Byzantine Fault Tolerance (BFT)

The absolute guarantee that no two correct nodes ever decide on different values. This property prevents a fork in the system's history. In a multi-agent context, this ensures all honest agents share the same view of a completed task or transaction, even if malicious agents broadcast conflicting proposals. Violating safety leads to a double-spend in financial systems or conflicting commands in a robot fleet.

• Mechanism: Achieved through multiple rounds of voting and cryptographic commitment schemes.
• Critical Guarantee: If one correct node decides on value v, all correct nodes eventually decide on v.

The guarantee that the system will eventually make progress and decide on a value, never getting stuck in an infinite loop. A protocol with liveness ensures that a malicious adversary cannot halt the network simply by refusing to send messages or by crashing a minority of nodes. Without liveness, a system suffers a Denial of Service (DoS) by design.

• Mechanism: Relies on synchronous network assumptions or leader-change protocols (view changes) to bypass unresponsive nodes.
• Critical Guarantee: Every correct node eventually decides on some value.

The mathematical upper bound on the number of faulty nodes a BFT system can tolerate. A deterministic, partially synchronous BFT network requires 3f + 1 total nodes to survive f Byzantine failures. This means a system of 4 nodes can survive 1 traitor, and a system of 7 nodes can survive 2.

• The 1/3 Rule: An adversary controlling one-third or more of the network can permanently break both safety and liveness.
• Practical Impact: This ratio dictates the minimum hardware and agent replication required for a secure deployment.

Once a decision is appended to the log, it is cryptographically irreversible. Unlike Proof-of-Work chains that offer probabilistic finality, true BFT protocols provide absolute finality within seconds. An agent can act on a confirmed decision immediately, without waiting for multiple confirmations to mitigate chain reorganization risk.

• Mechanism: A quorum of nodes signs the decision, creating a cryptographic proof that a supermajority agreed.
• Agentic Relevance: Enables low-latency, high-stakes autonomous actions where rollbacks are legally or financially impossible.

The decided value must have been proposed by a correct node and not fabricated out of thin air by the Byzantine nodes. This prevents a scenario where a cabal of malicious agents forces the network to decide on a "null" or self-serving value that no honest participant requested.

• Mechanism: Enforced by validating client signatures and pre-prepare phase logic.
• Contrast: Safety ensures everyone agrees; validity ensures the agreement is on a meaningful, legitimate input.

Modern BFT protocols go beyond masking faults; they identify the culprits. If safety is violated, the consensus log contains cryptographic evidence (conflicting signed messages) that pinpoints the specific Byzantine nodes. This is crucial for slashing staked assets in Proof-of-Stake systems or triggering agent revocation in a Decentralized Identifier (DID) network.

• Mechanism: Nodes sign every broadcast; sending equivocating messages creates undeniable proof of misbehavior.
• Agentic Relevance: Enables automated punishment and reputation degradation in a Trust Graph.

A cryptographic protocol allowing a group of agents to jointly compute a function over their private inputs while keeping those inputs completely confidential from one another. MPC is a direct application of BFT principles to data privacy, ensuring that even if a subset of agents is compromised, the underlying data remains secret. Key properties:

• Input privacy: No agent learns another's private data
• Correctness: The output is guaranteed to be accurate
• Threshold security: Tolerates up to n-1 passive adversaries or t active adversaries

A cryptographic scheme where a private key is split into shares distributed among multiple agents, requiring a minimum threshold of them to collaborate to produce a valid digital signature. This prevents any single compromised agent from unilaterally signing malicious transactions. BFT connection: The system remains secure and functional even if a minority of share-holders are Byzantine, as the honest majority can still produce valid signatures.

A cryptographic method enabling one agent to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. ZKPs allow agents in a BFT system to verify computational integrity without re-executing work or exposing private state. Applications in agent security:

• Proving a model was executed correctly without revealing weights
• Verifying an agent's identity without exposing credentials
• Attesting to data provenance without disclosing the source

A secure, isolated area within a main processor that guarantees the confidentiality and integrity of code and data loaded inside it. TEEs provide a hardware-rooted solution to the Byzantine Generals Problem by creating a tamper-proof enclave where agent logic executes. Key guarantees:

• Isolation: The OS or hypervisor cannot inspect enclave memory
• Remote Attestation: A remote party can cryptographically verify the exact code running
• Sealing: Data can be encrypted to a specific enclave's identity for secure storage

An exploit where a malicious subset of agents manipulates the agreement protocol of a distributed system to force an invalid state, rewrite history, or prevent legitimate transactions. BFT protocols are explicitly designed to resist these attacks. Common vectors:

• 51% Attack: Controlling a majority of voting power to double-spend
• Eclipse Attack: Isolating an honest node to feed it a false view of the network
• Nothing-at-Stake: Validating conflicting forks without penalty in Proof-of-Stake systems

The application of GNNs to learn the normal interaction patterns in an agent network topology and identify anomalous nodes or edges that indicate collusion or compromise. This technique operationalizes BFT monitoring by detecting Byzantine behavior in real-time. Detection capabilities:

• Identifying covert communication channels between agents
• Flagging nodes with statistically deviant voting patterns
• Detecting Sybil clusters through structural graph analysis