a multi-dimensional signal should be aggregated into authorization – precisely the gap our compositional operator and gating rule fill. Dynamic and probabilistic trust. Classical reputation systems summarize an agent’s past behavior into a scalar score [9], often via Beta or Dirichlet posteriors whose conjugacy makes updates cheap [10]. Recent LLM-era work revives this: DynaTrust [11] maintains per-agent Beta beliefs with failure-weighted smoothing to expose sleeper agents, AgentGuard [12] learns an online MDP model of emergent behavior for runtime assurance, and economic-game probes elicit LLMs’ own trustworthiness priors [28]. All track a single trust quantity and are therefore blind to the heart of the paradox: an agent that is behaviorally cooperative yet epistemically broken. We retain the Beta machinery, and prove its conservative steady state, but lift it to a vector of layer trusts coupled by a synergy operator, letting a hidden prerequisite failure veto authorization. Multi-agent debate, deception, and collective safety. Collaboration among LLM agents can both improve and degrade safety: structured debate raises answer quality and factuality [26], yet the same channels are exploitable – jailbreaks injected into one debater propagate through inter-agent messages and lift harmful-response rates well above single-agent baselines [25]. Simulations of deception and betrayal further show agents readily form, exploit, and misjudge trust in social settings [27]. Such findings argue for treating a compromised collaborator as the default threat (the stance our threat model adopts), not an edge case, and for authorization that does not amplify one corrupted agent’s influence across the collective. Uncertainty, calibration, and epistemic reliability. Any trust model’s epistemic layer rests on knowing when an agent is wrong. Bayesian and ensemble methods quantify predictive uncertainty [15], but LLMs are often miscalibrated, reporting high confidence on wrong outputs; recent work studies how to build and propagate well-grounded epistemic state across agents [29]. Our framework consumes such signals through the epistemic layer’s evidence s1s_1 and, via the synergy operator, lets a calibration collapse cascade into reduced authorization – turning a passive measurement into an active control input. Agent protocols. Interoperability standards such as MCP [17], A2A [18], and the broader protocol landscape [19] expose capabilities as scoped, token-mediated grants and increasingly issue short-lived credentials in the spirit of least privilege, standardizing the mechanism of capability exchange while staying silent on the policy that decides which scopes to issue. TGCC supplies exactly this missing policy layer (Sec. VII). Table I positions our approach against these lines of work: prior methods are dynamic, revocable, or partially layered, but none combines cross-layer composition, failure-adaptive weighting, capability gating, and formal guarantees. TABLE I: Positioning against prior approaches. Comp.: cross-layer composition; Adapt.: failure-adaptive weights; Gate: capability gating/revocation; Guar.: proven guarantees. Approach Comp. Adapt. Gate Guar. Reputation [9, 10] × × × × TVP defenses [5] × × partial × DynaTrust [11] × × × × Zero-trust [6, 8] × × ✓ × TGCC (ours) ✓ ✓ ✓ ✓ I The Operational Trust Stack Core idea. Maintain a vector of per-layer trusts, couple them so a prerequisite deficit suppresses dependent layers, and gate every capability on the resulting composite trust – authorization then tracks the weakest