Hierarchical Certified Semantic Commitment for Byzantine-Resilient LLM-Agent Collaboration

Abstract: Byzantine collaboration among large-language-model agents requires a finality-control primitive: given delivered stochastic, structured natural-language proposals, the protocol must decide whether the round supports a commit, what kind of commit, or a typed safe abort. Naive aggregation hides this choice behind a single verdict; classical Byzantine fault tolerance hides it behind byte-identity that LLM proposals do not satisfy. We introduce Hierarchical Certified Semantic Commitment (H-CSC), a BFT-inspired protocol that converts embedding-derived finality signals over verdict-conditioned proposal groups into one of three typed outcomes: a semantic_commit (a 2f+1 within-verdict semantic core backs the verdict, emitting a parameter-bound digest over the quantised aggregate), a verdict_commit (strong verdict margin but dispersed semantic rationale, emitting a verdict-level certificate without claiming a semantic aggregate), or an explicit abort with a typed reason. The contribution is typed finality, not raw commit accuracy. On a controlled semantic-poisoning diagnostic (BCS_v1, 120 episodes), H-CSC commits with low angular deviation on BFT-feasible buckets (0.31 to 2.04 degrees) and aborts 100% of beyond-BFT rounds (n<3f+1) as intended. On a real LLM-agent claim-verification benchmark (MVR-50, 50 tasks) under paired static and rushing Byzantine attacks, H-CSC commits 0.90/0.92 with honest-reference-invalid rates of 0.02/0.00, statistically matching a strong certificate-emitting verdict-only baseline. Unlike that baseline, H-CSC also emits an embedding-backed semantic_commit digest on 74%/72% of rounds, supplying typed provenance. A strict-semantic ablation commits only 0.54/0.48, showing the verdict-level fallback is necessary for coverage (+0.36/+0.44) at the same <=0.04 safety floor; a 100-task cross-model check across four LLMs preserves invalid_hmaj within 0.00 to 0.03.

• The paper presents a hierarchical protocol enabling certified and type-sensitive consensus among LLM agents under Byzantine conditions.
• The methodology encodes proposals into unit-norm embeddings and extracts semantic cores to differentiate honest from adversarial outputs.
• Empirical evaluations demonstrate high commit rates and robust safety metrics, validating the protocol in adversarial multi-agent LLM settings.

Hierarchical Certified Semantic Commitment for Byzantine-Resilient LLM-Agent Collaboration

Introduction and Motivations

Collaboration among LLM-based agents in distributed or adversarial environments introduces unique finality-control and agreement challenges not addressed by classical consensus protocols. Natural-language proposals generated by stochastic LLMs inherently lack byte-identity, making classical BFT mechanisms inadequate due to their reliance on exact matching. Furthermore, adversarial “Byzantine” agents in these settings can execute high-fidelity semantic attacks, outputting plausible yet semantically corrupted artifacts that evade naive aggregation or majority judgments. The paper "Hierarchical Certified Semantic Commitment for Byzantine-Resilient LLM-Agent Collaboration" (H-CSC) (2606.07316) introduces a protocol for certified, type-sensitive agreement among LLM agents facing Byzantine semantic attacks, producing outcomes that are both verifiable and distinguished by the semantic content underlying agent commitments.

Problem Statement and Formalism

The protocol operates over a set of $n$ agents, at most $f$ of which are Byzantine, under the standard $n \geq 3f + 1$ BFT threshold. In each round, agents submit structured proposals (verdict, confidence, evidence references, rationale, claim) encoded into embeddings by a deterministic, shared encoder (e.g., transformer-based sentence encoders, such as CRSE). The key challenge is to decide upon, and certificate, a single natural-language outcome—distinguishing not just the dominant surface verdict but also whether its semantic underpinnings can be certified as robust.

Classical aggregation methods and non-certified majority vote approaches fail under adversarial settings, as semantic perturbations can shift the plurality or introduce undetectable poisoning. Thus, the protocol must expose the structure of finality through explicit, type-distinguished outcomes: a “semantic commit” (when proposals are not only agreeing at the verdict level but also semantically tight), a “verdict commit” (when only high-level verdict agreement can be certified), or a type-reasoned abort.

Protocol Architecture and Control Flow

The H-CSC protocol (refer to Figure 1) employs a four-stage pipeline with a deterministic, embedding-driven decision logic:

1. Canonicalization and Encoding: Each agent’s proposal is canonicalized and encoded into a unit-norm embedding in $\mathbb{S}^{d-1}$ using a certified robust semantic encoder (CRSE); see Figure 2.
2. Verdict Grouping: The delivered set of proposals is partitioned by verdict, with the largest group selected as candidate for core extraction.
3. Within-Verdict Semantic Core Extraction: For the candidate group, an angular-threshold graph is constructed. The largest component of proposals within a radius $\theta_\alpha$ is extracted, and its admissibility (whether it forms a $2f+1$-sized core within the threshold) is checked.
4. Aggregation, Quantization, Certification: An admissible semantic core is aggregated (via geometric median) and quantized; the resulting digest is signed by a $2f+1$-sized certificate drawn from the core.
5. Typed Decision Step: If the semantic core is admissible, output a semantic commit; if not, but a $2f+1$ verdict-level quorum with sufficient margin exists, output a verdict commit; else, abort explicitly.

