Paper deep dive
Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking
Yayu Gao, Yong Xiao, Hao Hu, Xubo Li, Zhiwei Liu, Yingyu Li, Guangming Shi, Ping Zhang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/4/2026, 3:52:09 AM
Summary
The paper introduces TrustAgentNet, a blockchain-based zero-trust framework for Agentic AI Networking (AgentNet) to address security vulnerabilities and claim-to-capability inconsistencies in third-party skillset usage. It proposes a dual-tier architecture comprising a global Chain of Skillsets (CoS) for lifecycle management and transient Chains of Collaboration (CoC) for task-oriented multi-agent cooperation. The framework utilizes LLM agents for off-chain auditing and cryptographic consensus on-chain, achieving 100% accuracy in validating AI models and demonstrating resilience against adversarial attacks.
Entities (7)
Relation Signals (7)
TrustAgentNet → contains → Chain of Collaboration
confidence 95% · Furthermore, transient, task-oriented Chains of Collaboration (CoC) are dynamically established
TrustAgentNet → contains → Chain of Skillsets
confidence 95% · TrustAgentNet... Specifically, a global Chain of Skillsets (CoS) governs the lifecycle of skillset metadata
TrustAgentNet → implements → Zero Trust
confidence 95% · proposes TrustAgentNet, a dual-tier blockchain-secured zero-trust framework
Chain of Skillsets → manages → skillset metadata
confidence 92% · a global Chain of Skillsets (CoS) governs the lifecycle of skillset metadata
Chain of Collaboration → enables → Multi-Agent Collaboration
confidence 90% · Chains of Collaboration (CoC) are dynamically established to enable trustless distributed multi-agent collaboration
TrustAgentNet → validates → AI models
confidence 90% · achieves a flawless 100% accuracy across 50 AI models
Hyperledger Fabric → usedin → TrustAgentNet
confidence 85% · hardware prototype implemented based on a Hyperledger Fabric-based consortium blockchain
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Agentic AI networking (AgentNet) systems rely heavily on third-party skillset implementations and distributed multi-agent collaboration, yet they face major claim-to-capability inconsistencies and security vulnerabilities under trust-by-declaration assumptions. To bridge this gap, this paper proposes TrustAgentNet, a dual-tier blockchain-secured zero-trust framework. Specifically, a global Chain of Skillsets (CoS) governs the lifecycle of skillset metadata with protocols empowered by specialized agents to enforce off-chain auditing while maintaining lightweight on-chain cryptographic consensus. Furthermore, transient, task-oriented Chains of Collaboration (CoC) are dynamically established to enable trustless distributed multi-agent collaboration. Theoretical analysis of the three-way trade-off among security level, task performance, and resource overhead is provided and empirically validated. Experimental results on a hardware prototype demonstrate that compared with no-blockchain trust-by-default baselines, the zero-trust overhead of TrustAgentNet is dominated by off-chain inference, while the blockchain layer incurs minor ledger costs via the ledger-IPFS storage and on/off-chain integration design. Crucially, the proposed verification pipeline achieves a flawless 100% accuracy across 50 AI models, correctly validating 40 honest skillsets and intercepting 10 adversarial ones, and generalizes to non-AI domains with an 83.91% accuracy and a 0.85 F1-score across 1478 features from 171 ClawHub skills. Adversarial experiments further show that TrustAgentNet enables autonomous skillset self-recovery against various malicious attacks.
Tags
Links
- Source: https://arxiv.org/abs/2608.00104v1
- Canonical: https://arxiv.org/abs/2608.00104v1
Trouble viewing inline? Open PDF directly →
Full Text
107,411 characters extracted from source content.
Expand or collapse full text
Skillsets on the Chain: A Blockchain-based Zero-Trust Framework for Agentic AI Networking Yayu Gao, , Yong Xiao, , Hao Hu, Xubo Li, Zhiwei Liu, Yingyu Li, Guangming Shi, , and Ping Zhang *This work is accepted at IEEE Transactions on Cognitive Communications and Networking. Copyright may be transferred without notice, after which this version may no longer be accessible. This work was supported in part by the National Natural Science Foundation of China (NSFC) under grants 62571208 and 62525109, the Mobile Information Network National Science and Technology Key Project under grant 2024ZD1300700, and Hubei Natural Science Foundation Innovation Research Group Program under grant 2026AFA044. An earlier version of this paper was presented in part at the Proceedings of the IEEE GLOBECOM, Taipei, Taiwan, December 2025[1]. (Corresponding author: Yong Xiao.). Yayu Gao, Yong Xiao, Xubo Li and Zhiwei Liu are with the School of Electronic Information and Communications, the Huazhong University of Science and Technology, Wuhan, China 430074. Yong Xiao is also with the Peng Cheng Laboratory, Shenzhen, China, and Pazhou Laboratory (Huangpu), Guangzhou, China (e-mail: yayugao, yongxiao, xuboli, zhiweiliu@hust.edu.cn). Hao Hu and Yingyu Li are with the School of Mechanical Engineering and Electronic Information, China University of Geosciences (Wuhan), Wuhan, China 430074 (e-mail: 1202520838, liyingyu29@cug.edu.cn). G. Shi is with the Peng Cheng Laboratory, Shenzhen, China 518055, also with the School of Artificial Intelligence, Xidian University, Xi’an, Shaanxi, China 710071 (e-mail: gmshi@xidian.edu.cn). P. Zhang is with the State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing, China 100876 (email: pzhang@bupt.edu.cn). Abstract Agentic AI networking (AgentNet) systems rely heavily on third-party skillset implementations and distributed multi-agent collaboration, yet they face major claim-to-capability inconsistencies and security vulnerabilities under trust-by-declaration assumptions. To bridge this gap, this paper proposes TrustAgentNet, a dual-tier blockchain-secured zero-trust framework. Specifically, a global Chain of Skillsets (CoS) governs the lifecycle of skillset metadata with protocols empowered by specialized agents to enforce off-chain auditing while maintaining lightweight on-chain cryptographic consensus. Furthermore, transient, task-oriented Chains of Collaboration (CoC) are dynamically established to enable trustless distributed multi-agent collaboration. Theoretical analysis of the three-way trade-off among security level, task performance, and resource overhead is provided and empirically validated. Experimental results on a hardware prototype demonstrate that compared with no-blockchain trust-by-default baselines, the zero-trust overhead of TrustAgentNet is dominated by off-chain inference, while the blockchain layer incurs minor ledger costs via the ledger-IPFS storage and on/off-chain integration design. Crucially, the proposed verification pipeline achieves a flawless 100%100\% accuracy across 5050 AI models, correctly validating 4040 honest skillsets and intercepting 1010 adversarial ones, and generalizes to non-AI domains with an 83.91%83.91\% accuracy and a 0.850.85 F1-score across 14781478 features from 171171 ClawHub skills. Adversarial experiments further show that TrustAgentNet enables autonomous skillset self-recovery against various malicious attacks. I Introduction Agentic AI networking (AgentNet) is a novel AI-native networking ecosystem in which autonomous AI agents can collaborate, reason, and plan to solve complex, multi-step problems with minimal human intervention. It has the potential to overcome the limitations of existing AI-based solutions, positioning it as one of the possible architectures for next-generation networking systems, especially 6G and beyond[2]. The recent rapid rise of OpenClaw has empowered agents to independently invoke and implement third-party capabilities, opening up unprecedented possibilities for agentic autonomy and multi-agent collaborative workflows to complete complex tasks. However, the recent emergence of ClawdBot anomalies [3] exposes systemic vulnerabilities under this paradigm. Driven by sophisticated reasoning but operating on unverified third-party skillsets, agents can inadvertently or maliciously initiate unauthorized cross-platform interactions and recursive scanning. A skillset is defined as a modular, structured capability unit, comprising either neural network assets (e.g., AI model weights and gradients) or executable programmatic logic (e.g., procedural scripts provided in ClawHub), that provides specific functions, operational rules, and external dependencies to the invoking agent. Currently, the burgeoning skillset supply chain heavily relies on a “trust-by-declaration” model, where agents and skillsets all declare their functional capabilities using high-level natural-language directives in their metadata. These claimed capabilities are further encapsulated into standardized digital manifests, such as agent cards [4], and continuously broadcasted across AgentNet systems. When agents are required to solve complex distributed tasks, network orchestrators select candidate experts and route critical operation paths based solely on these unverified, advertised capability metadata. However, this structural reliance on unverified advertisements creates a critical governance vacuum and gives rise to a dangerous Claim-to-Capability gap. Recent large-scale empirical studies reveal a pervasive and systemic security crisis, showing over 26% of deployed skills harbor severe vulnerabilities [5], and 80% of active skills functionally deviate from their declared specifications [6]. When untrusted skillsets are integrated into agents’ decision logic, the claim-to-capability mismatch would propagate through the system layers, inducing severe performance drift, semantic deviation, and volatile execution boundaries across the agents’ subsequent behavioral trajectories. Consequently, the lifecycle security of third-party capabilities inside highly autonomous AgentNet systems is deeply coupled with a critical trusted supply chain problem, which further propagates into a collaboration trust crisis during multi-agent interactive workflows. To mitigate these vulnerabilities, the evolution of AgentNet necessitates the adoption of a decentralized, zero-trust framework predicated on the principle of never trust, always verify [7, 8]. However, enforcing continuous, verifiable full-lifecycle governance for skillsets and agents across untrusted edge environments poses the following three pivotal challenges: (1) Zero-trust lifecycle management of diverse agents’ skillsets: A central challenge in the deployment of AgentNet systems is establishing a secure registry that governs the entire lifecycle of agent skillsets without relying on a centralized authority. While baseline cryptographic identity provisioning can authenticate the digital identity of an agent, it cannot dynamically track or govern its evolving skillsets. It necessitates the development of a unified framework that can securely and efficiently manage and store, dynamically update and audit the versioning and declarations of these diverse skillsets and agents under strict zero-trust constraints. (2) Zero-trust claim-to-capability consistency auditing of skillsets: To ensure efficient multi-agent planning and task allocation, the network infrastructure should guarantee that each agent’s claimed capabilities match its real performance. To move beyond the trust-by-declaration model, the key lies in designing a verification mechanism for a skillset to identify the capability-performance gap before it is authorized for wide deployment. However, executing complex semantic evaluation and consistency verification algorithms following the zero-trust principle can be computationally prohibitive for resource-constrained blockchain ledgers, which demands further investigation. (3) Privacy preserving and secure sharing in task-oriented multi-agent collaboration: Orchestrating task-oriented multi-agent collaborative training and inference while preserving their privacy without sharing local raw data can be challenging. Moreover, these security enhancements inevitably introduce considerable computational latency and communication signaling overhead, leading to a tradeoff among security levels, task performance, and resource costs. Addressing this trade-off is essential to ensure that decentralized multi-agent collaboration remains scalable, flexible, and resilient under dynamic network environments. To address the above challenges, in this paper, we introduce a zero-trust AgentNet architecture, called TrustAgentNet, that supports skillset lifecycle management and decentralized multi-agent collaboration. Our main contributions are summarized as follows: (1) Dual-tier blockchain-enabled zero-trust architecture: We design a hierarchical, permissioned zero-trust framework. Specifically, a