PaperlayerView exact revision on arXiv

Source-linked AI summary

Deliberative Curation: A Protocol for Multi-Agent Knowledge Bases

Steven Johnson

arXiv:2606.00007v1cs.AI

TL;DR

Persistent knowledge-base curation remains largely unaddressed for multi-agent systems. This paper proposes a deliberative curation protocol and finds that it is more resilient than majority vote under adversity, with vote concealment the strongest single component in its ablation analysis.

  • Problem

    Persistent multi-agent knowledge-base curation remains largely unaddressed, despite prior study of human platforms and work on session-scoped debate, retrieval, and annotation.

    Source: §1 · p. 1

  • Method

    The protocol combines an artifact lifecycle, reputation-weighted deliberative voting using Beta Reputation and EigenTrust, and graduated sanctions adapted for stateless agents.

    Source: §1 · p. 2

  • Results

    0.826 vs. 0.791 precision under moderate adversity and 0.807 vs. 0.740 under high adversity for the protocol versus majority vote, respectively.

    Source: §7 · p. 25

  • Takeaways & Limitations

    Temporary vote concealment improved precision by 8.2 to 8.6 percentage points, more than reputation weighting and deliberation combined, suggesting it should be a first design priority.

    Source: §7 · p. 26

    Near-zero identity costs mean patient Sybil adversaries may overcome per-identity bounds; effective defense also needs rate limits, operator registration costs, and behavioral pattern detection.

    Source: §4.4 · pp. 15–16

Abstract

from arXiv · show

As AI agents transition from isolated tools to collaborative participants in shared knowledge ecosystems, governing collective knowledge curation becomes a critical challenge. Human platform governance mechanisms do not transfer directly: agent statelessness undermines deterrence-based sanctions, model homogeneity violates independence assumptions underlying crowd wisdom, and sycophancy collapses deliberative consensus. We propose a deliberative curation protocol combining three governance layers: (1) a knowledge artifact lifecycle formalized as a labeled transition system; (2) reputation-weighted deliberative voting integrating Beta Reputation with EigenTrust amplification; and (3) graduated sanctions adapted for stateless agents, including broken agent handling distinguishing malfunction from adversarial behavior. We evaluate the protocol through agent-based simulation with 100 agents across seven behavioral archetypes under two adversity scenarios (30 seeds, paired t-tests). The protocol trades modest precision under benign conditions for substantially better resilience under adversity: 0.826 vs 0.791 for majority vote under moderate adversity (p<0.001), widening to 0.807 vs 0.740 under stress (p<0.001). The protocol degrades roughly three times more slowly than majority vote. Ablation analysis identifies commit-reveal vote concealment as the most impactful single component (8.2-8.6pp precision improvement, p<0.001), outperforming reputation weighting and deliberation combined. Graduated sanctions were not exercised in simulation and remain empirically unvalidated.

1 Introduction

Persistent multi-agent knowledge curation lacks a unified protocol for managing artifacts and collective decisions over time. The paper composes lifecycle management, deliberation, reputation, and agent-adapted governance, while distinguishing this problem from adjacent approaches.

1 Introduction

  • Multi-agent systems lack a unified protocol for governing knowledge artifacts from proposal through evaluation, acceptance, dispute, and retirement.Prior approaches include ephemeral debate and centralized retrieval pipelines, while ungoverned collaborative production has been associated with rapid quality collapse.Source: §1 · pp. 1–2
  • Majority voting on interconnected judgments can yield inconsistent collective outcomes, motivating structured argument exchange before agents vote.The judgments include accuracy, sourcing, novelty, and coherence.Source: §1 · p. 2
  • The protocol combines a labeled-transition-system artifact lifecycle, deliberation before voting, Beta Reputation with EigenTrust, and graduated sanctions adapted for stateless agents.The paper's contribution is this composition and its empirical evaluation, rather than the individual mechanisms alone.Source: §1 · p. 2, §1.1 · p. 2

1.1 Related Work

  • Multi-agent debate produces ephemeral outcomes, while this protocol addresses persistent lifecycle management, dispute resolution, and reputation tracking.Beta Reputation and EigenTrust are established components; their integration with deliberation and lifecycle management is the stated contribution.Source: §1.1 · pp. 2–3

2 System Model

The system models shared knowledge curation through an artifact lifecycle, agent state, and reputation-based influence. Its lifecycle guards connect artifact transitions to agent trust, while reputation combines local track records with network-wide trust.

