Who is the 'I' in AI? Establishing Decentralized Identity and Accountability for Autonomous Agents

I. INTRODUCTION

• AI agents can be forked and run at machine speed, yet existing identity systems do not provide a deterministic, cryptographically verifiable way to identify them and assign accountability.The paper frames this gap as a security concern for decentralized agent economies, where agents may transact without human observers.Source: §I · p. 1

III. RELATED WORK

• The paper argues that prior frameworks rely on extrinsic attestations or reputation and do not cryptographically bind runtime execution to static model architecture.It contrasts these approaches with ABCD’s algorithmic provenance, behavioural checks, and delegated liability.Source: §I · p. 1, §III · p. 3

I. INTRODUCTION

• The paper introduces a formal domain-aware identity model that distinguishes human principals from autonomous AI agents.It also states three security theorems: behavioural coherence and tampering detection, Sybil and impersonation resistance, and temporal bounded authorization enforcement.Source: §I · p. 2
• The ABCD Framework combines algorithmic provenance, behavioural integrity, cryptographic anchoring, and delegated liability in a unified identity calculus.The framework is presented as an SSI-based response to the black-box problem in reputation-based models.Source: §I · pp. 1–2

II. BACKGROUND

• SSI uses issuer, holder, and verifier roles to exchange verifiable credentials, while DIDs let subjects prove identity control through keys and signatures.The paper presents self-certifying DIDs as suited to agents operating across platforms without a shared registrar.Source: §II · p. 2

III. RELATED WORK

• The paper identifies a gap in LOKA’s reliance on reputation and post-hoc dispute resolution, which does not establish cryptographic provenance for an agent’s runtime model.ABCD instead requires proofs of algorithmic provenance and delegated liability.Source: §III · pp. 2–3

IV. PROBLEM DEFINITION & THREAT MODEL

• The identity problem is framed as the joint absence of entity differentiation, identity coherence, and accountable delegation.Without these properties, decentralized ecosystems remain exposed to Sybil attacks, runtime tampering, and unaccountable damages.Source: §IV · p. 3

A. System Model and Assumptions

• The system is scoped to open, permissionless settings and agents acting above an autonomy cutoff, without a trusted intermediary.The threat model includes adversaries able to register valid DIDs and fork models at negligible cost; it excludes trusted execution hardware and enterprise perimeter threats.Source: A. System Model and Assumptions · pp. 3–4

B. Threat Model

• The threat model includes model swapping, liability evasion, and agents exceeding delegated authority, alongside Sybil and impersonation threats.These cases are described as runtime tampering, repudiation, and elevation of privilege.Source: §IV · p. 3, B. Threat Model · p. 4

V. FORMAL AI IDENTITY MODEL

• The formal AI identity model extends the Digital Identity Model’s set-theoretic calculus with logic for ABCD’s orthogonal verification layers.Its target is correlating forkable, non-human entities across mutually distrusting permissionless domains, rather than correlating one human across centralized providers.Source: §V · p. 4

A. Entities and Domains

• Within each domain, the model separates algorithmic, behavioural, cryptographic, and delegation attributes while treating humans and AI agents uniformly as entities.Existing human identifiers are cryptographically bound to the agent identity; the four attribute classes represent provenance, behaviour, identity proof, and human accountability.Source: A. Entities and Domains · pp. 4–5