global Chain of Skillset (CoS) serves as the immutable unified source of truth for agent identities and verified skillsets,decoupling the lightweight on-chain metadata registry from off-chain large model storage to minimize ledger bloat while guaranteeing content integrity. Moreover, transient task-oriented Chains of Collaboration (CoC) are dynamically orchestrated upon task instantiation and dissolved upon completion to support decentralized, privacy-preserving multi-agent collaboration, ensuring scalable and flexible balance between systemic security and resource overhead. (2) LLM-agent-enabled skillset lifecycle management protocols: We propose a secure skillset acquisition and semantic mapping protocol and a skillset submission and consistency verification protocol by utilizing specialized LLM agents. By shifting semantic inference and cross-modal consistency validation off-chain, while anchoring cryptographic hashes and trust state updates as immutable blockchain transactions, the protocols successfully secure both skillset registration and retrieval while maintaining lightweight on-chain consensus. (3) Theoretical analysis of three-way tradeoff among security level, agent performance, and resource cost: We provide a theoretical analysis that captures the three-way tradeoff among the security level, the agents’ model performance, as well as the communication and computational resource costs of the proposed TrustAgentNet. This tradeoff is further empirically validated by the experimental results obtained from a hardware prototype implemented based on a Hyperledger Fabric-based consortium blockchain. Experimental results further validate that the level of security can be improved at the cost of traffic volume, computational demands and running time for skillset training under a given performance target. (4) Prototype validation and performance analysis: We develop a 5G-enabled hardware/software prototype integrating Hyperledger Fabric and Kubo IPFS to evaluate the performance of TrustAgentNet. Resource consumption comparison with no-blockchain baseline reveals that the zero-trust overhead is heavily dominated by off-chain inference pipelines, whereas the blockchain layer imposes minimal constant-time transaction commitment delays owing to the blockchain-IPFS synergy and on-chain logging/off-chain inference design. Evaluated against an adversarial dataset of 5050 AI models, the framework achieves a flawless 100%100\% inconsistency interception rate. Furthermore, the verification protocol yields an 83.91%83.91\% accuracy and a 0.850.85 F1-score against 14781478 functional features from 171171 real-world ClawHub procedural skills, demonstrating its potential to govern diverse types of skillsets. Adversarial experiments demonstrate that agents can autonomously recover from diverse security risks via CoS interactions. The remainder of this paper is organized as follows. Section I summarizes the related work. Section I introduces the system model and problem statement. Section IV introduces the architectural framework of TrustAgentNet. Section V presents the LLM-driven skillset lifecycle management protocols, and Section VI introduces the CoC-oriented multi-agent collaboration methodology and its security-performance-resource trade-off analysis. A prototype of TrustAgentNet is implemented and evaluated in Section VII. Concluding remarks are summarized in Section VIII. I Related Work I-A Agentic AI and AgentNet Agentic AI systems have attracted significant interest recently due to their potential to fundamentally shift the paradigm from reactive, passive, and monolithic learning-based models to autonomous, goal-driven, multi-agent cooperation architectures based on decentralized learning and solution finding. Critically, these systems are evolving towards a decentralized structure where heterogeneous AI agents–each possessing specialized expertise and unique optimization targets–can collaborate to fulfill complex objectives directly on peer-to-peer networks. This decentralized approach inherently mitigates the risks associated with single points of failure and addresses the scalability and latency issues prevalent in centralized frameworks. Most existing studies primarily investigate the reasoning and orchestration capacities for multi-agent planning, tool use, memory integration, and environmental perception to enable complex, multi-step execution [9]. Building on these foundations, AgentNet was proposed as an AI-native networking paradigm characterized by high degrees of autonomy and adaptability, allowing agents to pursue objectives with minimal human intervention[10]. Our recent work [2] proposed a Generative Foundation Model (GFM)-based architecture to facilitate interaction, collaborative learning, and efficient knowledge synthesis among multiple GFM-as-agents. The practical utility of the AgentNet framework was demonstrated through 6G use cases, digital-twin industrial automation and metaverse infotainment, highlighting how AgentNet facilitates task-driven interactive networking systems with diverse AI agents. I-B Safety, Security, and Governance for Agentic AI Due to the profound and novel security risks of agentic AI systems including runaway behavior and multi-agent cascades, AI agent governance has become vital yet remains highly challenging [11]. Several studies have begun integrating zero-trust architectures into agentic AI, including continuous semantic intent validation for LLM-driven O-RAN control [12], zero-trust approach for MCP-based agents [13] and initial protocols for agent identity verification and delegation chains [14]. Meanwhile, the security of LLM-based agents has become a critical research frontier, leading to the development of specialized benchmarks and systematic defense frameworks. [15] demonstrated that even well-aligned LLMs and their safeguards remain significantly vulnerable to diverse attack strategies—such as virtualization, deception, and privilege escalation. AgentHarm [16] measured agentic robustness across 1111 harm categories through explicitly malicious tasks; and [17] proposed a comprehensive framework that benchmarked a wide array of attacks and defenses across diverse real-world scenarios. To further enhance evaluation precision, ASSEBench [18] provided a meticulously annotated dataset for testing the risk-detection capabilities of LLM-based safety evaluators. On the defensive side, holistic blueprints were proposed [19] to emphasize zero-trust execution, dynamic intent verification, and reasoning-action correlation. Following the rise of high-autonomy frameworks like OpenClaw, which grant agents operating-system-level permissions, research focus has been increasingly shifting from prompt-centric safety toward the systemic security vulnerabilities inherent in agent skills and tool invocations. [20] established a pivotal four-stage lifecycle security model and a seven-category threat taxonomy, identifying structural flaws inherent in the skill framework. Through large-scale empirical analysis, [5, 21, 22] have uncovered a critical security crisis in the agentic ecosystem, revealing that approximately 26.1% of skills harbor vulnerabilities like data exfiltration and privilege escalation, highlighting significant defensive bottlenecks in managing multi-step tool interactions and indirect harm scenarios. [23] further demonstrated that these latent flaws are actively exploitable through iterative, feedback-driven adversarial prompting without any modification to the skills themselves. Recently, [6] introduced a behavioral integrity verification (BIV) mechanism to address the declaration-implementation gap within open skill registries (e.g., OpenClaw) via code analysis, uncovering that 80% of skills functionally deviate from their declared capabilities. I-C Blockchain-enabled Distributed Learning and Computing Tracing its origins to Satoshi Nakamoto’s 2008 seminal work on Bitcoin, blockchain technology has evolved from a peer-to-peer cryptocurrency system into a cornerstone for ensuring trust in distributed ecosystems. At its core, a blockchain is a distributed, immutable ledger that utilizes cryptographic chaining to secure data blocks, thereby facilitating transparency and permanent record-keeping in the absence of a governing intermediary. Key features such as smart contracts, consensus algorithms, and robust encryption have driven its application far beyond its initial financial scope. Consequently, blockchain has improved operations in diverse domains such as logistics, decentralized finance, and digital identity, and is increasingly being integrated into distributed learning/computing environments to address data privacy and systemic integrity[24, 25]. This paradigm shift is particularly evident in the Federated Learning (FL) frameworks. By replacing the traditional central aggregator with a distributed ledger, blockchain-enabled FL was found to effectively mitigate single-point-of-failure risks, model tampering, and poisoning attacks for collaborative training processes across medical and industrial domains [26, 27]. [28] further combined Byzantine Fault-Tolerant (BFT) aggregation with differential privacy, mathematically proving model convergence under malicious attacks. To address the computational overhead of decentralized ledgers, computation reuse mechanisms were proposed in [29] to reduce the energy consumption of the blockchain-enabled FL training process. [30] leveraged blockchain to establish a secure, incentive-aware collaboration mechanism that motivates edge nodes to participate in federated training for joint caching and computation offloading optimization. Recently, [31] proposed B-MoE, utilizing blockchain to trace, verify, and record computational results within distributed Mixture of Experts (MoE) in large models. Beyond model training, blockchain also serves as a cornerstone for zero-trust security and resource management in B5G/6G edge intelligence environments [32, 33, 34, 35]. Specifically, optimized consensus algorithms like PBFT were deployed to achieve end-to-end traceability of user activities [32]. The synergy between blockchain and intelligent systems is further explored in vehicular networks, where blockchain assisted efficient batch authentication and key exchange for security rating prediction [33], and in network slicing, where blockchain facilitated real-time resource monitoring to meet sub-1ms latency constraints [34]. [35] proposed the integration of deep reinforcement learning with blockchain to optimize dynamic content caching in time-variant environments. I-D Remarks In summary, while Agentic AI systems and AgentNet are still in the early stages of development, both academia and industry have increasingly recognized the unprecedented security and trust challenges they introduce. The continuous evolution is transiting from prompt-centric defense vectors toward systemic skillset safety. However, existing paradigms predominantly operate as static, centralized toolkits localized within individual environments, leaving a critical gap in enforcing decentralized, full-lifecycle skillset governance and runtime resilience. Meanwhile, although the integration of blockchain technology into distributed learning and edge computing provides a promising technical pathway for decentralized trust, existing blockchain paradigms cannot be directly applied to address the unique challenges of skillset lifelong governance, including task-to-skillset mapping and claim-to-capability consistency verification, which may lead to profound computing and storage consumption bottlenecks on the chain. Furthermore, the mathematical trade-off among security enhancements, task performance, and resource overhead introduced by anchoring ledgers into multi-agent systems remains largely unexplored. To bridge these critical gaps, this paper proposes the zero-trust TrustAgentNet framework, designs blockchain-secured skillset lifecycle management algorithms, and establishes secure decentralized on-chain multi-agent collaboration. I System Model and Problem Formulation I-A System Model We consider a general AgentNet system architecture structured as a decentralized, non-perimeter network. The network consists of a set A of heterogeneous agents, deployed across various environments ℰE. In each environment e, eA_e agents are deployed and can collaborate to solve a finite set of tasks eT_e. Under the zero-trust paradigm, no agent ak∈a_k is inherently trusted based on its network location or origin. Instead, every agent is treated as a latent threat until its identity and operational integrity are verified. Each task can be further decomposed into multiple sub-tasks, each requiring a specific skillset generating the intended output based on the input. To be specific, a skillset is generally defined as a collection of encapsulated capabilities that