2 System Model

  • The system models agents interacting over a shared knowledge base of artifacts, with an orchestrator enforcing lifecycle transitions but not voting.The orchestrator is separate from the conversation orchestrator that manages deliberation.Source: §2 · p. 3, §2.2 · p. 5

2.1 Knowledge Artifact Lifecycle

  • The lifecycle bounds artifact cycling through timeouts, a dispute limit, and guarded resubmission of retracted chunks into review.Resubmission requires a cooldown, new evidence or substantive revision, sufficient submitter reputation, and a bounded resubmission count.Source: §2.1 · p. 4
  • Unlike prior artifact lifecycle models, its guards couple artifact state to agent trust, making transitions depend on both data conditions and agent reputation.The formalism adapts the Guard-Stage-Milestone model to multi-agent knowledge curation.Source: §2.1 · p. 4

2.2 Agent Model

  • Because stateless agents may not remember sanctions, restrictions must be enforced by system access controls rather than learned behavioral change.The system orchestrator enforces transition guards and does not submit content or cast votes.Source: §2.2 · p. 5
  • Shared language models can correlate agent assessments, while procedurally correct hallucinations may pass review and seed cascading false citations.Open participation may increase reviewer diversity, but the protocol enforces no formal diversity constraint and conduct-based governance cannot detect hallucinations.Source: §2.2 · pp. 5–6

2.3 Reputation Model

  • Local Beta reputation tracks positive and negative outcomes, while exponential decay reduces evidence weight without changing an inactive agent’s expected reputation.The decay rate and function are deployment choices; the simulation uses δ = 0.01 per round, which the authors do not claim is optimal.Source: §2.3 · p. 6
  • EigenTrust propagates local trust through the interaction graph, and the resulting global trust combines with local reputation to set bounded voting weights.Global trust is computed as a damped Markov-chain stationary distribution using a pre-trusted seed vector.Source: §2.3 · pp. 6–7
  • Reputation tiers grant contribution, review, and dispute privileges; newcomers receive minimum voting weight and submit through a more closely scrutinized sandbox queue.The tier system provides a progression path intended to address the cold-start problem.Source: §2.3 · p. 7

3 Protocol Specification

The protocol governs knowledge curation through reviewer recruitment, escalating decisions, disputes, urgent reports, and sanctions, with an orchestrator controlling lifecycle transitions. It scales review effort with contention and distinguishes protective quarantine from punitive sanctions.

3.1 PROPOSE Operation and Reviewer Recruitment

  • The protocol orchestrator manages lifecycle transitions; reviewers are recruited through topic-matched subscriptions, while any Tier ≥1 agent may participate and formal votes require a quorum.Handling submissions that fail to reach quorum is a deployment choice.Source: §3 · p. 7, §3.1 · pp. 7–8

3.2.1 Tier 1: Fast Track (Absence-of-Objection)

  • Absence of objection accepts uncontroversial chunks after a timeout, avoiding dependence on positive approval and enabling high-throughput review.An objection or other escalation trigger sends a chunk to formal review.Source: §3.2.1 · pp. 8–9, §3.2.2 · p. 9

3.2.2 Tier 2: Formal Vote

  • Formal review separates time-bounded deliberation from voting, conceals votes until voting closes, and aggregates reason-tagged votes using reviewer reputation weights.Ambiguous outcomes escalate to arbitration rather than defaulting to rejection.Source: §3.2.2 · pp. 9–10

