Paper deep dive

The Provenance Paradox in Multi-Agent LLM Routing: Delegation Contracts and Attested Identity in LDP

Sunil Prakash

Year: 2026Venue: arXiv preprintArea: cs.MAType: PreprintEmbeddings: 23

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 94%

Last extracted: 3/22/2026, 5:09:58 AM

Summary

The paper identifies the 'provenance paradox' in multi-agent LLM routing, where reliance on unverified, self-reported quality scores leads to systematic selection of the worst-performing agents. To mitigate this, the authors propose extensions to the LLM Delegate Protocol (LDP), including delegation contracts for bounded authority, a claimed-vs-attested identity model to distinguish verified quality, and typed failure semantics for automated recovery. Experiments confirm that attested routing achieves near-optimal performance, whereas self-claimed routing performs worse than random.

Entities (6)

LDP · protocol · 100%Sunil Prakash · researcher · 100%Delegation Contracts · governance-mechanism · 95%Provenance Paradox · phenomenon · 95%A2A · protocol · 90%MCP · protocol · 90%

Relation Signals (3)

LDP → extends → Delegation Contracts

confidence 100% · We extend the LLM Delegate Protocol (LDP) with delegation contracts

Self-claimed quality scores → causes → Provenance Paradox

confidence 95% · when delegates can inflate self-reported quality scores, quality-based routing produces a provenance paradox

Attested identity model → mitigates → Provenance Paradox

confidence 95% · distinguishing self-reported from verified quality eliminates the provenance paradox

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Multi-agent LLM systems delegate tasks across trust boundaries, but current protocols do not govern delegation under unverifiable quality claims. We show that when delegates can inflate self-reported quality scores, quality-based routing produces a provenance paradox: it systematically selects the worst delegates, performing worse than random. We extend the LLM Delegate Protocol (LDP) with delegation contracts that bound authority through explicit objectives, budgets, and failure policies; a claimed-vs-attested identity model that distinguishes self-reported from verified quality; and typed failure semantics enabling automated recovery. In controlled experiments with 10 simulated delegates and validated with real Claude models, routing by self-claimed quality scores performs worse than random selection (simulated: 0.55 vs. 0.68; real models: 8.90 vs. 9.30), while attested routing achieves near-optimal performance (d = 9.51, p < 0.001). Sensitivity analysis across 36 configurations confirms the paradox emerges reliably when dishonest delegates are present. All extensions are backward-compatible with sub-microsecond validation overhead.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

22,274 characters extracted from source content.