dictates how an agent executes a specific action or solves a sub-task. Broadly speaking, the realization of a skillset can be diverse, ranging from deterministic scripts and external API calls to learnable AI models. In this paper, we specifically focus on AI-model-based skill realization, where the logic is embedded within a learnable parametric structure. Formally, we define a skillset si∈s_i as a functional entity characterized by the tuple: si≜⟨Di,i,i,Φi,ωi⟩, [rgb]0,0,0s_i D_i,X_i,Y_i, _i, _i , (1) where DiD_i represents the declarative semantic metadata (e.g., natural-language declarations) advertised by the skillset provider, iX_i and iY_i represent the input space and output space respectively; Φi:i×Ωi→i _i:X_i× _i _i denotes the mapping functional logic (e.g., the model architecture or executable code), and ωi∈Ωi _i∈ _i denotes the learnable weights/parameters of the skillset. Assume that each agent aka_k in environment e can access a subset of skillsets k,e=s1,…,siS_k,e=\s_1,…,s_i\. Each agent maintains an exclusive local dataset k,eD_k,e sampled from an unknown distribution Pk,eP_k,e. To satisfy zero-trust privacy requirements, raw data k,eD_k,e is never exposed; only verifiable model updates or proofs of training can be transmitted. To enforce the “never trust, always verify” principle, we propose a hierarchical, blockchain-anchored architecture, TrustAgentNet, consisting of the Chain of Skillsets (CoS) and the Chain of Collaboration (CoC). In particular, the CoS serves as the global, consortium-blockchain-based ledger that permanently anchors the lifecycle of the universal skillset set S. To alleviate the on-chain storage bottleneck while preserving cryptographic immutability, only the semantic declaration DiD_i and the cryptographic hashes of the skillsets are stored on the CoS ledger as verification baselines, whereas the corresponding full data are securely offloaded to a distributed storage infrastructure. Each agent aka_k with authorized identity can interact with the CoS to execute secure skillset acquisition and submission. Meanwhile, CoC is architected as an on-demand, task-specific blockchain embedded within CoS. When a task publisher schedules a real-time collaborative session, a transient CoC is spawned from the CoS to orchestrate the distributed coordination among a subset of authenticated agents. Each CoC acts as a distributed ledger for gradient variations, intermediate embeddings etc. during the collaboration. Upon task completion, the consolidated updates achieved on the CoC are immutably settled back into the global CoS ledger, and the resources of CoC are released. Under this framework, authorized distributed agents can securely collaborate across heterogeneous environments without compromising data privacy. I-B Problem Formulation and Multi-Tier Zero-Trust Trade-off Metrics In traditional AgentNet architectures, skillsets are uploaded, downloaded, and executed across agents under an implicit trust-by-declaration assumption, introducing severe vulnerabilities. To address these limitations, TrustAgentNet replaces implicit trust with a zero-trust framework. However, enforcing continuous verification may incur multi-dimensional resource and performance penalties. To formalize these trade-offs mathematically, we decouple the system orchestration into two logical tiers: Tier-1: CoS-oriented skillset lifecycle management, which governs the secure submission and acquisition of skillsets; and Tier-2: CoC-oriented multi-agent collaboration, which regulates on-demand task-oriented collaborative learning/inference among multiple agents. I-B1 Tier-1: CoS-Oriented Skillset Lifecycle Management (Two-Way Trade-off) This tier governs the static lifecycle of skillsets interacting with CoS. Let us define the binary action variables π for a specific agent aj∈a_j and a skillset si∈s_i : the submission policy πsub(j,i)∈0,1π^(j,i)_sub∈\0,1\ (where πsub(j,i)=1π^(j,i)_sub=1 mandates rigorous on-chain verification when agent aja_j submits skillset sis_i) and the acquisition policy πacq(j,i)∈0,1π^(j,i)_acq∈\0,1\ (where πacq(j,i)=1π^(j,i)_acq=1 mandates smart-contract-based authenticated retrieval when agent aja_j requests skillset sis_i). The trade-off is inherently two-dimensional: • Lifecycle Security Level (GsicosG^cos_s_i): The security gain of skillset sis_i on the CoS is formalized as the weighted activation of verification protocols during the submission and acquisition phases across all participating agents: Gsicos()=∑j(wsub⋅πsub(j,i)+wacq⋅πacq(j,i)), [rgb]0,0,0G^cos_s_i( π)= _j (w_sub·π^(j,i)_sub+w_acq·π^(j,i)_acq ), (2) where wsubw_sub and wacqw_acq quantify the security weight of skillset submission and acquisition, respectively. • Lifecycle Resource Cost (CsicosC^cos_s_i): Enforcing zero-trust identification across the skillset lifecycle directly introduces multi-dimensional communication and computational resource consumption. We formalize this cost as a joint evaluation function: Csicos() [rgb]0,0,0C^cos_s_i( π) =∑j[πsub(j,i)⋅(Csub,jcomm+Csub,jcomp) [rgb]0,0,0= _j [π^(j,i)_sub· (C^comm_sub,j+C^comp_sub,j ) . +πacq(j,i)⋅(Cacq,jcomm+Cacq,jcomp)], [rgb]0,0,0 .+π^(j,i)_acq· (C^comm_acq,j+C^comp_acq,j ) ], (3) where CcommC^comm and CcompC^comp represent the abstract communication and computational costs mapped to agent aja_j, respectively. Specifically, during the submission phase (πsub(j,i)=1π^(j,i)_sub=1), the communication cost covers the consensus propagation overhead across the blockchain network, while the computational cost encapsulates the CPU utilization required for generating cryptographic signatures, executing verification algorithms, and running smart contracts. Conversely, during the acquisition phase (πacq(j,i)=1π^(j,i)_acq=1), the communication cost primarily reflects the network communication delay for querying the decentralized ledger and fetching the authenticated skillset model, whereas the computational cost accounts for the CPU overhead generated by authenticating ledger states and semantic mapping algorithms. I-B2 Tier-2: CoC-Oriented Multi-Agent Collaboration (Three-Way Trade-off) This tier governs the dynamic, runtime execution of multi-agent collaborative learning and inference workflows. Specifically, a task publisher initializes a collaborative task kT_k on the global CoS, which dynamically triggers a CoC to orchestrate and verify the zero-trust workflow. Denote ℛk⊆R_k as the universal candidate pool of available agents possessing the required skillsets to complete task kT_k, without yet considering security endorsements. To filter out latent adversarial entities, the CoC executes a admission decision policy πcoc(j,k)∈0,1π^(j,k)_coc∈\0,1\ as a stochastic cryptographic filter, where πcoc(j,k)=1π^(j,k)_coc=1 mandates that agent aj∈ℛka_j _k successfully passes the authentication and is authorized to join the CoC for task kT_k. Consequently, the authorized agent subset is defined as ℳk=aj∈ℛk∣πcoc(j,k)=1M_k=\a_j _k π^(j,k)_coc=1\, with its cardinality denoted as Mk=|ℳk|M_k=|M_k|. In Tier-2, the dynamic orchestration exhibits a complex three-way trade-off among security, task performance, and resource cost: • Collaboration Security Level (GkcocG^coc_k): Unlike conventional networks where a larger node size implies better structural path redundancy, security in cognitive multi-agent systems is strictly a decaying function of the authorized cluster size MkM_k due to the expansion of adversarial attack surfaces, which is given by Gkcoc(Mk)=1−Pcollusion(Mk∣coc), [rgb]0,0,0G^coc_T_k(M_k)=1-P_collusion (M_k π_coc ), (4) where Pcollusion(⋅)P_collusion(·) represents the tail probability of an adversarial majority successfully forming during decentralized consensus or distributed model aggregation. Crucially, by executing the admission policy coc π_coc, the CoC filters out possible malicious agents, parameterized as a bound that flattens the growth curve of the collusion probability. • Task Performance Error (ℰkE_T_k): The collaborative performance of a task is evaluated by ℰkE_T_k, a generalized, task-specific error or performance-gap function depending on the specific task, which can be written as ℰk=[ℱk(ωℳk,T)]−ℱℛk∗, [rgb]0,0,0E_T_k=E [F_k ( _M_k,T ) ]-F^*_R_k, (5) where ℱk(⋅)F_k(·) represents the empirical evaluation metric of the task by the MkM_k authorized agents and T coordination iterations, and ℱℛk∗F^*_R_k is the idealized theoretical performance boundary. The efficacy of task execution heavily depends on the diversity and volume of data or specialized capabilities contributed by authorized agents. Crucially, restricting MkM_k to enhance zero-trust security may inadvertently exclude “honest but non-conformist” edge agents from the CoC, leading to an optimality gap. • Resource Cost (CkcocC^coc_T_k): While CoS offers security benefits with the zero-trust principle, it also introduces a higher total resource cost due to the additional communication and computational resources required for distributed ledger verification operations. Total cost CkcocC^coc_T_k for a task kT_k can be formulated as: Ckcoc=[ϕ(Mk)⏟Verification Cost+ψ(Mk,T)⏟Commun/Comp Cost], C^coc_T_k= [ φ(M_k)_Verification Cost+ ψ(M_k,T)_Commun/Comp Cost ], (6) where ϕ(⋅)φ(·) represents the computational cost of the CoS executing the admission policy πcoc _coc for MkM_k agents, and ψ(⋅)ψ(·) represents the communication/computation cost of multi-agent coordination across T iterations. In summary, this section establishes the formulated system model and the performance tradeoff for secure, ledger-anchored skillset orchestration and multi-agent collaboration in AgentNet systems. In the following section, we will introduce the architectural framework of the proposed TrustAgentNet. IV TrustAgentNet Architecture Figure 1: An architectural framework of TrustAgentNet. The architectural framework TrustAgentNet is illustrated in Fig. 1, consisting of the following key components: • Infrastructure: includes the hardware infrastructure, such as cloud and edge computing and storage resources and communication networks that connect agents and the blockchain nodes, and the software systems including high-quality datasets, accumulated skillsets, distributed ledgers and comprehensive world models available for agents’ utilization. • Chain of skillsets (CoS): is the foundational, immutable ledger of TrustAgentNet, implemented as a consortium blockchain. It contains the following primary subfunctional modules: 1) Agent Identity Authentication: provides robust digital identity and authorization services by generating and authenticating a unique, non-repudiable cryptographic Agent Identity (AID) for new agents aka_k joining the network; 2) Skillset Tag Registry: stores the metadata of all available and up-to-date skillsets sis_i, si∈s_i∈S; 3) Upload/Download Inquiry Record: maintains the transparency and auditability of skillset usage by logging every interaction related to the submission of new skillsets (uploads) and the retrieval of existing skillsets (downloads) as a blockchain transaction. The detailed procedural execution and algorithm design will be introduced in Section V. • Skillset storage: is a decentralized storage network designed to provide permanent and content-addressed persistence for all skillsets by employing decentralized storage technologies, such as the InterPlanetary File System (IPFS), utilizing a group of distributed storage resources across the network. Upon storing a skillset, the decentralized storage generates a unique, content-based identifier (CID), e.g., a Content ID in IPFS, which is recorded within the skillset’s tag. Any agent can trustlessly query or download a specific skillset using the CID written in the skillset tag, guaranteeing that the retrieved content precisely matches the data initially registered and audited by the CoS. This separation of the decentralized ledger and the decentralized storage is fundamental to the scalability and trustworthiness of TrustAgentNet. • Chain of Collaboration (CoC) for a dedicated task: facilitates privacy-preserving coordination among multiple agents to collaboratively complete a training or inference task m in the CoS. Embedded within the broader CoS system as a runtime collaboration slice, a transient CoC is spawned from the CoS when a specific task session is initiated, and released when the task is accomplished. The task can be initiated by a task publisher by submitting a transaction to the CoS, and a corresponding CoC is established, where agents can volunteer or be activated to join the chain. Joining an existing chain necessitates endorsement, commonly requiring a consensus of a given percentage of the current participating agents. Upon successful endorsement, each agent within the authorized active subset can submit its local outputs to the blockchain as transactions for validation and aggregation. CoS accommodates numerous parallel CoCs and