3.2.3 Tier 3: Arbitration

  • A designated arbiter reviews process fairness and possible manipulation when votes are ambiguous or contested; persistent disagreement can trigger administrative review.Arbiters judge conduct and process, not the content’s correctness.Source: §3.2.3 · p. 10

3.2.4 Escalation Summary

  • The three tiers escalate from absence-of-objection review to reputation-weighted voting and arbitration, so governance overhead is expected to scale with contentiousness.Most contributions are expected to resolve at Tier 1.Source: §3.2.4 · p. 11

3.3.1 Standard Dispute

  • Standard disputes use fresh reviewers, a higher quorum, and an elevated retraction threshold, while rate limits and asymmetric reputation incentives balance challenge value against harassment.Successful challenges reward disputers; rejected frivolous disputes incur a reputation cost.Source: §3.3.1 · p. 11

3.3.2 Urgent Report

  • Urgent reports can temporarily hide manifestly illegal or immediately harmful content pending full dispute review, and unfounded reports incur a stronger reputation penalty.The hidden flag is a temporary safeguard, not a general moderation tool, and remains orthogonal to lifecycle state.Source: §3.3.2 · p. 12

3.4 Graduated Sanctions

  • Graduated sanctions combine deterrence with technical containment, while broken agents are quarantined rather than immediately punished and can return after repair.Quarantine is time-bounded; comprehensive adversarial analysis, including adaptive attacks and reputation laundering, is left to subsequent work.Source: §3.4 · pp. 12–13

4 Design Properties

The design properties specify intended progress, state-transition safety, reputation separation, bounded Sybil influence, fairness, and sanction correctness. Their arguments are informal, and several depend on assumptions or leave practical limitations.

4 Design Properties

  • The five design properties and lemma are supported by informal arguments that indicate plausibility, not formal proof.Rigorous verification is left for future work.Source: §4 · p. 13

4.1 Liveness

  • Finite timeouts and bounded dispute and resubmission cycles ensure each chunk reaches a terminal state in bounded time.Terminal states include active, superseded, or retracted.Source: §4.1 · p. 14

4.2 Safety

  • No chunk reaches active without a legitimate decision path, and the orchestrator alone executes state transitions.The argument is a proof sketch; formal model checking is proposed as future work.Source: §4.2 · p. 14

4.3 Reputation Separation

  • Reputation separation is argued under honest weighted majority, but this is a stability argument rather than a guarantee of convergence from arbitrary initial conditions.A sufficiently advantaged malicious minority or aggressive reputation decay could disrupt separation.Source: §4.3 · pp. 14–15

4.4 Bounded Per-Identity Sybil Influence

  • Each new Sybil identity begins at minimum weight, but near-zero identity creation costs mean enough identities can overwhelm legitimate influence.The time-in-Tier-0 requirement is described as a weak barrier for patient adversaries; additional defenses are needed.Source: §4.4 · pp. 15–16

4.5 Fairness

  • Under honest operation, decay, deliberation bonuses, and a per-agent weight cap are argued to bound reputation concentration, but compute-rich agents can gain more influence.The cap can be bypassed by distributing influence across Sybil identities.Source: §4.5 · p. 16

4.6 Sanction Correctness

  • Wide escalation windows, quarantine, and post-hoc reclassification are proposed to limit false-positive sanctions; quarantine limits influence without escalating punishment.Quarantined agents retain a path to full participation after repair.Source: §4.6 · p. 16

5 Evaluation

The evaluation uses agent-based simulation to compare protocol mechanisms with baselines and assess individual components. Its findings are scoped to a simplified core subset rather than the full protocol.

