Cryptography for verifiable agent systems

What an autonomous agent is, deterministic vs probabilistic agents, identity and authentication, authorization and action control, trust boundaries, and multi-agent threat models.

• What is an autonomous agent→
• Deterministic vs probabilistic agents→
• Cognitive architectures and BDI→
• Agent identity and authentication→
• Authorization and action control→
• Trust boundaries and threat models→

Hash functions, digital signatures (Ed25519 and ECDSA), message integrity, nonces and replay prevention, Merkle trees, hash chains and transparency — each with its mathematical basis and its concrete use in agent systems.

• Hash functions→
• Digital signatures→
• Public-key cryptography→
• Ed25519 vs ECDSA→
• Message integrity, nonces & replay→
• Merkle trees→
• Hash chains & transparency logs→

Principal and delegate, capability-based security, scope attenuation, delegation chains, signed short-lived credentials, cross-domain authorization and revocation — comparing macaroons, Biscuit and UCAN.

• Principals, delegates and capabilities→
• Scope attenuation→
• Delegation chains→
• Signed short-lived credentials→
• Cross-domain authorization→
• Revocation & independent verification→
• Macaroons, Biscuit and UCAN→

Statements and witnesses; completeness, soundness and zero-knowledge; arithmetic circuits and R1CS; commitments; trusted setup; and the trade-offs between Groth16, PLONK, STARKs and folding (Nova).

• What is a zero-knowledge proof?→
• Statement, witness, and the properties→
• Arithmetic circuits and R1CS→
• Commitments and setup→
• Proving systems compared→
• Recursion, folding, and Nova→

Detailed, honest studies of real research systems, grouped by paper: evidence-first offensive security (the promotion membrane), epistemic confidence calibration and cryptographic provenance for agent data, zero-knowledge delegation and coercion-deniable privacy pools, holonic neuro-symbolic multi-agent architectures, and the analysis of autonomous adversaries. Each study covers the problem, threat model, mechanism, a worked example, measured results and open problems — with explicit proven-vs-tested-vs-measured labelling. A valid proof or seal is never a proof that an agent’s decision was correct or safe.

Insecure delegation, confused deputy, tool compromise, prompt injection, agent impersonation, trust-boundary violations and collusion — and exactly where cryptography helps, and where it does not.

• The multi-agent threat landscape→
• Insecure delegation & the confused deputy across agents→
• Tool and supply-chain compromise→
• Prompt injection across agents→
• Agent impersonation & Sybil→
• Agent collusion & emergent risk→
• Where cryptography helps, and where it does not→

Hands-on, synthetic exercises: sign and verify a message, build a delegation chain, verify scopes, construct a hash chain and a Merkle tree, prevent replay, and a first look at a zero-knowledge circuit.

• Lab — sign and verify a message (Ed25519)→
• Lab — build a delegation chain→
• Lab — verify scope attenuation→
• Lab — build a hash-chain audit log→
• Lab — Merkle tree inclusion proof→
• Lab — prevent replay→
• Lab — a first zero-knowledge circuit (conceptual)→

A deep theoretical foundation on Ethereum’s execution layer and how zero-knowledge lives on-chain: the EVM execution model, gas and opcodes, contract storage layout and collisions, delegatecall with the proxy and Diamond (EIP-2535) upgrade patterns, external calls and reentrancy, and on-chain cryptography and zero-knowledge verification. It closes with two honest case studies of production EVM systems — coercion-resistant financial privacy, and zero-knowledge behavioral AML verification against autonomous adversaries — with explicit proven-vs-tested-vs-measured labelling.

• The EVM execution model→
• Gas, opcodes and the cost model→
• Contract storage layout and collisions→
• delegatecall, proxies and the Diamond (EIP-2535) pattern→
• External calls and reentrancy→
• On-chain cryptography and zero-knowledge verification→
• Case study: coercion-resistant financial privacy on the EVM→
• Case study: zero-knowledge behavioral AML verification→

What actually runs under an agent and why it behaves as it does: the Transformer and the residual stream, modern architectures (mixture-of-experts, state-space models), reasoning and test-time compute, verifiers, reward models and metacognition, retrieval, RAG and agentic RAG with computational memory, neuro-symbolic reasoning and knowledge representation, and uncertainty, calibration and the honest limits of language models.