verified layer, not the raw trust an adversary can inflate. I-A Threat model and assumptions Setting. N agents collaborate, each consuming others’ outputs and requesting capabilities (tool calls, write actions, message scopes) mediated by a controller that decides grants. Adversary. A compromised sleeper agent first behaves cooperatively to accrue trust, then acts maliciously once granted high-risk capabilities, keeping its behavioral conduct agreeable while a prerequisite layer – typically epistemic reliability – collapses into confident hallucination. Assumptions. (A1) each layer ℓ exposes a check yielding a noisy but informative success signal sℓs_ (calibration probe, role-conformance test, audit trail, etc.); (A2) the layer dependency structure is known, encoded by a fixed lower-triangular coupling matrix C, with epistemic reliability a prerequisite of all higher layers; (A3) per-capability risk thresholds are set by the deployer. Goal. Prevent privilege escalation by a stealthily compromised agent while preserving capability for honest agents: authorization should follow verified cross-layer trust, not raw behavioral agreement. I-B Per-layer trust as a Beta belief Consider L=5L=5 ordered trust layers indexed ℓ∈1,…,L ∈\1,…,L\: epistemic (11), behavioral (22), role (33), social (44), institutional (55). For agent i at step t we maintain a trust vector i(t)=[Ti,1(t),…,Ti,L(t)]⊤∈[0,1]LT_i(t)=[T_i,1(t),…,T_i,L(t)] ∈[0,1]^L (we drop the index i where a single agent is meant). Each component is the mean of a Beta posterior accumulating per-layer evidence with a forgetting factor γ∈(0,1]γ∈(0,1] and an asymmetric penalty ω≥1ω\!≥\!1 on failures: aℓ←γaℓ+[sℓ],bℓ←γbℓ+ω 1[¬sℓ],a_ ←γ a_ +1[s_ ], b_ ←γ b_ +ω\,1[ s_ ], (1) Ti,ℓ(t)=aℓaℓ+bℓ,T_i, (t)= a_ a_ +b_ , (2) where sℓs_ is the success indicator of a layer-ℓ check (calibration probe, utility-divergence test, role-conformance check, audit, etc.). The forgetting factor keeps trust responsive to behavioral shifts; ω>1ω>1 makes trust fall faster than it rises, as is standard for safety-critical reputation [10, 11]. The estimator admits a closed-form, provably conservative steady state. Proposition 1 (Conservative trust fixed point). Under stationary layer reliability Pr[sℓ]=ρℓ [s_ ]= _ , the expected-evidence recursion induced by (1) with forgetting γ∈(0,1)γ∈(0,1) and penalty ω≥1ω≥ 1 has the unique fixed point Tℓ⋆=ρℓρℓ+ω(1−ρℓ),T_ = _ _ +ω(1- _ ), (3) which satisfies Tℓ⋆≤ρℓT_ ≤ _ with equality iff ω=1ω=1, is strictly increasing in ρℓ _ , and is reached geometrically at rate γ (independent of its value on γ). Proof. Taking expectations of (1) gives two linear recursions, contractive since γ<1γ<1: a¯t+1=γa¯t+ρℓ,b¯t+1=γb¯t+ω(1−ρℓ), a_t+1=γ a_t+ _ , b_t+1=γ b_t+ω(1- _ ), with fixed points a¯⋆=ρℓ/(1−γ) a = _ /(1-γ) and b¯⋆=ω(1−ρℓ)/(1−γ) b =ω(1- _ )/(1-γ). Hence Tℓ⋆=a¯⋆a¯⋆+b¯⋆=ρℓρℓ+ω(1−ρℓ),T_ = a a + b = _ _ +ω(1- _ ), the factor 1−γ1-γ cancelling. Strict monotonicity follows from ∂Tℓ⋆/∂ρℓ=ω[ρℓ+ω(1−ρℓ)]−2>0∂ T_ /∂ _ =ω\,[ _ +ω(1- _ )]^-2>0, and Tℓ⋆≤ρℓ⇔(ω−1)(1−ρℓ)≥0,T_ ≤ _ (ω-1)(1- _ )≥ 0, which holds for ω≥1ω≥ 1 (equality iff ω=1ω=1). Contractivity at rate γ gives the stated geometric convergence. ∎ For example, (ρ,ω)=(0.9,3)(ρ,ω)=(0.9,3) gives T⋆=0.75T =0.75, while ρ=0.3ρ=0.3 gives T⋆≈0.13T ≈ 0.13: a reliability collapse is amplified into a sharp trust drop, exploited by the controller in Sec. V. I-C Cross-layer synergy operator The layers are not independent: a deficit in a prerequisite layer should suppress the usable trust of every layer that depends on it. We encode dependencies by a lower-triangular coupling matrix ∈[0,1]L×LC∈[0,1]^L× L, where CℓkC_ k (for k<ℓk< ) is the degree to which layer ℓ is conditioned on prerequisite k. Definition 1 (Synergy operator). The effective trust of layer ℓ is T~ℓ=Tℓ∏k<ℓ(1−Cℓk(1−Tk)). T_ \;=\;T_ _k< (1-C_ k(1-T_k) ). (4) A prerequisite deficit (1−Tk)(1-T_k) discounts T~ℓ T_ by a factor that scales with the coupling CℓkC_ k: when Cℓk=0C_ k=0 there is no dependency, and when Cℓk=1C_ k=1 a fully failed prerequisite (Tk=0T_k\!