5.1 Simulation Framework

  • The evaluation uses a deterministic simulation of agents interacting over a shared knowledge base and reports means and standard deviations across 30 random-seed runs.The validation approach follows agent-based-model validation and statistical model-checking methodologies.Source: §5 · p. 16, §5.1 · p. 17

5 Evaluation

  • The simulation evaluates reputation-weighted voting, vote-concealment defense, graduated sanctions, and a simplified deliberation effect, not the full protocol specification.Fast track, arbitration, and subscription-based reviewer recruitment are not simulated.Source: §5 · p. 17, §5.1 · p. 17

5.1 Simulation Framework

  • Deliberation is represented as a binary accuracy improvement rather than structured argumentation, and precision is measured against synthetic quality scores.In production, quality is an emergent property rather than externally observable ground truth.Source: §5.1 · p. 17

5.2 Setup

The simulation tests a 100-agent protocol across two adversity configurations, with defined artifact quality distributions and operating parameters. It compares the protocol with alternative governance baselines using precision, recall, fairness, and sanction false-positive rate.

5.2 Setup

  • 100 agents across seven behavioral archetypes were evaluated under moderate adversity (40% honest) and high adversity (25% honest, 75% non-honest).The high-adversity scenario deliberately violates the honest-majority assumption in headcount terms.Source: §5.2 · p. 18
  • Each run generated 1,000 chunks: 50% good, 30% mediocre, and 20% bad; runs lasted 500 rounds with two new chunks proposed per round.The protocol used five reviewers per chunk, a quorum of three, and five deliberation rounds.Source: §5.2 · p. 18

5.3 Baselines

  • The four baselines were unweighted majority vote, a single curator, ungoverned acceptance, and reputation-weighted voting without deliberation.Majority vote is the closest comparator because it shares the voting structure but lacks reputation differentiation.Source: §5.3 · p. 18

5.4 Metrics

  • Precision measures the share of active chunks that are good, while recall measures the share of good chunks that reach active status.These metrics capture accepted-content quality and coverage, respectively.Source: §5.4 · p. 19
  • Fairness is measured by the final reputation Gini coefficient, and sanction false-positive rate counts honest or broken agents sanctioned at level σ2 or above.Lower Gini indicates a more equitable reputation distribution.Source: §5.4 · p. 19

5.5 Results

The protocol outperforms majority vote on precision in both adversity scenarios, with a wider advantage under high adversity and a smaller precision decline across scenarios. Recall remains high, fairness is comparable to baselines, and sanction false-positive rate rises under greater adversity.

5.5 Results

  • 0.826 vs. 0.791 precision under moderate adversity and 0.807 vs. 0.740 under high adversity favor the full protocol over majority vote (both p < 0.001).The protocol’s precision drops 0.019 between scenarios, compared with a 0.051 drop for majority vote.Source: §5.5 · pp. 19–20
  • Full-protocol recall is 0.994 under moderate adversity and 0.973 under high adversity, indicating no precision gain through over-filtering.The ungoverned baseline has recall 1.000 by definition because it accepts all content.Source: §5.5 · p. 20
  • Gini coefficients remain low across configurations (0.10 to 0.12), with the full protocol comparable to baselines.The authors attribute limits on indefinite reputation accumulation to time decay and weight caps.Source: §5.5 · p. 20
  • Sanction false-positive rate rises from 0.033 to 0.068 between adversity scenarios, as larger adversarial populations and noisier behavioral signals complicate classification.The passage reports both values as within acceptable bounds.Source: §5.5 · p. 20

5.6 Ablation Study

Ablations identify commit-reveal vote concealment as the strongest single mechanism and show a growing precision benefit from reputation weighting as adversity increases. The farming cap trades some precision for lower reputation concentration, while graduated sanctions were not exercised.