• The Transformer and the residual stream→
• Modern model architectures: MoE and state-space models→
• Reasoning and test-time compute→
• Verifiers, reward models and metacognition→
• Retrieval, RAG and computational memory→
• Neuro-symbolic reasoning and knowledge representation→
• Uncertainty, calibration and the limits of LLMs→

How agents are built, from first principles to production: formal models of an agent and a taxonomy of architectures; reactive, deliberative and BDI agents; the LLM as a component (ReAct, Plan-and-Execute, reflection loops); memory and retrieval; multi-agent systems — communication, coordination and holonic organization; and orchestration, fault tolerance, patterns, antipatterns and the discipline of knowing when NOT to use an agent.

• Formal models of an agent and a taxonomy of architectures→
• Reactive, deliberative and BDI agents→
• The LLM as a component: ReAct→
• Plan-and-Execute and reflection loops→
• Memory and retrieval in agents→
• Multi-agent systems: communication, coordination and holonic organization→
• Orchestration, fault tolerance and when NOT to use an agent→

Authority, threats, controls and guarantees for agents that act on real systems: the agent threat model and its tactic taxonomy; the principle that reasoning is not authorizing; evidence, provenance and corroboration; prompt injection, poisoning and the lethal trifecta; identity, delegation, privilege escalation, access control and information-flow control; formal and runtime verification with verifiers, judges and consensus; and red teaming, governance and the tamper-evident, verifiable decision log.

• The agent threat model and its tactic taxonomy→
• Reasoning is not authorizing→
• The epistemology of agentic systems→
• Evidence, provenance and corroboration→
• Identity, delegation, access control and information-flow control→
• Verification: formal, runtime and consensus→
• Red teaming, governance and the verifiable decision log→

A deeper, security-first pass over the machinery behind ROOTRAVEN’s on-chain reasoning: commitment schemes in detail (Pedersen, KZG, IPA) and exactly what each binds and hides; the polynomial-IOP-plus-commitment architecture shared by PLONK, Halo2, STARKs and folding, at a conceptual and verification-cost level; the nullifier, Merkle-membership and privacy-pool pattern with its concrete security pitfalls; and — most RootRaven-relevant — ZK circuit security and auditing: under-constrained circuits, soundness-vs-completeness, weak Fiat–Shamir, trusted-setup risk and nullifier reuse, holding throughout that a valid proof attests to a statement under its assumptions, never that a circuit, contract or decision is correct or safe. Grounded in an external educational reference (Banco ZK, Vols. II–III, 2025).

• Commitment schemes in depth: Pedersen, KZG and IPA→
• Polynomial IOPs and modern proving systems→
• Nullifiers, Merkle membership and the privacy-pool pattern→
• ZK circuit security and auditing: under-constrained circuits and soundness→

The identity and privacy side of the Web3 stack, read with the same honesty as the rest of the academy: anonymous credentials and selective disclosure (BBS+-style, predicate proofs, unlinkability); Semaphore, the anonymous-membership-and-signalling primitive; non-membership proofs and the compliance patterns built on them (proof-of-innocence, association sets, privacy-preserving screening) with their contested, set-relative meaning; ring signatures and stealth addresses as non-SNARK privacy primitives; and decentralized identity with private soulbound tokens on the privacy/compliance spectrum. Throughout, a valid proof attests to control, membership or signed possession under stated assumptions — never to the truth of a claim or the wisdom of trusting its holder. Grounded in an external educational reference (Banco ZK, Vols. II–III, 2025).

• Anonymous credentials and selective disclosure→
• Semaphore: anonymous membership and signalling→
• Non-membership proofs, compliance and proof-of-innocence→
• Ring signatures and stealth addresses→
• Decentralized identity, ZK and private soulbound tokens→