Expand or collapse full text

The Provenance Paradox in Multi-Agent LLM Routing: Delegation Contracts and Attested Identity in LDP Sunil Prakash 1 1 Indian School of Business, Hyderabad, India , sunil_prakash_pgpmax2026@isb.edu Abstract Multi-agent LLM systems delegate tasks across trust boundaries, but current protocols do not govern delegation under unverifiable quality claims. We show that when delegates can inflate self-reported quality scores, quality-based routing produces a provenance para- dox: it systematically selects the worst delegates, performing worse than random. We extend the LLM Delegate Protocol (LDP) with delegation contracts that bound authority through explicit objectives, budgets, and failure policies; a claimed-vs-attested identity model that distinguishes self-reported from verified quality; and typed failure semantics enabling auto- mated recovery. In controlled experiments with 10 simulated delegates and validated with real Claude models, routing by self-claimed quality scores performs worse than random selection (simulated: 0.55 vs. 0.68; real models: 8.90 vs. 9.30), while attested routing achieves near-optimal performance (d = 9.51, p < 0.001). Sensitivity analysis across 36 configurations confirms the paradox emerges reliably when dishonest delegates are present. All extensions are backward-compatible with sub-microsecond validation overhead. 1 Introduction The deployment of multi-agent LLM systems is accelerating across enterprise, research, and consumer applications. These systems delegate tasks between agents based on capabilities, cost, and quality—a pattern formalized by protocols such as Google’s Agent-to-Agent (A2A) [A2A, 2025] and Anthropic’s Model Context Protocol (MCP) [Anthropic, 2024]. The LLM Delegate Protocol (LDP) [Prakash, 2025a] extended this landscape with identity-aware routing, demon- strating that rich delegate metadata enables significant efficiency gains. Complementary work on structured collective reasoning [Prakash, 2025b] has shown that typed epistemic acts improve multi-agent deliberation, motivating protocol-level support for structured delegation semantics. However, routing to the right agent is necessary but not sufficient. Current protocols lack three critical governance capabilities: 1. Bounded authority. No protocol-level mechanism exists to specify budgets, deadlines, or success criteria for delegated work. Delegation is implicit—“send task, hope for the best.” 2. Verified identity. Quality scores are self-reported. A rational agent has incentive to inflate claims to attract work, creating a provenance paradox where unverified signals degrade rather than improve routing [Prakash, 2025a]. 3. Structured failure handling. Failures are communicated as unstructured strings, prevent- ing automated recovery or failure categorization. This paper addresses all three gaps. Our central thesis is: Trustworthy delegation requires more than identity-aware routing. Once quality claims in- fluence work allocation, delegation becomes a governance problem—and self-claimed quality can actively harm outcomes. 1 arXiv:2603.18043v1 [cs.MA] 15 Mar 2026 1.1 Relationship to Prior Work This paper extends Prakash [2025a], which established LDP’s identity and routing layer but also exposed a critical weakness: unverified provenance metadata can backfire. That finding motivates this paper’s governance extensions. Table 1 contrasts the two contributions. Table 1: How this paper differs from the original LDP paper. DimensionLDP v1This paper FocusIdentity-aware routingTrustworthy delegation MetadataRich delegate identityClaimed vs. attested identity GovernanceSession/provenance structureContracts and policy envelopes Failure handling String errorsTyped machine-readable failures Risk addressed Poor routing without metadata Misrouting via inflated claims Key finding37% token reductionSelf-claimed worse than random The research arc is: Paper 1 showed metadata helps routing. It also exposed a weakness— unverifiable provenance can backfire. This paper is the governance answer to that weakness. 2 Background and Motivation 2.1 Layer 1: Communication and Routing Agent communication protocols have matured rapidly. A2A [A2A, 2025] provides skill-based task routing. MCP [Anthropic, 2024] standardizes tool integration. LDP [Prakash, 2025a] adds identity cards with model family, quality metrics, trust domains, and payload negotiation. These protocols solve communication: how agents discover, connect, and exchange messages. 2.2 Layer 2: Delegation Needs Explicit Expectations But delegation requires more than communication. Consider a financial analysis pipeline where a summarization agent delegates to a data extraction agent. The delegator cannot currently specify: “extract quarterly revenue figures, within a budget of 5,000 tokens, by 18:00 UTC, and fail explicitly if unavailable.” Without explicit contracts, delegation is governed only by implicit conventions—and implicit governance fails silently. 2.3 Layer 3: Self-Claims Create Manipulable Routing Most critically, when quality signals are self-claimed, routing itself becomes manipulable. Prakash [2025a] found that unverified confidence scores doubled quality variance in synthesis tasks. The deeper issue is structural: self-claims create an incentive where rational delegates inflate quality to attract work, systematically distorting routing toward the most dishonest agents. This is not just noisy metadata—it is a mechanism design failure at the protocol level. Existing protocols—A2A, MCP, LDP v1—support communication, discovery, and tool use, but do not adequately express bounded delegation authority or distinguish self-reported from attested capability claims in routing-critical metadata. 