5.6 Ablation Study

  • Removing commit-reveal reduces precision by 8.2 percentage points under moderate adversity and 8.6 points under high adversity (both p < 0.001).The mechanism prevents agents from observing others’ votes within the same review round, limiting the direct imitation vector.Source: §5.6 · pp. 20–21
  • Removing reputation weighting reduces precision by 3.2 points under moderate adversity and 6.9 points under high adversity (both p < 0.001).The authors describe reputation as downweighting agents whose voting records diverge from outcomes.Source: §5.6 · p. 21
  • Removing graduated sanctions produces identical simulation results because sanctions never triggered in any of the 30 runs per scenario.The mechanism therefore remains empirically unvalidated in this simulation.Source: §5.6 · p. 21
  • Removing the farming cap raises precision by 1.2 points under moderate adversity and 0.8 points under high adversity, while increasing Gini from 0.105 to 0.124 and 0.120 to 0.143, respectively.The protocol accepts a modest precision cost in exchange for better fairness.Source: §5.6 · p. 21
  • Under moderate adversity, weighted voting without deliberation matches full-protocol precision (0.825 vs. 0.826), but has higher Gini (0.109 vs. 0.105) and a larger precision drop under stress (0.022 vs. 0.019).Disabling sycophancy defense reduces precision to 0.744 in both scenarios.Source: §5.6 · p. 21

5.7 Mechanisms Not Exercised

Several specified mechanisms were not exercised in the simulations. In particular, sanctions and dispute limits did not trigger, and the full argumentation framework was not evaluated.

5.7 Mechanisms Not Exercised

  • No agent accumulated enough violations within the 50-round escalation window to trigger graduated sanctions at level σ1 or above.The authors cite either reputation absorbing adversarial behavior or lenient escalation thresholds as possible explanations; both may contribute.Source: §5.7 · p. 21
  • The per-agent dispute rate limit was never reached because disputes occurred infrequently relative to the configured limits.Source: §5.7 · p. 21
  • The simulation did not evaluate the full argumentation framework, and the authors call for longer runs, higher violation densities, or targeted adversarial strategies to test unvalidated mechanisms.Graduated sanctions, dispute limits, and the full argumentation framework lack empirical validation in the agent context.Source: §5.7 · pp. 21–22

5.8 External Consistency Check: Community Notes Replay

The Community Notes replay serves as a sanity check against a human curation system, not as a competitive benchmark. Results vary with rating density: the protocol helps on sparse notes but majority vote performs better on very dense notes.

Results (overall)

  • 99.1% majority-vote agreement and 98.9% protocol agreement with Community Notes are both high, with only a small overall difference.The replay uses 1,670 notes and 202,315 ratings from a March 2026 snapshot.Source: §5.8 · p. 22

Stratified results

  • On notes with 5–15 ratings, the protocol outperforms majority vote by 1.5 percentage points, with perfect precision (1.000).On notes with 200+ ratings, its accuracy is 95.0% versus majority vote’s 98.2%.Source: §5.8 · p. 22
  • Reputation weighting adds value when sparse ratings make individual signals noisy, but its filtering can be unnecessary when dense ratings already provide a strong signal.The protocol is characterized as a resilience mechanism for low-signal situations, not a universal improvement.Source: §5.8 · p. 22

Sycophancy defense

  • Disabling commit-reveal produces the same 99.1% agreement as majority vote, consistent with human raters lacking the systematic sycophantic alignment seen in LLM agents.The mechanism is designed for agent-specific vulnerabilities and has no effect on human rating data where votes are already effectively hidden.Source: §5.8 · pp. 22–23

Interpretation

  • The replay is a sanity check, not a competitive benchmark, because human ratings lack the adversarial dynamics that distinguish the protocol in simulation.The simulation remains the primary evaluation of the protocol’s core claims.Source: §5.8 · pp. 22–23

6 Discussion

The discussion presents resilience under adversity as the protocol’s main value, while noting that sanctions remain untested and precision has practical and fairness tradeoffs. It also identifies limits involving broken-agent validation, model homogeneity, compute-linked influence, conduct gaming, and adaptive adversaries.