(Figure 1)

Figure 1: H-CSC protocol control flow yielding semantic, verdict, or abort outcomes based on verdict-level and semantic embedding finality signals.

Figure 2: Instantiation of the Certified Robust Semantic Encoder (CRSE), which enforces semantic separation between honest and Byzantine proposals in the embedding space.

The protocol’s correctness, safety, and agreement properties are formally established, leveraging certificate uniqueness, deterministic digest construction, and standard BFT communication assumptions.

Empirical Evaluation

The experimental evaluation leverages both a controlled semantic-poisoning benchmark (BCS_v1) and a real-world LLM-agent claim verification benchmark (MVR-50), employing both static and “rushing” Byzantine attackers.

BCS_v1 demonstrates that the CRSE encoder achieves near-perfect AUC ($\approx 0.99$) in separating honest from Byzantine paraphrases; H-CSC commits with sub-degree angular error in BFT-feasible regimes and aborts $100\%$ of rounds beyond $f$0.

MVR-50 tasks evaluate the protocol with $f$1 on Climate-FEVER, with diverse honest and Byzantine agents. Results show:

• H-CSC commits $f$2 (static) / $f$3 (rushing) of rounds;
• Honest-reference-invalid commit rates are $f$4 (static) / $f$5 (rushing);
• The protocol emits a semantic commit on $f$6 (static) / $f$7 (rushing) of rounds, see Figure 3;
• The stricter semantic-only ablation covers only $f$8-$f$9, confirming the necessity of a hierarchical, verdict-level fallback for full coverage.

  Figure 3: MVR-50 strip plot summarizing the trade-off between commit rate and honest-reference-invalid commit rate across aggregation and certification methods under both static and rushing Byzantine attacks.

Crucially, the certificate-emitting verdict-only baseline (B3) achieves similar raw coverage and safety numerics, but unlike H-CSC, never produces an embedding-backed semantic commit. Confidence-weighted voting, as a naive alternative, yields significantly higher invalid commit rates ($n \geq 3f + 1$0).

Cross-model robustness (evaluated with four LLMs across 100 tasks per model) shows H-CSC maintains safety (invalid commit rate $n \geq 3f + 1$1) with coverage between $n \geq 3f + 1$2-$n \geq 3f + 1$3, highlighting the encoder and protocol’s generality.

Theoretical Properties

H-CSC’s correctness is established along five axes:

• Agreement: All honest verifiers agree on the commit type and digest when a certificate exists.
• Semantic Validity: For semantic commits, the aggregate is within $n \geq 3f + 1$4 angular distance of any honest core member; empirical error is much lower.
• Verdict Validity: For verdict commits, if the verdict margin exceeds $n \geq 3f + 1$5, the committed verdict matches the honest-reference plurality.
• Safe Abort: The protocol aborts for rounds with neither sufficient semantic nor verdict-level signal.
• Conditional Commit-or-Abort Termination: Liveness does not depend on Byzantine cooperation; termination occurs as soon as honest quorums are achieved.

A key limitation remains intrinsic to representation: if honest and Byzantine proposals are indistinguishable in the embedding space, the protocol cannot exclude the latter from the core.

Implications and Future Directions

H-CSC exposes critical structure in protocol-level finality for distributed LLM-agent systems. Practically, the protocol enables downstream users to verify not just what verdict was committed, but under what semantic guarantees—an essential requirement in domains where natural-language “consensus” is not byte-for-byte.

Theoretical advancements include a generalization of BFT-style finality for embedding-based outputs, demonstrating how modern multi-agent LLM workflows can be equipped with certified, type-sensitive outcome semantics. The distinction between embedding-justified and surface-verdict commitments enables finer-grained trust and robustness analysis for downstream applications, e.g., auditorially robust multi-agent LLM pipelines and protocol-aware aggregation in adversarial settings.

Open research avenues include:

• Extension to evidence-aware protocols, integrating provenance, and entailment checks;
• Within-round heterogeneous agent populations (vendors, encoder classes);
• Larger-scale (multi-hundred task) empirical studies and hyperparameter sensitivity analysis;
• Protocol composition into multi-round, state-machine-replication settings preserving type-sensitive validity.

Conclusion

H-CSC sets a new standard for certified, type-sensitive agreement among LLM agents under Byzantine conditions. While coverage and empirical safety are numerically comparable to strong certificate-based verdict-only baselines, only H-CSC supplies interpretable, embedding-backed semantic provenance for its semantic commits. This explicit bifurcation between semantic and verdict-level consensus is indispensable for robust, trustworthy LLM-agent collaboration in adversarial environments. Future generalizations, notably into evidence-aware settings and fully heterogeneous multi-agent systems, are expected to further cement the relevance of certified semantic commitment primitives in next-generation AI deployments.