3 Protocol Extensions We introduce four extensions to LDP, each backward-compatible (new fields are optional; exist- ing messages work unchanged). 2 3.1 Delegation Contracts Problem. Delegated tasks carry no explicit expectations about what constitutes success, how much they may cost, or what should happen when constraints are violated. Protocol addition. A delegation contract accompanies a task submission: "contract_id": "ctr-7f3a...", "objective": "Summarize the quarterly report", "success_criteria": ["<=300 words", "include revenue figures"], "policy": "failure_policy": "fail_closed", "budget": "max_tokens": 6000, "max_cost_usd": 0.05, "safety_constraints": ["no speculative projections"], "max_delegation_depth": 2 , "deadline": "2026-03-15T18:00:00Z" The contract is an optional field on TASK_SUBMIT. Delegates that do not understand contracts process the task normally—the contract expresses intent and enables auditing, not adversarial enforcement. Validation is client-side: the delegator checks results against deadline and budget upon receipt. Why this matters. Contracts make delegation auditable and bounded. Each contract specifies fail_closed (reject and return typed error with output preserved as partial_output) or fail_open (accept but log violations). This is policy expression, not platform enforcement— an important distinction that prevents overclaiming. Example trace. A delegator submits a summarization task with max_tokens: 6000 and fail_closed. The delegate produces a result consuming 8,200 tokens. The client adapter detects the budget violation, returns LdpError with code CONTRACT_VIOLATED, category policy, and attaches the delegate’s output as partial_output. The delegator can inspect the output, override the policy, or route to a cheaper delegate. 3.2 Claimed vs. Attested Identity Problem. Quality scores in delegate identity cards are self-reported, with no indication of how they were established. A delegate claiming q = 0.95 may be accurately reporting benchmark results or strategically inflating to attract work. Protocol addition. We add a claim_type field to quality metrics: • self_claimed — reported by the delegate itself. No external validation. • runtime_observed — measured by the LDP runtime from actual invocation performance (aggregated over recent calls, with recency weighting). • issuer_attested — verified by a trusted third party (e.g., an organization’s evaluation ser- vice). Requires issuer identity and recency metadata. • externally_benchmarked — validated by an external benchmarking service against standard- ized task suites. Trust semantics. Claim values should be interpreted jointly with claim type, task-family relevance, and freshness. A self_claimed score of 0.95 on “reasoning” carries less weight than an externally_benchmarked score of 0.85 on the same skill. Claims are skill-specific: a delegate may have externally_benchmarked quality for code generation but only self_claimed for creative writing. Freshness matters—attested scores can become stale as models are updated or fine-tuned. Why this matters. Routers can filter or weight claims by attestation level. A router that only trusts issuer_attested or externally_benchmarked claims is immune to the provenance paradox. Figure 1 illustrates the trust hierarchy. 3 self_claimed Delegate reports own quality runtime_observed LDP runtime measures quality issuer_attested Trusted third party verifies externally_benchmarked External benchmark validates Router Selected Delegate Low trust Medium trust High trust Highest trust Figure 1: Trust model for quality claims. Routers weight claims by attestation level—filtering out self_claimed scores eliminates the provenance paradox. 3.3 Typed Failure Semantics Problem. Task failures are communicated as unstructured strings (e.g., "error": "something went wrong"), preventing automated recovery or categorization. Protocol addition. We replace error strings with a structured LdpError carrying category, severity, retryable flag, and optional partial output. Why this matters. Typed failures enable automated recovery strategies: CategoryRetry? Severity Typical response runtimeYesErrorRetry or reroute to another delegate transport YesWarning Retry with exponential backoff policyNoFatalEscalate; contract violation capability NoErrorSelect different delegate qualityNoWarning Accept with quality warning identityNoErrorAuthentication failure sessionYesErrorRe-establish session Contract violations are a specific instance: fail_closed produces category policy, code CONTRACT_VIOLATED, with the delegate’s output preserved as partial_output. 3.4 Verification Status and Lineage Problem. Provenance currently records who produced a result but not how it was verified or which delegates handled it along the way. Protocol addition. We extend provenance with a granular verification_status enum (unverified, self_verified, peer_verified, tool_verified, human_verified), evidence ref- erences, and a lineage chain. Why this matters. Together with contracts and claim types, this completes the governance picture: contracts govern intent (what should happen), claim types govern trust in capability (who can do it), and verification status governs trust in outputs (was the result checked). Figure 2 shows the complete delegation lifecycle. 