PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication
Proof-Carrying Messages give every agent claim a Merkle-log proof and a signature. On 926 messages it accepts 10 stale lies, while plain A2A accepts all 712.
The claim
Proof-carrying messages force every agent claim to carry evidence the sender cannot fake.
The problem
Agents trust other agents, like a message that says the tests passed.
Channel authentication proves who spoke, not whether the claim is true.
A prompt-injected agent can launder false facts through the system.
How it works
Each claim cites a record in an append-only Merkle log.
The agent cannot write to that log; an independent signer signs it.
Receivers verify messages offline and return proven, unproven, or failed.
A claim based only on the sender's own report is never proven.
Authority travels in grant chains rooted in recorded human approval.
Figures
What changes
On 926 benchmark messages, PCM accepts 10 lies; plain A2A accepts all 712.
The accepted lies used only stale evidence; checks take about 1 ms.
Two independent verifiers agreed on all 926 verdicts.
Limits
The benchmark uses messages from real runs, not every deployment.
Deploying it needs an append-only log, a trusted signer, and offline checks.
Source · arXiv