B. Identity Calculus

• The valuation function maps entity attributes to values only when those attributes apply and are disclosed, allowing sparse identities.An agent may have a modelHash while another agent’s configHash is undefined.Source: B. Identity Calculus · p. 5
• A domain identifier uniquely distinguishes entities within that domain, whereas partial identifiers such as modelHash can be shared by multiple agent instances.A shared modelHash can group agents from the same release but cannot alone distinguish individual instances.Source: B. Identity Calculus · p. 6
• A partial identity is the set of defined attribute–value pairs for an agent in a domain, with undefined values covering non-applicability or non-disclosure.The valuation function is a partial map, so an attribute may be absent or withheld.Source: B. Identity Calculus · pp. 5–6
• A profile is a context-specific subset of an agent’s partial identity that always includes its DID and may disclose only selected additional attributes.For an auditor seeking proof of existence and owner linkage, the example profile includes the ownerDID but withholds performance metrics and architecture.Source: B. Identity Calculus · pp. 6–7
• Total identity unites an agent’s partial identities across domains while preserving each fact’s domain provenance and avoiding attribute collisions.Profiles are contextual disclosures derived from their respective partial identities; total identity is their domain-aware aggregate.Source: B. Identity Calculus · p. 7
• A verifier accepts an agent’s identity claim when its signature proves control of the private key bound to the claimed DID.The signature is checked against the public key registered in the agent’s DID document.Source: B. Identity Calculus · pp. 7–8

VI. THE ABCD FRAMEWORK

• The ABCD framework separates agent identity into four orthogonal dimensions that can be verified independently and mutually reinforce each other.The layers are restrictions or relations over mathematical primitives.Source: §VI · p. 8
• The framework spans computational, behavioural, cryptographic, and social aspects of AI-agent identity.The passage presents these aspects as necessary checks for complete trust establishment.Source: §VI · p. 8
• Each identity layer is expressed through restrictions or relations over mathematical primitives.The framework presents the layers as a multi-faceted account of agent identity.Source: §VI · p. 8

A. Layer C: Cryptographic Identity

• Layer C uses public-key cryptography and decentralized identifiers as the agent’s unforgeable digital identity anchor.The paper treats cryptographic identity as the primary trust anchor for AI agents.Source: A. Layer C: Cryptographic Identity · p. 8
• The DID attribute is the domain identifier, and verification uses the checkProofd function.The layer also includes associated public keys, key fingerprints, and verification procedures that bind proofs to identity assertions.Source: A. Layer C: Cryptographic Identity · p. 8
• Without the private key, an attacker cannot forge a signature that passes checkProofd.Actions signed with the agent’s private key provide proof associated with its identity.Source: A. Layer C: Cryptographic Identity · p. 8

B. Layer A: Algorithmic Fingerprint

• After cryptographic identity is established, ΦAlg projects characteristics such as model, version, and configuration for provenance verification.The function extracts immutable properties such as modelHash and versionTag.Source: B. Layer A: Algorithmic Fingerprint · p. 8
• The algorithmic fingerprint records static computational properties, including model architecture, training provenance, and configuration parameters.These properties change rarely and serve as provenance anchors for long-term trust relationships.Source: B. Layer A: Algorithmic Fingerprint · p. 8
• A regulator can check whether AgentX’s versionTag is v2.1, with a mismatch revealing operation on v3.0-beta instead.The example describes verification of an approved version in a DeFi domain.Source: B. Layer A: Algorithmic Fingerprint · p. 8
• A cloned model does not by itself grant a valid DID or another agent’s private key.The modelHash may be shared across agents from the same release, and impersonation resistance does not depend on Layer A.Source: B. Layer A: Algorithmic Fingerprint · p. 8

C. Layer B: Behavioural Fingerprint

• Behavioural Fingerprints capture dynamic performance metrics over time because static provenance cannot guarantee correct operations or predict all emergent behaviour.The framework treats refusal rate and latency as illustrative metrics, not an exhaustive set.Source: C. Layer B: Behavioural Fingerprint · p. 8
• A mismatch between documented latency under 200ms and observed 220ms over 30 days flags incoherence, potentially reflecting drift, resource contention, or malicious modification.The example also gives a refusal rate of 0.03 and an average trade size of $5000.Source: C. Layer B: Behavioural Fingerprint · p. 9

D. Layer D: Delegation and Ownership

• Ownership identifies the human accountable for an agent, while delegation grants temporary permission to act, a distinction especially relevant where decentralized systems lack traditional organizational hierarchies.The framework represents delegation as an agent-specific Verifiable Credential issued by the human owner and bound to the agent DID.Source: D. Layer D: Delegation and Ownership · p. 9
• Delegated authority can be time-bounded and explicitly revoked before expiry when early intervention is needed, such as if an agent behaves maliciously.The example permits trading up to $50,000 between t1 and t2; delegation expires after t2 unless revoked earlier.Source: D. Layer D: Delegation and Ownership · p. 9