supports various types of multi-agent decentralized collaboration frameworks, with each chain focusing on the collaborative learning and evolution of a specific task demand. Detailed execution and corresponding theoretical analysis will be discussed in Section VI. • Agents: include various types of task-oriented agents. Each agent aka_k implemented in a specific environment e has a unique set of locally observed dataset k,eD_k,e, and has a set of skillsets k,eS_k,e so as to accomplish certain tasks m∈em∈T_e. • Skillset tag: is a trusted digital certificate, endorsed by the CoS, used to advertise the capability declaration DiD_i of a skillset, the CID linking to the actual skillset artifact stored in the Storage, and its life-cycle traceability. Typically, a tag can be a JSON metadata file, which can be queried to allow dynamic capability discovery so the network can find the most suitable set of skillsets for a given task. To demonstrate how this architecture operates in practice, the subsequent sections formalize the operational workflows of TrustAgentNet into algorithmic protocols and theoretical analysis. Section V introduces the protocols governing the zero-trust skillset lifecycle management (Tier-1), while Section VI presents the on-chain multi-agent collaboration alongside their corresponding theoretical three-way tradeoff analysis (Tier-2). V Zero-Trust Skillset Lifecycle Management Protocols To realize the Tier-1 skillset management formalized in Section I-B, this section instantiates the operational workflows into two rigorous algorithmic protocols. Since standard smart contracts cannot comprehend high-level semantics or verify complex black-box intelligence, we integrate specialized LLM agents as core protocol primitives to achieve cognitive-level validation. Specifically, we first present the on-chain secure skillset acquisition and semantic mapping protocol driven by a Mapping Agent (M-Agent), followed by the zero-trust skillset submission and automated auditing protocol powered by a Verifying Agent (V-Agent). V-A On-Chain Secure Skillset Acquisition and Semantic Mapping Protocol To operationalize the skillset acquisition policy (πacq(j,i)=1π^(j,i)_acq=1) under a strict zero-trust regime, we propose an autonomous, ledger-driven semantic-to-cryptographic translation mechanism. When an authenticated agent aj∈a_j encounters a multi-modal environment mission goal GtargetG_target that exceeds its current local capabilities, it signs and submits a structured acquisition request transaction TXacqTX_acq to the CoS ledger, wrapping the raw natural language task goal GtargetG_target. The system triggers a two-phase retrieval and verification pipeline: smart-contract-mediated semantic decomposition and cryptographic integrity auditing. V-A1 Smart-Contract-Driven Semantic Task Decomposition via M-Agent In heterogeneous AgentNet systems, task requirements are frequently unstructured, multi-modal, and environment-specific. To bridge this gap, a specialized M-Agent is integrated into the core network infrastructure and invoked via the CoS smart contracts as a trusted semantic resolution layer. Upon validating the signature and identity AIDjAID_j of the requesting agent, the CoS smart contract triggers the M-Agent to parse TXacqTX_acq. The M-Agent decomposes the high-level goal GtargetG_target into an optimized sequence of atomic sub-tasks and matches them against the indexed capability fields within the global immutable skillset registry S. This ledger-mediated mapping and suite generation logic is formalized as a semantic projection function ΦLLM(⋅) _LLM(·): ΦLLM(Gtarget)⟶j′:=si∈∣SemMatch(si,Gtarget)=1, [rgb]0,0,0 _LLM(G_target) ^ _j:=s_i (s_i,G_target)=1, (7) where j′S _j denotes the customized minimal atomic skillset suite to accomplish the task. Through continuous contextual learning, the M-Agent can iteratively refine its mapping logic to ensure high-accuracy capability matching. V-A2 On-Chain Retrieval and Cryptographic Integrity Verification Once the required skillset subset j′S _j is determined, the CoS smart contract returns the corresponding secure cryptographic metadata tags for each requested si∈j′s_i _j to agent aja_j. Specifically, the returned tag for each skillset encapsulates a CID, with which as routing keys, agent aja_j can establish a peer-to-peer session with the decentralized storage network to fetch the original files of skillsets j′S _j. To eliminate intermediate tampering, man-in-the-middle poisoning, or transit data corruption, agent aja_j can independently recompute the cryptographic hash of the downloaded binary files, denoted as ℋ(Downloaded File)H(Downloaded File). The downloaded skillset asset is authorized for local loading and execution if and only if it satisfies the strict equivalence check: ℋ(Downloaded File)≡CIDCoS, [rgb]0,0,0H(Downloaded File) _CoS, (8) where CIDCoSCID_CoS represents the authoritative hash anchored on the immutable CoS ledger. Upon successful validation of all skillsets in j′S _j, agent aja_j can update its Agent Card to append the newly embedded capabilities, which can be subsequently advertised to agent controller or adjacent peer agents for further task orchestration. V-B Zero-Trust Skillset Submission and Verification Protocol To prevent malicious, compromised, or sub-optimal agents from contaminating the decentralized registry with false capability advertisements, TrustAgentNet enforces a claim-to-capability consistency verification protocol (πsub(j,i)=1π^(j,i)_sub=1) to audit the skillset’s claimed capabilities via a CoS-supervised pipeline. V-B1 Operational Workflow Specifically, upon locally developing or acquiring a new capability, a verified agent aja_j encapsulates the skillset into a signed transaction TXsubTX_sub and submits it to the CoS ledger. Once the transaction is deposited, the CoS smart contract autonomously triggers a specialized V-Agent deployed within a secure network sandbox. The V-Agent is tasked with executing a rigorous claim-to-capability consistency verification to empirically cross-examine whether the skillset’s technical implementation matches its advertised declarations. Upon terminating the verification loop, the V-Agent synthesizes and signs a comprehensive Consistency Auditing Report, and submits it back to the CoS smart contract. If the report certifies behavioral consistency, the contract executes a Proof-of-Performance (PoP) routine, dynamically initializes the skillset’s trust score and updates the submitting agent’s trust score on the global ledger. Figure 2: Graphic illustration of the V-Agent consistency verification protocol for different types of skillset submissions. V-B2 Verification Protocol Design Fig. 2 illustrates the verification protocol orchestrated by the V-Agent. Crucially, the verification protocol mainly includes three stages, accommodating both AI-model-based skillsets (comprising neural network weights/gradients, and model metadata) and procedural skillsets (comprising structured execution scripts and code manifests compliant with the ClawHub): Stage 1: Decoupling of implementation and declaration artifacts. Upon intercepting TXsubTX_sub, the V-Agent isolates the raw submission data based on its architectural track. For AI-model skillsets, it separates the weight parameters and gradient vectors from the behavioral metadata files. For procedural skillsets, it decouples the execution scripts and runtime resources from the declarative documentation (SKILL.md). This separation yields two distinct vectors for downstream evaluation: the operational Implementation Layer (executable code or model weights) and the semantic Declaration Layer (natural language claimed manifests and target benchmarks in the skillset tag). Stage 2: Semantic feature extraction from declaration layer. The V-Agent then extracts the skillset’s claimed capability profile from the declaration artifacts, formalizing it as a multi-dimensional semantic feature tensor ℱclaimF_claim. This extraction conforms to the dual-track skillset architecture: • AI-Model skillsets: The extracted features map the structural metadata required for neural deployment, specifically the deep learning framework, the designated test set, and the claimed performance metrics. • Procedural skillsets: The extraction targets four mutually exclusive runtime units from the documentation (SKILL.md) to define execution boundaries: Entry points (invocation triggers/APIs), Constraints (hard external dependencies/version requirements), Capability profiles (functional utility statements), and Behavior protocols (internal data routing/fallback logic). Stage 3: Cross-layer claim-to-capability consistency analysis. The LLM-based V-Agent completes the verification loop by orchestrating automated, sandboxed executions to cross-examine ℱclaimF_claim against the actual implementation layer. The evaluation mechanics are tailored to the skillset track: • AI-Model consistency verification: The V-Agent deploys a pure sandbox environment, mounts the raw submitted model weights, and executes batch inference over the declared test set. The system evaluates consistency by directly checking if the empirically measured performance matches the claimed metric within a tolerance, i.e., Δp=|claimed−empirical|<ϵ _p=|P_claimed-P_empirical|<ε. • Procedural consistency verification: Due to the programmatic complexity of execution scripts, the V-Agent evaluates each extracted procedural feature f via an audit function Ψ(f) (f) to render three distinct architectural verdicts: The V-Agent then conducts a formal consistency analysis, contrasting the implemented scripts/resources against the claimed features anchored in ℱclaimF_claim. The consistency validation rule is formulated as: Ψ(f)=Match,if f is verifiedMiss,if f is unimplementedUncertain,if f depends on the framework. (f)= casesMatch,&if $f$ is verified\\ Miss,&if $f$ is unimplemented\\ Uncertain,&if $f$ depends on the framework. cases (9) Here the Uncertain verdict is assigned to features natively bound to framework prompt spaces (e.g., OpenClaw core orchestrations) or external APIs, flagging them for further determination. V-B3 Dual-Tier Trust Algorithm Design To systematically govern submission compliance across heterogeneous asset tracks, the CoS smart contract enforces a dual-tier trust score algorithm that parallelly tracks a Skillset Trust Score s∈[0,1]TS_s∈[0,1] and an Agent Trust Score a∈[0,1]TS_a∈[0,1]. The individual skillset trust score s∈[0,1]TS_s∈[0,1] is given by s=exp(−γ⋅Δp),for AI-Model Skillsets1F∑i=1F(Ψ(fi)),for Procedural SkillsetsTS_s= cases (-γ· p),&for AI-Model Skillsets\\ 1F _i=1^F( (f_i)),&for Procedural Skillsets cases (10) where Δp _p quantifies the sandbox performance deviation for AI-model skillset with a tuning parameter γ>0γ>0; and Ψ(⋅)∈[0,1] (·)∈[0,1] represents a predefined monotone weighting function mapping the discrete architectural verdicts (Match,Uncertain,MissMatch,Uncertain,Miss) to bounded continuous scores. Concurrently, the presenting agent’s global trust score aTS_a is defined to track long-term historical compliance via an exponential moving average a(t)=ρa(t−1)+(1−ρ)s,TS_a^(t)= _a^(t-1)+(1-ρ)TS_s, (11) where ρ denotes the credit inertia factor. Multi-tier governance policies can further be continuously executed based on this dual-tier matrix: if the skillset score falls below the admission threshold (s<θadmTS_s< _adm), the specific skillset is rejected from CoS; if the aggregated trust score of an agent drops below the revocation threshold (a<θrevTS_a< _rev), the smart contract can trigger a predefined punishment routine, e.g., executing cryptographic access revocation by blacklisting the agent’s public key, or an economic slashing penalty that forfeits its pre-staked computational credits. VI CoC-Oriented On-Chain Multi-Agent Collaboration and Theoretical Analysis This section presents the on-chain multi-agent collaborative learning and inference sub-architecture within TrustAgentNet, designed to facilitate privacy-preserving, decentralized coordination across heterogeneous intelligence entities. Since individual agents operate in distinct, potentially antagonistic environments, they cannot directly expose their local datasets; thus, multi-agent collaboration must rely exclusively on the secure exchange of intermediate learning parameters, such as model output embeddings and cryptographic representations of gradients. To operationalize this environment, a task publisher initializes collaborative training or inference missions on the global CoS, which dynamically triggers the instantiation of an isolated CoC to orchestrate and verify the zero-trust workflow. In the remainder of this section, we first elaborate on three specialized collaborative framework primitives, including federated global model training, distributed MoE, and multi-agent model partitioning and sharing (MoPS), followed