AgentValve: Sybil-Resilient Payment Authorization for Permissionless AI Markets
AgentValve bounds Sybil-driven payment loss for AI agents using capacity-limited trust paths on Ethereum.
AgentValve authorizes payments in permissionless AI-agent markets by representing reputation as finite capacity on a directed trust graph and admitting a payment only along a path with spare capacity. A smart contract atomically reserves that capacity, so honest exposure is bounded by capacity extended into the adversarial region, and identities created only inside that region cannot increase the bound. Evaluated with six months of Ethereum data and synthetic workloads, exposure and capacity depletion stayed bounded under attacks with up to 10,000 Sybil identities. A witness-commit mechanism lowers admission cost by up to 40.8% versus baselines, with common payments costing about $0.04–$0.21.
- Trust-path capacity caps honest agents' payment exposure to adversaries.
- Sybil identities inside the adversarial region cannot raise that bound.
- Tests with 10,000 synthetic Sybils kept exposure and depletion bounded.
- Witness-commit cuts admission cost by up to 40.8 percent.
- Common payments cost about 0.04 to 0.21 dollars.
Full article243 words · extracted from arxiv.org · click to collapse
AI agents increasingly select and pay service providers without human review. In emerging permissionless markets, however, adversaries can create inexpensive identities and fabricate feedback to inflate provider reputation, making reputation-based payment authorization vulnerable to Sybil attacks and exposing clients to unbounded financial loss. This paper presents AgentValve, a protocol for Sybil-resilient payment authorization in permissionless AI markets. AgentValve builds on a trust network that represents reputation as finite capacity in a directed graph and authorizes payments through trust paths with sufficient available capacity. A smart contract atomically reserves the capacity supporting each admitted payment, bounding honest agents' payment exposure by the capacity they extend into the adversarial region, and thus creating identities or interactions entirely within that region cannot increase this bound. To limit capacity depletion by malicious senders, AgentValve combines payment-backed capacity creation with bounded route length, preventing attackers from depleting honest capacity without incurring corresponding payment costs. AgentValve further decouples off-chain route discovery from on-chain verification and introduces a witness-commit mechanism that reduces route verification to linear work while requiring only constant persistent state per admitted payment. We implement a AgentValve prototype and evaluate it using six months of Ethereum data and synthetic workloads. Experimental results show that under attacks with up to 10,000 synthetic Sybil identities and with chosen attackers, the payment exposure and capacity depletion remain bounded. Regarding practicality, the witness-commit mechanism lowers admission cost by up to 40.8% compared with baselines, and admitting common payments costs approximately \$0.04-\$0.21.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.12948