=\!0) zeroes the contribution. Equation (4) is a precise instantiation of the otherwise informal notion that “failure at a lower layer propagates upward.” I-D Composite trust We aggregate the effective trusts into a single score via a weighted generalized (power) mean of order p<0p<0 with adaptive weights αℓ≥0 _ ≥ 0, ∑ℓαℓ=1 _ _ =1: Φp(,)=(∑ℓ=1LαℓT~ℓp)1/p. _p(T; α)= ( _ =1^L _ \, T_ ^p )^1/p. (5) Negative p makes Φp _p sensitive to the weakest layers; p→−∞p→-∞ recovers the conservative weakest-link rule minℓT~ℓ _ T_ , while moderate |p||p| permits limited compensation between healthy layers. The next results make this precise. We first verify the construction is well-posed. Lemma 1 (Well-posedness). For any ∈[0,1]LT∈[0,1]^L and lower-triangular ∈[0,1]L×LC∈[0,1]^L× L, the effective trusts satisfy T~ℓ∈[0,1] T_ ∈[0,1], and for any weights α on the simplex and p<0p<0, Φp∈[minℓT~ℓ,maxℓT~ℓ]⊆[0,1] _p∈[ _ T_ , _ T_ ] [0,1]. Hence the stack is a well-defined map [0,1]L→[0,1][0,1]^L→[0,1]. Proof. Each factor 1−Cℓk(1−Tk)∈[0,1]1-C_ k(1-T_k)∈[0,1] because Cℓk,Tk∈[0,1]C_ k,T_k∈[0,1]; a finite product of [0,1][0,1] terms times Tℓ∈[0,1]T_ ∈[0,1] stays in [0,1][0,1], so T~ℓ∈[0,1] T_ ∈[0,1]. A weighted power mean of arguments in [0,1][0,1] lies between their minimum and maximum, both in [0,1][0,1]. ∎ Theorem 1 (Bounds and weakest-link limit). For any p<0p<0, Φp _p is non-decreasing in each T~ℓ T_ and satisfies minℓT~ℓ≤Φp(,)≤∑ℓαℓT~ℓ, _ T_ ≤ _p(T; α)≤ _ _ T_ , (6) with limp→−∞Φp=minℓT~ℓ _p→-∞ _p= _ T_ . Moreover, Φp(,)≤κminℓT~ℓ,κ:=(minℓαℓ)1/p≥1. _p(T; α)≤κ\, _ T_ , κ:= ( _ _ )^1/p≥ 1. (7) Proof. Bounds (6) and the limit are the standard ordering of weighted power means: the mean of order p is non-decreasing in p, equals the arithmetic mean at p=1p=1 and the minimum at p→−∞p→-∞; monotonicity of Φp _p in each T~ℓ T_ follows since each summand T~ℓp T_ ^p is monotone. For (7), let j∈argminℓT~ℓj∈ _ T_ . As p<0p<0 every term is positive, so ∑ℓαℓT~ℓp≥αjT~jp. _ _ T_ ^p≥ _j\, T_j^p. The map x↦x1/px x^1/p is decreasing for p<0p<0; applying it and using αj≥minℓαℓ _j≥ _ _ , Φp≤αj1/pT~j≤(minℓαℓ)1/pminℓT~ℓ=κminℓT~ℓ.∎ _p≤ _j^1/p\, T_j≤ ( _ _ )^1/p _ T_ =κ _ T_ . Equation (7) is the key actuation lever: composite trust is pinned to the weakest effective layer up to a bounded slack κ. We next bound how a compromised prerequisite caps every dependent layer. Proposition 2 (Cascade containment). Suppose a prerequisite layer k is compromised, Tk≤δT_k≤δ. Then every dependent layer ℓ>k >k with Cℓk≥cC_ k≥ c obeys T~ℓ≤1−c(1−δ) T_ ≤ 1-c(1-δ). In particular, if the epistemic layer (k=1k=1) is compromised and Cℓ1≥cC_ 1≥ c for all ℓ , then Φp≤κδ _p≤κ\,δ. Proof. In (4) the factor for prerequisite k is 1−Cℓk(1−Tk)≤1−c(1−δ)1-C_ k(1-T_k)≤ 1-c(1-δ); all other factors and TℓT_ are ≤1≤ 1, giving the per-layer bound. If k=1k=1 then T~1=T1≤δ T_1=T_1≤δ, so minℓT~ℓ≤δ _ T_ ≤δ and (7) gives Φp≤κδ _p≤κδ. ∎ IV Failure-Grounded Adaptive Weighting Fig. 1: (a) Steady-state trust (bars) vs. analytic fixed point T⋆T (diamonds), MAE 0.0070.007 (Proposition 1). (b) Failure-grounded weights αℓ(t) _ (t) shift toward the epistemic layer after compromise (Lemma 2). The weights (t) α(t) decide which layers the composite score should attend to. We argue they should track which layer is currently most responsible for harm, information available from runtime failure attribution. Let qℓ(t)∈[0,1]q_ (t)∈[0,1] be a layer-attributed loss (e.g., the fraction of harmful episodes in a window whose root cause is layer ℓ ). We maintain an exponentially weighted risk estimate and a multiplicative-weights (Hedge) update: r^ℓ(t) r_ (t) =(1−λ)r^ℓ(t−1)+λqℓ(t), =(1-λ) r_ (t-1)+λ\,q_ (t), (8) αℓ(t) _ (t) =exp(ηr^ℓ(t))∑kexp(ηr^k(t)). = \! (η\, r_ (t) ) _k \! (η\, r_k(t) ). (9) This places weight on layers whose failures most predict system harm, so the composite trust becomes most sensitive precisely where the system is breaking. Treating each layer as an “expert” whose instantaneous loss is −r^ℓ(t)- r_ (t), (9) is the Hedge algorithm and inherits its guarantee. Lemma 2 (No-regret layer tracking). With learning rate η=8lnL/Tη= 8 L/T, the weighting (9) achieves regret RT≤(T/2)lnLR_T≤ (T/2) L relative to the best fixed layer-weighting in hindsight over a horizon T. Proof. Immediate from the standard regret bound of the Hedge/multiplicative-weights algorithm with bounded losses in [0,1][0,1] [20, 21]. ∎ Thus (t) α(t) converges, in the no-regret sense, to emphasizing the empirically dominant failure layer, linking the system’s failure record directly to its trust computation rather than fixing weights a priori. V Trust-Gated Capability Control Fig. 2: Trust dynamics of a sleeper agent. Behavioral trust stays high; epistemic collapse propagates through the synergy operator and pushes composite trust Φp _p below the revocation threshold θ (self-revocation, Corollary 1). We now actuate composite trust. Let C be the set of capabilities (tool calls, message scopes, write actions). Each c∈c carries a risk threshold θc∈[0,1] _c∈[0,1] and a set of required prerequisite layers req(c)req(c) with per-layer thresholds θc,ℓ _c, . Definition 2 (Trust-gated grant). Agent i is granted capability c at step t iff gi(c,t)=[Φp(i(t))≥θc∧∀ℓ∈req(c):T~i,ℓ(t)≥θc,ℓ].g_i(c,t)=1\! [ _p(T_i(t))≥ _c\; \;∀ \!∈\!req(c)\!:\, T_i, (t)≥ _c, ]. (10) Grants are recomputed every step, so a capability token is short-lived and automatically revoked when trust degrades, realizing least-privilege and revocability. Algorithm 1 gives the runtime loop. Algorithm 1 TGCC runtime loop (per agent i, per step t) 0: coupling C, order p, thresholds θc,θc,ℓ\ _c, _c, \, rates λ,ηλ,η 1: observe layer checks s1,…,sLs_1,…,s_L; update Beta beliefs via (1) 2: compute effective trust ~ T via synergy operator (4) 3: update risk r^ℓ r_ and weights α via (9) 4: composite Φp←(∑ℓαℓT~ℓp)1/p _p←( _ _ T_ ^\,p)^1/p 5: for all capabilities c∈c do 6: issue/keep token for c iff grant predicate (10) holds; else revoke 7: end for 8: if minℓT~ℓ<θrec _ T_ < _rec then 9: trigger layer-specific recovery (e.g. external knowledge anchoring) 10: end if Every quantity is maintained by a recursive update, so the controller is cheap enough to run on every interaction. Proposition 3 (Constant per-step overhead). Each iteration of Algorithm 1 runs in O(L2+||)O(L^2+|C|) time and O(L)O(L) memory per agent, independent of the interaction history length t. Proof. The Beta updates (1) and the Hedge update (9) touch each layer once (O(L)O(L)) and store only 2L2L pseudo-counts and L risk estimates. The synergy operator (4) forms L products of at most L factors (O(L2)O(L^2)), and the composite (5) is O(L)O(L). The grant