PRIMUS: Identity, Governance, and Verification for Multi-Agent Federations
Sasank Annapureddy, Anjaneya Prasad Thamatani
cs.AI
Quick verdict
Couples BLS-signed identity and kill thresholds to multi-agent governance and pilots verifiers as fitness; candid self-reporting, but key artifacts withheld.
Summary
PRIMUS extends the PRIMA multi-agent framework from honest agents to adversarial federations, and separately asks whether verification output can steer search. Part I couples prime-factorization agent identity with BLS12-381 aggregate signatures (PIAC), derives a safe-kill threshold for EWMA deviation scores that cuts false-positive terminations from 80.2% to 0.0000 under 10% channel noise (Theorem 4.1), gives a closed-form crossover γ*≈9f below which singleton governance beats a 3f+1 quorum (Theorem 5.1, flat across n=50–10,000), and adds VRF succession with leases and fencing (0.0 versus 794.5 split-brain rounds). Part II converts a binary artifact-fidelity verifier into a graded 12-check fitness signal, piloted on binary covering codes (12,3). Calibration correlation against injected faults (ρ=0.676 deterministic, 0.819 full) falls to 0.158/0.406 against real LLM candidates — a measured same-designer confound. Graded pre-filtering beats a random control and, narrowly (CI [0.020, 0.220], n=5 pools), a binary gate on wasted-oracle fraction. Under adversarial optimization the score saturated at 1.0 after one honest call, so the anti-gaming evidence is null. No covering-code record resulted (best 32 versus incumbent 30). Main limitations: the checklist implementation is withheld under 'controlled release', samples are small, validation is simulation-only, and there is no deployment.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 2
● low 2
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Coupling prime-power identity with BLS12-381 aggregate signatures (PIAC) makes participation unforgeable under co-CDH with mandatory PoP, while the token factorization still indexes the public-key set that verifies the aggregate signature.
- Theorem 4.1's noise-calibrated kill threshold (θ ≥ ε/(1−λ) + √(ln(1/δ)/(2(1−λ²))), feasible only if θ < 1/(1−λ)) eliminates measured false-positive terminations — 80.2% with the naive θ=3.0 versus 0.0000 at ε=0.10 — in 30×500×200-agent simulations.
- A closed-form crossover γ*=(3f+1)²c_msg/(f·P_down·c_dmg)≈9f tells when singleton Warden governance is economically correct versus a 3f+1 Byzantine quorum, empirically flat across n=50–10,000.
- A binary artifact-fidelity verifier can be converted into a graded fitness signal at computable cost, but its calibration correlation against designer-injected faults (ρ=0.676/0.819) overstates real-candidate correlation (0.158/0.406) — a measured same-designer confound of roughly 4× on the deterministic score.
- Fidelity-only fitness ceilings search at faithfully reported, unambitious answers: all 380 valid adversarial artifacts stayed at the greedy |C|=32 against an incumbent of 30, and no covering-code record resulted.
Strengths
Evidence-tagging and preregistration discipline
Every numeric claim carries [VERIFIED]/[PARTIAL]/[NULL]/[ANALYTIC]/[OPEN]; §11 froze preregistrations and file manifests before scoring; the oracle harness sha256 was verified unchanged at every checkpoint; a prose-vs-data transcription error in the A′-vs-D CI is caught and corrected in §11.2.
Generalizable measured findings
Finding (a) quantifies the same-designer confound (ρ 0.676→0.158 deterministic, 0.819→0.406 full, ~4× on the deterministic score); finding (b) derives break-even exact-oracle prices ($2.69/$2.35/$6.27 per call vs random/no-filter/binary); finding (c) shows fidelity-only fitness ceilings search at the greedy answer (380/380 valid adversarial artifacts at |C|=32 vs incumbent 30).
Honest scope-setting
Internal numerical consistency
Weaknesses
Controlled release undermines independent verifiability
Fragile headline comparison in Part II
Uninformative adversarial arm by design
Simulation-only validation and citation drift in Part I
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
PRIMUS is two papers under one cover. Part I hardens PRIMA's prime-power agent identity (a = p^k; consensus token T = ∏p_j^e_j) for adversarial federations: PIAC binds the token's factorization to a BLS12-381 aggregate signature so "who participated for epoch ε" becomes cryptographically checkable (UNF-PART under co-CDH with mandatory PoP; information-theoretic contamination detection via residue R≠1). Theorem 4.1 derives θ ≥ ε/(1−λ) + √(ln(1/δ)/(2(1−λ²))) with feasibility θ < 1/(1−λ); at λ=0.9, δ=1e-5 the reported θmin values (6.00/6.50/7.50 for ε=0.05/0.10/0.20) reproduce exactly from the closed form, and measured false-kills are 0.0000/0.0000/0.0002 against 0.104/0.802/1.000 for the naive θ=3.0 — the abstract's "80% → 0.00% under 10% noise" is the middle row. Theorem 5.1 gives γ* = (3f+1)²c_msg/(f·P_down·c_dmg) ≈ 9f, agreeing with simulation to 0.89–1.16× over f∈{1,3,10,20}, flat across n=50–10,000 (≤0.57% spread). Fencing yields 0.0 split-brain rounds vs 794.5 without. Part II asks whether PRIMA's binary artifact-fidelity verdict can become a graded fitness signal, piloted on covering codes (12,3).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is PRIMUS?
PRIMUS is a proposed governance layer for federations of AI agents that combines prime-factorization-based agent identities with BLS aggregate signatures (PIAC certificates), a statistically calibrated threshold for safely removing misbehaving agents, and VRF-based leader succession protected by leases and fencing. It extends an earlier system called PRIMA, which assumed honest agents.
Was PRIMUS deployed or tested on real systems?
No. Part I results come from simulations (e.g., 30 trials × 500 rounds × 200 agents for the kill-threshold experiments). Part II is a small pilot costing $164.78 on the toy problem of binary covering codes using real LLM calls. The authors explicitly state there is no deployment data.
What is the 'same-designer confound' this paper reports?
The paper's checklist verifier correlated strongly with the number of faults the authors themselves injected (ρ=0.676–0.819) but weakly with the true quality of independently LLM-generated candidates (ρ=0.158–0.406). Because the fault injector was written by the same team that designed the checks, injected faults resembled what the checks look for — so fault-injection calibration overstated real-world performance by roughly 4× for the deterministic score in this pilot.
Did PRIMUS beat the binary covering code record?
No — the paper states this up front. The best valid code found in any run had size 32, versus a verified incumbent of 30 and a known census lower bound of 28 for the (12,3) instance. The search never improved on the existing record, which the authors report as an honest negative.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Tables were flattened to inline text in the extraction (e.g., the ε/θmin table and the Step-3 arm comparison), so column alignment was reconstructed from the prose sequence; all values were present and unambiguous.
- The abstract supplied in the metadata ends mid-sentence, but the full embedded paper text contains the complete abstract and continues through the references and Appendix D; nothing at the true end of the text is cut off.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.