by a rigorous theoretical analysis on the three-way tradeoff of security, task performance and resource cost. ((a)) ((b)) ((c)) Figure 3: On-chain multi-agent collaborative training/inference procedures of (a) federated global model training and (b) distributed mixture of experts networks, and (c) multi-agent model partition and sharing. VI-A On-Chain Multi-Agent Collaborative Learning/Inference The CoC framework specifically accommodates a series of multi-agent collaboration tasks as follows: 1) Federated global model training frameworks: This involves the collaborative training of a single global model among a selected set of authenticated agents ℳi⊆M_i possessing an identical skillset sis_i with their private local datasets jj∈ℳi\D_j\_j _i, as illustrated in Fig. 3(a). During the t-th round of coordination, the following steps are sequentially executed by the agents and the CoC, maintaining a rigorous zero-trust posture across all data exchanges. (1) Local model updating (at each agent): Each authorized agent aj∈ℳia_j _i queries the CoC to retrieve the prior consensus-validated global parameters wg(t−1)w_g^(t-1), and conducts local training utilizing its local dataset jD_j for E rounds to yield updated parameters wj(t)w_j^(t). (2) Parameter uploading to the chain: After local updating, each agent submits its local model parameters to the CoC as a cryptographically signed blockchain transaction TXj(t):=⟨AIDj,t,wj(t)⟩TX_j^(t):= _j,t,w_j^(t) to guarantee immutable non-repudiation. Adhering to the zero-trust principle, TXj(t)TX_j^(t) is broadcast for endorsement and consensus validation before including it in a proposed block. (3) Smart-Contract-Mediated Model aggregation (at the chain): The core function of aggregating the local updates occurs on the chain, mediated by a specialized Aggregation Smart Contract (ASC). Upon consensus commitment, the ASC is automatically triggered to execute the global parameter aggregation wg(t)=ΨASC(TXj(t)j∈ℳi)w_g^(t)= _ASC (\TX_j^(t)\_j _i ), where ΨASC(⋅) _ASC(·) represents the aggregation logic. The synthesized global state wg(t)w_g^(t) is securely committed to the CoC state, which is transparently queryable for agents to securely initialize round t+1t+1. 2) Distributed MoE frameworks of large models: Distributed MoE supports a group of specialized neural networks (called experts) deployed across heterogeneous edge devices, dynamically activated by a gating network to collaboratively execute complex tasks [36], as illustrated in Fig. 3(b). Upon task instantiation, the workflow for on-chain distributed MoE inference is as follows: (1) On-chain gate evaluation (at the chain): Instead of relying on a centralized coordinator, the on-chain gating network is executed entirely within a specialized routing smart contract on the CoC. For instance, the contract computes the gating weight vector g and dynamically selects the optimal subset of activated experts ℰactE_act via a top-K sparse activation mechanism[37]. (2) Expert local computation (at each expert): The edge users then download the task, utilize the activated experts to process the learning task, and submit their mid-layer computational outputs into a cryptographically signed transaction TXe:=⟨AIDe,TaskID,ye⟩TX_e:= _e,TaskID,y_e to the CoC similar to the previous case. (3) Smart-Contract-Mediated Output aggregation (at the chain): Similarly, the submitted expert outputs yee∈ℰact\y_e\_e _act are aggregated by a specialized ASC, and the final outputs Y of MoE are then committed to the global CoS state through cross-chain consensus registry, achieving verifiable end-to-end task fulfillment for secure retrieval by the task publisher. 3) Multi-agent model partitioning and sharing frameworks: To adapt large models to edge resource constraints, we integrate our recently proposed MoPS framework [38] into the CoC subsystem, segmenting deep networks into a global foundation shared-part and task-specific agent-specific parts, as illustrated in Fig. 3(c). More specifically, in MoPS, the agent controller hosts the shared parameters ωm,tshω^sh_m,t while assigning localized slices ωm,tiω^i_m,t to individual agents. To securely synchronize the collaborative training loop without central single-point-of-failure or privacy risks, during the t-th round of coordination, the following steps are sequentially executed and repeated by the agents and the agent controller: (1) Local model updating (at each agent): Each agent aia_i first downloads the consensused gradient tensor gm,t−1sh,ig^sh,i_m,t-1 from the agent controller via the CoC. It then computes and updates the gradient of its local model parameters by following Eqs. (8)-(9) in [38]. (2) Embedding uploading to the chain: Each agent aia_i calculates the model output embedding zti=f~i,ti(xti)z^i_t=f_ ω^i_i,t(x^i_t) and then uploads the embedding-label pair ⟨zti,yti⟩ z^i_t,y^i_t to the CoC as a signed transaction for consensus. (3) Shared model updating (at the chain): Upon receiving the embedding-label pairs from all called agents, the shared-part model ~i,tsh ω^sh_i,t is updated by performing the aggregated gradient descent using a specialized ASC and the output gradient tensor gm,tsh,ig^sh,i_m,t is submitted to CoC as a block, establishing an audited baseline for agents to safely initialize iteration t+1t+1. 4) Discussions on scalability and resource orchestration: A potential concern in large-scale AgentNet deployment is the management overhead of numerous concurrent CoCs. To mitigate this, TrustAgentNet employs an ephemeral instantiation strategy. Unlike persistent ledgers, each CoC is a lightweight, on-demand coordination instance. Upon task fulfillment, the CoC undergoes a state-compacting process where only the final verified results and audit logs are synchronized to the CoS, followed by the complete release of the CoC’s runtime resources. Furthermore, an adaptive on-chain/off-chain mode selection can be introduced to achieve better tradeoff between security and resource consumption. For routine tasks in trusted environments, agents can perform off-chain collaborative inference to minimize latency and overhead. The resource-intensive on-chain coordination is dynamically activated only when potential security risks or malicious anomalies are detected. This hierarchical and adaptive approach ensures that the systemic overhead remains linear relative to the task density, rather than experiencing the combinatorial explosion typically associated with flat, non-partitioned blockchain architectures. VI-B Theoretical Analysis on Three-way Tradeoff Among Security Level, Agent Performance, and Resource Consumption As described in Section VI-A, TrustAgentNet enables blockchain-secured multi-agent collaborative learning for distinct frameworks via dedicated CoCs. This subsection further presents the theoretical analysis of three-way tradeoff between security, agent skillset performance, and resource consumption in two representative frameworks: federated global modeling training and multi-agent model partitioning and sharing. VI-B1 Theoretical Results for Federated Global Model Training Frameworks For a specific skillset si∈:=⋃ak∈ks_i := _a_k S_k, a subset of agents ℳi⊆ℛiM_i _i that possess this skillset and obtain the consensus of the current participating agents will spontaneously engage in the co-training, which can be formulated as: P1:minwi∈ℝdFi(wi):=∑ak∈ℳipi,kFi,k(wi), P1:\ w_i ^d \ F_i(w_i):= _a_k _ip_i,kF_i,k(w_i), (12) where Fi,k(wi):=1|k|∑(xk,j,yk,j)∈kf(wi;xk,j,yk,j)F_i,k(w_i):= 1|D_k| _(x_k,j,y_k,j) _kf(w_i;x_k,j,y_k,j) represents the local objective function for agent ak∈ℳia_k _i, and pi,kp_i,k denotes the weight of agent aka_k for skillset sis_i, where 0≤pi,k≤10≤ p_i,k≤ 1 and ∑ak∈ℳipi,k=1 _a_k _ip_i,k=1. We define f:ℝd→ℝ+f:R^d ^+ as the non-negative loss function reflecting the error of the model wiw_i evaluated on sample (xk,j,yk,j)(x_k,j,y_k,j). Suppose the optimal model for skillset sis_i is given by wℛi∗=argminwi∑ak∈ℛipi,kFi,k(wi)w_R_i^*= _w_i _a_k _ip_i,kF_i,k(w_i) where ℛiR_i denotes the universal set of agents that have skillset sis_i without considering security endorsement. We then have the following definition on the impact of the introduction of security authentication. Definition 1 The impact of removing a subset i=ℛi∖ℳiQ_i=R_i _i of agents on skillset sis_i due to their failure to meet security certifications can be defined as the difference between the global optimal performance with all RiR_i agents and that with only the MiM_i certified agents. This discrepancy is given by: Cℳi∗(Fi)=∑ak∈ℛipi,k(Fi,k(wℳi∗)−Fi,k(wℛi∗)). C_M_i^*(F_i)= _a_k _ip_i,k(F_i,k(w_M_i^*)-F_i,k(w_R_i^*)). (13) We can then derive the following theoretical bound of the skillset performance with security endorsement on CoC-based federated global model training frameworks. Theorem 1 Suppose the following assumptions hold: Assumption 1 The objective function Fi,k(w)F_i,k(w) is L-smooth for any skillset sis_i and agent aka_k, i.e., ‖Fi,k(w)−Fi,k(w′)‖≤L‖w−w′‖\|F_i,k(w)-F_i,k(w )\|≤ L\|w-w \|. Assumption 2 The objective function Fi,k(w)F_i,k(w) is μ-convex for any skillset sis_i and agent aka_k, i.e., ‖Fi,k(w)−Fi,k(w′)‖≥μ‖w−w′‖\|F_i,k(w)-F_i,k(w )\|≥μ\|w-w \|. Assumption 3 The stochastic gradient of the loss function Fi,k(w)F_i,k(w) is upper bounded for any skillset sis_i and agent aka_k, i.e., ‖∇Fi,k(w)‖≤GE\|∇ F_i,k(w)\|≤ G. Assumption 4 The stochastic gradient of the loss function Fi,k(w)F_i,k(w) is variance-bounded for any skillset sis_i and agent aka_k, i.e., ‖∇Fi,k(w)−[∇Fi,k(w)]‖≤σkE\|∇ F_i,k(w)-E[∇ F_i,k(w)]\|≤ _k. Then, with κ=Lμ,γ=max8Lμ,Eκ= Lμ,γ= \ 8Lμ,E\, and the learning rate βt=2μ(γ+t) _t= 2μ(γ+t), we have ℰsi≤ _s_i≤ 4κμ(γ+ET)(∑ak∈ℛipi,k2σk2Dk+8E2G2+Aℳi+6LCℳi∗(Fi)) 4κμ(γ+ET)\! (\! _a_k _i\! p_i,k^2 _k^2D_k\!+\!8E^2G^2\!+\!A_M_i\!+\!6LC_M_i^*(F_i)\!\! ) +LBℳi, +LB_M_i, where Dk=|k|D_k=|D_k| is the cardinality of the set kD_k, Aℳi=μ2(γ+1)4∥w0−wℳi∗∥2A_M_i= μ^2(γ+1)4 w_0-w_M_i^* ^2, and Bℳi=∥wℳi∗−wℛi∗∥2B_M_i= w_M_i^*-w_R_i^* ^2. Proof: See Appendix A. ∎ Remark 1 Assumptions 1-4 are commonly introduced for most theoretical analyses of gradient-based model training processes [39, 40, 41]. In particular, Assumptions 1 and 2 guarantee that the objective function’s rate of change is bounded, thereby ensuring that infinitesimal adjustments to model weights yield predictable and manageable shifts in the loss landscape. Assumption 3 and 4 characterize the stability and reliability of the stochastic optimization process. Specifically, Assumption 3 ensures that the magnitude of the stochastic gradients remains within a reasonable range, preventing the model from experiencing gradient explosion during the training process. In practice, this assumption is often enforced through the use of gradient clipping techniques [42]. Assumption 4 restricts the noise level inherent in stochastic gradient estimation, implying that the updates from individual agents or data batches do not deviate excessively from the true gradient direction. Remark 2 Theorem 1 formalizes how security authentication non-linearly impacts the multi-agent optimization process. Specifically, a stricter authentication threshold inherently filters out suspicious agents, reducing the cardinality of the active collaborative agent cluster. From an optimization perspective, losing these agents, especially those possessing unique skillset characteristics, directly scales the statistical heterogeneity and amplifies the stochastic gradient variance, which is mathematically mapped onto the inflation of the structural bounds BℳiB_M_i and Cℳi∗C_M_i^*. Rather than a simple linear tradeoff, this formulation uncovers a delicate coupling: while elevating the security threshold secures the ecosystem, it introduces an implicit verification noise that widens the optimality gap and may destabilize the convergence of skillsets. VI-B2 Theoretical Results for Multi-agent Model Partitioning and Sharing Frameworks Note that, different from the problem P1 focusing on finding the global optimization solution to minimize a single objective function, the optimization objective in multi-agent model partitioning and sharing frameworks involves a vector of objectives from different agents. In this case, it is generally impossible to find a single global optimal solution that minimizes the loss functions of all the agents. To address this issue, in this paper, we consider the Pareto optimal solution, a metric commonly adopted for evaluating the tradeoff among a collection of possibly conflicting goals and objectives. Let i=⟨wi,sh,wi,1,…,wi,Mi⟩ _i= w_i,sh,w_i,1,...,w_i,M_i denote the overall model for the skillset sis_i, where wi,shw_i,sh denotes the shared part of the model and wi,kw_i,k for ak∈ℳia_k∈ M_i denotes the local part of the model. More formally, we define the Pareto optimal solution for the multi-agent system as follows: Definition 2 A solution