E. Quadrant Relationships Between the ABCD Layers

• Cryptographic Identity anchors Algorithmic Fingerprints and Behavioural Fingerprints, which are respectively checked against runtime behaviour and bound to the agent through signed metrics and logs.Behavioural actions are then checked against the permissions and constraints in Delegation and Ownership.Source: E. Quadrant Relationships Between the… · p. 9, Figure 1 · p. 9

F. Operational Architecture

• The operational architecture divides the identity lifecycle into three tiers: Entities, Core Management Modules, and Decentralized Infrastructure.Figure 2 presents the operational architecture.Source: F. Operational Architecture · p. 10, Figure 2 · p. 10

1) Participating Entities:

• Participating entities comprise AI agents seeking registration and credentials, human owners delegating authority, issuers asserting properties, and verifiers checking credentials before access.Issuers include auditors and model vendors; verifiers include external applications such as DeFi protocols.Source: 1) Participating Entities · p. 10

2) Core Management Modules:

• Core modules handle agent onboarding, credential issuance and revocation, delegation governance, and real-time verification across coherence, impersonation, and authorization checks.The Verification Service combines blockchain and IPFS data for those checks.Source: 2) Core Management Modules · p. 10
• The infrastructure keeps DIDs, public keys, and cryptographic hashes on blockchain while storing heavier or sensitive records off-chain in content-addressed, encrypted storage.Raw model weights and sensitive personal information are not held on-chain.Source: Decentralized Infrastructure · p. 10

G. Roadmap to Practical Implementation

• ABCD is intended as an application layer on mature SSI stacks and W3C standards rather than a replacement for current internet protocols.The roadmap identifies ACA-Py for SSI agent functions and OpenID4VC for human-to-agent delegation; ZKPs are optional, additive privacy tools.Source: G. Roadmap to Practical Implementation · pp. 10–11

VII. SECURITY THEOREMS

• The security analysis fixes coherence, impersonation, and authorization predicates, states the cryptographic and systems assumptions, and proves three corresponding security theorems.The stated guarantees concern behavioural coherence and tampering detection, Sybil and impersonation resistance, and temporal bounded authorization enforcement.Source: §VII · p. 11

A. Formal Characterizations

• The predicates define the conditions being assessed; the security claims come from later theorem and corollary derivations under the stated assumptions.A coherence failure means a policy finds observed behavioural attributes inconsistent with stated algorithmic attributes within an observation window.Source: A. Formal Characterizations · p. 11
• The authorization predicate accounts for delegation timing and revocation, including the requirement that the delegation has not been revoked during the relevant interval.The supplied predicate fragment includes start and end times and a non-revocation condition.Source: A. Formal Characterizations · p. 11

B. Assumptions

• The guarantees rely on cryptographic hardness, BFT ledger safety, self-certifying identity resolution, and authorization times defined by transaction finalization.Assumption 6 leaves the ordering of two pending, unfinalized transactions undetermined.Source: B. Assumptions · p. 12

