Securing distributed agent state against Byzantine actors

Most current multi-agent and distributed LLM frameworks rely on Last-Write-Wins or standard databases for shared context. This creates a serious vulnerability: if even one node is compromised or acts maliciously (for example through equivocation), it can fork the shared state across the cluster with no cryptographic proof of compromise and no reliable way to isolate the actor.

To address this, I’ve been exploring an architecture that separates concerns into two cryptographically verifiable layers:

• A Data Lattice using CRDTs to guarantee exact state convergence across honest nodes without requiring consensus.
• An Evidence Lattice using grow-only sets of self-authenticating Ed25519 proofs. Any peer can mathematically detect and permanently evict an equivocating identity.

Because standard robust selectors (such as multi-Krum) are discontinuous, even tiny floating-point variations can change the output. This forces the use of deterministic Q16.16 fixed-point arithmetic to create a reliable circuit breaker against geometric manipulation.

The design follows a strict zero-trust model:
The core CRDT engine, cryptographic validation, and Q16.16 math run entirely locally on the user’s system via a compiled Rust binary. The cloud relay is strictly stateless — it only routes encrypted byte-deltas and sees nothing but payloads and API keys. It cannot read, modify, or store agent state. The core Rust engine is maintained in a private repository.

This work builds on earlier results showing that standard neural network operators violate CRDT properties, and extends it to the problem of robust, coordinator-free aggregation.

A hosted testbed is available with a free base allowance of 25,000 operations, with additional capacity (50k–100k+) available on request for larger-scale adversarial and multi-node testing.

I’m particularly interested in feedback from researchers doing red teaming on distributed LLM infrastructure. Does this data + evidence lattice separation hold up under realistic adversarial conditions, or are there simpler bypasses?

Note: This focuses on protecting the infrastructure synchronization layer against Byzantine actors. It does not prevent individual LLMs from hallucinating — it ensures the cluster cannot silently fork its shared state.

References:

• ACFA Paper: https://arxiv.org/abs/2607.10305
• Neural operators and CRDT incompatibility: https://arxiv.org/abs/2605.19373
• Architecture & testbed: memora.optitransfer.ch
• Implementation: github.com/mgillr/memora-swarm