4 fail_closedfail_open Delegator [Contract] Delegate [Result]Validation [Pass/ Fail] Typed Error + partial_output Result + violations in provenance Figure 2: Delegation lifecycle: contract submission, execution, client-side validation, and branch- ing failure policy (fail_closed vs. fail_open). 4 Implementation All extensions are implemented in the LDP Python SDK (PyPI: ldp-protocol) and Rust refer- ence implementation (crates.io: ldp-protocol), comprising contract types, protocol integration, typed errors, attested identity, and verification/lineage. The test suite covers 168 tests across both SDKs. Backward compatibility. All new fields use serde/Pydantic defaults. An old-format TASK_SUBMIT without a contract field deserializes identically to the base protocol. A new-format message with contract, claim type, and verification status is ignored by delegates that do not understand these fields. Both parse correctly against the same schema. 5 Evaluation 5.1 The Provenance Paradox Proposition 1 (Routing under strategic inflation). In routing regimes that monotonically prefer reported quality, strategic inflation of self-reported scores can produce misallocation severe enough to underperform uninformed (random) routing. Intuitively: if the router always picks the delegate with the highest reported score, and dishonest delegates report scores above all honest delegates, then the router will always select a dishonest delegate—regardless of how many honest, high-quality alternatives exist. 5.2 E3: Simulated Routing Experiment Setup. We simulate a pool of 10 delegates with known true quality levels (q true ∈ [0.45, 0.95]). Three delegates are inflating: they report q claimed > q true by 0.35–0.45 points, making their claims the highest in the pool. Seven are honest (|q claimed − q true | < 0.02). Output quality is simulated as q output = q true +N(0, 0.05), clamped to [0, 1]. Three conditions, N = 100 tasks each: blind (random), self-claimed (route by reported score), attested (route by true quality). Results. Table 2 and Figure 3 summarize the findings. Self-claimed routing achieves the lowest quality (0.55), worse than blind (0.68), because inflated delegates capture 100% of routing. Attested routing achieves near-optimal quality (0.95) with 100% accuracy. 5.3 Sensitivity Analysis A skeptical reader may ask: does the paradox depend on specific parameter choices? We test 36 configurations varying dishonest delegate fraction (10%, 30%, 50%, 70%), inflation magnitude 5 Table 2: Simulated routing quality by condition (N = 100 per condition). Condition Quality Accuracy Inflation Effectp mean ± std(%)Selected (%) Size (d) Blind0.68± 0.176.025.0— Self-claimed 0.55± 0.040.0100.0 −0.98 < 0.001 Attested 0.95± 0.04 100.00.09.51 < 0.001 Effect sizes and p-values computed vs. blind (Mann-Whitney U). Stable across 10 seeds (±0.005–0.010). BlindSelf-ClaimedAttested 0.0 0.2 0.4 0.6 0.8 1.0 1.2 Mean Output Quality Worse than random *** (a) Output Quality Random baseline BlindSelf-ClaimedAttested 0 20 40 60 80 100 120 Routing Accuracy (%) *** (b) Routing Accuracy Figure 3: Simulated routing results. (a) Self-claimed routing is worse than random; attested achieves near-optimal. (b) Only attested routing selects the best delegate. ∗ p < 0.001. (low: 0.10–0.15, medium: 0.25–0.35, high: 0.40–0.50), and pool size (5, 10, 20). Self-claimed routing is worse than blind in 28% of configurations (10/36). The effect concentrates at higher dishonest fractions (≥ 30%) and medium-to-high inflation magnitudes. At low inflation or small dishonest pools, self-claimed routing can still outperform random—but never matches attested routing. This analysis shows the provenance paradox is real but not universal: it emerges specifically when inflators are numerous and their inflation is large enough to dominate the ranking. Attested routing is robust across all configurations. 5.4 Real-Model Validation To confirm the paradox holds beyond simulation, we validate with three real Claude models via the Anthropic API: Claude Sonnet (highest quality), Claude Haiku (standard), and Claude Haiku with a degraded system prompt constraining responses to 1–2 sentences (lowest quality). The degraded variant claims the highest quality score (0.95, inflated); honest variants claim 0.85 and 0.80 respectively. We run 10 reasoning tasks under three conditions with Claude Sonnet as an independent judge (1–10 scale). The provenance paradox is confirmed with real models: self-claimed routing (8.90) underper- forms blind (9.30) because the inflated degraded-Haiku captures 100% of routing. The effect size is smaller than in simulation (where dishonest delegates had much lower true quality), but the direction is consistent: self-claimed quality metadata degrades routing when inflation is present. 6 10%30%50%70% Dishonest Delegate Fraction (%) 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0 Mean Output Quality Blind (random) Self-claimed Attested Figure 4: Output quality vs. dishonest delegate fraction (pool size 10, medium inflation). The shaded region marks the “paradox zone” where self-claimed routing underperforms random. Table 3: Real-model validation with Claude models (N = 10 tasks, Sonnet as judge). Condition Avg ScoreModel Selected Blind9.30Random mix Self-claimed8.90Degraded-Haiku (always) Attested9.30Sonnet (always) 5.5 E4: Protocol Overhead Message-level overhead. A TASK_SUBMIT message without a contract serializes to 972 bytes; with a contract, 1,497 bytes—an increase of 525 bytes (54%). This is proportionally significant at the message level but negligible at the workload level, where LLM payloads span thousands to hundreds of thousands of tokens. Processing overhead. Contract validation (deadline + budget checks) costs 0.45 μs per result. Serialization adds ∼4 μs. Both are unmeasurable against LLM inference latencies of 500ms–5s (Figure 5). 