C. Theorems and Proofs

• When tampering changes registered weights and causes a monitored behaviour attribute to exceed its tolerance, the coherence policy flags the agent as unbound.The theorem's detection guarantee is conditional on behavioural sensitivity; the policy evaluates declared attributes against observed behaviour.Source: C. Theorems and Proofs · p. 12
• The detection claim is not universal: tampering whose behavioural deviation stays below tolerance falls outside the theorem’s guarantee.The authors identify coverage—whether real attacks exhibit behavioural sensitivity—as an open question.Source: C. Theorems and Proofs · p. 12
• Evasion occurs exactly when every attribute monitored by the policy stays within tolerance across the full input distribution during the observation window.The paper identifies the monitored dimensions and their tolerances as levers affecting the region in which evasion is possible.Source: C. Theorems and Proofs · p. 12
• Under Assumptions 2 and 3, an adversary without AgentX’s private key succeeds in making the system accept it as AgentX only with negligible probability.A different registered identifier resolves to its own registrant, while forging a signature under AgentX’s key would violate signature unforgeability.Source: C. Theorems and Proofs · pp. 12–13
• Under BFT consensus, the wallet dispatches an action for an owner through an agent if and only if the authorization predicate is true.Authorization requires ownership, a delegated action, an active time window, and no revocation; a false condition makes the guard reject dispatch.Source: C. Theorems and Proofs · p. 13
• A mandatory challenge window longer than expected finality latency with margin ensures a revocation submitted before the window opens is reflected before dispatch eligibility.The result depends on the challenge window and BFT finality assumptions.Source: C. Theorems and Proofs · p. 13

• The worked example centers on AgentX, a DeFi trading bot owned by Alice.Source: §VIII · p. 13
• Adv is modeled as a Dolev–Yao attacker who can intercept, delay, reorder, inject, and replay messages, and relay or propose blocks within threshold f.Source: §VIII · p. 14
• Adv cannot invert one-way functions, forge signatures, or corrupt more than f consensus nodes; Assumptions 1–5 hold.Source: §VIII · p. 14

A. Setup (Layers C and A)

• AgentX’s DID derives from its key, Alice’s ownership is recorded, and trades above $10,000 face a 64-block challenge window.Source: A. Setup (Layers C and A) · p. 14

B. Day 15: Coherence Failure (Theorem 1, Corollary 2)

• An 80 ms latency deviation exceeds the 45 ms tolerance, so the coherence check fails and raises an automated alert to Alice.Source: B. Day 15: Coherence Failure (Theorem… · p. 14

C. Same day: An Impersonation Attempt (Theorem 3)

• A forged signature under AgentX’s DID is rejected, while AgentY’s own valid DID resolves to AgentY rather than AgentX.Source: C. Same day: An Impersonation Attempt… · p. 14

D. Day 15–16: Revocation Under Contention (Theorem 4, Corollary 5)

• Alice’s revocation finalizes at b1 + 25 before the trade becomes eligible at b1 + 64, so the guard fails and the trade reverts.Source: D. Day 15–16: Revocation Under… · p. 14
• The challenge delay must exceed finality latency with margin; a revocation submitted too late can leave the outcome to transaction finalization order.Source: D. Day 15–16: Revocation Under… · p. 14

E. Operational Note: Reconciling Finality with Machine-Speed Execution

• Verifiers can cache identity and authorization for a bounded period, invalidate on revocation events, and reserve finality-latency costs for delegation and challenge boundaries.Source: E. Operational Note: Reconciling… · p. 14

IX. SECURITY ANALYSIS

• Runtime behavior that statistically deviates from a signed algorithmic fingerprint flags model swapping, while signed ownership links make attribution non-repudiable.Source: §IX · p. 15
• The framework keeps model weights off-chain while committing hashes on-chain, and Layer A registration gas adds cost to creating agent identities.Source: §IX · p. 15
• Delegated permissions are bounded by permission, time window, and budget, and actions after the authorization end time are rejected.Source: §IX · p. 15

A. Statistical Nature of Verification

• Layer B verification is probabilistic: short observation windows raise noise and false alarms, while long windows delay model-swap detection.Source: A. Statistical Nature of Verification · p. 15

B. Privacy-Transparency Trade-offs

• Public behavioral traces can expose side-channel information that may let competitors reverse-engineer proprietary strategies.Source: B. Privacy-Transparency Trade-offs · p. 15

C. Attribution vs. Enforcement

• Layer D can establish who is liable, but cannot compel restitution beyond pre-locked collateral; enforcement depends on external jurisdiction.Source: C. Attribution vs. Enforcement · p. 16

XI. CONCLUSION

• The conclusion presents ABCD as a foundational standard, not a definitive solution to the economic dilemma of autonomy.Source: §XI · p. 16