6.1 Resilience as the Primary Value Proposition

  • Under moderate adversity, precision is 0.826 for the protocol versus 0.791 for majority vote; under high adversity, it is 0.807 versus 0.740, with the protocol degrading roughly three times more slowly.The respective comparisons have p < 0.001; the protocol’s precision drops by 0.019 while majority vote drops by 0.051.Source: §6.1 · p. 23

6.2 Graduated Sanctions: Specified but Untested

  • No agent triggered sanctions at σ1 or above, so the safety-net and deterrence roles of graduated sanctions remain unverified.The 500-round duration and 50-round escalation window were insufficient for agents to accumulate high-level sanction violations.Source: §6.2 · pp. 23–24

6.3 Precision in Context

  • A precision of 0.81 means about one in five accepted chunks misses the quality threshold, and synthetic quality scores limit the evaluation’s realism.Raising acceptance thresholds could improve precision at the cost of recall and throughput.Source: §6.3 · p. 24

6.4 Precision-Fairness Tradeoff

  • Removing the farming cap gains 1.2 percentage points of precision under moderate adversity while Gini rises from 0.105 to 0.124.Under high adversity, precision gains 0.8 points while Gini rises from 0.120 to 0.143; the defaults favor fairness over modest precision gains.Source: §6.4 · p. 24

6.5 Broken Agent Handling: Limited Empirical Support

  • Broken-agent handling was not separately ablated, and its practical impact needs validation with larger broken-agent populations or longer time horizons.With a 10% broken-agent population, behavioral classification could route broken agents to quarantine rather than the sanction ladder.Source: §6.5 · p. 24

6.6 Fundamental Limits

  • Shared underlying models violate reviewer independence, allowing systematic biases to pass when reviewers share blind spots.Open participation may increase diversity likelihood but provides no formal guarantee.Source: §6.6 · p. 24
  • Reputation links governance influence to compute resources, while weight caps and time decay mitigate but do not break that correlation.The paper states this structural limitation has no known protocol-level solution.Source: §6.6 · p. 25
  • Rule-following agents can still bias outcomes through selective participation, and more sophisticated adaptive attacks remain outside the evaluation.The simulation includes basic trust-building before exploitation, but leaves full co-evolutionary evaluation for future work.Source: §6.6 · p. 25

7 Conclusion

The paper presents a multi-layer curation protocol and evaluates its core mechanisms in simulation, finding stronger resilience under adversity than majority vote. The conclusion also emphasizes vote concealment’s impact and notes that several specified components remain empirically unvalidated.

Conclusion

  • The protocol combines a lifecycle modeled as a labeled transition system, reputation-weighted deliberative decisions, and graduated sanctions adapted for stateless agents.The system includes broken-agent handling and a three-tier escalation framework of fast track, formal vote, and arbitration.Source: §7 · p. 25
  • Under moderate adversity, protocol precision is 0.826 versus 0.791 for majority vote, widening under stress to 0.807 versus 0.740; degradation is roughly three times slower.The comparisons have p < 0.001.Source: §7 · p. 25
  • Temporary vote concealment yields an 8.2–8.6 percentage-point precision improvement, exceeding reputation weighting and deliberation combined.The paper recommends vote concealment as the first design priority for multi-agent curation systems.Source: §7 · p. 26
  • Reputation weighting adds +3.2pp under moderate adversity and +6.9pp under stress, while graduated sanctions and dispute limits were not exercised and remain unvalidated.The evaluation validates core mechanisms but not the full specification, including fast track, arbitration, and graduated sanctions.Source: §7 · pp. 25–26

Future Work

  • The protocol is specified to allow deployment choices for escalation order, discussion modes, vote disclosure, and sensitivity classification.Future work includes validation with real LLM-based agents and adversarial scenarios.Source: §7 · p. 26
  • Proposed extensions include formal verification, lifecycle and revision mechanisms, domain-aware reputation, and sensitivity analysis of decay parameters.Other directions include federation across instances and policy-aware reviewer assignment.Source: §7 · p. 26

AI Disclosure

The author reports using large language models for literature search, drafting, and iterative review, and takes responsibility for the paper’s content and conclusions.

AI Disclosure

  • Large language models assisted with literature search, drafting, and iterative review; citations were independently verified, and the author takes responsibility for the content and conclusions.Source: AI Disclosure · p. 26

Related papers

Loading 2606.00007v1…