test (10) costs O(||)O(|C|) for bounded prerequisite sets. History-independence follows because the forgetting recursions summarize the entire past in the O(L)O(L) state. ∎ With L=5L=5 this overhead is negligible, so per-step re-evaluation and prompt revocation are practical even at large collective scale. V-A Breaking the Trust-Vulnerability Paradox A naive controller authorizes on a single pairwise/behavioral trust signal τ≈T2τ≈ T_2 (the behavioral layer). Under such gating, an adversary that keeps behaving agreeably retains privilege even while its epistemic reliability collapses. This is precisely the regime in which over-exposure grows with trust [5]. TGCC removes this attack surface. Theorem 2 (Paradox resolution). Consider a stealthy compromise in which an agent’s behavioral trust is driven arbitrarily high, T2→1T_2→ 1, while a prerequisite layer k degrades to Tk≤δT_k≤δ. Under naive behavioral gating, every capability with θc≤T2 _c≤ T_2 remains granted, so over-exposure is unbounded in the compromise depth. Under TGCC with order p and k a prerequisite of all layers (e.g. epistemic), every capability with θc>κδ,κ=(minℓαℓ)1/p, _c>κ\,δ, κ= ( _ _ )^1/p, (11) is revoked irrespective of T2T_2. Hence the granted high-risk set is non-increasing in the compromise depth (1−δ)(1-δ). Proof. By Proposition 2 the compromise gives Φp≤κδ _p≤κδ. If θc>κδ _c>κδ then Φp<θc _p< _c, so the first conjunct of (10) fails and c is denied regardless of T2T_2. Decreasing δ (a deeper compromise) lowers the bound κδκδ, weakly enlarging the revoked set, so the granted high-risk set is non-increasing in (1−δ)(1-δ). The naive case is immediate, its grant rule depending only on T2T_2. ∎ Combining the conservative fixed point (Proposition 1) with Theorem 2 bounds how quickly a compromise is contained. Corollary 1 (Self-revocation with bounded latency). Suppose at time t0t_0 a prerequisite layer k (prerequisite to all layers) suffers a reliability drop whose conservative fixed point satisfies Tk⋆≤δT_k ≤δ. Then Tk(t)→Tk⋆T_k(t)→ T_k geometrically at rate γ, and once Tk(t)≤δT_k(t)≤δ, TGCC denies every capability with θc>κδ _c>κδ regardless of behavioral trust. The number of steps until TkT_k reaches an ϵε-neighborhood of Tk⋆T_k is O(log1/γ(1/ϵ))O\! ( _1/γ(1/ε) ). Proof. Geometric convergence at rate γ follows from Proposition 1; the threshold-crossing time is then logarithmic in the target accuracy. Once Tk≤δT_k≤δ, Theorem 2 applies. ∎ Key insight. Naive gating makes authorization increasing in raw trust; TGCC makes it increasing in the weakest cross-layer-verified trust, which an adversary cannot inflate by behaving agreeably – turning the paradox’s monotone exposure growth into bounded, self-revoking exposure with logarithmic detection latency. VI Numerical Illustration We validate the framework in a controlled simulation of the layer-trust dynamics, instantiating a single agent under a sleeper-agent threat as arises in long-running collectives such as Agent Hospital [23], MetaGPT [22], and GPTSwarm [24]. Each layer emits Bernoulli evidence from a latent reliability ρℓ _ ; beliefs update via (1) (γ=0.985γ=0.985, ω=3ω=3). Before activation at t=80t=80 all layers are reliable (ρ≈0.9ρ≈ 0.9); after activation, epistemic reliability collapses to ρ1=0.30 _1=0.30 (confident hallucination) while behavioral reliability stays at 0.930.93 (agent remains agreeable), matching the exact stealth profile of Theorem 2. We set epistemic as a prerequisite of all layers, p=−6p=-6, and revocation threshold θ=0.55θ=0.55, averaged over 400400 seeds. Mechanism (Fig. 2). Behavioral trust stays high after activation, yet epistemic trust collapses and, through the synergy operator (4), drags composite Φp _p below θ, so TGCC revokes the high-risk capability while a behavioral-only gate never would – Theorem 2 made visible. Validation of the theory. Three checks (Table I). (i) Theorem 1: across 20,00020,000 random draws of (,)(T, α), zero violations of the bounds (6). (i) Proposition 1: observed steady-state trust matches the closed-form fixed point Tℓ⋆T _ to a mean absolute error of 0.0070.007 across layers (Fig. 1(a)). (i) Corollary 1: after compromise, the capability is revoked within 3.13.1 steps on average (median 22), consistent with the predicted logarithmic latency. Fig. 1(b) shows Hedge weights shifting toward the epistemic layer once it becomes the dominant failure source, as Lemma 2 anticipates. TABLE I: Predictions vs. simulation (400 seeds). Result Prediction Observed Thm. 1 bound violations 00 0/20,0000/20,000 Prop. 1 fixed point (MAE) exact 0.0070.007 Cor. 1 revocation latency O(log1/γ1ϵ)O( _1/γ\! 1ε) 3.13.1 steps Breaks TVP (Thm. 2) yes yes VII Deployment and Extensions Protocol mapping. TGCC is directly implementable over emerging agent protocols. In MCP [17] and A2A [18], capabilities are exposed as scoped, token-mediated grants, but the policy that sets scope is left unspecified [19]. Equation (10) is exactly such a policy: an OAuth-style scope is issued only while Φp _p and the required prerequisite layers clear the capability’s thresholds, with short-lived tokens giving the per-call revocation zero-trust guidance recommends [6, 8]. Cross-modal epistemic trust. The framework is modality-agnostic: for embodied or perceptual agents, the epistemic layer’s evidence s1s_1 can be sensor-fusion confidence or perceptual anomaly scores, so adversarial perturbations degrade T1T_1 and, via (4), gate downstream actuation – extending the stack beyond dialogue agents. Economic-incentive layer. In agentic marketplaces, misaligned incentives (e.g. tacit collusion) are not captured by reliability alone. An incentive layer between role and social, tracking deviation from incentive-compatible behavior, slots into (4) without changing the operator and composes with governance-graph mechanisms [16]. VIII Conclusion We turned a descriptive layered trust model into an operational controller for multi-agent LLM systems. A cross-layer synergy operator and generalized-mean composite give a principled, bounded way to combine layer trusts; a no-regret estimator grounds layer importance in observed failures; and Trust-Gated Capability Control converts the result into revocable, least-privilege authorization. We prove, and numerically confirm, that this combination breaks the Trust-Vulnerability Paradox: privilege tracks the weakest verified layer, not raw trust, so a stealthy compromise that inflates behavioral trust while degrading a prerequisite layer self-revokes within a logarithmic number of steps rather than escalating. It is implementable over current agent protocols and extends to perceptual and economic settings, offering a concrete path to safe, scalable multi-agent collaboration. References [1] L. Wang et al., “A survey on large language model based autonomous agents,” Frontiers of Computer Science, vol. 18, no. 6, 2024. [2] T. Guo et al., “Large language model based multi-agents: A survey of progress and challenges,” arXiv:2402.01680, 2024. [3] K.