profile i _i is called Pareto stationary solution if there exists a set of non-negative weights pi,kp_i,k for ak∈ℳia_k∈ M_i such that ∑ak∈ℳipi,k=1 _a_k∈ M_ip_i,k=1 and ∑ak∈ℳipi,k∇Fi,k(i,k)=0 _a_k∈ M_ip_i,k∇ F_i,k( _i, D_k)=0. A solution profile i∗ _i^* is Pareto optimal if no other Pareto stationary solution i _i for i≠i∗ _i≠ _i^* such that Fi,k(i)≤Fi,k(i∗)F_i,k( _i)≤ F_i,k( _i^*) for all ak∈ℳia_k∈ M_i and Fi,k(i)<Fi,k(i∗)F_i,k( _i)<F_i,k( _i^*) for at least one ak∈ℳia_k∈ M_i. From the above definition, we can observe that the Pareto stationary solution seeks a feasible solution set in which no other feasible solution can improve one agent’s objective without causing a deterioration in at least one other agent’s objective. Therefore, the optimization problem P1 can then be rewritten in the following form: P2:min⟨wi,sh,wi,1,…,wi,Mi⟩‖∑ak∈ℳipi,k∇Fi,k(⟨wi,sh,wi,k⟩)‖2. P2:\ _ w_i,sh,w_i,1,...,w_i,M_i \| _a_k∈ M_ip_i,k∇ F_i,k( w_i,sh,w_i,k )\|^2. (14) Let us now present the following theoretical bound of the skillset performance with security endorsement on blockchain based on multi-agent model partitioning and sharing framework. Theorem 2 Suppose assumption 1 holds, and the following assumption holds: Assumption 5 For any pi,k,ak∈ℳip_i,k,a_k∈ M_i, the initialized model 0 _0 satisfies that [∑ak∈ℳipi,kFi,k(0)]−mini[∑ak∈ℳipi,kFi,k(ℳi)]≤CI.E[Σ _a_k∈ M_ip_i,kF_i,k( _0)]- _ _iE[Σ _a_k∈ M_ip_i,kF_i,k( _ M_i)]≤ C_I. Suppose the model i,tt=1T\ _i,t\_t=1^T is trained by the static weighting pi,kp_i,k with βt=β≤12L _t=β≤ 12L. We can prove the following result: 1T∑t=0T−1[ℰsi,t]≤2(CI+Cℳi(Fi))(2β−Lβ2)T. 1T _t=0^T-1E[ E_s_i,t]≤ 2(C_I+C_ M_i(F_i))(2β-Lβ^2)T. (15) Proof: See Appendix B. ∎ Remark 3 Theorem 2 demonstrates that the average expected error decays at a rate of (1/T) O( 1/T), implying that increasing the number of coordination rounds T reduces the optimization error. However, the total resource cost, including communication, computation, and endorsement/verification overhead, scales linearly with T. Moreover, the bias term Cℳi(Fi)C_ M_i(F_i) captures the performance degradation caused by excluding uncertified agents, which remains fixed regardless of T. Together, these factors reveal a fundamental three-way trade-off among accuracy, resource expenditure, and security-induced bias in certified multi-agent model partitioning and sharing frameworks. VII Prototype and Experimental Results In this section, we introduce our developed TrustAgentNet prototype and present experimental results under various scenarios. VII-A Prototype and Experimental Setup We develop a TrustAgentNet prototype based on an open-source Radio Access Network (RAN) and softwareized 5G core network, as shown in Fig. 4, which extends our previous AgentNet platform developed in [38] by incorporating the proposed blockchain-secured zero-trust layers. While the primary focus of this work is on security, the integration of the RAN and 5GC allows us to evaluate the framework’s performance within a physically distributed and realistic wireless networking environment. Figure 4: TrustAgentNet prototype. Hardware and Network Topology: To simulate a tiered 6G AgentNet, the prototype components are distributed across a hierarchical topology. The TrustAgentNet prototype hardware consists of five major components: the gNodeB (gNB), the user equipment (UE), the 5G core (5GC) network, the blockchain server, and the skillset storage server, as illustrated in Fig. 4. Specifically, the gNB–which handles all RAN functions–is instantiated using the srsRAN open-source software suite [43]. This software-defined gNB connects to the UE via a Universal Software Radio Peripheral (USRP), NI USRP 2944R, which provides the essential hardware interface for over-the-air communication. The 5GC is implemented entirely using the Open5GS project installed on a workstation equipped with an Intel(R) Core(TM) i9-13900K CPU@5.8GHz, 128GB of DDR5 RAM, and an NVIDIA GeForce RTX 4090 GPU. We utilize a desktop server equipped with an Intel i5-10500T CPU and 64GB of memory to host the blockchain nodes and the skillset storage. Blockchain: We adopt the open source Hyperledger Fabric[44] as the consortium blockchain platform for both the CoS and each CoC. Specifically, the blockchain and storage infrastructure is containerized via Docker. The storage layer utilizes three decentralized IPFS nodes running Kubo v0.40.1. The blockchain network is configured with four peer nodes, one orderer node, and four independent CouchDB instances serving as state databases. Etcdraft and Raft are adopted as the consensus protocol and algorithm, respectively. Smart contracts are instantiated via dedicated chaincode containers to dynamically execute the zero-trust skillset acquisition and submission workflows. Specifically, CoS deploys a set of generic key-value smart contracts on Hyperledger Fabric, utilizing the unique cryptographic content hash of the skillset metadata as the immutable primary key to anchor the entire lifecycle states. Furthermore, the upper-layer business gateway encapsulates Fabric’s multi-phase transaction protocols via automated serialization and type routing mechanisms, allowing distributed agents to transparently invoke atomic ledger operations. During the skillset submission pipeline, the smart contracts persistently anchor critical milestones including initial report ingestion, CID cryptographic updates, and the final verification report anchoring; during the skillset acquisition pipeline, the smart contracts orchestrate task initialization, batch queries of model metadata, filtering result anchoring, and data retrieval, thereby constructing an immutable, end-to-end on-chain data pipeline. Agents: We implement DeepSeek-v3 to function as both the M-Agent and V-Agent deployed at the 5GC. Another LLM-based specialized agent, Security-agent (S-Agent), is further implemented at the UE side to guarantee agents’ runtime execution security. The S-Agent continuously monitors operational integrity and automatically initiates the security enhancement process by leveraging the CoS if a severe degradation in skillset performance is detected. Skillsets: We implement a diverse set of skillsets to thoroughly validate both the semantic mapping capability of the M-Agent and the behavioral integrity verification performance of the V-Agent. Firstly, the global CoS ledger is pre-populated with the metadata profiles of 200200 heterogeneous AI model skillsets spanning 1212 diverse application domains including medical diagnostics, autonomous driving, speech processing, and natural language processing (NLP). Concurrently, to benchmark the cross-modal zero-trust consistency verification capability of the V-Agent, we construct two distinct adversarial datasets for AI-model and procedural skillsets. Specifically, we construct an AI-model dataset comprising 5050 distinct AI model skillsets generated by cross-pairing 77 benchmark datasets (MNIST, FashionMNIST, EMNIST, CIFAR-10, CIFAR-100, SVHN, and Vehicle) with 55 representative neural network architectures (LeNet, SimpleCNN, MLP, ResNet18, and VGG16), within which 4040 honest skills are evaluated against 1010 meticulously designed adversarial skills injecting diverse deception vectors such as fabricated inference accuracy, descriptive metadata discrepancies, structural architecture spoofing, dataset origin falsification, poisoned model weights, and multi-dimensional blended deceptions. Moreover, the procedural skillset repository comprises 171 programmatic skills extracted from the ClawHub platform (with over 50 stars), covering data analysis, financial trading, content generation, and system tools. VII-B Evaluation of CoS Lifecycle Operations In this subsection, we focus on evaluating the performance and security resilience of Tier-1 lifecycle operations on the CoS. We first quantify the architectural overheads introduced by zero-trust skillset acquisition and skillset submission, and then present a generalized case study demonstrating the framework’s autonomous self-healing capabilities against malicious attacks. VII-B1 Evaluation of On-Chain Skillset Acquisition and Semantic Mapping Fig. 5 compares the multi-dimensional resource consumption of TrustAgentNet against a trust-by-default w/o-CoS baseline during the skillset acquisition pipeline, including the measured execution latency (ms), CPU utilization time, and traffic volume (KB) under varying global skillset repository sizes |||S|. Specifically, for CoS, we consider the four sequential operational phases: on-chain request submission (P1P_1), off-chain M-Agent sandboxed inference (P2P_2), on-chain result anchoring (P3P_3), and CoS metadata delivery (P4P_4). For the w/o-CoS baseline, agents directly query the M-Agent and retrieve feedback, completely bypassing decentralized cryptographic verification and consensus synchronization. For each skillset size |||S|, the agent issues an identical natural-language request, and each metric is evaluated by averaging the outcomes of 20 independent experimental trials. It can be clearly seen that the zero-trust overhead introduced by CoS is marginal. Across all resource dimensions, consumption is heavily dominated by the off-chain M-Agent inference (P2P_2) due to LLM cognitive mapping workloads. Conversely, blockchain-anchored phases (P1,P3,P4P_1,P_3,P_4) incur minor costs, validating that our blockchain-IPFS synergy and on/off-chain integration successfully confines on-chain operations to lightweight metadata hashing without processing bottlenecks. Specifically, the blockchain transactions executed during the on-chain request submission (P1P_1) and result anchoring (P3P_3) phases introduce a latency overhead of approx. 1515 ms, which is attributed to the endorsement and ordering consensus mechanisms. In terms of computational overhead, P2P_2 in CoS consumes more CPU utilization than the baseline due to on-chain metadata queries. Moreover, the framework exhibits robust structural scalability as the asset inventory |||S| scales from 3030 to 200200. As |||S| expands, the resource costs of the ledger-based phases (P1,P3,P4P_1,P_3,P_4) remain invariant, while that of P2P_2 scales sub-linearly to the semantic search space, demonstrating that TrustAgentNet can accommodate AgentNet systems with large-scale skillset inventories. Figure 5: Comparison in (a) latency, (b) CPU utilization time and (c) traffic volume between the proposed CoS and the baseline (w/o CoS) during the skillset acquisition process across varying scales of skillsets in the system. Note that to eliminate visual masking effects caused by multi-magnitude scaling disparities, the dominant P2P_2 (M-Agent inference) phase is placed at the top of the stacking hierarchy to preserve the visual legibility of the remaining micro-overhead stages. VII-B2 Evaluation of Zero-Trust Skillset Submission and Verification For the zero-trust submission and verification framework for AI-model skillsets, the V-Agent achieves a flawless 100%100\% detection accuracy across all 5050 empirical use cases, where all 4040 honest AI models successfully satisfy the cross-verification criteria, while the 1010 adversarial or falsified models are comprehensively intercepted at their respective dishonest dimensions. Let us further quantify the operational overhead across three phases: on-chain skillset submission (P1P_1), off-chain V-Agent verification (P2P_2), and on-chain report anchoring (P3P_3). Consider three submitted models with increasing parameter sizes: denoted as #1\#1 MNIST-LeNet (177177 KB), #2\#2 EMNIST-CNN (1.61.6 MB), and #3\#3 Vehicle-CNN (42.742.7 MB) for illustration. As a comparative benchmark, the baseline system without CoS (w/o CoS) directly uploads the skillset to decentralized storage layer without any security auditing. As shown in Fig. 6, during the on-chain skillset submission phase (P1P_1), CoS incurs a marginal latency overhead over the trust-by-default baseline, bounded within the millisecond range, as the ledger synchronization is solely for the lightweight skillset’s cryptographic metadata. Phase 22 (P2P_2) represents the core security-enhancing primitive unique to CoS, where the off-chain V-Agent performs multidimensional behavioral, structural, and architectural auditing. This pipeline encompasses dataset compatibility testing, model architecture graph validation, empirical performance profiling, and LLM-driven metadata self-consistency verification. Fig. 6 demonstrates that the execution latency and local CPU utilization time during P2P_2 scale monotonically with the model size, showing the intensified computational complexity of deep forward-pass evaluations on larger weight matrices. In the final phase (P3P_3), the cryptographic verification report is immutably anchored onto the consortium ledger via smart contracts, which demands negligible network traffic and constant-time transaction commitment