6 Related Work Existing protocols support communication, discovery, and tool use, but do not adequately ex- press bounded delegation authority or distinguish self-reported from attested capability claims in routing-critical metadata. Agent communication. A2A [A2A, 2025] provides skill-based routing; MCP [Anthropic, 2024] standardizes tool integration. Neither supports delegation contracts, attested identity, or typed failure semantics. Earlier protocols (KQML [Finin et al., 1994], FIPA-ACL [FIPA, 2002]) defined performative-based communication but predate LLM-specific governance concerns. Contract-based design. Design by Contract [Meyer, 1992] and cloud SLAs formalize qual- ity expectations. Our delegation contracts adapt these ideas to LLM agents, where constraints include token budgets, cost limits, and AI-specific safety rules. AI governance. The NIST AI RMF [NIST, 2023] emphasizes accountability. Our typed failures and lineage provide protocol-level mechanisms supporting these requirements. 7 0500100015002000 Bytes Message Size (bytes) +54% (a) Message Size Without contract With contract 0510 Microseconds (μs) Serialization (μs) Deserialization (μs) Validation (μs) +62% +59% new (b) Processing Time Without contract With contract Figure 5: Protocol overhead. Message-level overhead is noticeable; workload-level overhead is negligible. Trust and reputation. Trust management [Blaze et al., 1996] and reputation systems [Resnick et al., 2000] address self-reporting problems in distributed systems. Our claimed-vs-attested model is a lightweight analog that exposes claim provenance without requiring full reputation infrastructure. 7 Limitations and Future Work Simulated routing environment. Why it matters: Real model performance depends on prompt sensitivity, task specialization, and nonstationarity—not captured by scalar quality sim- ulation. Next step: We provide initial real-model validation (Section 5.4); larger-scale validation across diverse task families is needed. No concrete attestation infrastructure. Why it matters: Trust in issuer_attested and externally_benchmarked claims depends on issuer credibility, freshness, and task-family scoping. Next step: Define issuer identity model, claim signatures, expiry semantics, and skill- specific attestation. Best-effort policy enforcement. Why it matters: Delegates can misreport token usage or ignore constraints. Client-side validation cannot detect all violations. Next step: Runtime enforcement, cryptographic resource-consumption receipts, or platform-level billing integration. Informal success criteria. Why it matters: Contract success criteria are free-form strings, not machine-verifiable. Next step: Formal specification language with machine-checkable predi- cates (e.g., word count, output format, required fields). Delegation depth enforcement. Why it matters: max_delegation_depth is tracked in contracts but not enforced at runtime. Next step: Enforce via lineage chain length in multi-hop scenarios. 8 Conclusion Trustworthy delegation requires more than identity-aware routing. Once quality claims influence work allocation, delegation becomes a governance problem. Self-claimed quality does not merely add noise—it can systematically invert routing optimality, directing work to the least capable delegates. This paper provides three answers: • Contracts bound intent: explicit objectives, budgets, deadlines, and failure policies make delegation auditable. 8 • Attested identity protects routing: distinguishing self-reported from verified quality elim- inates the provenance paradox. • Typed failures enable recovery: machine-readable error categories with severity and retry semantics support automated delegation management. The provenance paradox confirmed here—routing by self-claimed quality performing worse than random in both simulation (d = 9.51) and real-model validation—is not a subtle edge case. It is a predictable consequence of ungovernered delegation that will affect any quality-based routing system operating on unverified claims. Code and data. Python SDK: https://pypi.org/project/ldp-protocol/. Rust crate: https://crates.io/crates/ldp-protocol. Protocol specification: https://github.com/sunilp/ ldp-protocol. References Google. Agent-to-Agent Protocol (A2A) Specification v1.0, 2025. https://github.com/google/ A2A Anthropic. Model Context Protocol Specification, 2024. https://modelcontextprotocol.io M. Blaze, J. Feigenbaum, and J. Lacy. Decentralized trust management. In IEEE Symposium on Security and Privacy, 1996. Foundation for Intelligent Physical Agents. FIPA ACL Message Structure Specification, 2002. T. Finin, R. Fritzson, D. McKay, and R. McEntire. KQML as an agent communication language. In Proceedings of CIKM, 1994. B. Meyer. Applying “Design by Contract”. Computer, 25(10):40–51, 1992. National Institute of Standards and Technology. AI Risk Management Framework (AI RMF 1.0), 2023. S. Prakash. LDP: An identity-aware delegation protocol for multi-agent LLM systems. arXiv preprint arXiv:2603.08852, 2025. S. Prakash. From debate to deliberation: Structured collective reasoning with typed epistemic acts. arXiv preprint arXiv:2603.11781, 2025. P. Resnick, K. Kuwabara, R. Zeckhauser, and E. Friedman. Reputation systems. Communica- tions of the ACM, 43(12):45–48, 2000. 9

Instant research discovery