-T. Tran et al., “Multi-agent collaboration mechanisms: A survey of LLMs,” arXiv:2501.06322, 2025. [4] E. Hossain, M. M. H. B. Nipu, M. S. Mahmood, M. J. Hossen, and M. F. Mridha, “Safe and scalable collaboration in multiagent LLM systems: A comprehensive review,” IEEE Trans. Syst., Man, Cybern., Syst., early access, 2026, doi: 10.1109/TSMC.2026.3704902. [5] Z. Xu et al., “The trust paradox in LLM-based multi-agent systems: When collaboration becomes a security vulnerability,” arXiv:2510.18563, 2025. [6] Y. Liu et al., “Secure multi-LLM agentic AI and agentification for edge general intelligence by zero-trust: A survey,” arXiv:2508.19870, 2025. [7] S. Raza et al., “TRiSM for agentic AI: A review of trust, risk, and security management in LLM-based agentic multi-agent systems,” arXiv:2506.04133, 2025. [8] S. Rose, O. Borchert, S. Mitchell, and S. Connelly, “Zero trust architecture,” NIST Special Publication 800-207, 2020. [9] S. D. Ramchurn, D. Huynh, and N. R. Jennings, “Trust in multi-agent systems,” The Knowledge Engineering Review, vol. 19, no. 1, p. 1–25, 2004. [10] A. Jøsang and R. Ismail, “The beta reputation system,” in Proc. 15th Bled Electronic Commerce Conf., 2002. [11] Y. Li, Q. Hu, Y. Zhang, L. Quan, J. Yu, and J. Wang, “DynaTrust: Defending multi-agent systems against sleeper agents via dynamic trust graphs,” arXiv:2603.15661, 2026. [12] R. Koohestani, “AgentGuard: Runtime verification of AI agents,” in Proc. 1st Int. Workshop on Agentic Software Engineering (AgenticSE), 40th IEEE/ACM Int. Conf. on Automated Software Engineering (ASE), 2025. [13] P. F. Christiano et al., “Deep reinforcement learning from human preferences,” in NeurIPS, 2017. [14] Y. Bai et al., “Constitutional AI: Harmlessness from AI feedback,” arXiv:2212.08073, 2022. [15] Y. Gal and Z. Ghahramani, “Dropout as a Bayesian approximation,” in ICML, 2016. [16] M. B. Syrnikov et al., “Institutional AI: Governing LLM collusion in multi-agent Cournot markets via public governance graphs,” arXiv:2601.11369, 2026. [17] Anthropic, “Model Context Protocol,” 2024. [Online]. Available: https://w.anthropic.com/news/model-context-protocol [18] Google, “Agent2Agent (A2A) protocol,” 2025. [19] A. Ehtesham et al., “A survey of agent interoperability protocols: MCP, ACP, A2A, and ANP,” arXiv:2505.02279, 2025. [20] Y. Freund and R. E. Schapire, “A decision-theoretic generalization of on-line learning and an application to boosting,” J. Computer and System Sciences, vol. 55, no. 1, p. 119–139, 1997. [21] S. Arora, E. Hazan, and S. Kale, “The multiplicative weights update method: A meta-algorithm and applications,” Theory of Computing, vol. 8, p. 121–164, 2012. [22] S. Hong et al., “MetaGPT: Meta programming for a multi-agent collaborative framework,” arXiv:2308.00352, 2023. [23] J. Li et al., “Agent hospital: A simulacrum of hospital with evolvable medical agents,” arXiv:2405.02957, 2025. [24] M. Zhuge et al., “GPTSwarm: Language agents as optimizable graphs,” in ICML, 2024. [25] S. Qi et al., “Amplified vulnerabilities: Structured jailbreak attacks on LLM-based multi-agent debate,” arXiv:2504.16489, 2025. [26] Y. Du, S. Li, A. Torralba, J. B. Tenenbaum, and I. Mordatch, “Improving factuality and reasoning in language models through multiagent debate,” arXiv:2305.14325, 2023. [27] P. M. P. Curvo, “The Traitors: Deception and trust in multi-agent language model simulations,” arXiv:2505.12923, 2025. [28] S. Yan, L. Zhu, and J.-Q. Zhu, “Eliciting trustworthiness priors of large language models via economic games,” arXiv:2602.00769, 2026. [29] R. Zhou et al., “Epistemic context learning: Building trust the right way in LLM-based multi-agent systems,” arXiv:2601.21742, 2026.