delays. In conclusion, the performance overhead introduced by TrustAgentNet is heavily dominated by the off-chain verification phase (P2P_2), whereas the blockchain consensus pipeline imposes marginal resource costs. Furthermore, even if the consortium blockchain network scales up in large-scale production environments, potentially increasing endorsement and ordering delays, the total system overhead is projected to remain acceptable, which is fundamentally attributed to the structurally decoupled, asynchronous nature of our on-chain/off-chain integration design. Figure 6: Comparison in (a) latency, (b) CPU utilization time and (c) traffic volume between the proposed CoS and the baseline (w/o CoS) during the skillset submission process across different submitted models. Similarly, the dominant P2P_2 (V-Agent verification) phase is placed at the top of the stacking hierarchy to preserve the visual legibility of the remaining micro-overhead stages. VII-B3 Empirical Verification Performance on Procedural Skillsets To demonstrate the architectural generalizability and cross-domain viability of our verification pipeline, we extend our evaluation to non-AI-model procedural capabilities. It is worth noting that while mainstream security literature for agent tool-use often conducts massive-scale fuzzing specifically tailored for procedural ecosystems, this subsection serves as a focused feasibility study. Our primary objective is to verify whether the zero-trust auditing workflow can seamlessly adapt to procedural skillsets without architectural modifications. TABLE I: Performance Evaluation of the Proposed Verification Protocol on Procedural Skillsets Feature Category No. of Features Accuracy Precision Recall F1-Score Entry 214 96.20% 0.995 0.969 0.982 Capability 797 84.80% 0.971 0.880 0.923 Behavior 257 76.80% 0.509 0.487 0.498 Constraint 210 76.70% 0.797 0.910 0.850 Overall 1478 83.91% 0.869 0.829 0.848 To this end, we evaluate our verification protocol on 171171 procedural skills extracted from the ClawHub repository. To establish a ground-truth baseline, we manually annotate the features encompassing Entry, Capability, Behavior, and Constraint, and their cross-layer alignment classifications (i.e., match, miss, and uncertain) for each skill.As shown in Table I, the verification protocol achieves a robust overall consistency accuracy of 83.91%83.91\% and an aggregated F1-score of 0.8480.848 across a total of 14781478 features. Specifically, our protocol delivers high alignment precision for structural features including Entry and Capability. However, Behavior alignment remains the primary bottleneck, which is fundamentally constrained by the ambiguous natural-language behavioral definitions in skill manifests that lack clear programmatic verification criteria. Overall, this empirical insight confirms that while highly effective for static, well-defined features, augmenting the framework with a dynamic sandbox verification remains crucial to enhance runtime behavioral analysis of procedural skills. Fig. 7 illustrates the latency performance of the verification protocol by analyzing the execution breakdown of 10 representative procedural skillsets across the three phases. The empirical results indicate that the latency associated with the initial artifact decoupling phase is practically negligible (as depicted in the inset diagram). The overall latency is heavily dominated by the LLM-driven inference during the feature extraction and consistency analysis phases. Statistical evaluation indicates that this inference latency scales positively with the feature granularity, yielding a Pearson correlation coefficient r=0.811r=0.811 and R2=0.658R^2=0.658. On average, the protocol consumes approximately 5.45.4 seconds of processing time per feature, demonstrating a predictable linear dependency on the functional granularity of the skillset metadata. Figure 7: Fine-grained execution latency breakdown for 10 representative procedural skillsets across three operational phases, where the inset highlights the millisecond-level cost of the artifact decoupling phase. VII-B4 Case Study: Autonomous Self-Healing Against Multi-Dimensional Attacks Due to the inherent autonomy and sophisticated tool-use capabilities of AI agents, AgentNet faces novel and persistent attack surfaces at the UEs, which can lead to systematic performance degradation or complete failures, ultimately jeopardizing the reliability and integrity of the overall AgentNet systems. We now demonstrate how the proposed TrustAgentNet framework supports autonomous agent recovery when an agent’s locally deployed skillsets are compromised by leveraging the CoS and distributed skillset storage. In this implementation, a mission-critical agent is deployed on a UE, possessing a skillset dedicated to high-precision military-civilian vehicle image recognition, used for continuous analysis of surveillance video feeds. The experiment simulates diverse malicious attacks targeting the locally deployed skillset assets on the UE, including gradient inversion, model poisoning and data poisoning. Figure 8: An implementation of TrustAgentNet for autonomous self-healing and recovery after an agent at the UE is attacked: the skillset performance after the attack at the UE is shown in the left-bottom subplot, and the skillset performance after the autonomous recovery is shown in the right-bottom subplot. As illustrated in Fig. 8, the recovery workflow is orchestrated by a specialized S-Agent, which continuously monitors the operational integrity of the local skillsets. Crucially, the S-Agent operates in an attack-agnostic manner; rather than relying on specific attack signatures or intrusion detection rules, it solely evaluates the runtime functional KPIs of the active skillsets. The S-Agent promptly identifies a significant and sudden drop in the skillset’s performance accuracy (i.e., failure to correctly recognize vehicles) caused by any of the aforementioned attacks, and initiates an autonomous recovery workflow. Specifically, the S-Agent extracts the unique skillset ID field from the compromised local skillset’s metadata. It then submits a secure transaction to the CoS to query the complete, verified skillset tag associated with that ID. The CoS smart contract returns the verified tag, which contains the unique CID field of the trusted skillset artifact. The S-Agent utilizes this CID to query the decentralized Skillset Storage network, fetching the corresponding original model files, and then securely assembles the recovered model and deploys it to the UE, replacing the compromised local skillset. The autonomous recovery process demonstrates that TrustAgentNet can efficiently and promptly identify agent abnormality and restore full agent functionality following heterogeneous malicious attacks. This significantly enhances the security, resilience, and robustness of Agentic AI networking in vulnerable, real-world operational environments. VII-C Empirical Validation of the Three-way Tradeoff for CoC-oriented On-Chain Multi-Agent Collaboration To empirically validate the inherent trade-off between security level, skillset training, and resource consumption within the proposed TrustAgentNet, as analytically established in Section VI, we conduct an experiment on our prototype. This experiment involved 20 agents, each equipped with an identical skillset for hand-written digit recognition but possessing a unique non-i.i.d. dataset. For the CoC associated with this skillset, we preconfigured five peer nodes to endorse the participation of agents in the training process. The endorsement policy stipulated that for an agent to be granted Figure 9: Running time, real-measured CPU occupancy time, and traffic volume under different percentage of nodes for agreeing to the endorsement in the TrustAgentNet prototype. access, x%x\% of these peer nodes must agree. We further assume a linear correlation between the increase in x%x\% and the number of agents failing to meet the security certification requirements. Each agent that successfully joined the training process performs local model training for 5 epochs before submitting its updated parameters to the CoC. As depicted in Fig. 9, we conduct a comparative analysis of the real-measured running time, CPU occupancy time, and traffic volume under varying percentages of nodes required to agree on an endorsement. Specifically, running time is defined as the cumulative time duration for the agents to collaboratively train the model until a target accuracy is achieved. CPU occupancy time represents the aggregate time during which the CPUs of the blockchain servers are utilized. Lastly, traffic volume refers to the total volume of data transmitted across the blockchain servers. Fig. 9 clearly demonstrates that enhancing system security by demanding agreement from a higher percentage of peer nodes for endorsement leads to increased computational demands (CPU usage) on the blockchain infrastructure. This is a direct consequence of a greater number of nodes needing to validate transactions according to the endorsement policy. Furthermore, the communication overhead escalates substantially as all endorsing peers are required to broadcast their endorsement decisions and digital signatures across the blockchain network. Notably, the running time for collaboratively training the skillset to achieve target accuracies of 95%95\%, 96%96\%, and 97%97\% also increases with a greater number of required endorsing peer nodes, indicating that improvements in security come at the expense of the distributed training performance of the skillset. VIII Conclusion This paper proposes TrustAgentNet, a novel consortium-blockchain-based framework to foster zero-trust security in skillset supply chain and multi-agent collaboration for autonomous AgentNet systems. The framework establishes a hierarchical dual-tier paradigm, leveraging a global CoS for static lifecycle asset validation and transient, task-oriented CoCs for dynamic multi-agent interactions. Lifecycle governance protocols for skillsets on CoS are proposed, specifically leveraging an M-Agent for semantic-to-skillset retrieval and a V-Agent for cross-modal integrity verification. Furthermore, theoretical analysis further reveals the fundamental three-way trade-off among the security level, task performance error, and resource overhead, which is empirically validated. Extensive evaluations on a hardware prototype demonstrate that the zero-trust overhead is heavily dominated by off-chain inference, whereas the optimized blockchain layer imposes minimal computational and consensus costs. Ultimately, empirical results confirm that TrustAgentNet robustly intercepts adversarial attacks and can seamlessly generalize across both AI-model and procedural skillsets, offering a viable trust-by-verification paradigm for AgentNet systems. References [1] Y. Gao, Y. Xiao, B. Liu, X. Li, A. Hu, W. Li, Y. Li, G. Shi, and P. Zhang, “Skillsets on the Chain: A Blockchain-based Trustworthy Agentic AI Networking Framework,” in Proc. of IEEE GLOBECOM, Taipei, Taiwan, Dec. 2025. [2] Y. Xiao, G. Shi, and P. Zhang, “Towards agentic AI networking in 6G: A generative foundation model-as-agent approach,” IEEE Communications Magazine, vol. 63, no. 9, Sep. 2025. [3] Guardz Cyber Intelligence Research, “When AI Agents Go Wrong: Clawdbots’ Security Failures, Active Campaigns, and Defense Playbook,” Feb. 2026. [4] Google and Industry Partners, “Agent-to-Agent (A2A) Protocol Specification,” Apr. 2025. [5] Y. Liu, W. Wang, R. Feng et al., “Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale,” arXiv preprint arXiv:2601.10338, 2026. [6] Y. Wu, T.-L. Li, and H. Liu, “Behavioral Integrity Verification for AI Agent Skills,” arXiv preprint arXiv:2605.11770, 2026. [7] H. Sedjelmaci, K. Tourki, and N. Ansari, “Enabling 6G Security: The Synergy of Zero Trust Architecture and Artificial Intelligence,” IEEE Network, vol. 38, no. 3, p. 171–177, 2024. [8] X. Chen, W. Feng, N. Ge, and Y. Zhang, “Zero Trust Architecture for 6G Security,” IEEE Network, vol. 38, no. 4, p. 224–232, 2024. [9] Z. Durante et al., “Agent AI: Surveying the Horizons of Multimodal Interaction,” arXiv preprint arXiv:2401.03568, Jan. 2024. [10] D. B. Acharya, K. Kuppan, and B. Divya, “Agentic AI: Autonomous Intelligence for Complex Goals—A Comprehensive Survey,” IEEE Access, vol. 13, Jan. 2025. [11] J. Kraprayoon, Z. Williams, and R. Fayyaz, “AI Agent Governance: A Field Guide,” arXiv preprint arXiv:2505.21808, 2025. [12] Y. Wang, X. Wu, J. Farooq et al., “PROMPTGUARD: Zero Trust Prompting for Securing LLM-Driven O-RAN Control,” in Proc. NDSS, 2026. [13] Y. Ando, “Zero-Trust Architecture for MCP-Based AI Agents: A Unified CLI Approach,” TechRxiv, vol. 2026, no. 0220, 2026. [14] R. Campbell, “Zero Trust for AI Systems: A Reference Architecture and Assurance Framework,” Preprints, Feb. 2026. [15] X. Shen, Z. Chen, M. Backes, Y. Shen, and Y. Zhang, “”Do Anything Now”: Characterizing and Evaluating In-the-Wild Jailbreak Prompts on Large Language Models,” in Proc. ACM CCS, 2024, p. 1671–1685. [16] M. Andriushchenko, A. Souly, M. Dziemian et al., “AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents,” in Proc. ICLR, 2025. [17] H. Zhang, J. Huang, K. Mei et al., “Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-Based Agents,” in Proc. ICLR, 2025. [18] H. Luo, S. Dai, C. Ni et al., “AgentAuditor: Human-Level Safety and Security Evaluation for LLM Agents,” in Proc. NeurIPS, 2025. [19] Z. Ying, X. Yang, S. Wu et al., “Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw,” arXiv preprint arXiv:2603.12644, 2026. [20] Z. Li, J. Wu, X. Ling et al., “Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis,” arXiv preprint arXiv:2604.02837, 2026. [21] Y. Liu, Z. Chen, Y. Zhang et al., “Do Not Mention This to the User”: Detecting and Understanding Malicious Agent Skills,” arXiv preprint arXiv:2602.06547, 2026. [22] Y. Xie, Y. S. Yuan, W. Wang et al., “ToolSafety: A Comprehensive Dataset for Enhancing Safety in LLM-Based Agent Tool Invocations,” in Proc. EMNLP, Suzhou, China, Nov. 2025, p. 14 135–14 156. [23] Z. Duan, Y. Tian, Z. Yin et al., “SkillAttack: Automated Red Teaming of Agent Skills Through Attack Path Refinement,” arXiv preprint arXiv:2604.04989, 2026. [24] L. Shi, T. Wang, Z. Xiong et al., “Blockchain-Aided Decentralized Trust Management of Edge Computing: Toward Reliable Off-Chain and On-Chain Trust,” IEEE Network, vol. 38, no. 5, p. 182–188, Sep. 2024. [25] Y. Qu, M. P. Uddin, C. Gan et al., “Blockchain-Enabled Federated Learning: A Survey,” ACM Comput. Surv., vol. 55, no. 4, Nov. 2022. [26] C. Ma, J. Li, L. Shi et al., “When Federated Learning Meets Blockchain: A New Distributed Learning Paradigm,” IEEE Computational Intelligence Magazine, vol. 17, no. 3, p. 26–33, Jul. 2022. [27] R. S. Antunes, C. André da Costa et al., “Federated Learning for Healthcare: Systematic Review and Architecture Proposal,” ACM Trans. Intell. Syst. Technol., vol. 13, no. 4, May 2022. [28] M. Xu, Z. Zou, Y. Cheng et al., “SPDL: A Blockchain-Enabled Secure and Privacy-Preserving Decentralized Learning System,” IEEE Trans. Comput., vol. 72, no. 2, p. 548–558, Apr. 2023. [29] Y. Lu, X. Huang et al., “Blockchain and Federated Learning for Privacy-Preserved Data Sharing in Industrial IoT,” IEEE Trans. Ind. Inform., vol. 16, no. 6, p. 4177–4186, Sep. 2020. [30] Q. Wang, S. Chen, and M. Wu, “Incentive-Aware Blockchain-Assisted Intelligent Edge Caching and Computation Offloading for IoT,” Engineering, vol. 31, p. 127–138, Dec. 2023. [31] W. Zhu, L. Shi, K. Wei, Z. Mei, Z. Wang, J. Wang, and J. Li, “When MoE Meets Blockchain: A Trustworthy Distributed Framework of Large Models,” arXiv preprint arXiv:2509.12141, Sep. 2025. [32] S. Guo, X. A. Hu, S. Guo et al., “Blockchain Meets Edge Computing: A Distributed and Trusted Authentication System,” IEEE Trans. Ind. Inform., vol. 16, no. 3, p. 1972–1983, Aug. 2020. [33] M. Poongodi, S. Bourouis, A. N. Ahmed et al., “A Novel Secured Multi-Access Edge Computing Based VANET with Neuro Fuzzy Systems Based Blockchain Framework,” Comput. Commun., vol. 192, p. 48–56, Aug. 2022. [34] H. Xu, P. V. Klaine, O. Onireti et al., “Blockchain-Enabled Resource Management and Sharing for 6G Communications,” Digital Communications and Networks, vol. 6, no. 3, p. 261–269, Aug. 2020. [35] Y. Dai, D. Xu, S. Maharjan et al., “Blockchain and Deep Reinforcement Learning Empowered Intelligent 5G Beyond,” IEEE Network, vol. 33, no. 3, p. 10–17, May 2019. [36] J. Wang, H. Du, D. Niyato et al., “Toward Scalable Generative AI via Mixture of Experts in Mobile Edge Networks,” IEEE Wireless Commun., vol. 32, no. 1, p. 142–149, Oct. 2025. [37] N. Shazeer, A. Mirhoseini, K. Maziarz, A. Davis, Q. V. Le, G. E. Hinton, and J. Dean, “Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layer,” in Proc. ICLR, Toulon, France, Apr. 2017. [38] Y. Xiao, X. Li, H. Zhou, Y. Li, Y. Gao, G. Shi, P. Zhang, and M. Krunz, “SANet: A Semantic-aware Agentic AI Networking Framework for Cross-layer Optimization in 6G,” IEEE Trans. Mobile Comput., p. 1–18, 2026. [39] Z. Ling, D. Chen, L. Yao et al., “On the Convergence of Zeroth-Order Federated Tuning for Large Language Models,” in Proc. ACM SIGKDD, 2024, p. 1827–1838. [40] H.-H. Chang, Y. Song, T. T. Doan et al., “Federated Multi-Agent Deep Reinforcement Learning (Fed-MADRL) for Dynamic Spectrum Access,” IEEE Trans. Wireless Commun., vol. 22, no. 8, p. 5337–5348, 2023. [41] A. Bukharin, Y. Li, Y. Yu et al., “Robust Multi-Agent Reinforcement Learning via Adversarial Regularization: Theoretical Foundation and Stable Algorithms,” in Proc. NeurIPS, vol. 36, 2023, p. 68 121–68 133. [42] J. Zhang, T. He, S. Sra et al., “Why Gradient Clipping Accelerates Training: A Theoretical Justification for Adaptivity,” in Proc. ICLR, 2019. [43] srsRAN, “Your Own Mobile Network,” Online available at srsRAN website, 2019. [44] E. Androulaki et al., “Hyperledger Fabric: A Distributed Operating System for Permissioned Blockchains,” in ACM EuroSys, Porto, Portugal, Apr. 2018, p. 1–15. [45] X. Li, K. Huang, W. Yang et al., “On the Convergence of FedAvg on Non-IID Data,” in Proc. ICLR, Addis Ababa, Ethiopia, Apr. 2020. Yayu Gao (Member, IEEE) is an Associate Professor in the School of Electronic Information and Communications at the Huazhong University of Science and Technology (HUST), Wuhan, China. Her research interests include next-generation wireless communication networks, agentic AI communication networking, edge intelligence, and artificial intelligence for networking. Yong Xiao (Senior Member, IEEE) is a professor in the School of Electronic Information and Communications at the Huazhong University of Science and Technology (HUST), Wuhan, China. He is also with Peng Cheng Laboratory, Shenzhen, China, and Pazhou Laboratory (Huangpu), Guangzhou, China. He is the associate group leader of the network intelligence group of IMT-2030 (6G promoting group). His research interests include AI/ML, game theory, distributed optimization, and their applications in agentic AI networking and semantic communications. Hao Hu is currently pursuing the postgraduate degree with the School of Mechanical Engineering and Electronic Information, China University of Geosciences, Wuhan, China. His research interests include trustworthy intelligence, agentic AI networking, and zero-trust systems. Xubo Li (Student Member, IEEE) received his B.S. degree in biomedical engineering from Huazhong University of Science and Technology, Wuhan, China in 2023. He is currently pursuing his Ph.D. in the School of Electronic Information and Communications at Huazhong University of Science and Technology, Wuhan, China. His research interests include machine learning, network intelligence, and next-generation wireless communication technology. Zhiwei Liu received the bachelor’s degree from Huazhong University of Science and Technology, Wuhan, China. He is currently pursuing a postgraduate degree with the School of Electronic Information and Communication, Huazhong University of Science and Technology, Wuhan. His research interests include trustworthy intelligence, agentic AI networking. Yingyu Li (Member, IEEE) is an Associate Professor at the School of Mechanical Engineering and Electronic Information, China University of Geosciences (Wuhan). Her research interests include machine learning and artificial intelligence for next-generation wireless networks, federated edge intelligence, green/low-carbon communication networks, distributed optimization, semantic communications, and intelligent Internet of Things. Guangming Shi (Fellow, IEEE) is the Vice Dean of Peng Cheng Laboratory and a Professor with the School of Artificial Intelligence, Xidian University. He is an IEEE Fellow, the chair of IEEE CASS Xi’an Chapter, a senior member of ACM and CCF, Fellow of the Chinese Institute of Electronics, and Fellow of IET. His research interests include Artificial Intelligence, Semantic Communications, and Human-Computer Interaction. Ping Zhang (Fellow, IEEE) is a professor in the School of Information and Communication Engineering at the Beijing University of Posts and Telecommunications. He is a member of the National Academy of Engineering of China. He is currently the director of the State Key Laboratory of Networking and Switching Technology, a member of IMT-2020 (5G) Experts Panel, and a member of the Experts Panel for China’s 6G development. His research is in the broad area of wireless communications with emphasis on novel coding design and model-driven approaches for semantic communications. Appendix A Proofs of Theorem 1 Before introducing the performance analysis for the proposed TrustAgentNet under federated global model traing framework, we first present the upper bound for participating agents. Let w¯ℳi,t=∑ai∈ℳipi,kwk,t w_ M_i,t= _a_i∈ M_ip_i,kw_k,t denote the global model at the ttth round of coordination. In [45], it has been proved that the following upper bound hold for the MiM_i agents that participates in the collaboration through authentication. Lemma 1 Suppose assumptions 1-4 hold, we have (‖w¯ℳi,t−wℳi∗‖2)≤Δ, (\| w_ M_i,t-w_ M_i^*\|^2)≤ , (16) where Δ is denoted by Δ= = 4μ2(γ+Et)(∑ak∈ℛipi,k2σk2Dk+8E2G2+Aℳi+6LCℳi∗(Fi)). 4μ^2(γ+Et) ( _a_k _i\! p_i,k^2 _k^2D_k\!+\!8E^2G^2\!+\!A_M_i\!+\!6LC_M_i^*(F_i) ). Decomposing the term ‖w¯ℳi,t−wℳi∗‖2\| w_ M_i,t-w_ M_i^*\|^2, we have ‖w¯ℳi,t−wℳi∗‖2−‖w¯ℳi,t−wℛi∗‖2 \| w_ M_i,t-w_ M_i^*\|^2-E\| w_ M_i,t-w_ R_i^*\|^2 = =\ 2⟨w¯ℳi,t−wℳi∗+wℳi∗−wℛi∗⟩+‖wℛi∗−wℳi∗‖2 2 w_ M_i,t-w_ M_i^*+w_ M_i^*-w_ R_i^* +\|w_ R_i^*-w_ M_i^*\|^2 = =\ 2⟨w¯ℳi,t−wℳi∗⟩−‖wℛi∗−wℳi∗‖2 2 w_ M_i,t-w_ M_i^* -\|w_ R_i^*-w_ M_i^*\|^2 ≥ ≥\ −‖w¯ℳi,t−wℳi∗‖2−2‖wℛi∗−wℳi∗‖2, -E\| w_ M_i,t-w_ M_i^*\|^2-2\|w_ R_i^*-w_ M_i^*\|^2, (17) where the last inequality comes from the fact that 2ab≥−a2−b22ab≥-a^2-b^2. Combing Lemma 1 and equation (17), we have ‖w¯ℳi,t−wℛi∗‖2≤2Δ+2‖wℛi∗−wℳi∗‖2.E\| w_ M_i,t-w_ R_i^*\|^2≤ 2 +2\|w_ R_i^*-w_ M_i^*\|^2. (18) Then, by leveraging the L-smooth property of the loss function, we can obtain ℰsi _s_i ≤L2‖w¯ℳi,t−wℛi∗‖2 ≤ L2E\| w_ M_i,t-w_ R_i^*\|^2 (19) ≤LΔ+L‖wℛi∗−wℳi∗‖2. ≤ L +L\|w_ R_i^*-w_ M_i^*\|^2. This concludes the proof. Appendix B Proofs of Theorem 2 To establish the performance analysis of our proposed TrustAgentNet under multi-agent model partitioning and sharing framework, we first prove the asymptotic stability of the framework in Lemma 2. Building upon this, we then derive the upper bound of the expected gradient norm to characterize the convergence behavior toward a stationary point. Lemma 2 Suppose Assumption 1 holds. Consider the sequence i,tt=1T\ _i,t\_t=1^T generated by static weighting-based solution. It holds that 1T∑t=0T−1[‖∑ak∈ℳipi,k∇Fi,k(i,t)‖2]≤ 1T _t=0^T-1E[\| _a_k∈ M_ip_i,k∇ F_i,k( _i,t)\|^2]≤ 2(2β−Lβ2)T(CI+Cℳi(Fi)). 2(2β-Lβ^2)T(C_I+C_ M_i(F_i)). (20) Proof: We first establish that, for any given static weight pi,kp_i,k for ak∈ℳia_k∈ M_i, there exists an upper bound for the gap between the global losses in two consecutive iteration rounds. By leveraging the L-smoothness of Fi,k(⋅)F_i,k(·), we have ∑ak∈ℳipi,k(Fi,k(i,t+1)−Fi,k(i,t))≤ _a_k∈ M_ip_i,k(F_i,k( _i,t+1)-F_i,k( _i,t))≤ ⟨∑ak∈ℳipi,k∇Fi,k(i,t),i,t+1−i,t⟩+L2‖i,t+1−i,t‖2 _a_k∈ M_ip_i,k∇ F_i,k( _i,t), _i,t+1- _i,t + L2\| _i,t+1- _i,t\|^2 =−βt⟨∑ak∈ℳipi,k∇Fi,k(i,t),∑ak∈ℳipi,k∇Fi,k(i,t)⟩ =- _t _a_k∈ M_ip_i,k∇ F_i,k( _i,t), _a_k∈ M_ip_i,k∇ F_i,k( _i,t) +L2βt2‖∑ak∈ℳipi,k∇Fi,k(i,t)‖2. + L2 _t^2\| _a_k∈ M_ip_i,k∇ F_i,k( _i,t)\|^2. (21) Taking expectation over the random sample during each iteration on both sides of the above inequality, and setting the step size L2≥βt=β≥0 L2≥ _t=β≥ 0, we have [∑ak∈ℳipi,k(Fi,k(i,t+1)−Fi,k(i,t))]≤ [ _a_k∈ M_ip_i,k(F_i,k( _i,t+1)-F_i,k( _i,t))]≤ −β[‖∑ak∈ℳipi,k∇Fi,k(i,t)‖2] - [\| _a_k∈ M_ip_i,k∇ F_i,k( _i,t)\|^2] +Lg2β2[‖∑ak∈ℳipi,k∇Fi,k(i,t)‖2]. + L_g2β^2E[\| _a_k∈ M_ip_i,k∇ F_i,k( _i,t)\|^2]. (22) Summing the the above inequality across all coordination rounds t=0t=0 to T−1T-1 and rearranging terms, we obtain 1T∑t=0T−1[‖∑ak∈ℳipi,k∇Fi,k(i,t)‖2]≤ 1T _t=0^T-1E[\| _a_k∈ M_ip_i,k∇ F_i,k( _i,t)\|^2]≤ 22β−Lβ2⋅1T[∑ak∈ℳipi,k(Fi,k(i,0)−Fi,k(ℛi,T))] 22β-Lβ^2· 1T\E[ _a_k∈ M_ip_i,k(F_i,k( _i,0)-F_i,k( _ R_i,T))] +[∑ak∈ℳipi,k(Fi,k(ℛi,T−Fi,k(ℳi,T))] +E[ _a_k∈ M_ip_i,k(F_i,k( _ R_i,T-F_i,k( _ M_i,T))]\ ≤2(2β−Lβ2)T(CI+Cℳi(Fi)). ≤ 2(2β-Lβ^2)T(C_I+C_ M_i(F_i)). (23) This concludes the proof. ∎ Based on Lemma 2, by the Jensen’s inequality and the convexity of the square function, as well as the sub-additivity of the square root function, it holds that 1T∑t=0T−1[‖∑ak∈ℳipi,k∇Fi,k(i,t)‖] 1T _t=0^T-1E[\| _a_k∈ M_ip_i,k∇ F_i,k( _i,t)\|] ≤(1T∑t=0T−1[‖∑ak∈ℳipi,k∇Fi,k(i,t)‖2])12 ≤ ( 1T _t=0^T-1E[\| _a_k∈ M_ip_i,k∇ F_i,k( _i,t)\|^2] ) 12 ≤2(CI+Cℳi(Fi))(2β−Lβ2)T. ≤ 2(C_I+C_ M_i(F_i))(2β-Lβ^2)T. (24) This completes the proof.